4 ms·

That's how I interpret it. Long story short, this isn't about asking browsers to ignore flawed procedures or lacking security. Incompetence is always a factor

by 2000UltraDeluxe 4y ago

That's how I interpret it. Long story short, this isn't about asking browsers to ignore flawed procedures or lacking security. Incompetence is always a factor and this law won't allow for more incompetence than we're already used to from private CA's. This is about preventing browsers from distrusting government-controlled CA's issuing certificates used to MITM traffic. EU's trying to do what Khazakhstan (IIRC, could be one of the other -stans) did a few years ago).

matheusmoreira 4y ago
The so called "national security certificates". Sneaking in covert interception mechanisms into our technology, obfuscating it with bullshit names and government euphemisms. Will these governments ever stop their tyranny? Why can't they cease and desist on the cryptography matter? We don't want to be surveilled, we don't want them "regulating" this stuff.
- 2000UltraDeluxe 4y ago
  I'm sure the intentions are good, but it's definitely a slippery slope.
  - matheusmoreira 4y ago
    I'm not sure at all. Actually I'd say it's nothing but a power grab. They love to preach about terrorists and children but what actually goes on is surveillance and criminalization of political opposition, dissenters, journalists, pretty much anyone that could threaten their power. It's literally happening in my country right now, thankfully not at Kazakhstan levels. At least not yet.
- ben_w 4y ago
  Of course not; the point of a state is to be the sole place where tyrannical powers can be found. I'd like to say that in a democracy the use of such powers are limited, but every so often I find myself disappointed by news that such powers are directed at protesters in the UK, and my news about the US leans towards "gosh don't these police cars look suspiciously more capable than actual military vehicles". For stuff like this, my main concern is that it creates an easy way for hostile agents (someone else's security agencies rather than our own) to break things that ought not to be breakable. But, given that most people (including most criminals) are clueless about digital security, this kind of thing may genuinely be useful for breaking into otherwise-secret chat forums. I can't balance these competing concerns. I really hope the people on our side ("security is good") are getting taken seriously by the agencies; but I don't have any reason to think that hope is anything more than wishful thinking.
  - matheusmoreira 4y ago
    We shouldn't balance any concerns, we should simply reject the idea that the governments should have any access at all. I'm convinced the whole purpose of the government granting itself these powere is to abuse them. There is no reason to accept this as legitimate. The governments of the world are essentially our enemies. Encryption technology needs to start threat modeling with governments in mind. Cryptography must be so ubiquitous and undefeatable that it's impossible for any government to do anything about it short of nuking its own citizens.
    - ben_w 4y ago
      I would love to be able to reject the idea of the government having any access, except I keep running into the messy reality of human nature. Heck, I’d do away with governments existing and advocate anarchism, except for the messy reality of human nature.
  - mindslight 4y ago
    > the point of a state is to be the sole place where tyrannical powers can be found Sure, but that doesn't imply that we should create new tyrannical powers out of whole cloth, just so the state can have them. The more that power remains distributed, allowing the population freedom and self-determination, the better.
    - ben_w 4y ago
      I wish what you say was possible, because I certainly like that world: my preference would be anarchy, except people keep disappointing me by finding new ways to dominate and rule — it seems (human) nature abhors a (power) vacuum.
      - matheusmoreira 4y ago
        Yeah, anarchy is a fundamentally impossible state. People naturally form groups because it increaes their chance of survival, every group of humans has rules, they cede power to leaders who solve their problems for them, people who don't like it will leave and join another group or become lone wolves. The problem with governments is they dominate the entire earth. They force their social contract on us and we're forced to accept it just because we happened to be born somewhere. We can't just reject their power and rules: leaving is expensive, difficult or impossible and the only thing we can do is escape to another imperfect government.
- 2000UltraDeluxe 4y ago
  In theory, this could be relatively easily circumvented with DANE. The problem is getting businesses to implement it for their domains when even simple things like SPF and DKIM is a complete mess aleready.
  - LeonM 4y ago
    > relatively easily Don't forget that DANE requires DNSSEC, which your DNS service provider must support (and switching DNS provider is not 'relatively easy'). Another problem with DNSSEC is that there are some people (and with 'some people' I mean tptacek) who are ferociously against it. Also, TLSA records require maintenance. If you forget to update them you will break things. Had to rotate your keys unexpectedly? Well now you have to wait for DNS propagation and explain your boss that some of your customers may get scary warning messages for a few hours when they try to reach you, and there will be nothing you can do about it.
  - tptacek 4y ago
    DANE does the opposite of circumventing this problem: it ratifies it. The DANE authorities are, de jure, the world governments that control the major DNS TLDs.

matheusmoreira 4y ago

The so called "national security certificates". Sneaking in covert interception mechanisms into our technology, obfuscating it with bullshit names and government euphemisms. Will these governments ever stop their tyranny? Why can't they cease and desist on the cryptography matter? We don't want to be surveilled, we don't want them "regulating" this stuff.

