6 ms·

Scientists deeply concerned with upcoming EU digital identity regulations

81 points by wsc981 3y ago

wsc981 3y ago
The linked PDF is an open letter undersigned by many scientists. > Last year, many of us wrote to you to highlight some of the dangers in the European Commission’s proposed eIDAS regulation. After reading the near-final text, we are deeply concerned by the proposed text for Article 45. The current proposal radically expands the ability of governments to surveil both their own citizens and residents across the EU by providing them with the technical means to intercept encrypted web traffic, as well as undermining the existing oversight mechanisms relied on by European citizens. Concretely, the regulation enables each EU member state (and recognised third party countries) to designate cryptographic keys for which trust is mandatory; this trust can only be withdrawn with the government’s permission (Article 45a(4)). This means any EU member state or third party country, acting alone, is capable of intercepting the web traffic of any EU citizen and there is no effective recourse. We ask that you urgently reconsider this text and make clear that Article 45 will not interfere with trust decisions around the cryptographic keys and certificates used to secure web traffic. Article 45 also bans security checks on EU web certificates unless expressly permitted by regulation when establishing encrypted web traffic connections (Article 45(2a)). Instead of specifying a set of minimum security measures which must be enforced as a baseline, it effectively specifies an upper bound on the security measures which cannot be improved upon without the permission of ETSI. This runs counter to well established global norms where new cybersecurity technologies are developed and deployed in response to fast moving developments in technology. This effectively limits the security measures that can be taken to protect the European web. We ask that you reverse this clause, not limiting but encouraging the development of new security measures in response to fast-evolving threats.
fithisux 3y ago
[flagged]
jplusequalt 3y ago
Is there any recourse for a free web going forward?
- bannedbybros 3y ago
  [dead]
- anononaut 3y ago
  Not one that will be legal in the EU in the long term.
  - privacy-please 3y ago
    Is it possible to build a trustless authentication system, that doesn't need certificates ? Cert-authorities have always been a attack-vector, which wasn't too bad because if they got compromised trust could be revoked, minimizing the damage. If that can't be done anymore because of legal or political risk, maybe a better system can be designed, which doesn't have this potential ? Maybe technical design has to take into account the existence of bad political actors, and minimize the political and legal attack surfaces not just the technical ones.
- adolph 3y ago
  Certificate and Public Key Pinning [0] but its not a free lunch [1] 0. https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning https://owasp.org/www-community/controls/Certificate_and_Pub... 1. https://www.digicert.com/blog/certificate-pinning-what-is-certificate-pinning https://www.digicert.com/blog/certificate-pinning-what-is-ce...
verisimi 3y ago
Anything except self-governance, is an abuse. It abuses those who have been taught to go along with this external governance by those running the governance system. Its all it ever was, all it can ever be. There is no social contract, its all abuse. Legalised theft to put in roads, or remove them, as at present. If some people want to work together, to opt-in voluntarily to do this or that, as long as it doesn't harm another - then great. To have this immoral monolith writing laws that no one can justify, is ridiculous. All pretence of legitimacy is gone, it is simply about control. The above is not a political argument. It is a moral one. What circumstances allow one to forcibly extract from another and steal 40% of their work, or worse and then have the gall to call itself "good"? How big does a gang have to be to gain rights than an individual does not have? No one would think it "right" that I demand 40% of their income! Government is just an extractive mafia system that attempts to pose as the "best we've got", whilst using force to knock down any alternative possibilities of management.
- bannedbybros 3y ago
  [dead]
- wolverine876 3y ago
  An interesting philosophical argument, though it's probably been made tens of thousands of times on HN, at least. Including the obvious arguments and counter-arguments, could you boil it down to what's new?
  - reedjosh 3y ago
    IDK what's new, but I'm 100 percent in agreement. If you claim logical consistency, I don't know how the group having rights an individual does not ever gets reconciled. In a town of three if two vote to take from the third it's clearly not just. Yet somehow as the group size grows people lose sight of that.
    - wolverine876 3y ago
      > IDK what's new, but I'm 100 percent in agreement I'll just say this part, then: IMHO that's always the wrong position to be in. We all desire logical consistency, but we don't ever get it. No theory even approaches 100% depiction of reality.
privacy-please 3y ago
>Instead of specifying a set of minimum security measures which must be enforced as a baseline, it effectively specifies an upper bound on the security measures What the F Why ?
arp242 3y ago
Dupe: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform - https://news.ycombinator.com/item?id=38126997 https://news.ycombinator.com/item?id=38126997 - Nov 2023 (65 comments) Last Chance to fix eIDAS: Secret EU law threatens Internet security - https://news.ycombinator.com/item?id=38109494 https://news.ycombinator.com/item?id=38109494 - Nov 2023 (302 comments)
arpa 3y ago
I think a french tradition of building barricades and setting shit on fire is sorely needed in brussels.
kossTKR 3y ago
Share private thoughts between you and your friends in the future and get rounded up in no time! I know we're already close with NSA, Five Eyes and whatnot but could the plutocracy be a little less blatant? I wonder if at some point surveillance and tech bureaucracy will become so cemented there's zero chance of revolt or accountability for the upper echelons. Whoever's on top at that point will stay on top until there's a sunstorm.
- privacy-please 3y ago
  If the economy is booming and everybody is content, it's possible to entrench power. But the way things are going now, i don't think so.
agarsev 3y ago
I still don't get the MITM argument. To me, it feels like there is a lot of heavy lifting beneath the could in "a EU government could MITM any other EU country citizen". Can somebody walk me through an example of how could the Romanian government MITM a portuguese citizen in Portugal accessing a website hosted in Sweden? Maybe there's something I'm missing? To me it feels like it would require a lot of third party cooperation (ie ISPs). As to the tracking potential of eIDs, I agree it could be lessened by improving the legislation as the letter proposes, but to me if feels like it adds a small risk of abuse for a lot of benefits (digital access to the administration, and better security through relying on modern practices instead of handwritten signatures). Again, what is the threat model for being tracked with this ID? Will a random t-shirt shop ask me for my ID? Will this give them better insight into my online habits than asking for my CC number? I see a lot of security professionals warning against this law, and I tend to defer to people who know more than me, but time and again, and as with other EU legislation, the arguments seem to feel unconvincing and mired with "potentials for abuse" and slippery slopes.

