5 ms·

The best way to deal with this is non-compliance and there need to be technical solutions to deny such attempts. One major factor that works against users is c

The best way to deal with this is non-compliance and there need to be technical solutions to deny such attempts. One major factor that works against users is central authentication. Schemes like oauth2 might bring convenience and security in many cases, but will endanger net freedom overall. Google just added age restriction on blogger. Result is that you need to provide Google with ID information to access some content. If more an more users elect to ID with their Google account you can see where it can lead. Naturally the EU wants to increase such schemes as well. It just released a law (DSA) that allegedly to restrict the influence of tech giants. That their proposals will drive people into ID schemes of said tech companies is either an oversight or something worse. I would think it is the latter and giant tech companies are very glad about the behavior of the commission. Because they too tried get people to use their ID solutions. Digital tech doesn't really prosper in the EU but certainly surveillance leveraging services of others. The only defense against such laws is to make them technologically not feasible. While Google did many good things for net security, their compliance on topics that serve its self-interest is a danger. Same goes for other large tech companies. That there is close collaboration between certain political elites and tech companies is pretty much a given. It was decried as a conspiracy theory until it was proven. Although it should be no surprise that there are such connections. Perhaps the influence of the EU commission is smaller, but I would not bet on it. Access to the market is on the hand they can play. Easily a strong enough hand to subject users to surveillance.

ur-whale 4y ago
> The best way to deal with this is non-compliance and there need to be technical solutions to deny such attempts. I disagree. While these are good to have, they are not enough. The reason is always the same: if you are found to be using the circumventing tech., you'll likely be in breach of the law, which will give the goons a legitimate reason to come and harass you. In a civilized country, that can translate into a fine, community service, etc... In the borderlands, it'll land you in jail or worse.
- carlosjobim 4y ago
  The goons will come and harass you if you are inconvenient or a threat to the ruling class, even if you are complying with all existing regulations. This happens in every country and region. For the common man non-compliance is the only non-violent way to preserve his rights or exercise freedom. You can do it successfully if you are smart and agile.
  - olddustytrail 4y ago
    No it doesn't happen in every country and region. In many places there's no such thing as a "ruling class". Politicians are just another type of public sector worker and certainly not the best paid or wealthiest.
    - chopin 4y ago
      Where would that be? I live in Europe and I don't think there is a country where politicians aren't corrupt.
      - t0bia_s 4y ago
        As European living in country with highest inflation rate I must agree. What annoys me a lot is a trending narration about blaming Putin for everything. Ministry of interior has leaked manuals where is writen guide for public relations about it. Basically it says that media need to blame Putin for hungry and problems with food supply chain. https://www.mvcr.cz/soubor/krit-memo-putin-hlad-komunikacni-doporuceni-pdf.aspx https://www.mvcr.cz/soubor/krit-memo-putin-hlad-komunikacni-... If you search for articles, they are writen following this guide exactly. https://duckduckgo.com/?q=putin+a+hlad https://duckduckgo.com/?q=putin+a+hlad
    - seanw444 4y ago
      In a perfect world.
- alphazard 4y ago
  It's much easier for people to resist by using "forbidden" systems in private, than to affect political change. In the context of the EU, other rights afforded to citizens make things like this hard to enforce.
kragen 4y ago
> One major factor that works against users is central authentication. Schemes like oauth2 also dns and the tls ca system, even including let's encrypt
- huslage 4y ago
  I'm not sure I follow how let's encrypt is included on this list. They are very transparent.
  - kragen 4y ago
    let's encrypt made a huge improvement on the status quo, but now that 95% of the web depends on them, they're an obvious central point of vulnerability for censors and spy agencies
    - DaiPlusPlus 4y ago
      ...you're not concerned about all of the other Trusted Root CAs that ship in OS/browser updates? Why would the NSA/GCHQ/etc need to compromise a high-profile target like LetsEncrypt when they could bribe any of the dozens of companies names listed in my own local certmgr.msc that I don't recognize at all[1]. 1: I'm seeing names like "Actalis", "Baltimore CyberTrust", "Cetrum" - some of these sound more like pharmaceuticals than tech companies...
      - kragen 4y ago
        a compromised root ca allows an attacker who already has dns or ip control (via bgp, arp spoofing, a captive portal, etc.) to leverage it into a working mitm attack on a tls site, but it can't revoke certs it didn't sign, and the attack is over as soon as the attacker loses dns or ip control by contrast, the ca you chose to sign your cert can revoke it, or refuse to renew it, taking your website permanently offline with zero effort on their part, unless you can find another ca to sign a new cert for you but if you could, let's encrypt wouldn't have had to exist in the first place the dozens of companies you mentioned make that less of a threat, not more of one, though they do of course increase of mitm attacks as i described in the first paragraph of this comment
jasmer 4y ago
Apple and Google will do what the EU tells them to do in the end.
- danuker 4y ago
  That won't stop them trying to lobby their way into banning third parties from the web if they could. Apple, Google, and Facebook are the 5th, 6th, and 7th largest lobbyists in the EU. https://www.lobbyfacts.eu/?sort=lob&order=desc https://www.lobbyfacts.eu/?sort=lob&order=desc
splitstud 4y ago
[dead]
Eduard 4y ago
> Schemes like oauth2 might bring convenience and security in many cases, but will endanger net freedom overall. Your statement makes it look like OAuth2 is inherently endangering net freedom. This isn't true. If OAuth2 was used ... - for authentication (versus authorization) only AND - AND by a select few providers (e.g. Google, Github, Facebook, Twitter) solely AND - AND NO other privacy-protecting authentication methods (e.g. classic username-password credentials) are available ... THEN your statement has reasonable truth.
- k0k0r0 4y ago
  Feels like where we are heading to.
dmitriid 4y ago
> The best way to deal with this is non-compliance and there need to be technical solutions to deny such attempts. You cannot solve human issues by technical solutions > One major factor that works against users is central authentication. Schemes like oauth2 might bring convenience and security in many cases, but will endanger net freedom overall. And what is your solution for that? Any authentication solution will inevitable converge to having trusted actors authenticating you. There's no technical solution for that. > It just released a law (DSA) that allegedly to restrict the influence of tech giants. That their proposals will drive people into ID schemes So what is your technical solution to this human law? > The only defense against such laws is to make them technologically not feasible. I also want to wish for moon and the stars. But we're not dealing with the realms of fantasy.