2000UltraDeluxe 4y ago
I'm sure the intentions are good, but it's definitely a slippery slope.
- matheusmoreira 4y ago
  I'm not sure at all. Actually I'd say it's nothing but a power grab. They love to preach about terrorists and children but what actually goes on is surveillance and criminalization of political opposition, dissenters, journalists, pretty much anyone that could threaten their power. It's literally happening in my country right now, thankfully not at Kazakhstan levels. At least not yet.
ben_w 4y ago
Of course not; the point of a state is to be the sole place where tyrannical powers can be found. I'd like to say that in a democracy the use of such powers are limited, but every so often I find myself disappointed by news that such powers are directed at protesters in the UK, and my news about the US leans towards "gosh don't these police cars look suspiciously more capable than actual military vehicles". For stuff like this, my main concern is that it creates an easy way for hostile agents (someone else's security agencies rather than our own) to break things that ought not to be breakable. But, given that most people (including most criminals) are clueless about digital security, this kind of thing may genuinely be useful for breaking into otherwise-secret chat forums. I can't balance these competing concerns. I really hope the people on our side ("security is good") are getting taken seriously by the agencies; but I don't have any reason to think that hope is anything more than wishful thinking.
- matheusmoreira 4y ago
  We shouldn't balance any concerns, we should simply reject the idea that the governments should have any access at all. I'm convinced the whole purpose of the government granting itself these powere is to abuse them. There is no reason to accept this as legitimate. The governments of the world are essentially our enemies. Encryption technology needs to start threat modeling with governments in mind. Cryptography must be so ubiquitous and undefeatable that it's impossible for any government to do anything about it short of nuking its own citizens.
  - ben_w 4y ago
    I would love to be able to reject the idea of the government having any access, except I keep running into the messy reality of human nature. Heck, I’d do away with governments existing and advocate anarchism, except for the messy reality of human nature.
- mindslight 4y ago
  > the point of a state is to be the sole place where tyrannical powers can be found Sure, but that doesn't imply that we should create new tyrannical powers out of whole cloth, just so the state can have them. The more that power remains distributed, allowing the population freedom and self-determination, the better.
  - ben_w 4y ago
    I wish what you say was possible, because I certainly like that world: my preference would be anarchy, except people keep disappointing me by finding new ways to dominate and rule — it seems (human) nature abhors a (power) vacuum.
    - matheusmoreira 4y ago
      Yeah, anarchy is a fundamentally impossible state. People naturally form groups because it increaes their chance of survival, every group of humans has rules, they cede power to leaders who solve their problems for them, people who don't like it will leave and join another group or become lone wolves. The problem with governments is they dominate the entire earth. They force their social contract on us and we're forced to accept it just because we happened to be born somewhere. We can't just reject their power and rules: leaving is expensive, difficult or impossible and the only thing we can do is escape to another imperfect government.
2000UltraDeluxe 4y ago
In theory, this could be relatively easily circumvented with DANE. The problem is getting businesses to implement it for their domains when even simple things like SPF and DKIM is a complete mess aleready.
- LeonM 4y ago
  > relatively easily Don't forget that DANE requires DNSSEC, which your DNS service provider must support (and switching DNS provider is not 'relatively easy'). Another problem with DNSSEC is that there are some people (and with 'some people' I mean tptacek) who are ferociously against it. Also, TLSA records require maintenance. If you forget to update them you will break things. Had to rotate your keys unexpectedly? Well now you have to wait for DNS propagation and explain your boss that some of your customers may get scary warning messages for a few hours when they try to reach you, and there will be nothing you can do about it.
- tptacek 4y ago
  DANE does the opposite of circumventing this problem: it ratifies it. The DANE authorities are, de jure, the world governments that control the major DNS TLDs.