Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Last Chance to fix eIDAS: Secret EU law threatens Internet security

last-chance-for-eidas.org

Post reply on HN
Print view View original

91–100 of 314 posts

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#91

Post by Jensson »

isilofi wrote: post #86
Jensson wrote: post #71

Earlier quoted context omitted.

> which can easily be manipulated to provide a copy of all messages to some convenient third location. Updating others javascript as a proxy isn't "easily". Also if the government goes all this way to tell each internet provider to spy on people, why do you think they couldn't tell certificate authorities to spy on people? It is the same level. I wouldn't be surprised if many CA's in USA already does this.

It is "easily", because current commercially available "firewall" appliances include that kind of capabilities. Just a few clicks, install a CA certificate, add a logging endpoint, done. Certain regulated industries like finance and medicine are required to use those. All chats are instantly intercepted and logged. And the way to spy on people via a certificate authority is exactly as described, you get a CA that sig…

Maybe browsers shouldn't hardcode those things? If they let you blacklist CAs you could do that yourself or via a plugin. There is nothing preventing browsers from implementing that, and have a one click button "don't trust compromised CAs". Could even had that during install as a toggle, would satisfy every legal requirement.

If this means users gets more power over what CAs to trust then that is a good thing.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#92

Post by mananaysiempre »

hannob wrote: post #62
runnedrun wrote: post #33

Does anyone know what the supposed benefits are for this kind of bill? Are proponents overtly advocating for increased surveillance ability?

A key idea behind all of this is to sell "qualified certificates". Which is another way of saying "expensive certificates". In the past, CAs sold EV certificates which gave you a nice green look in the browser bar and no security advantage (arguably security downsides, because you cannot automate it). That was good business, until browsers decided that this makes no sense and scraped any special treatment for EV cert…

Scott Helme had a similar take back in 2022[1].

[1] https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck...

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#93

Post by johnfonesca »

hannob wrote: post #62
runnedrun wrote: post #33

Does anyone know what the supposed benefits are for this kind of bill? Are proponents overtly advocating for increased surveillance ability?

A key idea behind all of this is to sell "qualified certificates". Which is another way of saying "expensive certificates". In the past, CAs sold EV certificates which gave you a nice green look in the browser bar and no security advantage (arguably security downsides, because you cannot automate it). That was good business, until browsers decided that this makes no sense and scraped any special treatment for EV cert…

>Which is another way of saying "expensive certificates".

True, basically eIDAS is a cartel. With the help of EU legislation, some Certification Authorities banded together and are now saying that certificates emited by anyone but them are not good. And obviously they fully controll the pricing for the "good" certificates.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#94

Post by kossTKR »

derelicta wrote: post #10
pxeger1 wrote: post #7

I’m assuming this another… misguided… attempt by the security services to make their jobs easier. The grip that intelligence communities apparently have on our governments is ridiculous. Why do they have such influence?

Western security services are what we call secret police in other parts of the world. Its goal is to protect the local status quo. That's it, and thats why it can assert so much influence.

This is one of the most important and least talked about power dynamics.

This is because that world is hidden to most people but would have just 20 years ago been covered by classical research journalism, namely the intersections between power, fiscal policy, law, the security state, foreign policy and mass media or other systems of control.

Politics and policy making is downstream from mostly non public clubs of people. Become a part of the security apparatus to gain power and draft plans for whole regions of the world and the future of society. The rest of us get to see their own self branding in Hollywood romantizations and ideological "event driven" smokescreens that cover the realpolitcal battles of power and resources that actually drive history.

That way the masses end up seeing the good fights for "Democracy", "Child safety", "Necessary financial bailouts" or "Primitive stupid people in X country need intervention" while these are all covering a big old game of Risk or Civilization ie. resource plundering, land grabs, violent exploitation of foreign markets, siphoning of wealth from the masses to the few, and panopticon-level systems of control implemented to keep dissent and enlightenment about these fact as much in the dark as possible.

Theres a reason the richest European families already took an interest in controlling the emerging postal services of several hundreds years ago just like early pamphlet media but somehow these very old facts have been so memoryholed everyone thinks we live in a somewhat meritocratic or even democratic society these days.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#95

Post by ratg13 »

NoboruWataya wrote: post #80

Very concerning. As a slight aside though, it is not a "secret law". All EU laws are published on its website in every official language, and the vast majority of laws (including this one) must be publicly ratified by the directly elected European Parliament before coming effective. They should tone down this kind of sensationalist clickbait that I would expect to find in UK tabloids. They probably think it helps the…

They’ve had entire programs around trying to get the public engaged in this topic.

I’ve watched many of their YouTube presentations.. all with less than 100 views when I watched them, despite them being uploaded for some time.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#97

Post by peyton »

NoboruWataya wrote: post #80

Very concerning. As a slight aside though, it is not a "secret law". All EU laws are published on its website in every official language, and the vast majority of laws (including this one) must be publicly ratified by the directly elected European Parliament before coming effective. They should tone down this kind of sensationalist clickbait that I would expect to find in UK tabloids. They probably think it helps the…

Why can’t Mozilla publish the agreed-upon changes? Are the drafts currently classified? If so, I think it’s okay to bell ring.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#98

Post by sofixa »

NoboruWataya wrote: post #80

Very concerning. As a slight aside though, it is not a "secret law". All EU laws are published on its website in every official language, and the vast majority of laws (including this one) must be publicly ratified by the directly elected European Parliament before coming effective. They should tone down this kind of sensationalist clickbait that I would expect to find in UK tabloids. They probably think it helps the…

Also, this:

> and will be presented to the public and parliament for a rubber stamp before the end of the year

That's not how the EU parliament works, they're not just a rubber stamp. The topic is sufficiently grave without the need for clickbait and painfully obvious exaggerations.

Re: Last Chance to fix eIDAS: Secret EU law threatens Internet security

#100

Post by vanderZwan »

mbwgh wrote: post #41

The following quote from former Jean-Claude Juncker, president of the European Commission sums up the way the EU seems to work quite nicely: "We decide on something, leave it lying around and wait and see what happens. If no one kicks up a fuss, because most people don't understand what has been decided, we continue step by step until there is no turning back."[0] [0] - https://en.wikiquote.org/wiki/Jean-Claude_Junck…

The worst part is that this is still better than how most governments currently work. At least there is a chance to give feedback.

Also, keep in mind that this is in the context of getting all member states of the EU to agree on something. People kicking up a fuss is the default situation because of conflicting interests between different states.

Make no mistake about how I feel about this though: it's still pretty horrible even with that context in mind. And as graemep pointed out the rest of the quotes on that page will tell you all you need to know about Juncker too.

Post reply on HN