6 ms·

Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. As it is, browser companies[0] are the sole authority on what

Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. As it is, browser companies[0] are the sole authority on what is and isn't a valid CA. At least the EU leadership is elected. [0] and let's be realistic here, this means Google.

SahAssar 5y ago
Historically google and apple has followed mozillas decisions on CAs most of the time (google didn't even have their own program for a long time). I think it is still somewhat accepted that if you get approved by mozilla you will probably get approval from apple and google pretty soon. MS can be a bit weird though IIRC.
tialaramex 5y ago
In practice there is every reason to believe it means m.d.s.policy, and thus anybody who cares. In principle Apple, Google, and Microsoft can do whatever they want, but well, go back and see the history of such interventions for yourself and draw your own conclusions about where the crucial decision was made.
rocqua 5y ago
When it comes to which CAs are trusted, Mozzila is generally in the lead. Not an elected group, true. But a foundation with a public charitable goal, and an entity with much less interest in being able to intercept communications than states. I think it's better of in the hands of an un-elected foundation than in the hands of an elected, but politicized entity with interests in intercepting communication.
- toyg 5y ago
  > When it comes to which CAs are trusted, Mozzila is generally in the lead. Mozilla might well not be around forever, considering the state of their market share. And let's be honest, as long as their main source of funds comes from Google, politically speaking they end up as a fig's leaf around Google's interests. As far as we know, they might take certain decisions about the life or death of any given CA after someone at Alphabet picks up the phone. Maybe they don't do that, but there is no guarantee nor formal process to address this - particularly not in Europe, since all these are US entities.
  - deleted 5y ago
    [deleted]
  - JoshTriplett 5y ago
    I've watched how Mozilla's CA process operates in past incidents, as well as in the review of new CAs, and the criteria they use and the evaluation they do seems quite transparent.
blibble 5y ago
> At least the EU leadership is elected. it isn't (directly anyway) for the last set of elections: they even held televised political debates with candidates then selected someone that hadn't even been mentioned (Von der Leyen)
- Xylakant 5y ago
  By that argument, the German government isn’t elected either. The Bundestag is elected and elects a Chancellor who then picks a government.
  - SiempreViernes 5y ago
    But that very same argument, the use of an electoral collage of course also means the US president is not elected, since people's vote only choose electors.
    - blibble 5y ago
      how do you think the American people would feel if the college elected someone that: - hadn't won any primaries - hadn't attended any debates - said zero words about their plans for office - and hadn't even run for president because that's exactly what happened with Von der Leyen's appointment
      - orwin 5y ago
        If Von der Leyen had even a third of the power Macron or Sholtz have, that could be an issue. I'd the French/German finance minister have more power than Von der Leyen. And once upon a time, the French Finance minister was an unelected banker, who never won a single election and did not work in the political field.
        blibble 5y ago
        the existence of other people in other countries doesn't mean the EU is fit to be called "democratic"
feanaro 5y ago
> Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. So how about we stop this proposal in its track right now instead?
- AnIdiotOnTheNet 5y ago
  Why? If given the choice between allowing corporate control of something and allowing an elected government control of something, it is not immediately obvious to me that leaving everything in corporate hands is a good idea.
  - danShumway 5y ago
    You're right, it's not immediately obvious across the board. But in this very specific case, Mozilla is making an argument that the government standards are meaningfully less secure than their own. Involving a government doesn't magically make things better 100% of the time, the actual tangible proposal still has to be better than what is happening in the market. Is that the case here? We don't need to have an abstract argument about whether governments or private corporations are always better; look at the specifics of this proposal and see if they're good for browser security. We have a lot of data that suggests that EV certificates do not provide meaningful security because the "green lock" doesn't actually guarantee what consumers think it does. Independent of what you think about governments overall, is it good to have a new standard that ignores that research in favor of having yet another kind of special certificate that is displayed to users as more trustworthy? In this specific case, Camerfirma is still considered by the EU government to be a trustworthy certificate provider even though all major browsers have blocked the company for repeated mistakes/policy violations. Independent of whether or not you trust the government overall, is a standard that would require browsers to trust Camerfirma a good idea? I don't think we should immediately assume any government involvement in the market is a bad idea, but there's also real danger in saying, "well, in theory it might be preferable for this to be more democratic", and then never asking the followup question, "but in practice, is this specific proposal good?" Yes, you're 100% correct, it's not immediately obviously bad across the board for the government to control something. But when I go beyond what is immediately obvious to me, then I start seeing arguments from Mozilla and other security researchers that (in my mind) make a lot of sense.
