Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Last Chance to fix eIDAS: Secret EU law threatens Internet security

last-chance-for-eidas.org

Post reply on HN
Print view View original

51–60 of 314 posts

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#51

Post by g-b-r »

Jensson wrote: post #16
g-b-r wrote: post #13

Earlier quoted context omitted.

Oh yeah if encryption is broken only for browsers no big deal right

Governments still can't see your requests to servers under normal circumstances with this law. The weakness is only if someone controls your internet connection and can use a compromised certification process to trick you into thinking you are at "e2e.com" when you are on another site, and in those cases the only difference from now is that your browser will display "secure" instead of "invalid cert". There is no oth…

> the only difference from now is that your browser will display "secure" instead of "invalid cert". There is no other difference.

Oh that's SUCH as an insignificant difference!!!

> So to orchestrate an attack they would need to build an webbapp that is sufficient similar for you not to notice, take over your internet connection and break the certification process.

You can simply relay the requests to the original site/"webapp", no need to build one similar

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#52

Post by supriyo-biswas »

Jensson wrote: post #44
supriyo-biswas wrote: post #40

Earlier quoted context omitted.

If a nonprofit like Let’s Encrypt can perform automated certificate renewal with a few API calls, so can the government. Also, MITMs are a thing and getting the EIDAS certs in the root store will show that the certs in question are trusted, which is all that really matters because there is no way for users to know what certificates were actually installed by the website owner.

That has nothing to do with this, I don't think you understand this vulnerability. You can see which certificate authority issued the cert, so you can see if the suddenly the site started using a vulnerable cert provider and thus know that it is compromised. Note that the same attack is possible right now, the only difference is how your browser displays it, you can just install a plugin to get back the original beha…

CA changes can happen due to many legitimate regions. Pinning certificates in this way doesn’t scale, as we saw with the deprecation of HPKP.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#53

Post by Jacobinians »

nvm0n2 wrote: post #37
Jacobinians wrote: post #24

[flagged]

It's not. Read the documents linked to from the article. The law clearly refers to certificates with domain names in them, not client certificates. Actually the bigger impact of this seems to be that you wouldn't be able to host websites anonymously anymore, making WHOIS privacy meaningless, because the law appears to mandate that all certificates contain legal identities in them. Annex IV: Qualified certificates for…

Domains are there so you do not send those certificates to UAE website. But only to EU websites.....

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#55

Post by mbwgh »

g_p wrote: post #43
mbwgh wrote: post #32

Earlier quoted context omitted.

I guess this is where client attestation comes into play.

Or, proliferation of the English (US) or English (UK) versions of browsers, which refuse to (and are not obliged to) include any of these CAs... I suspect if this ever does play out, it could result in fewer people using "EU spec" browsers, and more people using the international overseas version, thus undermining the entire intention of the policy proposal. It seems a pretty safe bet no browser maker would ship thes…

That's great if you are not going to be legally and technically required to use these EU spec browsers to be able to access your online banking or any platform registered as doing business in Europe.

The EU is playing the long game here I believe.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#56

Post by jahav »

g_p wrote: post #43
mbwgh wrote: post #32

Earlier quoted context omitted.

I guess this is where client attestation comes into play.

Or, proliferation of the English (US) or English (UK) versions of browsers, which refuse to (and are not obliged to) include any of these CAs... I suspect if this ever does play out, it could result in fewer people using "EU spec" browsers, and more people using the international overseas version, thus undermining the entire intention of the policy proposal. It seems a pretty safe bet no browser maker would ship thes…

I suspect such versions won't comply with Cyber Resilience Act (=company would be on hook for a fine). Browsers are in category 2 iirc.

Edit: rest of world might be fine(big maybe, these things have tendency to proliferate),eu citizens... screws are tightening.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#57

Post by isilofi »

Jensson wrote: post #8

There is nothing there that says every service must use specific certificates, just that browsers should accept certain ones. So this in no way breaks encryption for apps who care, this only reduces security on apps that wants to reduce security. For example, if you use private "e2echat.com" it can still use safe certs and be safe, the risk is only that "governmentchat.com" will use bad certs, which was already a ris…

There is no way for e2echat.com to make sure that the client will insist on a certain safe CA. Sure, in case e2echat.com controls all clients this would be possible, but this is a rare case.

In the general case, any CA can sign any website certificate. So all those new government CAs can sign all the man-in-the-middle certificates they like, and browsers are obliged to accept them. Nothing the website can do about that.

There are ways to pin certain CAs via DNSSEC and TLSA resource records in DNS. But browsers ignore those, and even if they didn't, the same EU proposal also specifies government DNS manipulation.

So the gist is: EIDAS must die.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#58

Post by Jensson »

supriyo-biswas wrote: post #52
Jensson wrote: post #44

Earlier quoted context omitted.

That has nothing to do with this, I don't think you understand this vulnerability. You can see which certificate authority issued the cert, so you can see if the suddenly the site started using a vulnerable cert provider and thus know that it is compromised. Note that the same attack is possible right now, the only difference is how your browser displays it, you can just install a plugin to get back the original beha…

CA changes can happen due to many legitimate regions. Pinning certificates in this way doesn’t scale, as we saw with the deprecation of HPKP.

All you need is a list of trusted CA's, like we do right now, and then issue a warning if it isn't on that list. It is a very simple plugin to make.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#59

Post by nvm0n2 »

midasuni wrote: post #48
nvm0n2 wrote: post #34

Earlier quoted context omitted.

Probably not really. The EU itself (at the Brussels level) doesn't have much of an intelligence apparatus. One exists but it's small and weak compared to the likes of the NSA. The most capable was GCHQ but of course that's no longer a part of the EU. The EU likes passing internet related legislation because of: 1. The politics of it. It involves the raw exercise of power over people who are easily bullied and that th…

The en commissioners are appointed by the eu heads of state (one each) and subject to confirmation from Parliament (congress). Somewhat analogous to the US exec branch. The commission President is proposed by the council (the heads of states) and appointed by parliament. I’m not aware of the EU arresting random US citizens for breaking laws like the gdpr, you’re thinking of America and the DMCA

That's what they claim, but in reality the President of the Commission rejects any Commissioner they don't like. This isn't meant to happen but eventually Juncker admitted that he did it all the time, and that this was considered normal.

So the Commissioners are in reality selected by the President.

This problem appears in every HN thread about the EU or its activities. People argue that it's a legitimate democratic structure based on how its treaties say it works, but the treaties aren't followed.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#60

Post by Jacobinians »

nvm0n2 wrote: post #37
Jacobinians wrote: post #24

[flagged]

It's not. Read the documents linked to from the article. The law clearly refers to certificates with domain names in them, not client certificates. Actually the bigger impact of this seems to be that you wouldn't be able to host websites anonymously anymore, making WHOIS privacy meaningless, because the law appears to mandate that all certificates contain legal identities in them. Annex IV: Qualified certificates for…

It is interface between webservice and member state for sending authentication data to member state for purpose of auth. Think OAUTH so webservice does not have to save any auth data.
Post reply on HN