Last Chance to fix eIDAS: Secret EU law threatens Internet security

Post by Jensson » Thu, Nov 02, 2023, 10:08 AM UTC

g-b-r wrote: post #75

Jensson wrote: post #26

Earlier quoted context omitted.

It is only undetectable if the site actually uses the vulnerable certificates. Otherwise you can see that the government is spying on you since the browser tells you what certificate it got (Telling you what certificate was used is a part of eIDAS). There is no way the government will replace certificates like that on an automated basis, it is too easy for people to notice and make a big deal about.

There's probably at most one person every ten millions who uses add-ons displaying each connection's certificate authority; and even them will likely not notice anything if it's only done to them occasionally (not to mention that absolutely no one checks the connections used to download third-party stuff, to my knowledge).

Post by g-b-r » Thu, Nov 02, 2023, 10:09 AM UTC

Jensson wrote: post #44

supriyo-biswas wrote: post #40

Earlier quoted context omitted.

If a nonprofit like Let’s Encrypt can perform automated certificate renewal with a few API calls, so can the government. Also, MITMs are a thing and getting the EIDAS certs in the root store will show that the certs in question are trusted, which is all that really matters because there is no way for users to know what certificates were actually installed by the website owner.

That has nothing to do with this, I don't think you understand this vulnerability. You can see which certificate authority issued the cert, so you can see if the suddenly the site started using a vulnerable cert provider and thus know that it is compromised. Note that the same attack is possible right now, the only difference is how your browser displays it, you can just install a plugin to get back the original beha…

Post by datpiff » Thu, Nov 02, 2023, 10:14 AM UTC

neodypsis wrote: post #76

diego_sandoval wrote: post #74

The proposal is so obscene that I doubt Apple, Google or even Microsoft would ever comply with it.

I guess Europe would have to fund its own browser development. The rest of the world won't participate.

Post by supriyo-biswas » Thu, Nov 02, 2023, 10:14 AM UTC

Post by supriyo-biswas » Thu, Nov 02, 2023, 10:16 AM UTC

Jensson wrote: post #78

supriyo-biswas wrote: post #72

Earlier quoted context omitted.

It’s intriguing to observe this phenomena on HN where any posts critical of the EU will get downvoted, even though it is natural for any country or block to try various means to show or enforce its power. And before someone says otherwise, I’ve seen this playing out hundreds of times.

It got downvoted since it says this regulation isn't made to spy on people. People want to believe it was made for a sinister purpose and not just due to naivete. If you look around you see plenty of people that gets upvoted and are critical of EU, so that isn't it.