4 ms·

Meanwhile the EU is considering legislation that would require all browsers to recognize and accept any company that pays a fee, irrespective of how clearly unt

by olliej 4y ago

Meanwhile the EU is considering legislation that would require all browsers to recognize and accept any company that pays a fee, irrespective of how clearly untrustworthy that company is. So in the future it could be illegal in the EU for a browser to drop a CA, even when they’re caught doing objectively fraudulent acts. All because a bunch of MEPs are presumably being paid off by CAs who want to get legislatively mandated rent payments

dane-pgp 4y ago
> irrespective of how clearly untrustworthy that company is. Isn't that a bit of an exaggeration? Surely what the EU is proposing is that browsers have to accept just those companies which pay the necessary fee and which some EU body declares to be trustworthy. You're right, though, that this still adds to the attack surface, because now you have to trust not just your browser vendor, and all the CAs that they trust, but also this EU body and all the CAs that they trust. (For those who haven't been following, here's what the EFF has to say about it: https://www.eff.org/fa/deeplinks/2021/12/eus-digital-identity-framework-endangers-browser-security https://www.eff.org/fa/deeplinks/2021/12/eus-digital-identit... )
- tinus_hn 4y ago
  What’s to prevent the EU from declaring itself trustworthy?
  - josefx 4y ago
    Its courts? At least that is the only thing that keeps the EU Commission from going full police state.
    - tgv 4y ago
      The EU Commission? You mean, the one without an actual police force or army, or any say over the member states' criminal legislation? That Commission?
      - anticensor 4y ago
        PESCO and Europol exist. Not a body of the EU commission, but still.
      - josefx 4y ago
        > or any say over the member states' criminal legislation? That Commission? One of the jobs of the commission is deciding whether member states are in line with their treaty obligations, that includes any laws passed by said member states.
    - simplotek 4y ago
      > At least that is the only thing that keeps the EU Commission from going full police state. Such an extraordinary claim. Are you able to provide any evidence that supports your claim that at any time the EU Commission tried to go "full police state", and that courts kept that from happening?
    - pmontra 4y ago
      The Commission and the Parliament can do whatever they want but it's the Council that de facto has the final word on everything that matters.
    - tinus_hn 4y ago
      The EU court can only rule using laws written by the EU
- iso1631 4y ago
  That EFF page is really weird - English text, but right-aligned, with question marks to the left of the text, as if the text had been translated from a RTL language (Farsi perhaps given the /fa/ in the link?) From the looks of it the EU wants to push out a wide spread identity management system, which is fine. It's unclear to me after a brief perusal why they can't use a normal root certificate, or create their own along a letsencrypt line (indeed that would be a great benefit having another widespread free ACME powered certificate authority, one funded by the taxpayer), with the same protections and transparency as LE.
  - DismantleMars 4y ago