ur-whale 4y ago

> The best way to deal with this is non-compliance and there need to be technical solutions to deny such attempts. I disagree. While these are good to have, they are not enough. The reason is always the same: if you are found to be using the circumventing tech., you'll likely be in breach of the law, which will give the goons a legitimate reason to come and harass you. In a civilized country, that can translate into a fine, community service, etc... In the borderlands, it'll land you in jail or worse.

carlosjobim 4y ago
The goons will come and harass you if you are inconvenient or a threat to the ruling class, even if you are complying with all existing regulations. This happens in every country and region. For the common man non-compliance is the only non-violent way to preserve his rights or exercise freedom. You can do it successfully if you are smart and agile.
- olddustytrail 4y ago
  No it doesn't happen in every country and region. In many places there's no such thing as a "ruling class". Politicians are just another type of public sector worker and certainly not the best paid or wealthiest.
  - chopin 4y ago
    Where would that be? I live in Europe and I don't think there is a country where politicians aren't corrupt.
    - t0bia_s 4y ago
      As European living in country with highest inflation rate I must agree. What annoys me a lot is a trending narration about blaming Putin for everything. Ministry of interior has leaked manuals where is writen guide for public relations about it. Basically it says that media need to blame Putin for hungry and problems with food supply chain. https://www.mvcr.cz/soubor/krit-memo-putin-hlad-komunikacni-doporuceni-pdf.aspx https://www.mvcr.cz/soubor/krit-memo-putin-hlad-komunikacni-... If you search for articles, they are writen following this guide exactly. https://duckduckgo.com/?q=putin+a+hlad https://duckduckgo.com/?q=putin+a+hlad
  - seanw444 4y ago
    In a perfect world.
alphazard 4y ago
It's much easier for people to resist by using "forbidden" systems in private, than to affect political change. In the context of the EU, other rights afforded to citizens make things like this hard to enforce.

kragen 4y ago

> One major factor that works against users is central authentication. Schemes like oauth2 also dns and the tls ca system, even including let's encrypt

huslage 4y ago
I'm not sure I follow how let's encrypt is included on this list. They are very transparent.
- kragen 4y ago
  let's encrypt made a huge improvement on the status quo, but now that 95% of the web depends on them, they're an obvious central point of vulnerability for censors and spy agencies
  - DaiPlusPlus 4y ago
    ...you're not concerned about all of the other Trusted Root CAs that ship in OS/browser updates? Why would the NSA/GCHQ/etc need to compromise a high-profile target like LetsEncrypt when they could bribe any of the dozens of companies names listed in my own local certmgr.msc that I don't recognize at all[1]. 1: I'm seeing names like "Actalis", "Baltimore CyberTrust", "Cetrum" - some of these sound more like pharmaceuticals than tech companies...
    - kragen 4y ago
      a compromised root ca allows an attacker who already has dns or ip control (via bgp, arp spoofing, a captive portal, etc.) to leverage it into a working mitm attack on a tls site, but it can't revoke certs it didn't sign, and the attack is over as soon as the attacker loses dns or ip control by contrast, the ca you chose to sign your cert can revoke it, or refuse to renew it, taking your website permanently offline with zero effort on their part, unless you can find another ca to sign a new cert for you but if you could, let's encrypt wouldn't have had to exist in the first place the dozens of companies you mentioned make that less of a threat, not more of one, though they do of course increase of mitm attacks as i described in the first paragraph of this comment

jasmer 4y ago

Apple and Google will do what the EU tells them to do in the end.

danuker 4y ago
That won't stop them trying to lobby their way into banning third parties from the web if they could. Apple, Google, and Facebook are the 5th, 6th, and 7th largest lobbyists in the EU. https://www.lobbyfacts.eu/?sort=lob&order=desc https://www.lobbyfacts.eu/?sort=lob&order=desc

splitstud 4y ago

[dead]

Eduard 4y ago

> Schemes like oauth2 might bring convenience and security in many cases, but will endanger net freedom overall. Your statement makes it look like OAuth2 is inherently endangering net freedom. This isn't true. If OAuth2 was used ... - for authentication (versus authorization) only AND - AND by a select few providers (e.g. Google, Github, Facebook, Twitter) solely AND - AND NO other privacy-protecting authentication methods (e.g. classic username-password credentials) are available ... THEN your statement has reasonable truth.

k0k0r0 4y ago
Feels like where we are heading to.

dmitriid 4y ago

> The best way to deal with this is non-compliance and there need to be technical solutions to deny such attempts. You cannot solve human issues by technical solutions > One major factor that works against users is central authentication. Schemes like oauth2 might bring convenience and security in many cases, but will endanger net freedom overall. And what is your solution for that? Any authentication solution will inevitable converge to having trusted actors authenticating you. There's no technical solution for that. > It just released a law (DSA) that allegedly to restrict the influence of tech giants. That their proposals will drive people into ID schemes So what is your technical solution to this human law? > The only defense against such laws is to make them technologically not feasible. I also want to wish for moon and the stars. But we're not dealing with the realms of fantasy.