5 ms·

> This upper bar on security may even ban browsers from enforcing Certificate Transparency, an IETF technical standard that ensures a CA’s issuing history can b

> This upper bar on security may even ban browsers from enforcing Certificate Transparency, an IETF technical standard that ensures a CA’s issuing history can be examined by the public in order to detect malfeasance. I don't quite understand that. How does a browser enforce CT? Even if a browser queries CT logs, they're not that helpful without any context, right? How would a browser get anything useful from the logs beyond knowing a certificate was published to the logs? Isn't it the job of the domain owner to monitor those logs since they're the only one that's going to know definitively if a certificate is illegitimate?

agwa 3y ago
Browsers enforce Certificate Transparency by rejecting certificates which aren't published in CT logs. A certificate that is published in CT logs isn't necessarily legitimate, but at least it's public so domain owners can detect it and raise the alarm if the certificate is illegitimate. Unfortunately, Article 45 states that certificates issued by EU-mandated CAs "shall not be subject to any mandatory requirements other than the requirements laid down in paragraph 1" and paragraph 1 does not allow browsers to reject certificates not published in CT logs. Thus, EU-mandated CAs will be able to issue undetectable MitM certificates.
- gcbirzan 3y ago
  Do you happen to have the full text you're referring to? I cannot find that on Google and the one I'm reading says something else. I also couldn't find it on eff's post
  - thedaly 3y ago
    I can't seem to find it anywhere. This line leads me to think it isn't public, which is crazy: > The text isn't final yet, but is subject to approval behind closed doors in Brussels on November 8.
  - agwa 3y ago
    Unfortunately, the text is being drafted in secret and the latest version has not been released publicly. I have seen a leaked copy but I don't have permission to post it. I can attest that the various posts and letters speaking against eIDAS are accurately representing the text. I know this isn't a satisfying answer, but blame the EU for drafting legislation in secret.
    - immibis 3y ago
      Why are we arguing about something still in the drafting stage, then? If they're still working on it, they're still working on it. It's not even finished to the stage where the public or the parliament can review it. There's probably stuff in there they're still thinking through and will eventually delete. Laws don't go from secret drafting, straight to law. They get public comments, the parliament has to vote on them, the commission has to vote on them (I think - something like that), they go back to drafting to make an amended version that's more acceptable, etc etc... of course the unfinished draft version isn't acceptable. This isn't the first time everyone's got upset about an unfinished EU law. All previous times, it was shot down by the EU Parliament, who are supposed to represent the citizens.
      - sleevi 3y ago
        Because this is not the “start of drafting” but roughly “final text that is largely a rubber stamp approval.” This is the output of having been through the the trilogue process - where the Parliament would/has shut things down before - and not been shut down. [1] https://en.m.wikipedia.org/wiki/Formal_trilogue_meeting https://en.m.wikipedia.org/wiki/Formal_trilogue_meeting
- zlg_codes 3y ago
  Ah, so every CA in Europe just lost trustworthiness due to their government. Delist European CAs until they get their shit together.
  - ls612 3y ago
    When Kazakhstan tried pulling this the browser vendors did that to them and were able to because Kazakhstan couldn’t imprison their executives and employees to compel compliance. The EU on the other hand can and will.
    - zlg_codes 3y ago
      How would the EU punish Google, who is an American company? At most, the EU affects things within its borders. They have no say on the greater Internet. The EU had better invest in its own browser if it intends to outlaw encryption.
      - ls612 3y ago
        By locking up it's executives in Europe or seizing it's property in Europe. Both of which it has in far greater quantities than Kazakhstan did.
        zlg_codes 3y ago
        Ah, I see. So at minimum, they'd need strategies to move assets out of the region while complying to some degree, until the assets were safe.
      - spacebanana7 3y ago
        A better example would be Brave or another smaller organisation. Big multinationals have employees and assets everywhere that can be threatened. However smaller organisations operating from a single jurisdiction can only be threatened by their local government (or at least with the consent of their local government).
- donmcronald 3y ago
  > A certificate that is published in CT logs isn't necessarily legitimate, but at least it's public so domain owners can detect it and raise the alarm if the certificate is illegitimate. Oh yeah. I can't believe I didn't put that together. Thanks for spelling it out :-)
vanchor3 3y ago
> How does a browser enforce CT? The certificate contains signatures from the CT logs. The browser can either accept those signatures or check the CT log itself. This "enforces" CT for the certificate of the site you're accessing, but not necessarily the CA. Of course if a certificate comes up that fails CT logging, that can raise scrutiny of the CA.

