Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

eidas-open-letter.org

Post reply on HN
Print view View original

51–60 of 67 posts

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#51

Post by Metus »

jeroenhd wrote: post #44
radicalbyte wrote: post #28

Earlier quoted context omitted.

Interesting - I know DNSSEC (great solution) but haven't seen DANE. From a quick glance it looks like an obvious solution which should be implemented by the browser vendors and top sites.

DNSSEC is a great concept with a rather convoluted design that's based on limitations of computers in the 90s. It's obviously better to have DNSSEC than not to, but I wouldn't call it a "great solution". Case in point: the DNS client never actually validates the DNSSEC signatures, the DNS server the client uses is supposed to do that, and then simply sets a flag that says "I validated this". Perfect for recursive DNS…

> It's a shame, really, because DANE would've fixed so many problems.

It would basically make services like Let's Encrypt unnecessary and would move us close to a world where email encryption and validation works by default.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#52

Post by wolrah »

radicalbyte wrote: post #30
Thorrez wrote: post #24

Earlier quoted context omitted.

HPKP was generally not recommended even when it was still around due to the danger of breaking your site. https://scotthelme.co.uk/im-giving-up-on-hpkp/

We're already all used to running ad/script block on our clients so accept a certain level of breakage. It's just a part of the cost of using the web that some sites are crap (youtube being the big one nowadays) but in the end we just "route around them" (they die).

> We're already all used to running ad/script block on our clients so accept a certain level of breakage.

The "we" reading this post? Yeah, probably.

The internet population as a whole? Absolutely not, nowhere close.

I've been using Adblock or its descendants since the original Firefox extension where downloadable filter lists were a separate addon, and every time I have to browse a mainstream web site when using a "normal" person's computer it blows my mind how bad the experience is with all kinds of extra iframes I never normally see full of ads moving around, modals, etc. without even getting in to video content.

Normal people don't troubleshoot things like we do, if it doesn't work they try to do the same thing over and over again until they get bored or annoyed and then either move on or call one of us to "fix it".

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#53

Post by CodeWriter23 »

johncolanduoni wrote: post #26
spacebanana7 wrote: post #22

Could we work around this by moving encryption to the application/website layer with client certificates? Please let me know if you see any reason this wouldn't work.

You still have a bootstrapping problem. How do we establish what application-layer signatures are valid when a member state can forge a certificate for any origin at the transport-layer?

By using pre-shared keys instead of public key encryption. I'm not suggesting that is a practical solution for day-to-day use; I am saying this is how LE will be evaded, if this law should come to pass. So in effect, only criminals will have encryption.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#54

Post by [deleted] »

severino wrote: post #16
throwawaaarrgh wrote: post #6

Wow. Does the EU intend on basically killing their economies? Online commerce is a huge deal and would be heavily impacted if people didn't trust their connections.

Why would people worry? We already have mobile phones, televisions, cars, etc., continuously monitoring and sending private information about ourselves and our relatives to external parties that we may don't even know about. This -if comes to be true- would just mean that more parties could have access to our data. But who cares once we are already giving it for free?

[deleted]

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#55

Post by spacebanana7 »

CodeWriter23 wrote: post #53
johncolanduoni wrote: post #26

Earlier quoted context omitted.

You still have a bootstrapping problem. How do we establish what application-layer signatures are valid when a member state can forge a certificate for any origin at the transport-layer?

By using pre-shared keys instead of public key encryption. I'm not suggesting that is a practical solution for day-to-day use; I am saying this is how LE will be evaded, if this law should come to pass. So in effect, only criminals will have encryption.

Do your reckon there could be a consumer friendly way to generate pre-shared keys? With a Diffie–Hellman like algorithm

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#56

Post by EGreg »

TheFuzzball wrote: post #7

> The proposed eIDAS revision gives Member States the possibility of inserting root certificates at will [..] That should've been a clear problem when architecting this system for anyone that knows how PKI works. Control and transparency around CAs ( especially roots ) is extremely important for web security. Did they not consider issuing citizens with WebAuthn certificates, or working with browser vendors to support…

WebAuthn uses private keys in the secure enclave. It won’t be affected.