81 points by wsc981 3y ago

The linked PDF is an open letter undersigned by many scientists. > Last year, many of us wrote to you to highlight some of the dangers in the European Commission’s proposed eIDAS regulation. After reading the near-final text, we are deeply concerned by the proposed text for Article 45. The current proposal radically expands the ability of governments to surveil both their own citizens and residents across the EU by providing them with the technical means to intercept encrypted web traffic, as well as undermining the existing oversight mechanisms relied on by European citizens. Concretely, the regulation enables each EU member state (and recognised third party countries) to designate cryptographic keys for which trust is mandatory; this trust can only be withdrawn with the government’s permission (Article 45a(4)). This means any EU member state or third party country, acting alone, is capable of intercepting the web traffic of any EU citizen and there is no effective recourse. We ask that you urgently reconsider this text and make clear that Article 45 will not interfere with trust decisions around the cryptographic keys and certificates used to secure web traffic. Article 45 also bans security checks on EU web certificates unless expressly permitted by regulation when establishing encrypted web traffic connections (Article 45(2a)). Instead of specifying a set of minimum security measures which must be enforced as a baseline, it effectively specifies an upper bound on the security measures which cannot be improved upon without the permission of ETSI. This runs counter to well established global norms where new cybersecurity technologies are developed and deployed in response to fast moving developments in technology. This effectively limits the security measures that can be taken to protect the European web. We ask that you reverse this clause, not limiting but encouraging the development of new security measures in response to fast-evolving threats.

fithisux 3y ago

[flagged]

jplusequalt 3y ago

Is there any recourse for a free web going forward?