agwa 3y ago

Browsers enforce Certificate Transparency by rejecting certificates which aren't published in CT logs. A certificate that is published in CT logs isn't necessarily legitimate, but at least it's public so domain owners can detect it and raise the alarm if the certificate is illegitimate. Unfortunately, Article 45 states that certificates issued by EU-mandated CAs "shall not be subject to any mandatory requirements other than the requirements laid down in paragraph 1" and paragraph 1 does not allow browsers to reject certificates not published in CT logs. Thus, EU-mandated CAs will be able to issue undetectable MitM certificates.

gcbirzan 3y ago
Do you happen to have the full text you're referring to? I cannot find that on Google and the one I'm reading says something else. I also couldn't find it on eff's post
- thedaly 3y ago
  I can't seem to find it anywhere. This line leads me to think it isn't public, which is crazy: > The text isn't final yet, but is subject to approval behind closed doors in Brussels on November 8.
- agwa 3y ago
  Unfortunately, the text is being drafted in secret and the latest version has not been released publicly. I have seen a leaked copy but I don't have permission to post it. I can attest that the various posts and letters speaking against eIDAS are accurately representing the text. I know this isn't a satisfying answer, but blame the EU for drafting legislation in secret.
  - immibis 3y ago
    Why are we arguing about something still in the drafting stage, then? If they're still working on it, they're still working on it. It's not even finished to the stage where the public or the parliament can review it. There's probably stuff in there they're still thinking through and will eventually delete. Laws don't go from secret drafting, straight to law. They get public comments, the parliament has to vote on them, the commission has to vote on them (I think - something like that), they go back to drafting to make an amended version that's more acceptable, etc etc... of course the unfinished draft version isn't acceptable. This isn't the first time everyone's got upset about an unfinished EU law. All previous times, it was shot down by the EU Parliament, who are supposed to represent the citizens.
    - sleevi 3y ago
      Because this is not the “start of drafting” but roughly “final text that is largely a rubber stamp approval.” This is the output of having been through the the trilogue process - where the Parliament would/has shut things down before - and not been shut down. [1] https://en.m.wikipedia.org/wiki/Formal_trilogue_meeting https://en.m.wikipedia.org/wiki/Formal_trilogue_meeting
zlg_codes 3y ago
Ah, so every CA in Europe just lost trustworthiness due to their government. Delist European CAs until they get their shit together.
- ls612 3y ago
  When Kazakhstan tried pulling this the browser vendors did that to them and were able to because Kazakhstan couldn’t imprison their executives and employees to compel compliance. The EU on the other hand can and will.
  - zlg_codes 3y ago
    How would the EU punish Google, who is an American company? At most, the EU affects things within its borders. They have no say on the greater Internet. The EU had better invest in its own browser if it intends to outlaw encryption.
    - ls612 3y ago
      By locking up it's executives in Europe or seizing it's property in Europe. Both of which it has in far greater quantities than Kazakhstan did.
      - zlg_codes 3y ago
        Ah, I see. So at minimum, they'd need strategies to move assets out of the region while complying to some degree, until the assets were safe.
    - spacebanana7 3y ago
      A better example would be Brave or another smaller organisation. Big multinationals have employees and assets everywhere that can be threatened. However smaller organisations operating from a single jurisdiction can only be threatened by their local government (or at least with the consent of their local government).
donmcronald 3y ago
> A certificate that is published in CT logs isn't necessarily legitimate, but at least it's public so domain owners can detect it and raise the alarm if the certificate is illegitimate. Oh yeah. I can't believe I didn't put that together. Thanks for spelling it out :-)

vanchor3 3y ago

> How does a browser enforce CT? The certificate contains signatures from the CT logs. The browser can either accept those signatures or check the CT log itself. This "enforces" CT for the certificate of the site you're accessing, but not necessarily the CA. Of course if a certificate comes up that fails CT logging, that can raise scrutiny of the CA.