15 ms·

Mozilla publishes position paper on the EU Digital Identity Framework

216 points by xoa 5y ago

max_ 5y ago
>One of the most important ways in which browsers protect users is through website authentication. For instance, if a person wants to visit Europa.eu, the web browser must reliably ensure that the site is actually under control of the owner of the domain ‘Europa.eu’, and not an attacker on the network impersonating the European Commission’s domain.
theplumber 5y ago
Anyone knows how this relates to webauthn and why they need a new way of doing online authentication?
MR4D 5y ago
Authoritarianism raises its head in all sorts of interesting ways. Interesting to see the EU choose the path of Kazakhstan.[0] [0] - https://www.internetsociety.org/news/statements/2019/internet-society-concerns-kazakhstan-encryption/ https://www.internetsociety.org/news/statements/2019/interne...
- theplumber 5y ago
  A proper online identity framework is long due though. Maybe this is not the proper one but sending copies of my passport, electricity bills and lately selfie recordings as well to "prove my identity" doesn't seem right either.
  - Aerroon 5y ago
    When this becomes widespread then you can expect to have to authenticate this way everywhere. Want to make a Twitter account? Please authenticate with your government ID. Facebook? Of course. Video games? You bet. South Korea already has these retirements for (some of) their video games.
    - sleevi 5y ago
      The draft revisions actually propose such authentication to be mandatory to implement for service providers if their users would like to use it. That is, it specifically targets websites (particularly Very Large Online Platforms) that they MUST accept such ID in lieu of an email or password, at the user’s request. This was part of the original motivation for the revisions, to target “Sign in with Facebook” or “Sign in with Google” and require such sites also offer a “Login with EU” option. Source: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A2021%3A281%3AFIN https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A20...
      - denton-scratch 5y ago
        So $VLOP is compelled to accept QWAC user-certificates, if one user requests it? And QWAC user-certificates are issued by TSPs whose CA cert must appear in the root-store unconditionally? That means there is nothing preventing $TSP from forging my certificate, and giving it to criminals/government-agents, and nothing to keep the TSP in line, because the single audit constraint is "Keep the Minister satisfied". I personally don't have a problem with the idea of replacing passwords with user-certs, provided I get to generate my own cert with my own private key. But the evidence is that general users can't learn how to use certificates. I hate passwords, but I'd rather use passwords than a user-cert issued by an unreliable CA.
        Jensson 5y ago
        The "unreliable CA" you are talking about here happens to be banks and similar. Do you trust that your bank doesn't just steal your money? Yes, you basically can't function in modern society if you don't. These e-id's just piggybacks on that trust to also work on online sign-ins. Most people worry more about their bank account being compromised than their github, so if these CA's (ie banks) starts to abuse their position we would have way bigger troubles than someone stealing your github accounts.
        denton-scratch 5y ago
  - xoa 5y ago
    Governments though can do that through their own passive demand. Ie., they can issue proper smartcards/tokens for citizens to identify themselves with, and then say that those can (and eventually must) be used for electronic interactions with the government itself (taxes being a big one but they'd easily be useful for a range of stuff). Follow/improve open standards. With something good, open and convenient private usage will naturally follow. Government can also by definition get involved with the issue of legal liability and fix BS like "identity theft" by shifting liability for businesses who do not meet good authentication standards. Doing it that way also creates room for fixing serious issues in practice before a natural rollout, as it starts by the government dogfooding its own standard. And if a lot of sites demand it, browsers will respond absent overwhelming reason not to, which itself is a good form of pressure to get said overwhelming reasons fixed. I'm very doubtful though that trying to just directly legislate how software universally works though bypassing process is a good idea. Massive room for abuse as well.
    - slowmovintarget 5y ago
      I think you touch on the issue. Having a standard for Identity Management seems reasonable. Mandating that such a state-regulated identity be used for all on-line data passing on the internet seems like a nightmare waiting to happen. That may not be the step in between "collect underpants" and "profit" but it feels like it's coming. In the U.S., I'm sure something like this will be sold in the clothing of think-of-the-children.
      - Jensson 5y ago
        > Mandating that such a state-regulated identity be used for all on-line data passing on the internet seems like a nightmare waiting to happen. They didn't mandate that though, the proposal was that it should be possible to use it, not that everyone should be forced to use it. You would still be able to log in using other means. Basically, facebook would be required to provide you with the option to use e-id to log in. But you could still log in with other means. It just gives you more freedom.
        5y ago
  - indymike 5y ago
    > A proper online identity framework is long due though. Due by whom, and for what?
    - toomuchtodo 5y ago
      For citizens who want efficient, effective access to services that require identity. The need for identity isn’t going away, and a poor implementation doesn’t guard against overreach.
      - Tom4hawk 5y ago
        In Poland you can do a lot of things digitally by authenticating on governments sites with your Bank (Imagine "Continue with your bank" instead of "Continue with Google" or "Continue with Facebook"). It's nice because bank already verified my identity when I was creating a bank account. I did not have to scan&send anything, go verify in some office etc. and I was able to do multiple things: change how my company is taxed, register for COVID vaccination, government census.
        AlexandrB 5y ago