dane-pgp 5y ago
> Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. A more direct and confrontational approach would be for browser companies to do what website owners have effectively done, which is to agree in advance to implement some sort of annoying pop-up (shown every time the browser updates) saying "Do you want the EU to weaken your security and enable spying? [Yes] [No]", like those annoying cookie pop-ups. The difference being, of course, that the cookie pop-ups are designed to dark-pattern users into giving away their rights, and to blame the EU unfairly, whereas these browser pop-ups would be to help protect users' rights and to correctly blame the EU (assuming the regulation passes).
jcranmer 5y ago
> and let's be realistic here, this means Google. Actually, it doesn't. There are four main browser CA root stores: Apple, Microsoft, Mozilla, and Google, and these are also the root stores of their respective operating systems (if you're on Linux, you're using Mozilla's root store, because distros do not want to run anything themselves). Furthermore, the Microsoft, Google, and Mozilla root stores all also require inclusion in the common CA database, which is run by Mozilla. Also, Mozilla (and maybe Google) require CAs to participate in Mozilla's public lists, especially when it comes to notifying people of big CA security oopsies--all of the big CA issues have come to light on that list, and the coordination of the responses by browsers has been done by Mozilla. So the biggest authority on who a valid CA is? Mozilla.
- SiempreViernes 5y ago
  So, what you're saying is that Mozilla could sanction Russian CAs such that nobody would trust them?
  - Thiez 5y ago
    They theoretically could, but why?
  - aaomidi 5y ago
    No because that trust in Mozilla is only placed there because they only care about CAs operating properly. Nothing else.
  - tialaramex 5y ago
    First there would have to be Russian CAs. There aren't any. Most likely because Russians wouldn't trust a Russian CA, so what's the point setting one up? If against the odds somebody had built a trustworthy Russian CA and it was currently in the root trust store for Firefox (and so likely everything else) then we might have this question to ponder, although the answer is likely "No" since this hypothetical CA isn't doing anything wrong, but that's a hypothetical very different from reality.
  - jcranmer 5y ago
gruez 5y ago
> Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. That doesn't sound like a sad state of affairs to you? It's like responding to the PATRIOT act by saying "Probably tech companies will refuse to comply and deal with the federal government in court if they make a stink about it."
- AnIdiotOnTheNet 5y ago
  I mean, what's the alternative? We see people here complain every single day about unilateral action taken by Google and the like. Which is better, to have to deal with the rule of laws written by an elected body in a court, or to shout into the wind at a corporation?
  - gruez 5y ago
    >We see people here complain every single day about unilateral action taken by Google and the like. While that's true to some extent, I don't find that to be the case in this specific area (ie. trust store and/or encryption). Are the browser vendors unfairly applying rules (ie. favoring incumbents)? Are their requirements too arduous? Are they not revoking bad CAs? It's not clear what this regulation is supposed to solve.
  - JoshTriplett 5y ago
    Third option: work with a transparent Open Source organization that processes CAs on the basis of keeping the Internet secure, where nation-state-level interception is considered part of the threat model.
- JoshTriplett 5y ago
  That sounds like a great state of affairs, if people actually raise challenges to such laws, and win. I would love to see such overreaching attempts tied up endlessly in litigation, ideally with associated PR to make sure that the visible actions are all portrayed as a mess associated with the officials supporting such overreach in the first place. I'd rather see overreach stopped before it starts, but in the absence of that, I'd like to see it stopped by any means we have, including civil disobedience and litigation. In this context: remove CAs that issue MITM certificates, and loudly and repeatedly say "So you're prosecuting us and demanding that we include a known-insecure CA that's used to make the Internet less secure? Is that what you'd like to say to these cameras, the entire Internet, and people who will see this played repeatedly while they decide whether to vote for you in the next election? Or would you like to drop this?"

