Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

theregister.com

Post reply on HN
Print view View original

61–70 of 73 posts

Re: Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

#61

Post by Jacobinians »

jruohonen wrote: post #57
Jacobinians wrote: post #52

Earlier quoted context omitted.

BUT citizen should be NOT reading THE REGISTER, becasue of these kind of misinformation / misquided campaings

> BUT citizen should be NOT reading THE REGISTER, becasue of these kind of misinformation / misquided campaings You might misunderstand the competency of some citizens here. Does DigiNotar ring a bell?

Does google have certificates in there, does china have certificates in there, does russia have certificates in there ALREADY TODAY ???? So if you worry about that, then you should OBVIOUSLY understand that it is either non issue OR it is exploited TODAY EVEN WITHOUT THIS LAW... So this law being in place changes NOTHING in either case.

Re: Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

#62

Post by jruohonen »

Jacobinians wrote: post #61
jruohonen wrote: post #57

Earlier quoted context omitted.

> BUT citizen should be NOT reading THE REGISTER, becasue of these kind of misinformation / misquided campaings You might misunderstand the competency of some citizens here. Does DigiNotar ring a bell?

Does google have certificates in there, does china have certificates in there, does russia have certificates in there ALREADY TODAY ???? So if you worry about that, then you should OBVIOUSLY understand that it is either non issue OR it is exploited TODAY EVEN WITHOUT THIS LAW... So this law being in place changes NOTHING in either case.

Please don't spread disinformation. You don't clearly understand how the PKI works.

Re: Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

#63

Post by SenAnder »

philprx wrote: post #53
SenAnder wrote: post #3

How is forbidding browsers from distrusting spying CAs proposed to work? E.g. would using/distributing Firefox become a crime?

No, it would mean for Firefox developers that it's illegal to have feature that can disable the EU member state certificates. Such crypto backdooring failed in the past, so they're trying to go after the weakest link they can think of. In this case, software publishers.

Suppose they include those features anyway. Do Firefox developers in the EU get arrested? Does the EU block US websites distributing Firefox, and arrest anyone running a local mirror? Do programmers that compile and run their own, personal versions of Firefox, where they have personally removed untrustworthy CAs, get raided by the police?

Re: Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

#64

Post by YESNONAMEMAN »

ho_schi wrote: post #59

I remember a (now removed?) passage in Wikipedia stated that self-signed certificates where considered as default for HTTPS back in the 90ies. But the idea of signing Certificate-Authorities prevailed. Users get instantly a “lock” creating a feeling of security - and it made some people rich. Self-Signed actually is the only trustworthy approach to use certificates. And with QR-Codes or ASCII-Art it is user friendly.…

Malware actor can self sign google.com certificate..... So self sign is ... Because you still need to verify that Google is Google or that malware actor is not Google, so you came to similar situations / conclusions.

BUT current CA situation is travesty in its own right that is little bit different topic.

Re: Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

#65

Post by YESNONAMEMAN »

SenAnder wrote: post #63
philprx wrote: post #53

Earlier quoted context omitted.

No, it would mean for Firefox developers that it's illegal to have feature that can disable the EU member state certificates. Such crypto backdooring failed in the past, so they're trying to go after the weakest link they can think of. In this case, software publishers.

Suppose they include those features anyway. Do Firefox developers in the EU get arrested? Does the EU block US websites distributing Firefox, and arrest anyone running a local mirror? Do programmers that compile and run their own, personal versions of Firefox, where they have personally removed untrustworthy CAs, get raided by the police?

They do not need to hijack this process, in a way as is said in article, or in comments, there are different methods already in use, successfully. So there is absolutely no need from anybody to be doing this in this way ( even if it works like they write in that article ). if they need it for state security then it does not need to be this OVERT, there are legal provisions to do this covertly IN US OR IN EU. They are even cooperating between jurisdictions. So UK is sending data from US citizens on uk servers to US, EU is sending data about US citizens on Eu servers to US, etc. And no GDPR does not cover this.

