5 ms·

> but the certificates themselves will not necessarily be "less secure" I don't trust the EU to handle encryption. I don't think that is unreasonable especiall

> but the certificates themselves will not necessarily be "less secure" I don't trust the EU to handle encryption. I don't think that is unreasonable especially with the attempts against it cloaked as "reasonable access". The chain of trust has weaknesses and any government institution can only fully undermine that trust. It would not last a week without abuse, the same happened with Covid tracking apps and location information. > there is a question of legitimacy. For the EU there is actually quite a lot of that. It is true that at some point we have to trust someone, but which problem do you want to see solved here?

seszett 5y ago
I actually have move trust into the EU institutions than into the three main browser vendors. The EU is certainly more legitimate in most respects than various US private organisations.
raverbashing 5y ago
> I don't trust the EU to handle encryption. Literally nowhere in the article it says that. The TL;DR is: "QWAC certificates will have to show the green banner" and maybe non-QWAC will have some kind of warning. The link on TFA is informative https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck-qwacs-like-a-duck-probably-an-ev-certifiacate/ https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck... (sounds like a CA lobbying for this crap) In the end I suspect browsers might revoke some QWAC certs if they feel they are invalid
- raxxorrax 5y ago
  The whole article is about mandatory certificates, of course that is basically taking control of the most widespread encryption in use today. Encryption that has its weakness in the chain of trust, which the EU wants to have an influence on. So yes, this is essentially handling encryption if the EU indeed wants to enforce mandated certificates. If you want to discuss technicalities and the problem of key exchange we can do that too.
Denvercoder9 5y ago
> the same happened with Covid tracking apps and location information. Do you have (a link to) more information on that? As far as I have seen (in NL) the Covid tracking app was designed and implemented fairly well and abuse has been very limited to non-existant.
- raxxorrax 5y ago
  Here is an English source I could find: https://digit.site36.net/2022/01/22/tracking-corona-infections-german-luca-app-in-a-downfall/ https://digit.site36.net/2022/01/22/tracking-corona-infectio... There are two prominent apps in Germany. The other one is indeed secure against such attempts because it is technically not possible to get the information. I wouldn't even accuse the investigators here, it just shows that if there is a possibility for tracking, that it will be used. For better or worse reasons.
  - chopin 5y ago
    >I wouldn't even accuse the investigators here There is a legal mandate which forbids use other than for Covid-Tracking. There is no excuse for anyone involved in this.
- chopin 5y ago
  The Luca-App in Germany has been misused DESPITE legislation that reserves use exclusively for Covid-Tracking. Health authorities have been complicit in this. Afaik there where no repercussions for the offenders.
  - zaarn 5y ago
    The Luca App is a privately developed app that a few german states paid for. The Corona-Warn-App has had no issues with privacy as it was designed privacy first and there is no possibility of data abuse to my knowledge.
  - rpadovani 5y ago
    The Luca-App drives me crazy. A private app pushed by some local governments, while an official, public one was available. Just why?
snovv_crash 5y ago
What do you expect the E.U. to do that Google or Microsoft isn't doing already?
- raxxorrax 5y ago
  I don't generally use browsers of these companies, but if they break the chain of trust they would damage themselves as much as any user. I believe in the self interest of these companies and the understanding how the effectiveness of TLS is reliant on trust. I would trust Google more than Microsoft that likes compliance a little bit too much, but since both want their browsers established, any compromise to security would disqualify them immediately. The EU has ambitions for surveillance as far as I know.
  - tptacek 5y ago
    They're already breaking the chain of trust. One of the EU's TSPs was dis-trusted by Mozilla after a long history of misissuance and BR violations. This isn't hypothetical; the EU is mandating the inclusion of insecure CAs.
- SpicyLemonZest 5y ago
  I expect them to enforce slow, ponderous change processes which make it impractical to remove any but the most egregious violators from the trusted CA list.

seszett 5y ago

I actually have move trust into the EU institutions than into the three main browser vendors. The EU is certainly more legitimate in most respects than various US private organisations.

raverbashing 5y ago

> I don't trust the EU to handle encryption. Literally nowhere in the article it says that. The TL;DR is: "QWAC certificates will have to show the green banner" and maybe non-QWAC will have some kind of warning. The link on TFA is informative https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck-qwacs-like-a-duck-probably-an-ev-certifiacate/ https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck... (sounds like a CA lobbying for this crap) In the end I suspect browsers might revoke some QWAC certs if they feel they are invalid

raxxorrax 5y ago
The whole article is about mandatory certificates, of course that is basically taking control of the most widespread encryption in use today. Encryption that has its weakness in the chain of trust, which the EU wants to have an influence on. So yes, this is essentially handling encryption if the EU indeed wants to enforce mandated certificates. If you want to discuss technicalities and the problem of key exchange we can do that too.

Denvercoder9 5y ago

> the same happened with Covid tracking apps and location information. Do you have (a link to) more information on that? As far as I have seen (in NL) the Covid tracking app was designed and implemented fairly well and abuse has been very limited to non-existant.

raxxorrax 5y ago
Here is an English source I could find: https://digit.site36.net/2022/01/22/tracking-corona-infections-german-luca-app-in-a-downfall/ https://digit.site36.net/2022/01/22/tracking-corona-infectio... There are two prominent apps in Germany. The other one is indeed secure against such attempts because it is technically not possible to get the information. I wouldn't even accuse the investigators here, it just shows that if there is a possibility for tracking, that it will be used. For better or worse reasons.
- chopin 5y ago
  >I wouldn't even accuse the investigators here There is a legal mandate which forbids use other than for Covid-Tracking. There is no excuse for anyone involved in this.
chopin 5y ago
The Luca-App in Germany has been misused DESPITE legislation that reserves use exclusively for Covid-Tracking. Health authorities have been complicit in this. Afaik there where no repercussions for the offenders.
- zaarn 5y ago
  The Luca App is a privately developed app that a few german states paid for. The Corona-Warn-App has had no issues with privacy as it was designed privacy first and there is no possibility of data abuse to my knowledge.
- rpadovani 5y ago
  The Luca-App drives me crazy. A private app pushed by some local governments, while an official, public one was available. Just why?

snovv_crash 5y ago

What do you expect the E.U. to do that Google or Microsoft isn't doing already?

raxxorrax 5y ago
I don't generally use browsers of these companies, but if they break the chain of trust they would damage themselves as much as any user. I believe in the self interest of these companies and the understanding how the effectiveness of TLS is reliant on trust. I would trust Google more than Microsoft that likes compliance a little bit too much, but since both want their browsers established, any compromise to security would disqualify them immediately. The EU has ambitions for surveillance as far as I know.
- tptacek 5y ago
  They're already breaking the chain of trust. One of the EU's TSPs was dis-trusted by Mozilla after a long history of misissuance and BR violations. This isn't hypothetical; the EU is mandating the inclusion of insecure CAs.
SpicyLemonZest 5y ago
I expect them to enforce slow, ponderous change processes which make it impractical to remove any but the most egregious violators from the trusted CA list.