        Canada has this too for some government services like the tax system.
      - logifail 5y ago
        > The need for identity isn’t going away [..] My identity is just fine, but thanks for your concern :) I can walk into my local bank branch and ask to either pay in or withdraw money and they don't ask for any kind of ID(!), or my account number, becuase they actually know me :) They even tend to say "Hello $firstname" when I walk in, even if I only called in to use the ATM. Amazing how good ol'fashioned _offline_ identity can actually be secure. Try walking into my local branch with faked ID of me and attempting to withdraw funds from my account.
        deleted 5y ago
        [deleted]
  - ostenning 5y ago
    I guess that depends what you expect from society and government. Do you expect that everything runs like an extremely powerful well oiled machine, where 100% interoperability likely means complete surveillance? A seemingly technocratic dystopian reality where every impulse is quantified and catalogued? I think its naive to believe that governments don't want more money, power and control over its citizens and government likely will be extracting more with every optimization the system makes. Or would you rather an extremely powerful machine that is disjointed, highly flawed and laden with inconvenience in-so-that society doesn't really know who you are? Where the individual has more freedom and liberty, but as a result there is more crime and less "safety". A world where powerful anti-social forces are at play, such as disinformation campaigns, polarization of discourse, fringe movements and revolution. The commonality is they are both driven by technology. We have built an extremely powerful machine and that has introduced enormous complexity into our society. This complexity equates to entropy and either we pull it together with draconian government policy, or the system unravels.
    - argomo 5y ago
      Question: how will the free/liberal society (plagued by polarization, etc) fare against the dystopian ones? In the past we've been able to out-innovate and maintain moral leadership thru a fictional aspiration to democratic norms. Now state actors can run finely targeted propaganda campaigns and measure our engagement with them in real time while using extensive censorship measures to prevent us from doing the same to their populations. None of this invalidates your point, but the tables have been tilted and abstract discussions of freedom tend to avoid wrestling with the geopolitical ramifications.
  - logifail 5y ago
    > A proper online identity framework is long due though [..] You're entitled to your opinion but for me, it's a firm "No, thanks". I feel considerably more comfortable* carrying a paper document which proves my vaccination/negative test than I do using any kind of government-approved app on my phone. * that's putting it mildly
    - effie 5y ago
      You should be comfortable with carrying and using a document certifying a test result, but not with a document proving vaccination. The first is reasonable to due to its obvious utility in infection control, the second is not; it is now become a tool for sowing division and hatred in society. If you care about limiting infections, get tested. If you care about freedom, reject government certificates.
    - dariosalvi78 5y ago
      looks like you haven't lived in 5 European countries and have to interact with all of them for things like taxes, pensions, vehicles registrations, and with mobile phones numbers that change, 2FAs that go crazy, passwords that expire etc. etc. Yes, a common electronic ID is an absolute godsend. Can't wait for it to be implemented on every fricking public administration website.
  - kwhitefoot 5y ago
    We use BankID for this in Norway (and elsewhere in Scandinavia I think).
  - raxxorrax 5y ago
    We spend trillions on e-commerce with "normal" user accounts that worked just fine. Some cases of thefts and other crimes that doesn't warrant any action in my opinion. Meanwhile we have a huge problem with governmental surveillance, which is a worse crime than theft depending on how you grade it.
- emteycz 5y ago
  This EU effort to control is ongoing for many years now, how is it in any way unexpected?
  - furi 5y ago
    Perhaps I'm out of the loop, but the EU attempting to make it illegal to distribute web browsers that don't include certain features is unexpected (and deeply worrying) to me.
    - Shadonototra 5y ago
      They are protecting their interest Why should a foreign country have control over my interests? Why should Mozilla DECIDE what I should and shouldn't trust? I am very glad that the public opinion decided to not trust Firefox at all (3% market share today)
      - plandis 5y ago
        Mozilla doesn’t decide that. Mozilla is an option _you_ can chose to use. It’s one of N options.
        Jensson 5y ago
        But all large browsers happens to be American. It makes sense that EU wants to regulate this rather than hand over all decisions related to trust to USA. For example, imagine if all big browsers everyone uses where made in China, and mostly just trusted Chinese CA. Do you think that would be a problem? Do you think the rest of the world would just let that happen instead of starting to regulate it? That is the situation EU faces right now with American browsers.
        emteycz 5y ago
        I never asked EU to do this for me, and don't want it. No government should have this power. Who did? I don't remember a single party having this in their program.
- bogle 5y ago
  I don't think QWACs are at all the same as state controlled root certificates. Browsers aren't going to show EV certificates.
  - sleevi 5y ago
    The proposed regulation requires that QWACs MUST be accepted and recognized as such, such as using the European List of Trusted Lists as part of the root store. That is, if a QWAC is issued by a CA that is not part of the browser root store, it must not be rejected (as any other untrusted certificate would be).
chuckee 5y ago
> In a nutshell, the revised Article 45 would force browsers to suspend the ‘root store’ policies that are essential for maintaining trust and security online. [..] At the same time, the types of website certificates that browsers would be forced to accept, namely QWACs Can someone explain where this 'force' comes from? I wasn't aware the EU had such authority to decide how programs on a users private computer must behave. Would e.g. making a fork of Firefox that does not comply with this digital identity framework be illegal? Or is this just hyperbole from Mozilla, and the browser would be merely non-compliant?