bannedbybros 3y ago
[dead]
anononaut 3y ago
Not one that will be legal in the EU in the long term.
- privacy-please 3y ago
  Is it possible to build a trustless authentication system, that doesn't need certificates ? Cert-authorities have always been a attack-vector, which wasn't too bad because if they got compromised trust could be revoked, minimizing the damage. If that can't be done anymore because of legal or political risk, maybe a better system can be designed, which doesn't have this potential ? Maybe technical design has to take into account the existence of bad political actors, and minimize the political and legal attack surfaces not just the technical ones.
adolph 3y ago
Certificate and Public Key Pinning [0] but its not a free lunch [1] 0. https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning https://owasp.org/www-community/controls/Certificate_and_Pub... 1. https://www.digicert.com/blog/certificate-pinning-what-is-certificate-pinning https://www.digicert.com/blog/certificate-pinning-what-is-ce...

verisimi 3y ago

Anything except self-governance, is an abuse. It abuses those who have been taught to go along with this external governance by those running the governance system. Its all it ever was, all it can ever be. There is no social contract, its all abuse. Legalised theft to put in roads, or remove them, as at present. If some people want to work together, to opt-in voluntarily to do this or that, as long as it doesn't harm another - then great. To have this immoral monolith writing laws that no one can justify, is ridiculous. All pretence of legitimacy is gone, it is simply about control. The above is not a political argument. It is a moral one. What circumstances allow one to forcibly extract from another and steal 40% of their work, or worse and then have the gall to call itself "good"? How big does a gang have to be to gain rights than an individual does not have? No one would think it "right" that I demand 40% of their income! Government is just an extractive mafia system that attempts to pose as the "best we've got", whilst using force to knock down any alternative possibilities of management.

bannedbybros 3y ago
[dead]
wolverine876 3y ago
An interesting philosophical argument, though it's probably been made tens of thousands of times on HN, at least. Including the obvious arguments and counter-arguments, could you boil it down to what's new?
- reedjosh 3y ago
  IDK what's new, but I'm 100 percent in agreement. If you claim logical consistency, I don't know how the group having rights an individual does not ever gets reconciled. In a town of three if two vote to take from the third it's clearly not just. Yet somehow as the group size grows people lose sight of that.
  - wolverine876 3y ago
    > IDK what's new, but I'm 100 percent in agreement I'll just say this part, then: IMHO that's always the wrong position to be in. We all desire logical consistency, but we don't ever get it. No theory even approaches 100% depiction of reality.

privacy-please 3y ago

>Instead of specifying a set of minimum security measures which must be enforced as a baseline, it effectively specifies an upper bound on the security measures What the F Why ?

arp242 3y ago

Dupe: Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform - https://news.ycombinator.com/item?id=38126997 https://news.ycombinator.com/item?id=38126997 - Nov 2023 (65 comments) Last Chance to fix eIDAS: Secret EU law threatens Internet security - https://news.ycombinator.com/item?id=38109494 https://news.ycombinator.com/item?id=38109494 - Nov 2023 (302 comments)

arpa 3y ago

I think a french tradition of building barricades and setting shit on fire is sorely needed in brussels.

kossTKR 3y ago

Share private thoughts between you and your friends in the future and get rounded up in no time! I know we're already close with NSA, Five Eyes and whatnot but could the plutocracy be a little less blatant? I wonder if at some point surveillance and tech bureaucracy will become so cemented there's zero chance of revolt or accountability for the upper echelons. Whoever's on top at that point will stay on top until there's a sunstorm.

privacy-please 3y ago
If the economy is booming and everybody is content, it's possible to entrench power. But the way things are going now, i don't think so.

agarsev 3y ago

I still don't get the MITM argument. To me, it feels like there is a lot of heavy lifting beneath the could in "a EU government could MITM any other EU country citizen". Can somebody walk me through an example of how could the Romanian government MITM a portuguese citizen in Portugal accessing a website hosted in Sweden? Maybe there's something I'm missing? To me it feels like it would require a lot of third party cooperation (ie ISPs). As to the tracking potential of eIDs, I agree it could be lessened by improving the legislation as the letter proposes, but to me if feels like it adds a small risk of abuse for a lot of benefits (digital access to the administration, and better security through relying on modern practices instead of handwritten signatures). Again, what is the threat model for being tracked with this ID? Will a random t-shirt shop ask me for my ID? Will this give them better insight into my online habits than asking for my CC number? I see a lot of security professionals warning against this law, and I tend to defer to people who know more than me, but time and again, and as with other EU legislation, the arguments seem to feel unconvincing and mired with "potentials for abuse" and slippery slopes.