To be clear: EU here is backdooring https encryption which protects most communication, not signing. While also moving to ban end-to-end encryption (Spain leading the way).

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#57

Post by wkat4242 »

This would be really easy to detect. Just look at the certificate chain.

It would be trivial to make a plugin to warn the user of this, at which point they know they're under surveillance which would be worse than just doing human surveillance IMO.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#58

Post by wkat4242 »

radicalbyte wrote: post #12

If this goes through without change the browser vendors should implement an UX which allows the user to disable these root certificates; ideally within different contexts. I also hope that our community produces tools to allow the cert stack on our OSes to be purged of these certificates.

We already have that option. At least on desktop OSes. On mobile it's hard, especially on Android it's no longer possible to add root CAs in the system store without rooting, ever since Android 7.

I believe on iOS you can do it with an MDM profile.

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#59

Post by xoa »

gbil wrote: post #36
galadran wrote: post #34

Earlier quoted context omitted.

As I commented there, you've misunderstood this change. There's a difference between certificates distributed with the OS and certificates added to the OS by a user. Right now Firefox ignores both. This change ONLY picks up the certificates added to the OS by a user. Firefox will continue to ignore the certificates included with the OS store by default.

Literally in the bugzilla entry is stated either by user or administrator so either you misunderstood or you need to raise this directly to the bug for correction EDIT: for clarity, something I should have done from the beginning, I checked the affected code, they clearly remove warnings around security.enterprise_roots.enabled preference and enable it by default. This is the preference that was added back in the day…

Late so don't if you will see this, but from the very beginning, the security.enterprise_roots.enabled preference always stated it applied to certificates added, not those included by default, eg [0]. System vs User context is still different from baked-in vs added. On macOS for example the System keychain contains certificates added that are then accessible by all users and can only be added by an Administrator, and the separate System Roots keychain holds the root certificates (151 on the Mac I'm sitting in front of) that Apple ships with the OS. Firefox reading from both the "login" and "System" keychains doesn't mean reading from "System Roots". The suggested release notes for the bug report you linked reinforces this [1] (capitalization emphasis added):

>[Suggested wording]: By default, Firefox will now use TLS trust anchors (e.g., certificates) ADDED to the operating system by the user or an administrator. This works on Windows, macOS, and Android, and it can be turned off in the "Privacy & Security" section of Firefox settings, under "Certificates".

If you think all of these descriptions have been wrong all along from the code, that'd definitely be worth bringing up on Bugzilla. Personally I'm happy to have it enabled by default vs always needing to remember to do so if it's working as described. I think support for one's own CAs should be encouraged even the overall UX around running your own CA is mediocre right now.

----

0: https://support.mozilla.org/en-US/kb/how-disable-enterprise-... :

>"Mozilla has added an Enterprise Roots preference to Firefox as a solution to the problem. This preference can be used to import any root certificate authorities (CAs) that have been added to the operating system, to resolve your TLS connection error. You can determine if a website is relying on an imported root certificate by clicking the Site Information icon in the address bar."

1: https://bugzilla.mozilla.org/show_bug.cgi?id=1848815

Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform

#60

Post by GuB-42 »

EGreg wrote: post #15
radicalbyte wrote: post #12

If this goes through without change the browser vendors should implement an UX which allows the user to disable these root certificates; ideally within different contexts. I also hope that our community produces tools to allow the cert stack on our OSes to be purged of these certificates.

Then they’ll ban that UX. Just like US banned the ability to disclose how much taxes you pay for airline tickets EDIT: for clarification, they banned disclosing it in initial communications like emails. They can do same for browsers. Apple also successfully banned apps from disclosing links to buying stuff online etc.

And I am all for it.

How much tax there is to pay is not my problem as a consumer. The only thing that matters is how much it will cost me to get the thing. Everything one must pay, including all fees and taxes should be included. Listing these will only cause unnecessary confusion and is often done in a deceptive manner.

It has nothing to do with adding root certificates to browsers. These are consumer protection laws against deceptive advertising. It may be surprising to Americans but in most of Europe, thanks to such laws, the price you see is usually the exact price you are paying. No taxes, fees or tips, it is all included, which I think is better for everyone.

Post reply on HN