12 ms·

A planned EU regulation about website certificates is causing concern

156 points by hannob 5y ago

toyg 5y ago
This title is clickbait. The proposed amendment to the framework is just excessively bureaucratic around the management of cert authorities. This might potentially result in browsers accepting certificates from authorities with a slightly dubious track record (according to browser vendors), yes, but the certificates themselves will not necessarily be "less secure" - which the layman typically interprets as "cryptographically weaker". In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance. In fact, as time passes and authorities become more and more tech savvy, I expect this sort of thing to happen more and more. There is a lot of unaccountable authority (eh) in internet infrastructure, with special companies like Google and Microsoft (and yes, Mozilla too) effectively holding the keys to many kingdoms. Even if such power is used scarcely and wisely, there is a question of legitimacy.
- syshum 5y ago
  The only thing worse the corporate control over CA's is government control over CA's... There is alternative to both, the solution to corporations having too much power is NEVER giving that power to governments
- raxxorrax 5y ago
  > but the certificates themselves will not necessarily be "less secure" I don't trust the EU to handle encryption. I don't think that is unreasonable especially with the attempts against it cloaked as "reasonable access". The chain of trust has weaknesses and any government institution can only fully undermine that trust. It would not last a week without abuse, the same happened with Covid tracking apps and location information. > there is a question of legitimacy. For the EU there is actually quite a lot of that. It is true that at some point we have to trust someone, but which problem do you want to see solved here?
  - seszett 5y ago
    I actually have move trust into the EU institutions than into the three main browser vendors. The EU is certainly more legitimate in most respects than various US private organisations.
  - raverbashing 5y ago
    > I don't trust the EU to handle encryption. Literally nowhere in the article it says that. The TL;DR is: "QWAC certificates will have to show the green banner" and maybe non-QWAC will have some kind of warning. The link on TFA is informative https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck-qwacs-like-a-duck-probably-an-ev-certifiacate/ https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck... (sounds like a CA lobbying for this crap) In the end I suspect browsers might revoke some QWAC certs if they feel they are invalid
    - raxxorrax 5y ago
      The whole article is about mandatory certificates, of course that is basically taking control of the most widespread encryption in use today. Encryption that has its weakness in the chain of trust, which the EU wants to have an influence on. So yes, this is essentially handling encryption if the EU indeed wants to enforce mandated certificates. If you want to discuss technicalities and the problem of key exchange we can do that too.
  - Denvercoder9 5y ago
    > the same happened with Covid tracking apps and location information. Do you have (a link to) more information on that? As far as I have seen (in NL) the Covid tracking app was designed and implemented fairly well and abuse has been very limited to non-existant.
    - raxxorrax 5y ago
      Here is an English source I could find: https://digit.site36.net/2022/01/22/tracking-corona-infections-german-luca-app-in-a-downfall/ https://digit.site36.net/2022/01/22/tracking-corona-infectio... There are two prominent apps in Germany. The other one is indeed secure against such attempts because it is technically not possible to get the information. I wouldn't even accuse the investigators here, it just shows that if there is a possibility for tracking, that it will be used. For better or worse reasons.
- ayende 5y ago
  Less secure is exactly that. If `Mr Shady` is in the mandated list (by law), and the browsers are required to threat their certificates as trusted, what do you think is the impact on the whole ecosystem?
  - ClumsyPilot 5y ago
    I would be perfectly happy with MR shady issuing such certificates if he has €100 billion in escriw with EU authorities and is legally forced to cover all losses and fraud caused by his certificates. Then, perhaps, mr. Shady will think twice
- SiempreViernes 5y ago
  How is the state of certificate authorities included in browsers these days? I remember some years back there being much noise about supposedly atrocious behaviour by some of the default included cert issuers...
  - hannob 5y ago
    It's much better. There are processes to enforce good behavior, these are very transparent (basically everything is happening on public mailing lists, the mozilla bugtracker and wiki), and in extreme cases CAs get distrusted for real. None of that is happening for QWACs.
- blibble 5y ago
  > In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance. I have zero trust in the competence and intentions of EU institutions I already have to trust the firm that maintains the browser, how does adding another party help exactly? this proposal's endgame is mandatory key escrow (attempt number #8 or so)
  - rosetremiere 5y ago
    > I have zero trust in EU institutions, Why is that?
    - rjzzleep 5y ago
      Because of people like Axel Voss, Von der Leyen etc. https://qz.com/1389385/article-11-and-article-13-axel-voss-is-surprised-by-eu-copyright-law/ https://qz.com/1389385/article-11-and-article-13-axel-voss-i...
    - LeifCarrotson 5y ago
      Browser vendors have an incentive to maintain trust, it's their stock in trade. If they screw up, it directly affects their bottom line because people will move elsewhere. Their goals align closely with my own. A foreign government (or even my own) has somewhere between zero and weak alignment with my goals. There's little reason they would want to choose good certificate authorities and strong reasons why they would choose ones their intelligence agencies can backdoor. Why should I add them to the chain of trust?
      - Jensson 5y ago
        Browser vendors monetize your data, that is their main trade. Having lots of users doesn't matter if you don't control them in some way, such as decide who gets to be trusted as a CA. The browsers are supporting the current tech hegemony for CA's, for some reason Americans are much more "trustworthy" than people from anywhere else, do you really believe that? Why should the people in Europe be forced to trust shady American companies like Google or Microsoft who are or likely will get compromised by the American state? It makes sense for them to regulate this so that they can have European options.
- hannob 5y ago
  CAs with a dubious track record are a far bigger problem in terms of practical security than weak cryptographic keys.
  - patmorgan23 5y ago
    Both are equally important because either one will break the security. The CA problem is the harder human problem to solve though.
- bugmen0t 5y ago
  With the commodification of free and automated certificates, I'd argue that authorities become less and less tech savvy: There is little to no money in the business sector, which means there's less possibility to keep technical people around. Also, I am surprised what exactly is making you think that the baseline requirements do not exist for security reasons (even if it isn't exclusively about cryptographic security).
  - toyg 5y ago
    > With the commodification of free and automated certificates, I'd argue that authorities become less and less tech savvy That's not what I meant. The point is that, as time passes, more and more people are involved in political decision-making who understand how tech works. > what exactly is making you think that the baseline requirements do not exist for security reasons Once you move out of the nitty-gritty of crypto tech, "security" is in the eye of the beholder. Is a solution more "secure", for society at large, if it allows terrorists to communicate undisturbed? You might say yes, others might say no. There isn't an absolute scale there. Choosing trust is one of those areas where the solution is political, not technical, hence forever debatable. So a statement implying that one set of compromises is "less secure" just because it moves trust from certain subjects to other ones (more formally accountable, in this case), is simply not objectively true, and really meant to muddle the waters.
- JoshTriplett 5y ago
