5 ms·

Enabling man-in-the-middle attacks for exfiltration.

by chopin 5y ago

rini17 5y ago
You mean something like cloudflare? I find mitm fears related to CAs rather funny when everybody uses cloudflare anyway.
- gruez 5y ago
  cloudflare is an entity that you can choose to trust with your data. It's not any different than how your hosting provider/cdn can "MITM" you as well. The issue people are having with this regulation is that the government is forcing you to trust some unrelated party.
  - rini17 5y ago
    You are forced to trust cloudflare too as you can't do business without DDoS protection anymore. I'd prefer such trust to be rooted in my (EU) jurisdiction.
    - chopin 5y ago
      Now I have to trust the EU and Cloudflare. As much as I despise Cloudflare, at least in Germany the pandemic has shown that authorities can't be trusted with data even if taken with the best of intentions.
      - rini17 5y ago
        Nobody can be trusted with data.
    - gruez 5y ago
      >You are forced to trust cloudflare too as you can't do business without DDoS protection anymore At best, you're "forced to trust" a DDoS protection vendor, not cloudflare specifically. I'm sure there are DDoS protection vendors that are "rooted in [...] (EU) jurisdiction". Also, switching between such vendors is pretty trivial, much easier than trying to trying to lobby the government into stopping surveillance.
      - rini17 5y ago
        If you can't even name one example without extensive research then it's likely not so trivial. And where you get the firm conviction that both cloudflare and existing CA's aren't tapped already?
        gruez 5y ago
        >If you can't even name one example without extensive research then it's likely not so trivial. If I had to name one off the top of my head it would be ovh. >And where you get the firm conviction that both cloudflare and existing CA's aren't tapped already? "why don't you let the government mandate encryption backdoors? Your messaging app is probably already backdoored already"
        rini17 5y ago
        "let's avoid having any laws governing the internet, because all governments are evil, corporations are good and ignorance is freedom!" /s
        gruez 5y ago
        But my argument against this regulation isn't that "all governments are evil, corporations are good", it's that with respect to certificate authorities, corporations are largely doing a pretty good job, in contrast to governments who are pushing encryption backdoors. If google/mozilla/apple are abusing their position and harming users through their CA programs, then I might consider regulation. But for now it looks like a power grab.
        rini17 5y ago
        Again, how can you so sure google/mozilla/apple are doing a good job when they are not transparent or accountable to public? We have no idea so we happily live in illusion that they aren't pushing anything nefarious. Whereas the public lawmaking in democracies is messy, fueled by outrage and visible special interests.

Enabling man-in-the-middle attacks for exfiltration.

by chopin 5y ago

Enabling man-in-the-middle attacks for exfiltration.

You mean something like cloudflare? I find mitm fears related to CAs rather funny when everybody uses cloudflare anyway.

gruez 5y ago
cloudflare is an entity that you can choose to trust with your data. It's not any different than how your hosting provider/cdn can "MITM" you as well. The issue people are having with this regulation is that the government is forcing you to trust some unrelated party.
- rini17 5y ago
  You are forced to trust cloudflare too as you can't do business without DDoS protection anymore. I'd prefer such trust to be rooted in my (EU) jurisdiction.
  - chopin 5y ago
    Now I have to trust the EU and Cloudflare. As much as I despise Cloudflare, at least in Germany the pandemic has shown that authorities can't be trusted with data even if taken with the best of intentions.
    - rini17 5y ago
      Nobody can be trusted with data.
  - gruez 5y ago
    >You are forced to trust cloudflare too as you can't do business without DDoS protection anymore At best, you're "forced to trust" a DDoS protection vendor, not cloudflare specifically. I'm sure there are DDoS protection vendors that are "rooted in [...] (EU) jurisdiction". Also, switching between such vendors is pretty trivial, much easier than trying to trying to lobby the government into stopping surveillance.
    - rini17 5y ago
      If you can't even name one example without extensive research then it's likely not so trivial. And where you get the firm conviction that both cloudflare and existing CA's aren't tapped already?
      - gruez 5y ago
        >If you can't even name one example without extensive research then it's likely not so trivial. If I had to name one off the top of my head it would be ovh. >And where you get the firm conviction that both cloudflare and existing CA's aren't tapped already? "why don't you let the government mandate encryption backdoors? Your messaging app is probably already backdoored already"
        rini17 5y ago
        "let's avoid having any laws governing the internet, because all governments are evil, corporations are good and ignorance is freedom!" /s
        gruez 5y ago
        But my argument against this regulation isn't that "all governments are evil, corporations are good", it's that with respect to certificate authorities, corporations are largely doing a pretty good job, in contrast to governments who are pushing encryption backdoors. If google/mozilla/apple are abusing their position and harming users through their CA programs, then I might consider regulation. But for now it looks like a power grab.
        rini17 5y ago
        Again, how can you so sure google/mozilla/apple are doing a good job when they are not transparent or accountable to public? We have no idea so we happily live in illusion that they aren't pushing anything nefarious. Whereas the public lawmaking in democracies is messy, fueled by outrage and visible special interests.