3 ms·

It's another side of the efforts of going around encryption, chat controls deals with communication services, this one with browsers

by g-b-r 3y ago

Jensson 3y ago
But this doesn't force browsers and sites to use weak encryption. It is very different.
- g-b-r 3y ago
  This forces browsers to accept all the CAs approved by the EU states, and you can be certain that some of them will be used for decrypting (and if needed modifying) the traffic
  - Jensson 3y ago
    And then you can just tell the browser to not trust those CAs and you are safe. This is nothing like "chat control". This only lets the government spy on people who don't care if the government spies on them.
    - yaris 3y ago
      IIRC one cannot tell the browser to not trust root CAs, that's why all the fuss.
      - Jensson 3y ago
        Why shouldn't you be able to do that? Seems like a simple thing to implement. I get why they want a hardcoded list, but I don't get why you can't add a way to block parts of that hardcoded list.
        g-b-r 3y ago
        web-browsers shall ensure
        Jensson 3y ago
        The only requirement is that browsers displays the data. The browser can add "warning, this certificate is potentially compromised" when it displays it, nothing in the current document says browsers aren't allowed to say that, just that the browser has to be aware of the certificate. It is similar to how Chrome displays a warning when you visit some sites. You can visit the site anyway, but you get a warning since Google thinks it is bad.
        yaris 3y ago
        Technically correct. But if Firefox displays a big red warning when someone's grandma goes to her favourite recipe website, and Safari (or Chrome) just display the website to grandma (and to the officer on duty, but who cares) - how long will Firefox survive?
        agwa 3y ago
        It's not clear that a warning would be allowed. In particular, the new paragraph 45(2a) prohibits mandatory checks on eIDAS certificates. Mozilla has proposed text[1] that would make clear that the requirement is only to display identity information, but this text has not been adopted. [1] https://securityriskahead.eu/wp-content/uploads/2023/09/Mozilla-Statement-20230830.docx.pdf https://securityriskahead.eu/wp-content/uploads/2023/09/Mozi...
        g-b-r 3y ago
        Even without the 45 (2a), displayed in a user-friendly manner could already be interpreted to prevent prominent warnings

It's another side of the efforts of going around encryption, chat controls deals with communication services, this one with browsers

by g-b-r 3y ago

It's another side of the efforts of going around encryption, chat controls deals with communication services, this one with browsers

Jensson 3y ago

But this doesn't force browsers and sites to use weak encryption. It is very different.

g-b-r 3y ago
This forces browsers to accept all the CAs approved by the EU states, and you can be certain that some of them will be used for decrypting (and if needed modifying) the traffic
- Jensson 3y ago
  And then you can just tell the browser to not trust those CAs and you are safe. This is nothing like "chat control". This only lets the government spy on people who don't care if the government spies on them.
  - yaris 3y ago
    IIRC one cannot tell the browser to not trust root CAs, that's why all the fuss.
    - Jensson 3y ago
      Why shouldn't you be able to do that? Seems like a simple thing to implement. I get why they want a hardcoded list, but I don't get why you can't add a way to block parts of that hardcoded list.
      - g-b-r 3y ago
        web-browsers shall ensure
        Jensson 3y ago
        The only requirement is that browsers displays the data. The browser can add "warning, this certificate is potentially compromised" when it displays it, nothing in the current document says browsers aren't allowed to say that, just that the browser has to be aware of the certificate. It is similar to how Chrome displays a warning when you visit some sites. You can visit the site anyway, but you get a warning since Google thinks it is bad.
        yaris 3y ago
        Technically correct. But if Firefox displays a big red warning when someone's grandma goes to her favourite recipe website, and Safari (or Chrome) just display the website to grandma (and to the officer on duty, but who cares) - how long will Firefox survive?
        agwa 3y ago
        It's not clear that a warning would be allowed. In particular, the new paragraph 45(2a) prohibits mandatory checks on eIDAS certificates. Mozilla has proposed text[1] that would make clear that the requirement is only to display identity information, but this text has not been adopted. [1] https://securityriskahead.eu/wp-content/uploads/2023/09/Mozilla-Statement-20230830.docx.pdf https://securityriskahead.eu/wp-content/uploads/2023/09/Mozi...
        g-b-r 3y ago
        Even without the 45 (2a), displayed in a user-friendly manner could already be interpreted to prevent prominent warnings