  > In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance. And what happens when one of those institutions violates existing widespread CA policy, such as by issuing a certificate for MITM purposes, or otherwise making the web less secure? Right now, browsers can simply remove such CAs based on their established policy. (This isn't a hypothetical; browsers have had to remove CAs for such misbehavior in the past.)
  - AnIdiotOnTheNet 5y ago
    Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. As it is, browser companies[0] are the sole authority on what is and isn't a valid CA. At least the EU leadership is elected. [0] and let's be realistic here, this means Google.
    - SahAssar 5y ago
      Historically google and apple has followed mozillas decisions on CAs most of the time (google didn't even have their own program for a long time). I think it is still somewhat accepted that if you get approved by mozilla you will probably get approval from apple and google pretty soon. MS can be a bit weird though IIRC.
    - tialaramex 5y ago
      In practice there is every reason to believe it means m.d.s.policy, and thus anybody who cares. In principle Apple, Google, and Microsoft can do whatever they want, but well, go back and see the history of such interventions for yourself and draw your own conclusions about where the crucial decision was made.
    - rocqua 5y ago
      When it comes to which CAs are trusted, Mozzila is generally in the lead. Not an elected group, true. But a foundation with a public charitable goal, and an entity with much less interest in being able to intercept communications than states. I think it's better of in the hands of an un-elected foundation than in the hands of an elected, but politicized entity with interests in intercepting communication.
- hsbauauvhabzb 5y ago
  I trust the people I implicitly have to trust (browsers could backdoor your browser, so why would they trust a dodgy certificate). I don’t trust a government, especially not my own, to handle certificate authority selection without involving politics.
  - okl 5y ago
    Hey, nothing keeps you from managing your trusted certificates on your machine, right? Maybe this initiative can even highlight some issues regarding dubious CAs and make people care about whom they trust more explicitly.
    - hsbauauvhabzb 5y ago
      Ah yes, I’ll just tell grandma she should just validate the corporate behaviours of certificate authorities herself. How did I not think of this before?
- arsome 5y ago
  Hoping the browser vendors will enable this only for EU users, I want nothing to do with bad CAs.
- coldtea 5y ago
  >but the certificates themselves will not necessarily be "less secure" - which the layman typically interprets as "cryptographically weaker". Less secure is more about trust than the crypto algorithm... The strongest algorithm with no trust in the authority issuing it, is useless.
- scarface74 5y ago
  I’m always amazed at HN posters undying trust of government with respect to technology which has repeatedly shown itself to be corrupt, inept and has never taken the time to think through unintended consequences.
  - toyg 5y ago
    Because private companies are always competent, never abuse their privileges, and always act in the best interest of society at large. /S
    - scarface74 5y ago
      The difference is that private companies don’t have the power to force me to do anything - the government can forcible take away my property and liberty.
    - gruez 5y ago
      The difference is that governments have a monopoly on violence. Corporations don't.
    - danShumway 5y ago
      If I understand correctly, this legislation isn't about the government issuing certificates; it's about the government granting inclusion privileges to the same kinds of private companies that you're worried about. I distrust private companies too, but I trust Mozilla more than I trust companies like Camerfirma, and we have a pretty long track-record that shows us that governments are typically slow to address misconduct in private companies they're partnered with. I'm not sure I understand why this is being treated as a private company vs government debate; in my mind this is a debate over whether we should all be required by the government to trust private companies that Mozilla claims already today don't meet their security standards. It feels odd to claim that a government telling me I have to trust a private company fixes corporate incompetence or malfeasance. You don't see a potential for abuse of corporate privilege or for exploitative behavior when a private, for-profit CA can't be distrusted in browsers without them first petitioning the government?
- _8j50 5y ago
  What authority does the EU have to tell browsers what settings to use in their non-commercial product? The EU is always free to fork browsers or maintain a version tuned to EU standards and let users choose what they want.
- michaelt 5y ago
  Does the EU government, or the US government, or any other government for that matter strike you as doing a particularly good job of legislating around the internet? Personally, my impression is the legislation is at best hit-and-miss. You might get some great privacy protection. You might get mandatory encryption back doors. You might get free mobile data roaming. You might get cookie warning messages. You might get worldwide license-free spectrum, some of the most economically productive spectrum ever. You might get a patent system that lets people patent slide-to-unlock. You might get the state funding university research and giving the results away for free. You might get the DMCA giving youtube creators getting copyright strikes because someone's copyrighted silence. You might get cable rights of way and common carrier protections, which are vital to the communications industry working. You might get government ID checks for social media users. Seems to me legislation is a coin flip - sometimes great, other times completely boneheaded.
- sigzero 5y ago
  > In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance. I actually do not think that is what we want at all.
- danShumway 5y ago
  > but the certificates themselves will not necessarily be "less secure" - which the layman typically interprets as "cryptographically weaker". I think this is word-games. If all we cared about was cryptographic security we wouldn't have have certificate authorities in the first place, making certificates that are themselves secure isn't hard. The only reason we care about certificate authorities is because of the security of the surrounding process: which is exactly the stuff that Mozilla is complaining about. You're minimizing the most important part of a certificate authority. It's like going into a discussion about a potential phishing vulnerability and saying, "there's not security risk because the browser requests are still going over SSL." The point of a certificate authority isn't just to have cryptographically secure certificates, it's to have a secure issuer. So it feels really misleading to completely jump over the concerns Mozilla has laid out about weaker standards for issuer security and say that it's fine just because everything is still encrypted.
- pinephoneguy 5y ago
  >certificates from authorities with a slightly dubious track record CAs can sign certs for any website, that absolutely makes the web less secure.
- Canada 5y ago
  Governments should have absolutely zero control or influence over the trusted CA list that browsers ship.
- kmeisthax 5y ago