- keddad 5y ago
  Well, the original document states that "Web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1...". I'm not sure, however, what punishment, if any, is there for the browsers that don't comply with that regulation.
  - raxxorrax 5y ago
    Not the browsers will be reprimanded. That would be webservices like Youtube that only allows browsers providing a certified ID to let users look at the more controversial cat pictures. It is an extremely transparent power grab.
- Mindwipe 5y ago
  > I wasn't aware the EU had such authority to decide how programs on a users private computer must behave. Why not? They publish directives that result in criminal law in member states all the time. A directive is published, member states are obligated to turn that into domestic legislation, and yes, ultimately a state can criminalise lots of things if it wants to.
  - chuckee 5y ago
    > such authority Key word "such". Prescribing which certificates I am obligated to trust is many many steps beyond e.g. banning DRM circumvention (which is itself a step too far IMO).
xoa 5y ago
This did get posted a few weeks ago at the time it was written but didn't get much traction at that point, yet seems like a reasonably important issue. The EU has done worthy things for issues like privacy, but whatever pluses and minuses of regulating personal and business policy I'm a lot more dubious about government sticking its hand directly into how specific software (like browsers) functions. That seems like a serious step beyond merely trying to ensure there is competition and choice in different products, full disclosure about them, level playing fields etc. Dictating implementation details even for open source feels like something with much, much more scope for serious negative side effects getting baked in particularly in fields where best practices move fast. A negative security example that comes readily to mind are how bad government policies/standards helped cement for a long time the awful practice of complex password requirements including rapid change requirements, "security questions" and so on. These are actively negative for security, people in the field realized pretty fast (and of course many argued from the start) that the only reqs for passwords should be some minimum length, not using previously exposed ones, and having a sufficiently high maximum length that everyone is free to use more comfortable ones like diceware if they wished. While that has been getting revised at last bureaucracy still moves much too slowly there. Of course this hasn't made it through the gauntlet and hopefully won't, but I'm glad to see it getting some attention.
- dahfizz 5y ago
  I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.
  - mariusor 5y ago
    What makes you believe it's until the end of time? They did do it with micro USB also. From what I can see the mandate changes with the times, so if everything evolves I would assume that they'll update their requirements.
  - 5y ago
phicoh 5y ago
I wonder why QWACs are less secure than DV. There is an argument why EV should be treated the same a DV I'm not buying that argument but for the moment let's accept it as true. However, now Mozilla is arguing that EV is less secure than DV. That seems weird to me. Currently, browsers have root certificates for lots of countries. I can imagine that for a country it becomes a huge problem if suddenly a major browser decides to reject certificates used by that country's government. Of course, it would be nice if country certificates could be restricted to country specific resources. Maybe mozilla should push for that.
- Jwarder 5y ago
  I see two issues at play. Not all European CAs meet browsers' root programs requirements. Forcing everyone to accept those certs weakens all root programs (Mozilla's, Microsoft's, etc). There is also the concern that special indicators displayed with a certificate can mislead users. A scummy company with an EV cert isn't any more trustworthy than if they had a DV cert, but browsers want to be careful not to imply a fancy logo makes the site any safer.
  - kjetil 5y ago
    Are the TSP audit requirements less strict than what the browsers’ root programs require?
    - Jwarder 5y ago
      Mozilla says so. https://drive.google.com/file/d/1DgJe-Ku4u66JF2D6zha28tSKxPBzavyQ/view?usp=sharing https://drive.google.com/file/d/1DgJe-Ku4u66JF2D6zha28tSKxPB... I can't speak with authority, but my reading of PKI issues suggests Google is just as strict, while Microsoft and Apple are less strict. However, that just might be because MS and Apple are less public with their root programs.
  - Jensson 5y ago
    > Not all European CAs meet browsers' root programs requirements. That sounds like a huge problem, why should EU trust that USA handles trust certificates well? Of course they would want to regulate this instead of leaving that extremely large security hole open, letting USA alone decide what counts as secure or not is not in EU's interests.
Shadonototra 5y ago
Why is it ok for an american company to collude with foreign politics? Can't they focus on their broken system first?
- muricula 5y ago
  This sort of thing is actually somewhere I think Mozilla can make a difference. As a major browser, they are listened to when they lobby standards bodies and political bodies about the web and internet security, and very often they are listened to. I agree Firefox could be better, but time spent on effective lobbying which will help all browsers is well spent.
- deleted 5y ago
  [deleted]
- zoobab 5y ago
  EU laws are written by foreign actors, just look at the lobbying going on on DSA/DMA, those foreign corporations are writing laws against the interests of European companies and citizens.
- raxxorrax 5y ago
  As someone from Europe I am thankful for any resistance to such plans and many laws implemented by the EU are written by foreign companies. Companies like central administrations, far easier to lobby against compared to citizens that must carry themselves through countless more or less democratic institutions.
parasense 5y ago