SahAssar 5y ago

Historically google and apple has followed mozillas decisions on CAs most of the time (google didn't even have their own program for a long time). I think it is still somewhat accepted that if you get approved by mozilla you will probably get approval from apple and google pretty soon. MS can be a bit weird though IIRC.

tialaramex 5y ago

In practice there is every reason to believe it means m.d.s.policy, and thus anybody who cares. In principle Apple, Google, and Microsoft can do whatever they want, but well, go back and see the history of such interventions for yourself and draw your own conclusions about where the crucial decision was made.

rocqua 5y ago

When it comes to which CAs are trusted, Mozzila is generally in the lead. Not an elected group, true. But a foundation with a public charitable goal, and an entity with much less interest in being able to intercept communications than states. I think it's better of in the hands of an un-elected foundation than in the hands of an elected, but politicized entity with interests in intercepting communication.

toyg 5y ago
> When it comes to which CAs are trusted, Mozzila is generally in the lead. Mozilla might well not be around forever, considering the state of their market share. And let's be honest, as long as their main source of funds comes from Google, politically speaking they end up as a fig's leaf around Google's interests. As far as we know, they might take certain decisions about the life or death of any given CA after someone at Alphabet picks up the phone. Maybe they don't do that, but there is no guarantee nor formal process to address this - particularly not in Europe, since all these are US entities.
- deleted 5y ago
  [deleted]
- JoshTriplett 5y ago
  I've watched how Mozilla's CA process operates in past incidents, as well as in the review of new CAs, and the criteria they use and the evaluation they do seems quite transparent.

blibble 5y ago

> At least the EU leadership is elected. it isn't (directly anyway) for the last set of elections: they even held televised political debates with candidates then selected someone that hadn't even been mentioned (Von der Leyen)

Xylakant 5y ago
By that argument, the German government isn’t elected either. The Bundestag is elected and elects a Chancellor who then picks a government.
- SiempreViernes 5y ago
  But that very same argument, the use of an electoral collage of course also means the US president is not elected, since people's vote only choose electors.
  - blibble 5y ago
    how do you think the American people would feel if the college elected someone that: - hadn't won any primaries - hadn't attended any debates - said zero words about their plans for office - and hadn't even run for president because that's exactly what happened with Von der Leyen's appointment
    - orwin 5y ago
      If Von der Leyen had even a third of the power Macron or Sholtz have, that could be an issue. I'd the French/German finance minister have more power than Von der Leyen. And once upon a time, the French Finance minister was an unelected banker, who never won a single election and did not work in the political field.
      - blibble 5y ago
        the existence of other people in other countries doesn't mean the EU is fit to be called "democratic"

feanaro 5y ago

> Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. So how about we stop this proposal in its track right now instead?

AnIdiotOnTheNet 5y ago
Why? If given the choice between allowing corporate control of something and allowing an elected government control of something, it is not immediately obvious to me that leaving everything in corporate hands is a good idea.
- danShumway 5y ago
  You're right, it's not immediately obvious across the board. But in this very specific case, Mozilla is making an argument that the government standards are meaningfully less secure than their own. Involving a government doesn't magically make things better 100% of the time, the actual tangible proposal still has to be better than what is happening in the market. Is that the case here? We don't need to have an abstract argument about whether governments or private corporations are always better; look at the specifics of this proposal and see if they're good for browser security. We have a lot of data that suggests that EV certificates do not provide meaningful security because the "green lock" doesn't actually guarantee what consumers think it does. Independent of what you think about governments overall, is it good to have a new standard that ignores that research in favor of having yet another kind of special certificate that is displayed to users as more trustworthy? In this specific case, Camerfirma is still considered by the EU government to be a trustworthy certificate provider even though all major browsers have blocked the company for repeated mistakes/policy violations. Independent of whether or not you trust the government overall, is a standard that would require browsers to trust Camerfirma a good idea? I don't think we should immediately assume any government involvement in the market is a bad idea, but there's also real danger in saying, "well, in theory it might be preferable for this to be more democratic", and then never asking the followup question, "but in practice, is this specific proposal good?" Yes, you're 100% correct, it's not immediately obviously bad across the board for the government to control something. But when I go beyond what is immediately obvious to me, then I start seeing arguments from Mozilla and other security researchers that (in my mind) make a lot of sense.