  The problem isn't merely the fact that the EU wants some control over the process, it's the fact that the EU wants to revive a bunch of dead ideas and bad CAs in the process of doing so. The article specifically cites a CA that was banned from root trust stores which the EU wants to forcibly un-ban, which is very bad. Yes - strictly speaking, those bad CAs can still issue "cryptographically secure" certs. However, the layman does not have a clue what "cryptographic security" means. They just hear "~~b̷̧͚́͝ȧ̷̠̜̦̉k̵̯̘̠͊̂e̴̞̓̃m̵̹͒̂͠o̵͎̣̎̓n̴͔̤̖̊̑o̴̙̰̼̍c̶͖̅͊h̶͔͛̇̓i̸͚̎n̶̮̬̊̒c̴̮̈̌ḣ̸̹i̵̤̊̈́n̴̹̮̾̃̈́~~ security", parse out the bits of English they do understand, and treat the rest as a linguistic intensifier, which is highly misleading. In fact, "cryptographic" in this context specifically ignores the authentication of the key. It just means that it's computationally infeasible[0] to decrypt the message if you only have the ciphertext. However, in order to get this security, you need to make sure only the intended recipient has the key. This not only means that the recipient needs to keep their key safe, but that you need to make sure that you're using the intended recipient's key. Otherwise, an attacker could just hand you their key instead of the recipients, and then decrypt your messages and do whatever they want with them. In other words, secure key authentication and exchange is a necessary precondition for cryptographic concealment. In some simple cryptosystems, we don't talk about this, mostly because we imagine the recipient and sender exchanging keys in such a way that the system doesn't need to care about it. Perhaps they exchanged paper keys in person in the middle of a potato field in Idaho. However, this is highly restrictive; imagine having to drive to every tech start-up's HQ to copy some QR codes with their public keys on it before you could visit a new website. What we would rather have is a way to take one securely-exchanged key we already have, and use it to securely exchange more keys over the Internet. That's what a CA ultimately is - an entity we already have keys for, that is capable of making sure our recipients are who they say they are. So if I go to news.ycombinator.com, the server I connect to will send me a message from that CA saying that they checked the server and validated that it's run by the person who owns news.ycombinator.com. Except now that makes the CA the weakest link in the system. A CA that is malicious can totally strip any and all of the protections that HTTPS is supposed to provide. So browser vendors are really, really picky as to what CAs they put in their trust stores. CAs that habitually make mistakes or lie out of their asses get removed because they are not trust-worthy. Any legal proposal that would make it easier or even possible for them to reverse such a decision needs to be treated like cancer. Yes, I know that browser vendors hold a lot of power in this equation - but there is little evidence that the measures they impose upon CAs are excessive or pretextual. Furthermore, the proposed replacement is making mistakes that the browser vendors aren't, so it's a strict security downgrade for no added freedom[1]. [0] trying every possible key requires more compute time than exists in the current universe [1] CAs are sideloadable on every device ever. Yes, even iOS. However, the only use for this is for... - Securing local web servers without an FQDN - Using enterprise security/spyware/filtering products that need to strip HTTPS in order to work I know of no case in which a CA has gotten into the business by telling people to install their alternative certificate. There are some edge cases in which very large CAs - specifically Let's Encrypt - have transitioned from having another root cross-sign them to becoming a root CA themselves. However, that only affected really old devices, and you could at least theoretically install the ISRG Root X1 cert on that device to work around this. https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ https://letsencrypt.org/docs/dst-root-ca-x3-expiration-septe...
- logifail 5y ago
  > the certificates themselves will not necessarily be "less secure" - which the layman typically interprets as "cryptographically weaker" We don't just need _cryptographic_ strength to deliver security, otherwise we'd all be using self-signed certificates...
raxxorrax 5y ago
One of the most relevant problems in Germany is that there is a caste that entirely specializes in written warnings and cease-and-desist declarations. A lot of our parliament consists of lawyers that tend to make favorable laws for their own industry. Just as background information on how Germany tends to enforce laws through private enterprise. Really good behavior from the browser vendors. Either the TLS chain is working or it is not. There is little nuance in the chain of trust. Since encryption seems to be the enemy dejure of governments, I would expect the next step would allow decryption by state executive forces if such "certificates" were established. This seems like getting a foot in the door. But I still wonder how it would enforce compliance. Certificates can be added and removed from browsers. Some use the OS certificate store and some have their own. I hope the community keeps a watchful eye. Because a mandated certificate is the opposite of secure.
- octagonal 5y ago
  Belgium is very similar in that regard. Our politicians are very talented in turning what should be straightforward processes into complex bureaucratic puzzles that require at the least an advanced degree in accounting to solve. So frustrating as it's holding SMEs back.
- rrll22 5y ago
  I hope someone from the Chrome team reads this and decides to implement a separate certificate store like Firefox has.
- toyg 5y ago
  Sorry for being a grammar nazi, but "enemy dejure" doesn't mean what you think it means - technically that form states that encryption is an enemy in law (de jure, in Latin - typically used in opposition to de facto, "in practice"). I expect you meant to write "du jour", French for "current, of the day (jour)". Fire your autocorrector.
Denvercoder9 5y ago
I'm curious what causes this proposal to get attention now. As far as I can find, it has been submitted by the European Commission in June of last year, but little has happened since; the European Parliament and European Council in particular don't seem to have considered it yet.
throwaway984393 5y ago
I know nobody likes this idea, but I believe the best solution is a curated list of companies, products, and their websites. You provide a browser add-on that displays the list, and let users search through it and click on the company/product they want. Here's some ways to implement this: 1. Have CAs publish a list of domains and company names. This is problematic because lots of companies have different domains and legal entities, and it's very likely an attacker could list a company that sounds like another company with a malware domain. 2. Volunteers register companies and their domains and brand logos in a Git repo and companies can request changes if need be. They'll be explicitly only trying to list domains that people have asked for and scrutinize them to prevent adding phishing sites. The latter would have some problems I'm sure, but it gets closest to what users want, which is "show me Bank websites" / "show me Bank of America's website". By having a curated list and some strict policies on managing the list, it will probably be much safer and easier than any other method that exists today to find a company website. Additional techniques could add integrity, like a reporting mechanism, and a star feature to favorite specific sites so they come up first with the number of times they've been starred.
- raxxorrax 5y ago
  We can create a toddler net and for some applications that would provide benefits. It could use the same infrastructure as the common net and can leave it completely unaffected. You would just need specialized web clients.
  - throwaway984393 5y ago
    Why would you need specialized clients?
    - renewiltord 5y ago
      So that those who want toddlernet won’t be exposed to the rest of the Internet. Their clients will only display todsites.
      - 5y ago
tgflynn 5y ago
Aside from the details of this specific proposal it seems to me that government mandates on what end-user software can do is uncharted territory. How would this affect open source browsers ? The most widely known browsers (ie. Chrome and Firefox) aren't even traditional commercial products since they are distributed for free and derived from open source code.
- Someone 5y ago
  Having government mandates on what end-user software can do is not uncharted territory. Some examples: https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... https://en.wikipedia.org/wiki/GIF#Unisys_and_LZW_patent_enforcement https://en.wikipedia.org/wiki/GIF#Unisys_and_LZW_patent_enfo... https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
  - tgflynn 5y ago
    Your examples don't support your argument very much. Export controls on cryptography were eliminated decades ago as it became clear that they made no sense and were counterproductive in a world where the Internet exists. Patents are a legal concept that has been in existence for centuries but enforcement is only possible through civil court proceedings between private parties. Governments are not directly involved in enforcing patents. Moreover there have been few if any successful patent lawsuits against open source software. As for the GDPR, from the wikipedia page you linked it appears to apply to enterprises that process data, not software. I don't think the GDPR attempts to restrict what data a software program can process locally on your computer. It only comes into effect if that data gets sent to some company.