I think the Browsers should swing the axe the other direction. Indicate the website is broken when EV certificates are present. Also, indicate all websites are broken if/or when the Root-CA-trust ever be forcefully extended to include EV CA authorities, in particular state backed authorities. I'm not sure about the EU, but forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech. Regrettably I would not be surprised if EU took a more authoritarian stance.
- malermeister 5y ago
  I don't see how the USA's first amendment is at all applicable to the EU.
- deadbunny 5y ago
  I'm not sure I follow. How are EV certificates weak? They use the same cyphers and just have extra validation on the owner/domain.
  - mikeiz404 5y ago
    It appears to be more of a UI issue where the legal entity name is shown along side or sometimes in place of the URL which can be misleading. To compound problems legal entity names are not required to be unique across states or countries so an EV certificate for a popular company name can be obtained in another geography and presented to the user on an attacker controlled domain. https://www.bleepingcomputer.com/news/security/extended-validation-ev-certificates-abused-to-create-insanely-believable-phishing-sites/ https://www.bleepingcomputer.com/news/security/extended-vali...
- pantulis 5y ago
  "forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech." I understand the issues mentioned in passing scammy actors as legitimate but, in which way your rights to speech would be vulnerated?
  - deleted 5y ago
66fm472tjy7 5y ago
Is the draft of the revision available anywhere? I don't see a link anywhere in the position paper. Article 45 in the current regulation[0] says nothing about browsers. I am curious about the exact language that would force Firefox support the technology and include the TSPs in their root store. [0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014R0910&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
- sleevi 5y ago
  https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A2021%3A281%3AFIN https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A20...
denton-scratch 5y ago
It's ultimately my decision which certificates I will trust. I can choose to trust just one certificate, and ignore the Mozilla root store, or I can use Mozilla's root store, and modify it. These are my decisions, not Mozzilla's. So this proposed regulation mandates that my browser must support QWAC, and include TSP roots? Does that mean that browsers MUST deprive me of the ability to control my root store? Would I be in violation if I modified my (open-source) browser so that it was no longer in compliance? Supposing I published my patch on a website outside the EU (e.g. in the UK)? To be clear, I don't want a root cert from any entity that is effectively controlled by a government, to be trusted by my browser. Some governments bother me more than others, (for example) a Turkish government-controlled CA was caught forging certificates. There's still a Turkish CA in there, I see; Debian have seen fit to remove it. It's all fine, the sky won't fall. As long as I can still decide who I trust.
- Jensson 5y ago
  This is all the initial recommendations says about browsers and certificates, there is nothing about preventing browsers from allowing the users to configure this, just to have them support it (and most of this is already supported by browsers, this is mostly just a recommendation to force all browsers to implement site security): > To that end, web-browsers should ensure support and interoperability with Qualified certificates for website authentication pursuant to Regulation (EU) No 910/2014. They should recognise and display Qualified certificates for website authentication to provide a high level of assurance, allowing website owners to assert their identity as owners of a website and users to identify the website owners with a high degree of certainty. Edit: It also limits this to larger web browser providers in another part and only after 5 years. So people are free to run their own forks of browsers, so I doubt that it will be forbidden for browsers to just have a setting for specific sets of certs.
  - denton-scratch 5y ago
    Thanks.
  - raxxorrax 5y ago
    "It is just this" is something we hear very often when it is about user surveillance. And then mandate sites use it for any age restricted content? Comes a year later. And everything against a backdrop that some EU members want encryption backdoors. Meanwhile we have safe e-commerce for years. No, thank you.
motohagiography 5y ago
The use cases for digital identity are almost all pernicious. Sure, you can use it for nice things like public services, except we do that today quite expansively without one, and why do we need biometric level proofs for that? A government digital identity means that every informal transaction in the economy that uses it relies on the state as an inline broker. We can see this today with vax passports, where just this month you have to check-in with the government before you can enter a restaurant. (only temporary, surely) It's designed to manage people like livestock, and we all know that some pigs are more equal than others. Even vax passports and so-called "mandates," have exploited loopholes in our high trust societies and assumed formlessness as to avoid being challenged legally. Digital identity regimes will use the same indirect methods. This is their strategy. Why do you need to prove your identity unless you there is some intent to prosecute you? Most of the value in the economy is based on people taking on transaction risk on behalf of others, so replacing it with digital identity will destroy degrees of economic freedom and opportunity for your kids and grandkids. Identity does not create opportunity, it limits it. Civilization doesn't survive malicious institutions that turn inward against the people they serve, and I hope other technologists think seriously about identity and consider the consequences of it falling into the hands of an enemy or evil institution, because having worked in identity, I guarantee it will.
- the_greyd 5y ago
  You make a good point. In a state of pandemic, the population IS in some sense similar to livestock, bodies to be managed, since the virus has weaponized our bodies. Wouldn't you say?
  - tasogare 5y ago
    The common method to deal with avian influenza is killing all the livestock when one case is detected. Your comparison is scary and uncanny, but well aligned with how violent the pandemic has been handled by various governments.
    - the_greyd 5y ago

