5 ms·

I think the Browsers should swing the axe the other direction. Indicate the website is broken when EV certificates are present. Also, indicate all websites are

I think the Browsers should swing the axe the other direction. Indicate the website is broken when EV certificates are present. Also, indicate all websites are broken if/or when the Root-CA-trust ever be forcefully extended to include EV CA authorities, in particular state backed authorities. I'm not sure about the EU, but forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech. Regrettably I would not be surprised if EU took a more authoritarian stance.

malermeister 5y ago
I don't see how the USA's first amendment is at all applicable to the EU.
deadbunny 5y ago
I'm not sure I follow. How are EV certificates weak? They use the same cyphers and just have extra validation on the owner/domain.
- mikeiz404 5y ago
  It appears to be more of a UI issue where the legal entity name is shown along side or sometimes in place of the URL which can be misleading. To compound problems legal entity names are not required to be unique across states or countries so an EV certificate for a popular company name can be obtained in another geography and presented to the user on an attacker controlled domain. https://www.bleepingcomputer.com/news/security/extended-validation-ev-certificates-abused-to-create-insanely-believable-phishing-sites/ https://www.bleepingcomputer.com/news/security/extended-vali...
pantulis 5y ago
"forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech." I understand the issues mentioned in passing scammy actors as legitimate but, in which way your rights to speech would be vulnerated?
- deleted 5y ago
  [deleted]
- vhold 5y ago
  It would be compelled speech if the law required the browsers to say that a connection is secure when its creators don't want it to. https://en.wikipedia.org/wiki/Compelled_speech https://en.wikipedia.org/wiki/Compelled_speech Whether or not it would violate the 1st amendment would be up to the courts to decide.
  - Jensson 5y ago
    The cancer label warnings in California aren't violating any free speech, this is the same thing so it wouldn't violate it. All the browsers would say is "The European Union has verified the identity of this site owner" or something similar.
    - SkeuomorphicBee 5y ago
      I feel there is a big difference between a mandated warning label (California cancer labels), Vs a mandated endorsement like forcing browses to say that unsecure connection is secure.
      - Jensson 5y ago
        Sure there is a big difference, but not from the perspective of free speech. Both cases forces you to display a label even if you don't want to show it to people. It is understood that the label isn't your speech, hence it doesn't limit your free speech rights. You might object to this for other reasons, but free speech isn't a good reason.
    - perihelions 5y ago
      >"The cancer label warnings in California aren't violating any free speech" That's because it's commercial speech [0] attached to a sale of a product, which gets a reduced level of protection. I'm don't think that you could, in the US, compel non-commercial software to express messages like "We trust this CA". Mozilla has a 1st amendment right to not trust to CA's, and to tell their users why they don't trust the CA; to boycott a CA; to implement this in code and ship it. [0] https://crsreports.congress.gov/product/pdf/IF/IF11072 https://crsreports.congress.gov/product/pdf/IF/IF11072 ("The First Amendment: Categories of Speech")
sofixa 5y ago
> I'm not sure about the EU, but forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech. Regrettably I would not be surprised if EU took a more authoritarian stance. Care to expand on this? I have a hard time making any sort of connection.

malermeister 5y ago

I don't see how the USA's first amendment is at all applicable to the EU.

deadbunny 5y ago

I'm not sure I follow. How are EV certificates weak? They use the same cyphers and just have extra validation on the owner/domain.

mikeiz404 5y ago
It appears to be more of a UI issue where the legal entity name is shown along side or sometimes in place of the URL which can be misleading. To compound problems legal entity names are not required to be unique across states or countries so an EV certificate for a popular company name can be obtained in another geography and presented to the user on an attacker controlled domain. https://www.bleepingcomputer.com/news/security/extended-validation-ev-certificates-abused-to-create-insanely-believable-phishing-sites/ https://www.bleepingcomputer.com/news/security/extended-vali...

pantulis 5y ago

"forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech." I understand the issues mentioned in passing scammy actors as legitimate but, in which way your rights to speech would be vulnerated?

deleted 5y ago
[deleted]
vhold 5y ago
It would be compelled speech if the law required the browsers to say that a connection is secure when its creators don't want it to. https://en.wikipedia.org/wiki/Compelled_speech https://en.wikipedia.org/wiki/Compelled_speech Whether or not it would violate the 1st amendment would be up to the courts to decide.
- Jensson 5y ago
  The cancer label warnings in California aren't violating any free speech, this is the same thing so it wouldn't violate it. All the browsers would say is "The European Union has verified the identity of this site owner" or something similar.
  - SkeuomorphicBee 5y ago
    I feel there is a big difference between a mandated warning label (California cancer labels), Vs a mandated endorsement like forcing browses to say that unsecure connection is secure.
    - Jensson 5y ago
      Sure there is a big difference, but not from the perspective of free speech. Both cases forces you to display a label even if you don't want to show it to people. It is understood that the label isn't your speech, hence it doesn't limit your free speech rights. You might object to this for other reasons, but free speech isn't a good reason.
  - perihelions 5y ago
    >"The cancer label warnings in California aren't violating any free speech" That's because it's commercial speech [0] attached to a sale of a product, which gets a reduced level of protection. I'm don't think that you could, in the US, compel non-commercial software to express messages like "We trust this CA". Mozilla has a 1st amendment right to not trust to CA's, and to tell their users why they don't trust the CA; to boycott a CA; to implement this in code and ship it. [0] https://crsreports.congress.gov/product/pdf/IF/IF11072 https://crsreports.congress.gov/product/pdf/IF/IF11072 ("The First Amendment: Categories of Speech")

sofixa 5y ago

> I'm not sure about the EU, but forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech. Regrettably I would not be surprised if EU took a more authoritarian stance. Care to expand on this? I have a hard time making any sort of connection.