dane-pgp 5y ago

> Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. A more direct and confrontational approach would be for browser companies to do what website owners have effectively done, which is to agree in advance to implement some sort of annoying pop-up (shown every time the browser updates) saying "Do you want the EU to weaken your security and enable spying? [Yes] [No]", like those annoying cookie pop-ups. The difference being, of course, that the cookie pop-ups are designed to dark-pattern users into giving away their rights, and to blame the EU unfairly, whereas these browser pop-ups would be to help protect users' rights and to correctly blame the EU (assuming the regulation passes).

jcranmer 5y ago

> and let's be realistic here, this means Google. Actually, it doesn't. There are four main browser CA root stores: Apple, Microsoft, Mozilla, and Google, and these are also the root stores of their respective operating systems (if you're on Linux, you're using Mozilla's root store, because distros do not want to run anything themselves). Furthermore, the Microsoft, Google, and Mozilla root stores all also require inclusion in the common CA database, which is run by Mozilla. Also, Mozilla (and maybe Google) require CAs to participate in Mozilla's public lists, especially when it comes to notifying people of big CA security oopsies--all of the big CA issues have come to light on that list, and the coordination of the responses by browsers has been done by Mozilla. So the biggest authority on who a valid CA is? Mozilla.

SiempreViernes 5y ago
So, what you're saying is that Mozilla could sanction Russian CAs such that nobody would trust them?
- Thiez 5y ago
  They theoretically could, but why?
- aaomidi 5y ago
  No because that trust in Mozilla is only placed there because they only care about CAs operating properly. Nothing else.
- tialaramex 5y ago
  First there would have to be Russian CAs. There aren't any. Most likely because Russians wouldn't trust a Russian CA, so what's the point setting one up? If against the odds somebody had built a trustworthy Russian CA and it was currently in the root trust store for Firefox (and so likely everything else) then we might have this question to ponder, although the answer is likely "No" since this hypothetical CA isn't doing anything wrong, but that's a hypothetical very different from reality.
- jcranmer 5y ago

gruez 5y ago

> Probably browsers will remove it anyway and deal with EU in court if they make a stink about it. That doesn't sound like a sad state of affairs to you? It's like responding to the PATRIOT act by saying "Probably tech companies will refuse to comply and deal with the federal government in court if they make a stink about it."

AnIdiotOnTheNet 5y ago
I mean, what's the alternative? We see people here complain every single day about unilateral action taken by Google and the like. Which is better, to have to deal with the rule of laws written by an elected body in a court, or to shout into the wind at a corporation?
- gruez 5y ago
  >We see people here complain every single day about unilateral action taken by Google and the like. While that's true to some extent, I don't find that to be the case in this specific area (ie. trust store and/or encryption). Are the browser vendors unfairly applying rules (ie. favoring incumbents)? Are their requirements too arduous? Are they not revoking bad CAs? It's not clear what this regulation is supposed to solve.
- JoshTriplett 5y ago
  Third option: work with a transparent Open Source organization that processes CAs on the basis of keeping the Internet secure, where nation-state-level interception is considered part of the threat model.
JoshTriplett 5y ago
That sounds like a great state of affairs, if people actually raise challenges to such laws, and win. I would love to see such overreaching attempts tied up endlessly in litigation, ideally with associated PR to make sure that the visible actions are all portrayed as a mess associated with the officials supporting such overreach in the first place. I'd rather see overreach stopped before it starts, but in the absence of that, I'd like to see it stopped by any means we have, including civil disobedience and litigation. In this context: remove CAs that issue MITM certificates, and loudly and repeatedly say "So you're prosecuting us and demanding that we include a known-insecure CA that's used to make the Internet less secure? Is that what you'd like to say to these cameras, the entire Internet, and people who will see this played repeatedly while they decide whether to vote for you in the next election? Or would you like to drop this?"