216 points by xoa 5y ago

max_ 5y ago

>One of the most important ways in which browsers protect users is through website authentication. For instance, if a person wants to visit Europa.eu, the web browser must reliably ensure that the site is actually under control of the owner of the domain ‘Europa.eu’, and not an attacker on the network impersonating the European Commission’s domain.

theplumber 5y ago

Anyone knows how this relates to webauthn and why they need a new way of doing online authentication?

MR4D 5y ago

Authoritarianism raises its head in all sorts of interesting ways. Interesting to see the EU choose the path of Kazakhstan.[0] [0] - https://www.internetsociety.org/news/statements/2019/internet-society-concerns-kazakhstan-encryption/ https://www.internetsociety.org/news/statements/2019/interne...

theplumber 5y ago
A proper online identity framework is long due though. Maybe this is not the proper one but sending copies of my passport, electricity bills and lately selfie recordings as well to "prove my identity" doesn't seem right either.
- Aerroon 5y ago
  When this becomes widespread then you can expect to have to authenticate this way everywhere. Want to make a Twitter account? Please authenticate with your government ID. Facebook? Of course. Video games? You bet. South Korea already has these retirements for (some of) their video games.
  - sleevi 5y ago
    The draft revisions actually propose such authentication to be mandatory to implement for service providers if their users would like to use it. That is, it specifically targets websites (particularly Very Large Online Platforms) that they MUST accept such ID in lieu of an email or password, at the user’s request. This was part of the original motivation for the revisions, to target “Sign in with Facebook” or “Sign in with Google” and require such sites also offer a “Login with EU” option. Source: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A2021%3A281%3AFIN https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A20...
    - denton-scratch 5y ago
      So $VLOP is compelled to accept QWAC user-certificates, if one user requests it? And QWAC user-certificates are issued by TSPs whose CA cert must appear in the root-store unconditionally? That means there is nothing preventing $TSP from forging my certificate, and giving it to criminals/government-agents, and nothing to keep the TSP in line, because the single audit constraint is "Keep the Minister satisfied". I personally don't have a problem with the idea of replacing passwords with user-certs, provided I get to generate my own cert with my own private key. But the evidence is that general users can't learn how to use certificates. I hate passwords, but I'd rather use passwords than a user-cert issued by an unreliable CA.
      - Jensson 5y ago
        The "unreliable CA" you are talking about here happens to be banks and similar. Do you trust that your bank doesn't just steal your money? Yes, you basically can't function in modern society if you don't. These e-id's just piggybacks on that trust to also work on online sign-ins. Most people worry more about their bank account being compromised than their github, so if these CA's (ie banks) starts to abuse their position we would have way bigger troubles than someone stealing your github accounts.
        denton-scratch 5y ago
- xoa 5y ago
  Governments though can do that through their own passive demand. Ie., they can issue proper smartcards/tokens for citizens to identify themselves with, and then say that those can (and eventually must) be used for electronic interactions with the government itself (taxes being a big one but they'd easily be useful for a range of stuff). Follow/improve open standards. With something good, open and convenient private usage will naturally follow. Government can also by definition get involved with the issue of legal liability and fix BS like "identity theft" by shifting liability for businesses who do not meet good authentication standards. Doing it that way also creates room for fixing serious issues in practice before a natural rollout, as it starts by the government dogfooding its own standard. And if a lot of sites demand it, browsers will respond absent overwhelming reason not to, which itself is a good form of pressure to get said overwhelming reasons fixed. I'm very doubtful though that trying to just directly legislate how software universally works though bypassing process is a good idea. Massive room for abuse as well.
  - slowmovintarget 5y ago
    I think you touch on the issue. Having a standard for Identity Management seems reasonable. Mandating that such a state-regulated identity be used for all on-line data passing on the internet seems like a nightmare waiting to happen. That may not be the step in between "collect underpants" and "profit" but it feels like it's coming. In the U.S., I'm sure something like this will be sold in the clothing of think-of-the-children.
    - Jensson 5y ago
      > Mandating that such a state-regulated identity be used for all on-line data passing on the internet seems like a nightmare waiting to happen. They didn't mandate that though, the proposal was that it should be possible to use it, not that everyone should be forced to use it. You would still be able to log in using other means. Basically, facebook would be required to provide you with the option to use e-id to log in. But you could still log in with other means. It just gives you more freedom.
      - 5y ago
- indymike 5y ago
  > A proper online identity framework is long due though. Due by whom, and for what?
  - toomuchtodo 5y ago
    For citizens who want efficient, effective access to services that require identity. The need for identity isn’t going away, and a poor implementation doesn’t guard against overreach.
    - Tom4hawk 5y ago
      In Poland you can do a lot of things digitally by authenticating on governments sites with your Bank (Imagine "Continue with your bank" instead of "Continue with Google" or "Continue with Facebook"). It's nice because bank already verified my identity when I was creating a bank account. I did not have to scan&send anything, go verify in some office etc. and I was able to do multiple things: change how my company is taxed, register for COVID vaccination, government census.