Re: Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

#66

Post by YESNONAMEMAN »

jcfrei wrote: post #45

The problem the EU faces - or the respective national European intelligence agencies for that matter - is that they lack access to a comprehensive, global data funnel. The US, Russia and China all have their respective systems: The US has access to the data of Facebook (WhatsApp and Instagram), Apple messenger, Google's GMail. Russia has Telegram and China has I think Weibo, WeChat, TikTok and probably some more. I w…

Facebook app( either web or ios) does not have to be SAME app as your friend have installed / opened. Some call it A/B testing, some call it malicious update. Depends on contents.

Apple can send malicious update to any app.... Do you check hashes thru 3rd party service ? Apple is scanning ALL your photos, documents on your device, with ML AND AGAINST HASH, DO you think they do not scan your photo for face of UBL ?

Re: Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

#67

Post by GTP »

eimrine wrote: post #21
GTP wrote: post #12

Earlier quoted context omitted.

Duffie-Hellman can be MITMed if nothing checks that the value you get from the other party actually comes from the intended other party. I.e., an identity check.

That is OK if the talk is not about bank or currency exchange.

That's still not OK. Think about this: you are encrypting your traffic to prevent some third party from seeing/modifying it. But without authentication, you don't know who you're communicating with. So it could be that you're talking with the very third party that you were trying to protect from in the first place.

Re: Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

#68

Post by rvnx »

frankjr wrote: post #48
rvnx wrote: post #17

Earlier quoted context omitted.

It exists and works already: Certificate Transparency logs, HSTS and Cert Pinning are “protecting”. The first may have the side-effect (or intended ?) to inform US companies which websites you are visiting upon addition of new entries though…

> Certificate Transparency logs CT logs are just, well, logs. They don't do anything to protect you from having your traffic intercepted via maliciously issued certificate. You might learn later (if somebody bothers to check) that it occurred but at that point the damage is already done. > HSTS This just says the connection should only be established via HTTPS, nothing more. > Cert Pinning Cert pinning has been remov…

Yes exactly the 3 elements are necessary for the protection to work.

HSTS is the official way to force HTTPS (aside 301 redirects), if you have the best certificate in the world, but the client is using HTTP, then there is no point.

If you only have CT logs you are just catching the issue (if... the CT log servers themselves are not blocked by the rogue actor), but it's still too late.

Cert Pinning is here to prevent the issue, whether browsers or not wants to follow it is another question.

Re: Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

#69

Post by frankjr »

rvnx wrote: post #68
frankjr wrote: post #48

Earlier quoted context omitted.

> Certificate Transparency logs CT logs are just, well, logs. They don't do anything to protect you from having your traffic intercepted via maliciously issued certificate. You might learn later (if somebody bothers to check) that it occurred but at that point the damage is already done. > HSTS This just says the connection should only be established via HTTPS, nothing more. > Cert Pinning Cert pinning has been remov…

Yes exactly the 3 elements are necessary for the protection to work. HSTS is the official way to force HTTPS (aside 301 redirects), if you have the best certificate in the world, but the client is using HTTP, then there is no point. If you only have CT logs you are just catching the issue (if... the CT log servers themselves are not blocked by the rogue actor), but it's still too late. Cert Pinning is here to prevent…

Right, I think I misunderstood what you were saying earlier.

Re: Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

#70

Post by illiac786 »

poor understanding of how PKI work.

> that government can ask its friendly CA for a copy of that certificate

1/ copying/reafing the certificate without the private key is something every TLS client must be able to do, this is a must. It is absolutely not a security concern.

2/ copying the certificate and the private key would be a concern, except s CA never sees the private key and hence cannot have it. The CA signs a CSR which does not contains the private key.

Overall I still agree with the article since the problem is not that the CA can copy the cert but rather that is can issue a new cert for the same URL, enabling MitM attacks.

Also, I garantee this gov CA will be breached in no time. There would be simply too many government agencies with access... Impossible to secure.

Post reply on HN