    - Someone 5y ago
      > Export controls on cryptography were eliminated decades ago According to that Wikipedia page, some restrictions remain today. Even if there weren’t anymore, I wouldn’t call it a territory uncharted because we haven’t been there for a few decades. > Governments are not directly involved in enforcing patents. Not directly, no, but they decide on what’s patentable and what’s not, and on how long patents hold. For example, AFAIK the periodic Disney patent extension doesn’t come about from civil court proceedings between private parties. > I don't think the GDPR attempts to restrict what data a software program can process locally on your computer Similarly, I haven’t read the proposal, but don’t expect this regulation will forbid you to use any kind of certificate locally on your computer, or between your own computers. > It only comes into effect if that data gets sent to some company. That, IMO, is limiting “what end user software can do”.
londons_explore 5y ago
Presumably the browser vendors could require this new EU thing and a certificate from someone they trust.
rob_c 5y ago
just bureaucracy refusing to die as the tech moves on, nothing new I suppose...
jerf 5y ago
It occurs to me, I'd be interested in my browser tracking the root certificates it uses and has encountered, and present me with a report of them. I've been interested in curating my cert list personally before, but without an idea of what certs I am in practice trusting (and not just in theory), it's really difficult to know where to start. You're presented with a list of a couple hundred or so root authorities with little more than their name to go by. I could get a real jumpstart if there was 80-90% that I simply never encounter and could easily see that. One way browsers could push back at least a little on this would be to make cert auditing like this easier, and, if not already possible, potentially expose it to extensions. Preferably with a brand new "manage certificates" extension, which the browsers are welcome to and/or invited to festoon with whatever dire warnings about security they like. (It's hard, if not impossible, to create an interface to improve security like this that can't also be used to tear it down.) Giving enough visibility into the cert process that an extension could flag "hey, this is a new root cert you've never seen before" would be nice too. Obviously, my metaphorical grandmother isn't going to be interested in this, but it could at least start a more community-oriented "conversation", in the form of running code, around what cert authorities I trust, rather than the browser coders. I'm not looking to see if this already exists, because if it does I'm sure someone will know exactly where it is and what it's called and can link it to me, and everyone else reading. Please do, if it already exists.
matt123456789 5y ago
The firm Camerfirma is provided as the poster child of why the EU can’t be trusted with the QWAC issuance rights - because it (EU) has been shown evidence of malpractice on the part of Camerfirma and failed to revoke its QWAC CA status. But looking at the page linked by the article, it seems Camerfirma’s QWAC CA status has in fact been withdrawn? The article doesn’t make this distinction clear. Or do I misunderstand?
Digit-Al 5y ago
I don't really understand how the EU can enforce this. If the major browser vendors threatened to prevent their browsers from being able to be used in the Eurozone over this they would have to back down because without the big four browsers almost every single person in the EU would basically be unable to access the internet. It would cause chaos. All four companies are based in the US as far as I am aware so it's not like the EU could do much about it. As an English citizen I sure as hell wouldn't want this to happen though.
- krageon 5y ago
  > If the major browser vendors threatened to This won't happen, so none of what comes after matters. > As an English citizen England is not part of the EU.
  - josephcsible 5y ago
    > England is not part of the EU. So? Stuff like cookie consent banners are the EU's doing, and they happen worldwide now.
    - krageon 5y ago
      No, they're not. No need to ask consent if you don't use them (or use only ones you need). The fact that you see them everywhere is a purposeful piece of malice by each and every website you visit.
- hef19898 5y ago
  Nothing like this would happen, the market is to big. And money is all the big vendors care about.
jeroenhd 5y ago
What's the problem they're trying to solve here? Is it just lobbying fortthe return of special EV certificates or is there actually some kind of government issue that these people are trying to solve?
- chopin 5y ago
  Enabling man-in-the-middle attacks for exfiltration.
  - rini17 5y ago
    You mean something like cloudflare? I find mitm fears related to CAs rather funny when everybody uses cloudflare anyway.
    - gruez 5y ago
      cloudflare is an entity that you can choose to trust with your data. It's not any different than how your hosting provider/cdn can "MITM" you as well. The issue people are having with this regulation is that the government is forcing you to trust some unrelated party.
      - rini17 5y ago
        You are forced to trust cloudflare too as you can't do business without DDoS protection anymore. I'd prefer such trust to be rooted in my (EU) jurisdiction.
        chopin 5y ago
        Now I have to trust the EU and Cloudflare. As much as I despise Cloudflare, at least in Germany the pandemic has shown that authorities can't be trusted with data even if taken with the best of intentions.
        rini17 5y ago
Shadonototra 5y ago
I don't want foreign companies to tell me what to trust, i believe in the government I elect, and their representatives in the EU Yes mozilla, I don't trust you And btw what you do is called political interference, you should be ashamed mozilla > is causing concerns hahaha, what's the goal here? spreading fear and misleading people into thinking that's how they should feel? typical from mozilla, trying to save their sinking chip
dusted 5y ago
I wonder what that means for the most important websites on the Internet (those of private individuals hosting their own websites on their own computers on their own Internet connections from their own homes).
unfocussed_mike 5y ago
"That was Feisty Duck, reporting on some misguided QWACs that are ruffling feathers, outside the EU headquarters in Brussels. And now, over to you for tomorrow's weather, Dewey -- will it be nice weather for ducks?" (Burning karma for duck news jokes)
tekacs 5y ago
In an era where they weren’t able to defeat ‘ubiquitous encryption’ (everything moving to HTTPS) or end-to-end encryption… … this seems like a convenient way to allow the EU to provide their own CAs who will be willing to cooperate in issuing MitM certs, achieving the goal irrespective. Certificate Transparency will surely help with this, assuming that they don’t try to override that too, but I’m curious to research now and see if the EFF is taking note of this.
parasense 5y ago
> Thus, if implemented, these plans could mean that browsers would be forced to give special treatment to TLS certificates that have been issued by entities held to a lower standard than the other certificate authorities. I'm not clear on the "forced" aspect of all this EU regulation. How does the EU force Firefox/Mozilla, Google Chrome, or any software in existence to recognize the EU's list of certificate authorities? Sounds like compelled speech. How the EU plans to force somebody to write source code to open source projects is an amusing idea... Would I break the law if I forked Firefox, and chose not to include the EU's certificate authority? IF yes, how are they going to compel my speech outside the EU? Sound like the EU will have to create their own web browser.
car_analogy 5y ago
> the certificate authorities that would issue these certificates would be decided by the EU member states, and browsers would be forced to accept those It's not a question of trusting the EU, but of user autonomy. Even if the EU were 100% trustworthy, that shouldn't let it force users which certificates they trust. If I phone a friend, but his voice sounds off, and his manner of speech unusual, so that I suspect he's being impersonated - what business does any government have telling me that I must trust it is indeed my friend on the line?