      - AlexandrB 5y ago
        Canada has this too for some government services like the tax system.
    - logifail 5y ago
      > The need for identity isn’t going away [..] My identity is just fine, but thanks for your concern :) I can walk into my local bank branch and ask to either pay in or withdraw money and they don't ask for any kind of ID(!), or my account number, becuase they actually know me :) They even tend to say "Hello $firstname" when I walk in, even if I only called in to use the ATM. Amazing how good ol'fashioned _offline_ identity can actually be secure. Try walking into my local branch with faked ID of me and attempting to withdraw funds from my account.
      - deleted 5y ago
        [deleted]
- ostenning 5y ago
  I guess that depends what you expect from society and government. Do you expect that everything runs like an extremely powerful well oiled machine, where 100% interoperability likely means complete surveillance? A seemingly technocratic dystopian reality where every impulse is quantified and catalogued? I think its naive to believe that governments don't want more money, power and control over its citizens and government likely will be extracting more with every optimization the system makes. Or would you rather an extremely powerful machine that is disjointed, highly flawed and laden with inconvenience in-so-that society doesn't really know who you are? Where the individual has more freedom and liberty, but as a result there is more crime and less "safety". A world where powerful anti-social forces are at play, such as disinformation campaigns, polarization of discourse, fringe movements and revolution. The commonality is they are both driven by technology. We have built an extremely powerful machine and that has introduced enormous complexity into our society. This complexity equates to entropy and either we pull it together with draconian government policy, or the system unravels.
  - argomo 5y ago
    Question: how will the free/liberal society (plagued by polarization, etc) fare against the dystopian ones? In the past we've been able to out-innovate and maintain moral leadership thru a fictional aspiration to democratic norms. Now state actors can run finely targeted propaganda campaigns and measure our engagement with them in real time while using extensive censorship measures to prevent us from doing the same to their populations. None of this invalidates your point, but the tables have been tilted and abstract discussions of freedom tend to avoid wrestling with the geopolitical ramifications.
- logifail 5y ago
  > A proper online identity framework is long due though [..] You're entitled to your opinion but for me, it's a firm "No, thanks". I feel considerably more comfortable* carrying a paper document which proves my vaccination/negative test than I do using any kind of government-approved app on my phone. * that's putting it mildly
  - effie 5y ago
    You should be comfortable with carrying and using a document certifying a test result, but not with a document proving vaccination. The first is reasonable to due to its obvious utility in infection control, the second is not; it is now become a tool for sowing division and hatred in society. If you care about limiting infections, get tested. If you care about freedom, reject government certificates.
  - dariosalvi78 5y ago
    looks like you haven't lived in 5 European countries and have to interact with all of them for things like taxes, pensions, vehicles registrations, and with mobile phones numbers that change, 2FAs that go crazy, passwords that expire etc. etc. Yes, a common electronic ID is an absolute godsend. Can't wait for it to be implemented on every fricking public administration website.
- kwhitefoot 5y ago
  We use BankID for this in Norway (and elsewhere in Scandinavia I think).
- raxxorrax 5y ago
  We spend trillions on e-commerce with "normal" user accounts that worked just fine. Some cases of thefts and other crimes that doesn't warrant any action in my opinion. Meanwhile we have a huge problem with governmental surveillance, which is a worse crime than theft depending on how you grade it.
emteycz 5y ago
This EU effort to control is ongoing for many years now, how is it in any way unexpected?
- furi 5y ago
  Perhaps I'm out of the loop, but the EU attempting to make it illegal to distribute web browsers that don't include certain features is unexpected (and deeply worrying) to me.
  - Shadonototra 5y ago
    They are protecting their interest Why should a foreign country have control over my interests? Why should Mozilla DECIDE what I should and shouldn't trust? I am very glad that the public opinion decided to not trust Firefox at all (3% market share today)
    - plandis 5y ago
      Mozilla doesn’t decide that. Mozilla is an option _you_ can chose to use. It’s one of N options.
      - Jensson 5y ago
        But all large browsers happens to be American. It makes sense that EU wants to regulate this rather than hand over all decisions related to trust to USA. For example, imagine if all big browsers everyone uses where made in China, and mostly just trusted Chinese CA. Do you think that would be a problem? Do you think the rest of the world would just let that happen instead of starting to regulate it? That is the situation EU faces right now with American browsers.
        emteycz 5y ago
        I never asked EU to do this for me, and don't want it. No government should have this power. Who did? I don't remember a single party having this in their program.
bogle 5y ago
I don't think QWACs are at all the same as state controlled root certificates. Browsers aren't going to show EV certificates.
- sleevi 5y ago
  The proposed regulation requires that QWACs MUST be accepted and recognized as such, such as using the European List of Trusted Lists as part of the root store. That is, if a QWAC is issued by a CA that is not part of the browser root store, it must not be rejected (as any other untrusted certificate would be).

