Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
eidas-open-letter.org
Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
1–10 of 67 posts
Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
#2"In summary, we strongly warn against the currently proposed trilogue agreement, as it fails to properly respect the right to privacy of citizens and secure online communications; without establishing proper safeguards as outlined above, it instead substantially increases the potential for harm."
The Open Source Security Foundation (OpenSSF) has co-signed the Industry Joint Statement on Article 45 in the EU’s eIDAS Regulation, indicating that "Those provisions are likely to weaken the security of the Internet as a whole": https://openssf.org/blog/2023/11/02/openssf-co-signs-industr...
Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
#3Dupe from yesterday:
Last Chance to fix eIDAS: Secret EU law threatens Internet security - https://news.ycombinator.com/item?id=38109494 - Nov 2023 (280 comments)
Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
#4Some press coverage from Computer Weekly https://www.computerweekly.com/news/366557952/EU-eIDAS-refor... and The Record https://therecord.media/eu-urged-to-drop-law-website-authent...
Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
#5Good timing I think to remind you of the upcoming Firefox changes as discussed here
https://news.ycombinator.com/item?id=38009663
EDIT: for context
Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
#6Wow. Does the EU intend on basically killing their economies? Online commerce is a huge deal and would be heavily impacted if people didn't trust their connections.
Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
#7> The proposed eIDAS revision gives Member States the possibility of inserting root certificates at will [..]
That should've been a clear problem when architecting this system for anyone that knows how PKI works. Control and transparency around CAs (especially roots) is extremely important for web security.
Did they not consider issuing citizens with WebAuthn certificates, or working with browser vendors to support using client certificates (since they'd only need to be trusted by the server, not the client)?
I am confused.
Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
#8Wow. Does the EU intend on basically killing their economies? Online commerce is a huge deal and would be heavily impacted if people didn't trust their connections.
Well, for now most people do trust the states and don't know the implications of this. The EU could have just as well modified e-commerce and other pages before everything was encrypted.
I also don't know how certificate pinning is impacted by this (which would mean that simply creating another cert from a EU root cert would at the very least be noticable)
Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
#9Does this mean they would essentially be able to MITM attack all traffic?
Re: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
#10Wow. Does the EU intend on basically killing their economies? Online commerce is a huge deal and would be heavily impacted if people didn't trust their connections.
People will trust their connections regardless of this.