156 points by hannob 5y ago

toyg 5y ago

This title is clickbait. The proposed amendment to the framework is just excessively bureaucratic around the management of cert authorities. This might potentially result in browsers accepting certificates from authorities with a slightly dubious track record (according to browser vendors), yes, but the certificates themselves will not necessarily be "less secure" - which the layman typically interprets as "cryptographically weaker". In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance. In fact, as time passes and authorities become more and more tech savvy, I expect this sort of thing to happen more and more. There is a lot of unaccountable authority (eh) in internet infrastructure, with special companies like Google and Microsoft (and yes, Mozilla too) effectively holding the keys to many kingdoms. Even if such power is used scarcely and wisely, there is a question of legitimacy.

syshum 5y ago
The only thing worse the corporate control over CA's is government control over CA's... There is alternative to both, the solution to corporations having too much power is NEVER giving that power to governments
raxxorrax 5y ago
> but the certificates themselves will not necessarily be "less secure" I don't trust the EU to handle encryption. I don't think that is unreasonable especially with the attempts against it cloaked as "reasonable access". The chain of trust has weaknesses and any government institution can only fully undermine that trust. It would not last a week without abuse, the same happened with Covid tracking apps and location information. > there is a question of legitimacy. For the EU there is actually quite a lot of that. It is true that at some point we have to trust someone, but which problem do you want to see solved here?
- seszett 5y ago
  I actually have move trust into the EU institutions than into the three main browser vendors. The EU is certainly more legitimate in most respects than various US private organisations.
- raverbashing 5y ago
  > I don't trust the EU to handle encryption. Literally nowhere in the article it says that. The TL;DR is: "QWAC certificates will have to show the green banner" and maybe non-QWAC will have some kind of warning. The link on TFA is informative https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck-qwacs-like-a-duck-probably-an-ev-certifiacate/ https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck... (sounds like a CA lobbying for this crap) In the end I suspect browsers might revoke some QWAC certs if they feel they are invalid
  - raxxorrax 5y ago
    The whole article is about mandatory certificates, of course that is basically taking control of the most widespread encryption in use today. Encryption that has its weakness in the chain of trust, which the EU wants to have an influence on. So yes, this is essentially handling encryption if the EU indeed wants to enforce mandated certificates. If you want to discuss technicalities and the problem of key exchange we can do that too.
- Denvercoder9 5y ago
  > the same happened with Covid tracking apps and location information. Do you have (a link to) more information on that? As far as I have seen (in NL) the Covid tracking app was designed and implemented fairly well and abuse has been very limited to non-existant.
  - raxxorrax 5y ago
    Here is an English source I could find: https://digit.site36.net/2022/01/22/tracking-corona-infections-german-luca-app-in-a-downfall/ https://digit.site36.net/2022/01/22/tracking-corona-infectio... There are two prominent apps in Germany. The other one is indeed secure against such attempts because it is technically not possible to get the information. I wouldn't even accuse the investigators here, it just shows that if there is a possibility for tracking, that it will be used. For better or worse reasons.
ayende 5y ago
Less secure is exactly that. If `Mr Shady` is in the mandated list (by law), and the browsers are required to threat their certificates as trusted, what do you think is the impact on the whole ecosystem?
- ClumsyPilot 5y ago
  I would be perfectly happy with MR shady issuing such certificates if he has €100 billion in escriw with EU authorities and is legally forced to cover all losses and fraud caused by his certificates. Then, perhaps, mr. Shady will think twice
SiempreViernes 5y ago
How is the state of certificate authorities included in browsers these days? I remember some years back there being much noise about supposedly atrocious behaviour by some of the default included cert issuers...
- hannob 5y ago
  It's much better. There are processes to enforce good behavior, these are very transparent (basically everything is happening on public mailing lists, the mozilla bugtracker and wiki), and in extreme cases CAs get distrusted for real. None of that is happening for QWACs.
blibble 5y ago
> In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance. I have zero trust in the competence and intentions of EU institutions I already have to trust the firm that maintains the browser, how does adding another party help exactly? this proposal's endgame is mandatory key escrow (attempt number #8 or so)
- rosetremiere 5y ago
  > I have zero trust in EU institutions, Why is that?
  - rjzzleep 5y ago
    Because of people like Axel Voss, Von der Leyen etc. https://qz.com/1389385/article-11-and-article-13-axel-voss-is-surprised-by-eu-copyright-law/ https://qz.com/1389385/article-11-and-article-13-axel-voss-i...
  - LeifCarrotson 5y ago
    Browser vendors have an incentive to maintain trust, it's their stock in trade. If they screw up, it directly affects their bottom line because people will move elsewhere. Their goals align closely with my own. A foreign government (or even my own) has somewhere between zero and weak alignment with my goals. There's little reason they would want to choose good certificate authorities and strong reasons why they would choose ones their intelligence agencies can backdoor. Why should I add them to the chain of trust?
    - Jensson 5y ago
      Browser vendors monetize your data, that is their main trade. Having lots of users doesn't matter if you don't control them in some way, such as decide who gets to be trusted as a CA. The browsers are supporting the current tech hegemony for CA's, for some reason Americans are much more "trustworthy" than people from anywhere else, do you really believe that? Why should the people in Europe be forced to trust shady American companies like Google or Microsoft who are or likely will get compromised by the American state? It makes sense for them to regulate this so that they can have European options.
hannob 5y ago
CAs with a dubious track record are a far bigger problem in terms of practical security than weak cryptographic keys.
- patmorgan23 5y ago
  Both are equally important because either one will break the security. The CA problem is the harder human problem to solve though.
bugmen0t 5y ago
With the commodification of free and automated certificates, I'd argue that authorities become less and less tech savvy: There is little to no money in the business sector, which means there's less possibility to keep technical people around. Also, I am surprised what exactly is making you think that the baseline requirements do not exist for security reasons (even if it isn't exclusively about cryptographic security).
- toyg 5y ago
  > With the commodification of free and automated certificates, I'd argue that authorities become less and less tech savvy That's not what I meant. The point is that, as time passes, more and more people are involved in political decision-making who understand how tech works. > what exactly is making you think that the baseline requirements do not exist for security reasons Once you move out of the nitty-gritty of crypto tech, "security" is in the eye of the beholder. Is a solution more "secure", for society at large, if it allows terrorists to communicate undisturbed? You might say yes, others might say no. There isn't an absolute scale there. Choosing trust is one of those areas where the solution is political, not technical, hence forever debatable. So a statement implying that one set of compromises is "less secure" just because it moves trust from certain subjects to other ones (more formally accountable, in this case), is simply not objectively true, and really meant to muddle the waters.
JoshTriplett 5y ago
> In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance. And what happens when one of those institutions violates existing widespread CA policy, such as by issuing a certificate for MITM purposes, or otherwise making the web less secure? Right now, browsers can simply remove such CAs based on their established policy. (This isn't a hypothetical; browsers have had to remove CAs for such misbehavior in the past.)
- AnIdiotOnTheNet 5y ago
  Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. As it is, browser companies[0] are the sole authority on what is and isn't a valid CA. At least the EU leadership is elected. [0] and let's be realistic here, this means Google.
  - SahAssar 5y ago
    Historically google and apple has followed mozillas decisions on CAs most of the time (google didn't even have their own program for a long time). I think it is still somewhat accepted that if you get approved by mozilla you will probably get approval from apple and google pretty soon. MS can be a bit weird though IIRC.
  - tialaramex 5y ago
    In practice there is every reason to believe it means m.d.s.policy, and thus anybody who cares. In principle Apple, Google, and Microsoft can do whatever they want, but well, go back and see the history of such interventions for yourself and draw your own conclusions about where the crucial decision was made.
  - rocqua 5y ago
    When it comes to which CAs are trusted, Mozzila is generally in the lead. Not an elected group, true. But a foundation with a public charitable goal, and an entity with much less interest in being able to intercept communications than states. I think it's better of in the hands of an un-elected foundation than in the hands of an elected, but politicized entity with interests in intercepting communication.