chuckee 5y ago

> In a nutshell, the revised Article 45 would force browsers to suspend the ‘root store’ policies that are essential for maintaining trust and security online. [..] At the same time, the types of website certificates that browsers would be forced to accept, namely QWACs Can someone explain where this 'force' comes from? I wasn't aware the EU had such authority to decide how programs on a users private computer must behave. Would e.g. making a fork of Firefox that does not comply with this digital identity framework be illegal? Or is this just hyperbole from Mozilla, and the browser would be merely non-compliant?

keddad 5y ago
Well, the original document states that "Web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1...". I'm not sure, however, what punishment, if any, is there for the browsers that don't comply with that regulation.
- raxxorrax 5y ago
  Not the browsers will be reprimanded. That would be webservices like Youtube that only allows browsers providing a certified ID to let users look at the more controversial cat pictures. It is an extremely transparent power grab.
Mindwipe 5y ago
> I wasn't aware the EU had such authority to decide how programs on a users private computer must behave. Why not? They publish directives that result in criminal law in member states all the time. A directive is published, member states are obligated to turn that into domestic legislation, and yes, ultimately a state can criminalise lots of things if it wants to.
- chuckee 5y ago
  > such authority Key word "such". Prescribing which certificates I am obligated to trust is many many steps beyond e.g. banning DRM circumvention (which is itself a step too far IMO).

xoa 5y ago

This did get posted a few weeks ago at the time it was written but didn't get much traction at that point, yet seems like a reasonably important issue. The EU has done worthy things for issues like privacy, but whatever pluses and minuses of regulating personal and business policy I'm a lot more dubious about government sticking its hand directly into how specific software (like browsers) functions. That seems like a serious step beyond merely trying to ensure there is competition and choice in different products, full disclosure about them, level playing fields etc. Dictating implementation details even for open source feels like something with much, much more scope for serious negative side effects getting baked in particularly in fields where best practices move fast. A negative security example that comes readily to mind are how bad government policies/standards helped cement for a long time the awful practice of complex password requirements including rapid change requirements, "security questions" and so on. These are actively negative for security, people in the field realized pretty fast (and of course many argued from the start) that the only reqs for passwords should be some minimum length, not using previously exposed ones, and having a sufficiently high maximum length that everyone is free to use more comfortable ones like diceware if they wished. While that has been getting revised at last bureaucracy still moves much too slowly there. Of course this hasn't made it through the gauntlet and hopefully won't, but I'm glad to see it getting some attention.

dahfizz 5y ago
I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.
- mariusor 5y ago
  What makes you believe it's until the end of time? They did do it with micro USB also. From what I can see the mandate changes with the times, so if everything evolves I would assume that they'll update their requirements.
- 5y ago

phicoh 5y ago

I wonder why QWACs are less secure than DV. There is an argument why EV should be treated the same a DV I'm not buying that argument but for the moment let's accept it as true. However, now Mozilla is arguing that EV is less secure than DV. That seems weird to me. Currently, browsers have root certificates for lots of countries. I can imagine that for a country it becomes a huge problem if suddenly a major browser decides to reject certificates used by that country's government. Of course, it would be nice if country certificates could be restricted to country specific resources. Maybe mozilla should push for that.

Jwarder 5y ago
I see two issues at play. Not all European CAs meet browsers' root programs requirements. Forcing everyone to accept those certs weakens all root programs (Mozilla's, Microsoft's, etc). There is also the concern that special indicators displayed with a certificate can mislead users. A scummy company with an EV cert isn't any more trustworthy than if they had a DV cert, but browsers want to be careful not to imply a fancy logo makes the site any safer.
- kjetil 5y ago
  Are the TSP audit requirements less strict than what the browsers’ root programs require?
  - Jwarder 5y ago
    Mozilla says so. https://drive.google.com/file/d/1DgJe-Ku4u66JF2D6zha28tSKxPBzavyQ/view?usp=sharing https://drive.google.com/file/d/1DgJe-Ku4u66JF2D6zha28tSKxPB... I can't speak with authority, but my reading of PKI issues suggests Google is just as strict, while Microsoft and Apple are less strict. However, that just might be because MS and Apple are less public with their root programs.
- Jensson 5y ago
  > Not all European CAs meet browsers' root programs requirements. That sounds like a huge problem, why should EU trust that USA handles trust certificates well? Of course they would want to regulate this instead of leaving that extremely large security hole open, letting USA alone decide what counts as secure or not is not in EU's interests.

Shadonototra 5y ago

Why is it ok for an american company to collude with foreign politics? Can't they focus on their broken system first?

muricula 5y ago
This sort of thing is actually somewhere I think Mozilla can make a difference. As a major browser, they are listened to when they lobby standards bodies and political bodies about the web and internet security, and very often they are listened to. I agree Firefox could be better, but time spent on effective lobbying which will help all browsers is well spent.
deleted 5y ago
[deleted]
zoobab 5y ago
EU laws are written by foreign actors, just look at the lobbying going on on DSA/DMA, those foreign corporations are writing laws against the interests of European companies and citizens.
raxxorrax 5y ago
As someone from Europe I am thankful for any resistance to such plans and many laws implemented by the EU are written by foreign companies. Companies like central administrations, far easier to lobby against compared to citizens that must carry themselves through countless more or less democratic institutions.