    >That EFF page is really weird - English text, but right-aligned, with question marks to the left of the text, as if the text had been translated from a RTL language (Farsi perhaps given the /fa/ in the link?) It's just a Farsi link to an English article that's automatically applying RTL styling, the original version of the page in English looks fine. https://www.eff.org/deeplinks/2021/12/eus-digital-identity-framework-endangers-browser-security https://www.eff.org/deeplinks/2021/12/eus-digital-identity-f...
ReptileMan 4y ago
Let me guess - this landing page gives green, certified by TotallyNotNSONoWaySir Ltd
bombolo 4y ago
So paying to a browser is good buy paying to a government is bad?
- netheril96 4y ago
  The browser vendors know what they are doing. The government has no idea.
  - bombolo 4y ago
    As if browser vendors never included any shady or incompetent root CA? For example: https://www.techtarget.com/searchsecurity/news/252436120/23000-Symantec-certificates-revoked-following-leak-of-private-keys https://www.techtarget.com/searchsecurity/news/252436120/230... Firefox seems to include root CA from the governments of: Hong Kong (so China?), Spain, Turkey, Tunisia, Netherlands.
    - olliej 4y ago
      And when they find evidence of a CA misbehaving they revoke them, as here, they don’t go to the EU and say “hey we think you need to re audit this company” and then wait a few months/years while the business continues to pay the EU to remain in the root stores.
- olliej 4y ago
  Wtf are you talking about? You don’t pay a browser to get your roots included. You file a bug report, and provide the supporting documentation and audits. If the relevant root program considers your supporting documentation sufficient, they include you. You cannot pay a root program to include your root certa, and any CA that was found to have done so would likely find other programs considering that to be a red flag.
  - tialaramex 4y ago
    It's actually interesting. Three of the major trust stores are also OS vendors. Microsoft, Apple and Google. Each of those three actually just has a rather opaque "send us an email and we'll talk about it" type process. I don't think there's any implication that you can or should pay them money (indeed Microsoft is clear that there is "No Fee" for this), clearly none of these organisations is desperate for cash. But it's actually unclear what you can do besides maybe send email and hope. Mozilla's process is as you state to file a Bugzilla bug. You go in a big queue and there's eventually a public discussion on m.d.s.policy once you get to the front of the queue. Now, in theory there is no relationship between Mozilla's transparent process and say, Apple or Microsoft. Indeed even for Google there's only a rather thin relationship, the final decision is theirs but they do say you need to talk to Mozilla. But in practice the Mozilla process matters most.
moring 4y ago
Do you know details on how they are planning to enforce this in open-source browsers?
ranguna 4y ago
> illegal in the EU for a browser to drop a CA, even when they’re caught doing objectively fraudulent acts. Right now Mozilla, Microsoft and many other privately owned root certificate mainterns control whether or not CA are trust worthy. I actually see your statement the other way around, it would be illegal for browser to support a CA when the EU deems it as untrustworthy.
- olliej 4y ago
  Do you really think that a CA shady enough for the EU to reject would not have already been rejected by the various root programs?
  - ranguna 4y ago
    I do not, hence this seems to be a non issue.
- anticensor 4y ago
  Browser vendors could solve the issue by distributing two editions of their browsers, one only trusting certificates accepted by the EU and one rejecting all the certificates in the list by the EU.