hsbauauvhabzb 5y ago
I trust the people I implicitly have to trust (browsers could backdoor your browser, so why would they trust a dodgy certificate). I don’t trust a government, especially not my own, to handle certificate authority selection without involving politics.
- okl 5y ago
  Hey, nothing keeps you from managing your trusted certificates on your machine, right? Maybe this initiative can even highlight some issues regarding dubious CAs and make people care about whom they trust more explicitly.
  - hsbauauvhabzb 5y ago
    Ah yes, I’ll just tell grandma she should just validate the corporate behaviours of certificate authorities herself. How did I not think of this before?
arsome 5y ago
Hoping the browser vendors will enable this only for EU users, I want nothing to do with bad CAs.
coldtea 5y ago
>but the certificates themselves will not necessarily be "less secure" - which the layman typically interprets as "cryptographically weaker". Less secure is more about trust than the crypto algorithm... The strongest algorithm with no trust in the authority issuing it, is useless.
scarface74 5y ago
I’m always amazed at HN posters undying trust of government with respect to technology which has repeatedly shown itself to be corrupt, inept and has never taken the time to think through unintended consequences.
- toyg 5y ago
  Because private companies are always competent, never abuse their privileges, and always act in the best interest of society at large. /S
  - scarface74 5y ago
    The difference is that private companies don’t have the power to force me to do anything - the government can forcible take away my property and liberty.
  - gruez 5y ago
    The difference is that governments have a monopoly on violence. Corporations don't.
  - danShumway 5y ago
    If I understand correctly, this legislation isn't about the government issuing certificates; it's about the government granting inclusion privileges to the same kinds of private companies that you're worried about. I distrust private companies too, but I trust Mozilla more than I trust companies like Camerfirma, and we have a pretty long track-record that shows us that governments are typically slow to address misconduct in private companies they're partnered with. I'm not sure I understand why this is being treated as a private company vs government debate; in my mind this is a debate over whether we should all be required by the government to trust private companies that Mozilla claims already today don't meet their security standards. It feels odd to claim that a government telling me I have to trust a private company fixes corporate incompetence or malfeasance. You don't see a potential for abuse of corporate privilege or for exploitative behavior when a private, for-profit CA can't be distrusted in browsers without them first petitioning the government?
_8j50 5y ago
What authority does the EU have to tell browsers what settings to use in their non-commercial product? The EU is always free to fork browsers or maintain a version tuned to EU standards and let users choose what they want.
michaelt 5y ago
Does the EU government, or the US government, or any other government for that matter strike you as doing a particularly good job of legislating around the internet? Personally, my impression is the legislation is at best hit-and-miss. You might get some great privacy protection. You might get mandatory encryption back doors. You might get free mobile data roaming. You might get cookie warning messages. You might get worldwide license-free spectrum, some of the most economically productive spectrum ever. You might get a patent system that lets people patent slide-to-unlock. You might get the state funding university research and giving the results away for free. You might get the DMCA giving youtube creators getting copyright strikes because someone's copyrighted silence. You might get cable rights of way and common carrier protections, which are vital to the communications industry working. You might get government ID checks for social media users. Seems to me legislation is a coin flip - sometimes great, other times completely boneheaded.
sigzero 5y ago
> In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance. I actually do not think that is what we want at all.
danShumway 5y ago
> but the certificates themselves will not necessarily be "less secure" - which the layman typically interprets as "cryptographically weaker". I think this is word-games. If all we cared about was cryptographic security we wouldn't have have certificate authorities in the first place, making certificates that are themselves secure isn't hard. The only reason we care about certificate authorities is because of the security of the surrounding process: which is exactly the stuff that Mozilla is complaining about. You're minimizing the most important part of a certificate authority. It's like going into a discussion about a potential phishing vulnerability and saying, "there's not security risk because the browser requests are still going over SSL." The point of a certificate authority isn't just to have cryptographically secure certificates, it's to have a secure issuer. So it feels really misleading to completely jump over the concerns Mozilla has laid out about weaker standards for issuer security and say that it's fine just because everything is still encrypted.
pinephoneguy 5y ago
>certificates from authorities with a slightly dubious track record CAs can sign certs for any website, that absolutely makes the web less secure.
Canada 5y ago
Governments should have absolutely zero control or influence over the trusted CA list that browsers ship.
kmeisthax 5y ago
The problem isn't merely the fact that the EU wants some control over the process, it's the fact that the EU wants to revive a bunch of dead ideas and bad CAs in the process of doing so. The article specifically cites a CA that was banned from root trust stores which the EU wants to forcibly un-ban, which is very bad. Yes - strictly speaking, those bad CAs can still issue "cryptographically secure" certs. However, the layman does not have a clue what "cryptographic security" means. They just hear "~~b̷̧͚́͝ȧ̷̠̜̦̉k̵̯̘̠͊̂e̴̞̓̃m̵̹͒̂͠o̵͎̣̎̓n̴͔̤̖̊̑o̴̙̰̼̍c̶͖̅͊h̶͔͛̇̓i̸͚̎n̶̮̬̊̒c̴̮̈̌ḣ̸̹i̵̤̊̈́n̴̹̮̾̃̈́~~ security", parse out the bits of English they do understand, and treat the rest as a linguistic intensifier, which is highly misleading. In fact, "cryptographic" in this context specifically ignores the authentication of the key. It just means that it's computationally infeasible[0] to decrypt the message if you only have the ciphertext. However, in order to get this security, you need to make sure only the intended recipient has the key. This not only means that the recipient needs to keep their key safe, but that you need to make sure that you're using the intended recipient's key. Otherwise, an attacker could just hand you their key instead of the recipients, and then decrypt your messages and do whatever they want with them. In other words, secure key authentication and exchange is a necessary precondition for cryptographic concealment. In some simple cryptosystems, we don't talk about this, mostly because we imagine the recipient and sender exchanging keys in such a way that the system doesn't need to care about it. Perhaps they exchanged paper keys in person in the middle of a potato field in Idaho. However, this is highly restrictive; imagine having to drive to every tech start-up's HQ to copy some QR codes with their public keys on it before you could visit a new website. What we would rather have is a way to take one securely-exchanged key we already have, and use it to securely exchange more keys over the Internet. That's what a CA ultimately is - an entity we already have keys for, that is capable of making sure our recipients are who they say they are. So if I go to news.ycombinator.com, the server I connect to will send me a message from that CA saying that they checked the server and validated that it's run by the person who owns news.ycombinator.com. Except now that makes the CA the weakest link in the system. A CA that is malicious can totally strip any and all of the protections that HTTPS is supposed to provide. So browser vendors are really, really picky as to what CAs they put in their trust stores. CAs that habitually make mistakes or lie out of their asses get removed because they are not trust-worthy. Any legal proposal that would make it easier or even possible for them to reverse such a decision needs to be treated like cancer. Yes, I know that browser vendors hold a lot of power in this equation - but there is little evidence that the measures they impose upon CAs are excessive or pretextual. Furthermore, the proposed replacement is making mistakes that the browser vendors aren't, so it's a strict security downgrade for no added freedom[1]. [0] trying every possible key requires more compute time than exists in the current universe [1] CAs are sideloadable on every device ever. Yes, even iOS. However, the only use for this is for... - Securing local web servers without an FQDN - Using enterprise security/spyware/filtering products that need to strip HTTPS in order to work I know of no case in which a CA has gotten into the business by telling people to install their alternative certificate. There are some edge cases in which very large CAs - specifically Let's Encrypt - have transitioned from having another root cross-sign them to becoming a root CA themselves. However, that only affected really old devices, and you could at least theoretically install the ISRG Root X1 cert on that device to work around this. https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ https://letsencrypt.org/docs/dst-root-ca-x3-expiration-septe...
logifail 5y ago
> the certificates themselves will not necessarily be "less secure" - which the layman typically interprets as "cryptographically weaker" We don't just need _cryptographic_ strength to deliver security, otherwise we'd all be using self-signed certificates...