parasense 5y ago

I think the Browsers should swing the axe the other direction. Indicate the website is broken when EV certificates are present. Also, indicate all websites are broken if/or when the Root-CA-trust ever be forcefully extended to include EV CA authorities, in particular state backed authorities. I'm not sure about the EU, but forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech. Regrettably I would not be surprised if EU took a more authoritarian stance.

malermeister 5y ago
I don't see how the USA's first amendment is at all applicable to the EU.
deadbunny 5y ago
I'm not sure I follow. How are EV certificates weak? They use the same cyphers and just have extra validation on the owner/domain.
- mikeiz404 5y ago
  It appears to be more of a UI issue where the legal entity name is shown along side or sometimes in place of the URL which can be misleading. To compound problems legal entity names are not required to be unique across states or countries so an EV certificate for a popular company name can be obtained in another geography and presented to the user on an attacker controlled domain. https://www.bleepingcomputer.com/news/security/extended-validation-ev-certificates-abused-to-create-insanely-believable-phishing-sites/ https://www.bleepingcomputer.com/news/security/extended-vali...
pantulis 5y ago
"forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech." I understand the issues mentioned in passing scammy actors as legitimate but, in which way your rights to speech would be vulnerated?
- deleted 5y ago

66fm472tjy7 5y ago

Is the draft of the revision available anywhere? I don't see a link anywhere in the position paper. Article 45 in the current regulation[0] says nothing about browsers. I am curious about the exact language that would force Firefox support the technology and include the TSPs in their root store. [0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014R0910&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

sleevi 5y ago
https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A2021%3A281%3AFIN https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A20...

denton-scratch 5y ago

It's ultimately my decision which certificates I will trust. I can choose to trust just one certificate, and ignore the Mozilla root store, or I can use Mozilla's root store, and modify it. These are my decisions, not Mozzilla's. So this proposed regulation mandates that my browser must support QWAC, and include TSP roots? Does that mean that browsers MUST deprive me of the ability to control my root store? Would I be in violation if I modified my (open-source) browser so that it was no longer in compliance? Supposing I published my patch on a website outside the EU (e.g. in the UK)? To be clear, I don't want a root cert from any entity that is effectively controlled by a government, to be trusted by my browser. Some governments bother me more than others, (for example) a Turkish government-controlled CA was caught forging certificates. There's still a Turkish CA in there, I see; Debian have seen fit to remove it. It's all fine, the sky won't fall. As long as I can still decide who I trust.

Jensson 5y ago
This is all the initial recommendations says about browsers and certificates, there is nothing about preventing browsers from allowing the users to configure this, just to have them support it (and most of this is already supported by browsers, this is mostly just a recommendation to force all browsers to implement site security): > To that end, web-browsers should ensure support and interoperability with Qualified certificates for website authentication pursuant to Regulation (EU) No 910/2014. They should recognise and display Qualified certificates for website authentication to provide a high level of assurance, allowing website owners to assert their identity as owners of a website and users to identify the website owners with a high degree of certainty. Edit: It also limits this to larger web browser providers in another part and only after 5 years. So people are free to run their own forks of browsers, so I doubt that it will be forbidden for browsers to just have a setting for specific sets of certs.
- denton-scratch 5y ago
  Thanks.
- raxxorrax 5y ago
  "It is just this" is something we hear very often when it is about user surveillance. And then mandate sites use it for any age restricted content? Comes a year later. And everything against a backdrop that some EU members want encryption backdoors. Meanwhile we have safe e-commerce for years. No, thank you.

motohagiography 5y ago

The use cases for digital identity are almost all pernicious. Sure, you can use it for nice things like public services, except we do that today quite expansively without one, and why do we need biometric level proofs for that? A government digital identity means that every informal transaction in the economy that uses it relies on the state as an inline broker. We can see this today with vax passports, where just this month you have to check-in with the government before you can enter a restaurant. (only temporary, surely) It's designed to manage people like livestock, and we all know that some pigs are more equal than others. Even vax passports and so-called "mandates," have exploited loopholes in our high trust societies and assumed formlessness as to avoid being challenged legally. Digital identity regimes will use the same indirect methods. This is their strategy. Why do you need to prove your identity unless you there is some intent to prosecute you? Most of the value in the economy is based on people taking on transaction risk on behalf of others, so replacing it with digital identity will destroy degrees of economic freedom and opportunity for your kids and grandkids. Identity does not create opportunity, it limits it. Civilization doesn't survive malicious institutions that turn inward against the people they serve, and I hope other technologists think seriously about identity and consider the consequences of it falling into the hands of an enemy or evil institution, because having worked in identity, I guarantee it will.

the_greyd 5y ago
You make a good point. In a state of pandemic, the population IS in some sense similar to livestock, bodies to be managed, since the virus has weaponized our bodies. Wouldn't you say?
- tasogare 5y ago
  The common method to deal with avian influenza is killing all the livestock when one case is detected. Your comparison is scary and uncanny, but well aligned with how violent the pandemic has been handled by various governments.
  - the_greyd 5y ago