Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

eidas-open-letter.org

Post reply on HN
Print view View original

41–50 of 67 posts

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#41

Post by samus »

spacebanana7 wrote: post #32
johncolanduoni wrote: post #26

Earlier quoted context omitted.

You still have a bootstrapping problem. How do we establish what application-layer signatures are valid when a member state can forge a certificate for any origin at the transport-layer?

Ideally through hardware keys, but I see how that's hard to adopt. It's not entirely unrealistic though in the context of Play Store/App Store for the first download of an app from Google/Apple servers to be protected in transport by hardware keys. Do the web browsers & operating systems face the same bootstrapping problem at the moment? At some point they must get their first certificate without using a certificate…

Of course they face that problem. It's a subset of the more general bootstrapping problem for a computer. So far, it mostly works as long as we can trust the hardware and we assume that the stack as we have it now is trustworthy.

As soon as you download and install an OS via an MITMed connection, it's over.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#42

Post by HappMacDonald »

Yeul wrote: post #35
Communitivity wrote: post #31

Earlier quoted context omitted.

I would say it's not speaking against the intel agencies. The intelligence community protects us from many threats (terrorists, foreign organized crime, etc.). However, they are human, and make mistakes in the name of self-preservation, zeal for their mission, and in some cases greed. The intel agencies of different countries act as checks and balances against each other, to some degree. In some countries there are e…

Making porn sites KYC is likely something that the public wants. There have been numerous cases of nude pics of minors ending up on "amateur" porn sites.

That's not Know Your Customer that's Know Your Producer.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#43

Post by master-lincoln »

EGreg wrote: post #15
radicalbyte wrote: post #12

If this goes through without change the browser vendors should implement an UX which allows the user to disable these root certificates; ideally within different contexts. I also hope that our community produces tools to allow the cert stack on our OSes to be purged of these certificates.

Then they’ll ban that UX. Just like US banned the ability to disclose how much taxes you pay for airline tickets EDIT: for clarification, they banned disclosing it in initial communications like emails. They can do same for browsers. Apple also successfully banned apps from disclosing links to buying stuff online etc.

> for clarification, they banned disclosing it in initial communications like emails

please give a source for that. That's the spin some airlines gave it, but as far as I understood the new requirement was to list the full price including taxes and fees in advertisements. This could be seen as hiding the fees and taxes, but the Airlines are still allowed to list fees and taxes.

In Europe, listing the full price is mandated for all industries as far as I know. Feels bad as a customer to not know what you will have to pay upfront, like it is in most industries in the US. But it also feels weird to me that this ruling was only applied to the air travel industry.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#44

Post by jeroenhd »

radicalbyte wrote: post #28
zajio1am wrote: post #20

Earlier quoted context omitted.

We already have such system: DANE + DNSSEC. Unfortunately browsers vendors do not implement it.

Interesting - I know DNSSEC (great solution) but haven't seen DANE. From a quick glance it looks like an obvious solution which should be implemented by the browser vendors and top sites.

DNSSEC is a great concept with a rather convoluted design that's based on limitations of computers in the 90s. It's obviously better to have DNSSEC than not to, but I wouldn't call it a "great solution".

Case in point: the DNS client never actually validates the DNSSEC signatures, the DNS server the client uses is supposed to do that, and then simply sets a flag that says "I validated this". Perfect for recursive DNS resolvers running on localhost, but terrible for security when applied as designed.

Another example: Firefox currently has encrypted client hello enables to encrypt the SNI information and help combat traffic analysis, but only if you enable DoH to ensure that the necessary DNS records are correct. Once again, Mozilla didn't trust DNSSEC to work right and opted to trust DoH servers on their word.

In truth, DNSSEC isn't widely used, at least not internationally. Some TLDs have high DNSSEC usages, often because their registrar advocates for securing DNS, but with companies like Amazon failing to produce DNSSEC software that doesn't cause massive outages and TLDs like .nz going down for a day because of bad policies and management, many people don't bother.

It's a shame, really, because DANE would've fixed so many problems. I attribute its failure mostly to the design decisions the people behind DNSSEC made when they released the protocol.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#45

Post by mistrial9 »

Communitivity wrote: post #31
motohagiography wrote: post #19

I had a comment, but I think the tide has passed the point where there is any value or wisdom in speaking against the intelligence agencies.

I would say it's not speaking against the intel agencies. The intelligence community protects us from many threats (terrorists, foreign organized crime, etc.). However, they are human, and make mistakes in the name of self-preservation, zeal for their mission, and in some cases greed. The intel agencies of different countries act as checks and balances against each other, to some degree. In some countries there are e…

speaking to emphasize layered representation, not the future-value of a single vote or wave of voters...

Those representatives in a position to affect the arc of the actions here, especially those who work in the civilian sphere regularly, need all manner of support now.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#46

Post by jeroenhd »

TheFuzzball wrote: post #7

> The proposed eIDAS revision gives Member States the possibility of inserting root certificates at will [..] That should've been a clear problem when architecting this system for anyone that knows how PKI works. Control and transparency around CAs ( especially roots ) is extremely important for web security. Did they not consider issuing citizens with WebAuthn certificates, or working with browser vendors to support…

Knowing the EU is behind this, I wouldn't be surprised if the people making decisions about this are even aware of any technology beyond Windows XP.

The funny thing is that several European governments have actually operated certificate authorities of their own, and they worked just fine.

It's so stupid, because the rest of the eIDAS is a pretty good idea.

From what I can tell, this stupid addendum is the result of the certificate authority industry, which were mad that nobody trusts EV certificates anymore (because they never added the security they promised in the first place).

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#47

Post by jeroenhd »

gbil wrote: post #5

Good timing I think to remind you of the upcoming Firefox changes as discussed here https://news.ycombinator.com/item?id=38009663 EDIT: for context

Thank god they're fixing this. Can't wait for Java to also pick up third party certificates. Every time I install my personal CA certificate I need to go through every application and do the special certificate dance (in the case of Electron, modifying the launch arguments) because every application is opinionated about what certificates it should trust for some stupid reason.

Every OS has an API for this, why should I need to go into the special super secret debug settings to tell an application "trust the system you're running on and use the damn API already".

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#48

Post by ruiisnwn »

EGreg wrote: post #29
red_admiral wrote: post #27

Earlier quoted context omitted.

The pushback against ad tech - or more precisely tracking tech - is hardly the same thing. One of the EU's moves will greatly improve privacy, another one will harm it. A world is possible where we have end-to-end encryption AND a ban on profiling people online without their consent.

Sure, and a world is possible when we have other types of tech, too. For example we can have zero-knowledge proofs to access online sites and prove we’re over 18. But the UK government has already passed a law requiring all websites to KYC their members with a passport. And Utah recently passed a law also protecting children on social sites and I asked their politicians directly how they will enforce it — a likely ca…

[dead]

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#50

Post by hyperman1 »

Https always had problems with the long list of mysterious root certificates. Maybe this is the push needed to do something about it, e.g. :

* Warn when a new root is user for the first time.

* Warn when a site changes its root cert.

* Warn when a root cert is used for DNS names that shouldnt belong to it, e.g. wrong tld.

In a broader context, the question who you trust when will become more and more important. E.g. deepfakes might push us all to digitally sign their real messages. I don't think the current root certificate systems can survive the deluge of mistrust generated by AI.

Post reply on HN