by olliej 4y ago

dane-pgp 4y ago

> irrespective of how clearly untrustworthy that company is. Isn't that a bit of an exaggeration? Surely what the EU is proposing is that browsers have to accept just those companies which pay the necessary fee and which some EU body declares to be trustworthy. You're right, though, that this still adds to the attack surface, because now you have to trust not just your browser vendor, and all the CAs that they trust, but also this EU body and all the CAs that they trust. (For those who haven't been following, here's what the EFF has to say about it: https://www.eff.org/fa/deeplinks/2021/12/eus-digital-identity-framework-endangers-browser-security https://www.eff.org/fa/deeplinks/2021/12/eus-digital-identit... )

tinus_hn 4y ago
What’s to prevent the EU from declaring itself trustworthy?
- josefx 4y ago
  Its courts? At least that is the only thing that keeps the EU Commission from going full police state.
  - tgv 4y ago
    The EU Commission? You mean, the one without an actual police force or army, or any say over the member states' criminal legislation? That Commission?
    - anticensor 4y ago
      PESCO and Europol exist. Not a body of the EU commission, but still.
    - josefx 4y ago
      > or any say over the member states' criminal legislation? That Commission? One of the jobs of the commission is deciding whether member states are in line with their treaty obligations, that includes any laws passed by said member states.
  - simplotek 4y ago
    > At least that is the only thing that keeps the EU Commission from going full police state. Such an extraordinary claim. Are you able to provide any evidence that supports your claim that at any time the EU Commission tried to go "full police state", and that courts kept that from happening?
  - pmontra 4y ago
    The Commission and the Parliament can do whatever they want but it's the Council that de facto has the final word on everything that matters.
  - tinus_hn 4y ago
    The EU court can only rule using laws written by the EU
iso1631 4y ago
That EFF page is really weird - English text, but right-aligned, with question marks to the left of the text, as if the text had been translated from a RTL language (Farsi perhaps given the /fa/ in the link?) From the looks of it the EU wants to push out a wide spread identity management system, which is fine. It's unclear to me after a brief perusal why they can't use a normal root certificate, or create their own along a letsencrypt line (indeed that would be a great benefit having another widespread free ACME powered certificate authority, one funded by the taxpayer), with the same protections and transparency as LE.
- DismantleMars 4y ago
  >That EFF page is really weird - English text, but right-aligned, with question marks to the left of the text, as if the text had been translated from a RTL language (Farsi perhaps given the /fa/ in the link?) It's just a Farsi link to an English article that's automatically applying RTL styling, the original version of the page in English looks fine. https://www.eff.org/deeplinks/2021/12/eus-digital-identity-framework-endangers-browser-security https://www.eff.org/deeplinks/2021/12/eus-digital-identity-f...

ReptileMan 4y ago

Let me guess - this landing page gives green, certified by TotallyNotNSONoWaySir Ltd

bombolo 4y ago

So paying to a browser is good buy paying to a government is bad?

netheril96 4y ago
The browser vendors know what they are doing. The government has no idea.
- bombolo 4y ago
  As if browser vendors never included any shady or incompetent root CA? For example: https://www.techtarget.com/searchsecurity/news/252436120/23000-Symantec-certificates-revoked-following-leak-of-private-keys https://www.techtarget.com/searchsecurity/news/252436120/230... Firefox seems to include root CA from the governments of: Hong Kong (so China?), Spain, Turkey, Tunisia, Netherlands.
  - olliej 4y ago
    And when they find evidence of a CA misbehaving they revoke them, as here, they don’t go to the EU and say “hey we think you need to re audit this company” and then wait a few months/years while the business continues to pay the EU to remain in the root stores.
olliej 4y ago
Wtf are you talking about? You don’t pay a browser to get your roots included. You file a bug report, and provide the supporting documentation and audits. If the relevant root program considers your supporting documentation sufficient, they include you. You cannot pay a root program to include your root certa, and any CA that was found to have done so would likely find other programs considering that to be a red flag.
- tialaramex 4y ago
  It's actually interesting. Three of the major trust stores are also OS vendors. Microsoft, Apple and Google. Each of those three actually just has a rather opaque "send us an email and we'll talk about it" type process. I don't think there's any implication that you can or should pay them money (indeed Microsoft is clear that there is "No Fee" for this), clearly none of these organisations is desperate for cash. But it's actually unclear what you can do besides maybe send email and hope. Mozilla's process is as you state to file a Bugzilla bug. You go in a big queue and there's eventually a public discussion on m.d.s.policy once you get to the front of the queue. Now, in theory there is no relationship between Mozilla's transparent process and say, Apple or Microsoft. Indeed even for Google there's only a rather thin relationship, the final decision is theirs but they do say you need to talk to Mozilla. But in practice the Mozilla process matters most.

moring 4y ago

Do you know details on how they are planning to enforce this in open-source browsers?

ranguna 4y ago

> illegal in the EU for a browser to drop a CA, even when they’re caught doing objectively fraudulent acts. Right now Mozilla, Microsoft and many other privately owned root certificate mainterns control whether or not CA are trust worthy. I actually see your statement the other way around, it would be illegal for browser to support a CA when the EU deems it as untrustworthy.

olliej 4y ago
Do you really think that a CA shady enough for the EU to reject would not have already been rejected by the various root programs?
- ranguna 4y ago
  I do not, hence this seems to be a non issue.
anticensor 4y ago
Browser vendors could solve the issue by distributing two editions of their browsers, one only trusting certificates accepted by the EU and one rejecting all the certificates in the list by the EU.