raxxorrax 5y ago

One of the most relevant problems in Germany is that there is a caste that entirely specializes in written warnings and cease-and-desist declarations. A lot of our parliament consists of lawyers that tend to make favorable laws for their own industry. Just as background information on how Germany tends to enforce laws through private enterprise. Really good behavior from the browser vendors. Either the TLS chain is working or it is not. There is little nuance in the chain of trust. Since encryption seems to be the enemy dejure of governments, I would expect the next step would allow decryption by state executive forces if such "certificates" were established. This seems like getting a foot in the door. But I still wonder how it would enforce compliance. Certificates can be added and removed from browsers. Some use the OS certificate store and some have their own. I hope the community keeps a watchful eye. Because a mandated certificate is the opposite of secure.

octagonal 5y ago
Belgium is very similar in that regard. Our politicians are very talented in turning what should be straightforward processes into complex bureaucratic puzzles that require at the least an advanced degree in accounting to solve. So frustrating as it's holding SMEs back.
rrll22 5y ago
I hope someone from the Chrome team reads this and decides to implement a separate certificate store like Firefox has.
toyg 5y ago
Sorry for being a grammar nazi, but "enemy dejure" doesn't mean what you think it means - technically that form states that encryption is an enemy in law (de jure, in Latin - typically used in opposition to de facto, "in practice"). I expect you meant to write "du jour", French for "current, of the day (jour)". Fire your autocorrector.

Denvercoder9 5y ago

I'm curious what causes this proposal to get attention now. As far as I can find, it has been submitted by the European Commission in June of last year, but little has happened since; the European Parliament and European Council in particular don't seem to have considered it yet.

throwaway984393 5y ago

I know nobody likes this idea, but I believe the best solution is a curated list of companies, products, and their websites. You provide a browser add-on that displays the list, and let users search through it and click on the company/product they want. Here's some ways to implement this: 1. Have CAs publish a list of domains and company names. This is problematic because lots of companies have different domains and legal entities, and it's very likely an attacker could list a company that sounds like another company with a malware domain. 2. Volunteers register companies and their domains and brand logos in a Git repo and companies can request changes if need be. They'll be explicitly only trying to list domains that people have asked for and scrutinize them to prevent adding phishing sites. The latter would have some problems I'm sure, but it gets closest to what users want, which is "show me Bank websites" / "show me Bank of America's website". By having a curated list and some strict policies on managing the list, it will probably be much safer and easier than any other method that exists today to find a company website. Additional techniques could add integrity, like a reporting mechanism, and a star feature to favorite specific sites so they come up first with the number of times they've been starred.

raxxorrax 5y ago
We can create a toddler net and for some applications that would provide benefits. It could use the same infrastructure as the common net and can leave it completely unaffected. You would just need specialized web clients.
- throwaway984393 5y ago
  Why would you need specialized clients?
  - renewiltord 5y ago
    So that those who want toddlernet won’t be exposed to the rest of the Internet. Their clients will only display todsites.
    - 5y ago

tgflynn 5y ago

Aside from the details of this specific proposal it seems to me that government mandates on what end-user software can do is uncharted territory. How would this affect open source browsers ? The most widely known browsers (ie. Chrome and Firefox) aren't even traditional commercial products since they are distributed for free and derived from open source code.

Someone 5y ago
Having government mandates on what end-user software can do is not uncharted territory. Some examples: https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... https://en.wikipedia.org/wiki/GIF#Unisys_and_LZW_patent_enforcement https://en.wikipedia.org/wiki/GIF#Unisys_and_LZW_patent_enfo... https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
- tgflynn 5y ago
  Your examples don't support your argument very much. Export controls on cryptography were eliminated decades ago as it became clear that they made no sense and were counterproductive in a world where the Internet exists. Patents are a legal concept that has been in existence for centuries but enforcement is only possible through civil court proceedings between private parties. Governments are not directly involved in enforcing patents. Moreover there have been few if any successful patent lawsuits against open source software. As for the GDPR, from the wikipedia page you linked it appears to apply to enterprises that process data, not software. I don't think the GDPR attempts to restrict what data a software program can process locally on your computer. It only comes into effect if that data gets sent to some company.
  - Someone 5y ago
    > Export controls on cryptography were eliminated decades ago According to that Wikipedia page, some restrictions remain today. Even if there weren’t anymore, I wouldn’t call it a territory uncharted because we haven’t been there for a few decades. > Governments are not directly involved in enforcing patents. Not directly, no, but they decide on what’s patentable and what’s not, and on how long patents hold. For example, AFAIK the periodic Disney patent extension doesn’t come about from civil court proceedings between private parties. > I don't think the GDPR attempts to restrict what data a software program can process locally on your computer Similarly, I haven’t read the proposal, but don’t expect this regulation will forbid you to use any kind of certificate locally on your computer, or between your own computers. > It only comes into effect if that data gets sent to some company. That, IMO, is limiting “what end user software can do”.

londons_explore 5y ago

Presumably the browser vendors could require this new EU thing and a certificate from someone they trust.

rob_c 5y ago

just bureaucracy refusing to die as the tech moves on, nothing new I suppose...

jerf 5y ago

It occurs to me, I'd be interested in my browser tracking the root certificates it uses and has encountered, and present me with a report of them. I've been interested in curating my cert list personally before, but without an idea of what certs I am in practice trusting (and not just in theory), it's really difficult to know where to start. You're presented with a list of a couple hundred or so root authorities with little more than their name to go by. I could get a real jumpstart if there was 80-90% that I simply never encounter and could easily see that. One way browsers could push back at least a little on this would be to make cert auditing like this easier, and, if not already possible, potentially expose it to extensions. Preferably with a brand new "manage certificates" extension, which the browsers are welcome to and/or invited to festoon with whatever dire warnings about security they like. (It's hard, if not impossible, to create an interface to improve security like this that can't also be used to tear it down.) Giving enough visibility into the cert process that an extension could flag "hey, this is a new root cert you've never seen before" would be nice too. Obviously, my metaphorical grandmother isn't going to be interested in this, but it could at least start a more community-oriented "conversation", in the form of running code, around what cert authorities I trust, rather than the browser coders. I'm not looking to see if this already exists, because if it does I'm sure someone will know exactly where it is and what it's called and can link it to me, and everyone else reading. Please do, if it already exists.

matt123456789 5y ago

The firm Camerfirma is provided as the poster child of why the EU can’t be trusted with the QWAC issuance rights - because it (EU) has been shown evidence of malpractice on the part of Camerfirma and failed to revoke its QWAC CA status. But looking at the page linked by the article, it seems Camerfirma’s QWAC CA status has in fact been withdrawn? The article doesn’t make this distinction clear. Or do I misunderstand?

Digit-Al 5y ago

I don't really understand how the EU can enforce this. If the major browser vendors threatened to prevent their browsers from being able to be used in the Eurozone over this they would have to back down because without the big four browsers almost every single person in the EU would basically be unable to access the internet. It would cause chaos. All four companies are based in the US as far as I am aware so it's not like the EU could do much about it. As an English citizen I sure as hell wouldn't want this to happen though.

krageon 5y ago
> If the major browser vendors threatened to This won't happen, so none of what comes after matters. > As an English citizen England is not part of the EU.
- josephcsible 5y ago
  > England is not part of the EU. So? Stuff like cookie consent banners are the EU's doing, and they happen worldwide now.
  - krageon 5y ago
    No, they're not. No need to ask consent if you don't use them (or use only ones you need). The fact that you see them everywhere is a purposeful piece of malice by each and every website you visit.
hef19898 5y ago
Nothing like this would happen, the market is to big. And money is all the big vendors care about.

jeroenhd 5y ago

What's the problem they're trying to solve here? Is it just lobbying fortthe return of special EV certificates or is there actually some kind of government issue that these people are trying to solve?

chopin 5y ago
Enabling man-in-the-middle attacks for exfiltration.
- rini17 5y ago
  You mean something like cloudflare? I find mitm fears related to CAs rather funny when everybody uses cloudflare anyway.
  - gruez 5y ago
    cloudflare is an entity that you can choose to trust with your data. It's not any different than how your hosting provider/cdn can "MITM" you as well. The issue people are having with this regulation is that the government is forcing you to trust some unrelated party.
    - rini17 5y ago
      You are forced to trust cloudflare too as you can't do business without DDoS protection anymore. I'd prefer such trust to be rooted in my (EU) jurisdiction.
      - chopin 5y ago
        Now I have to trust the EU and Cloudflare. As much as I despise Cloudflare, at least in Germany the pandemic has shown that authorities can't be trusted with data even if taken with the best of intentions.
        rini17 5y ago

Shadonototra 5y ago

I don't want foreign companies to tell me what to trust, i believe in the government I elect, and their representatives in the EU Yes mozilla, I don't trust you And btw what you do is called political interference, you should be ashamed mozilla > is causing concerns hahaha, what's the goal here? spreading fear and misleading people into thinking that's how they should feel? typical from mozilla, trying to save their sinking chip

dusted 5y ago

I wonder what that means for the most important websites on the Internet (those of private individuals hosting their own websites on their own computers on their own Internet connections from their own homes).

unfocussed_mike 5y ago

"That was Feisty Duck, reporting on some misguided QWACs that are ruffling feathers, outside the EU headquarters in Brussels. And now, over to you for tomorrow's weather, Dewey -- will it be nice weather for ducks?" (Burning karma for duck news jokes)

tekacs 5y ago

In an era where they weren’t able to defeat ‘ubiquitous encryption’ (everything moving to HTTPS) or end-to-end encryption… … this seems like a convenient way to allow the EU to provide their own CAs who will be willing to cooperate in issuing MitM certs, achieving the goal irrespective. Certificate Transparency will surely help with this, assuming that they don’t try to override that too, but I’m curious to research now and see if the EFF is taking note of this.

parasense 5y ago

> Thus, if implemented, these plans could mean that browsers would be forced to give special treatment to TLS certificates that have been issued by entities held to a lower standard than the other certificate authorities. I'm not clear on the "forced" aspect of all this EU regulation. How does the EU force Firefox/Mozilla, Google Chrome, or any software in existence to recognize the EU's list of certificate authorities? Sounds like compelled speech. How the EU plans to force somebody to write source code to open source projects is an amusing idea... Would I break the law if I forked Firefox, and chose not to include the EU's certificate authority? IF yes, how are they going to compel my speech outside the EU? Sound like the EU will have to create their own web browser.

car_analogy 5y ago

> the certificate authorities that would issue these certificates would be decided by the EU member states, and browsers would be forced to accept those It's not a question of trusting the EU, but of user autonomy. Even if the EU were 100% trustworthy, that shouldn't let it force users which certificates they trust. If I phone a friend, but his voice sounds off, and his manner of speech unusual, so that I suspect he's being impersonated - what business does any government have telling me that I must trust it is indeed my friend on the line?