4 ms·

This won't stop here. Whoever in the EU government is willing to suffer the bad PR optics of outlawing Firefox, is willing to go further I'd wager. How long bef

This won't stop here. Whoever in the EU government is willing to suffer the bad PR optics of outlawing Firefox, is willing to go further I'd wager. How long before Linux is banned in the EU on personal devices?

immibis 3y ago
Can we stop the FUD? Your comment is the equivalent of saying the EU government is willing to outlaw iPhones: No they're not, they're just saying they have to have USB-C charging ports.
- kstrauser 3y ago
  Perhaps, but USB-C is arguably the equivalent of the Lightning port. Broken TLS is not the functional equivalent of working TLS.
  - immibis 3y ago
    You think if the government issues certificates this breaks TLS? I had no idea it was so fragile. Here's what's happening - the government wants a unified framework for digital identity. They're not saying you have to use it, but they want the framework to be there. Part of the framework is that you can get a certificate with your name on it, signed by the government saying this is officially you, and you can put this on a website to digitally sign the website. Obviously the government-issued certificate is going to have certain parameters, and they want browsers to accept these parameters so these websites will work. How else would you possibly do this, than publishing the certificate parameters and saying browsers must accept these? I don't think they prohibited the browser from saying "this is an EU identity certificate", did they? I imagine it appears as an EV green box showing the person's name and country code. I don't know why I'd ever want that to appear on my website, but I guess some people do.
    - kstrauser 3y ago
      > You think if the government issues certificates this breaks TLS? I had no idea it was so fragile. Nice strawman. The actual situation is that the government wants to require browsers to accept signatures from CAs that the government selects, and ban them from validating the security of the certs signed by those CAs. In other words, they want the ability to be able to issue their own cert for example.com and forbid the browser from telling you that it's signed by a .gov rather than, say, Comodo. With this idiotic, mandated arrangement, it would be impossible for an end user to tell whether they were speaking directly to example.com or to the government's MITM proxy.
      - immibis 3y ago
        Well, yes? Part of the government issuing certificates for people is that those certificates shall be accepted as proof of identity, including in browsers. I'm not sure how else you'd like to do that. Maybe they issue certificates but nobody accepts them? No, that way is madness. > and ban them from validating the security of the certs signed by those CAs. I'm going to need a source on that one, chief. Are you talking about this part? > To that end, web-browsers should ensure support and interoperability with Qualified certificates for website authentication pursuant to Regulation (EU) No 910/2014. They should recognise and display Qualified certificates for website authentication to provide a high level of assurance, allowing website owners to assert their identity as owners of a website and users to identify the website owners with a high degree of certainty. Maybe you are talking about this? > For those purposes web-browsers shall ensure that the identity data provided using any of the methods is displayed in a user friendly manner. Frankly, displaying the fact that a government issued identity certificate is used seems to me to be the exact opposite of a MITM, but what do I know? Where does it say that if google.com has Angela Merkel's personal certificate instead of Google's one, the browser shall present it as a secure connection?
        phendrenad2 3y ago
        I recommend reading the eff.org article linked above. It states: "Article 45 forbids browsers from enforcing modern security requirements on certain CAs without the approval of an EU member government. Which CAs? Specifically the CAs that were appointed by the government, which in some cases will be owned or operated by that selfsame government." and: "The current text of Article 45 requires that browsers trust CAs appointed by governments, and prohibits browsers from enforcing any security requirements on those CAs beyond what is approved by ETSI. In other words, it sets an upper bar on how much security browsers can require of CAs" and: "This upper bar on security may even ban browsers from enforcing Certificate Transparency" If you can't connect the dots and understand why people are upset, I can't help you.
  - immibis 3y ago
    Government-issued identity verification is at least as good as private-entity-issued identity verification, since, you know, the government is the one with the databases of identities.
- redder23 3y ago
  It's not FUD it's the truth, they OBVIOUSLY want to control everything and remove privacy and enable government surveillance. They have just proven that by trying over and over again. They just know they can not blatantly outlaw Linux or things like that, that is why they try to sneak in shit like this with some buried text on the legislation. If they could at the flip of a finger outlaw Linux and things like that and impose total control, they would for sure do it instantly. It's just that it's too established, too common so there would be too much outrage, so they try to break encryption this way instead. If they had their way, they would have a total control!
  - immibis 3y ago
    This is the bill, right? There may be a newer version I didn't find. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52021PC0281 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Can you indicate which parts are objectionable on the grounds of leading to a totalitarian surveillance dystopia?
    - Saline9515 3y ago
      It's a slippery slope. In my language (french), we call it "sausage politics", where you take small slices of your freedom one by one. This regulation is unwanted by anyone in the EU, creates security risks, and relies mainly on "trust me I won't do anything bad", that we all know is not going to happen. Also, laws can't be reverted in the EU semi-dictatorial regime, so, such things are really dangerous. Each year that goes, I'm thinking of a plan to leave, as our freedoms get lower and lower. Recently, the digital services' EU gauleiter declared that "content calling for rebellion" should be deleted from social media. Same goes with AML, and with the digital ID, where your government will have a single key allowing to know every service you're registered to. And let's not speak about the CBDC.
    - redder23 3y ago
      I will not do what you ask because you will not believe it anyway. You are desperately clinging on to some failed mindset that they are out for you because you like that they force Apple to use USB-C or whatever. You also seem not to read the actual point of the objection everyone has. They want to SPY ON EU citizens! WTF are you not understanding about this? Its all explained in the EFF article and countless others that are on top of HN right now. If you not see the INTENTIONS and the slow creeping dystopia you are blind. I am not going to search some specific text part out for you that proves that, its perfectly obvious for people who follow just a little bit of news and have common sense.

immibis 3y ago

Can we stop the FUD? Your comment is the equivalent of saying the EU government is willing to outlaw iPhones: No they're not, they're just saying they have to have USB-C charging ports.

kstrauser 3y ago
Perhaps, but USB-C is arguably the equivalent of the Lightning port. Broken TLS is not the functional equivalent of working TLS.
- immibis 3y ago
  You think if the government issues certificates this breaks TLS? I had no idea it was so fragile. Here's what's happening - the government wants a unified framework for digital identity. They're not saying you have to use it, but they want the framework to be there. Part of the framework is that you can get a certificate with your name on it, signed by the government saying this is officially you, and you can put this on a website to digitally sign the website. Obviously the government-issued certificate is going to have certain parameters, and they want browsers to accept these parameters so these websites will work. How else would you possibly do this, than publishing the certificate parameters and saying browsers must accept these? I don't think they prohibited the browser from saying "this is an EU identity certificate", did they? I imagine it appears as an EV green box showing the person's name and country code. I don't know why I'd ever want that to appear on my website, but I guess some people do.
  - kstrauser 3y ago
    > You think if the government issues certificates this breaks TLS? I had no idea it was so fragile. Nice strawman. The actual situation is that the government wants to require browsers to accept signatures from CAs that the government selects, and ban them from validating the security of the certs signed by those CAs. In other words, they want the ability to be able to issue their own cert for example.com and forbid the browser from telling you that it's signed by a .gov rather than, say, Comodo. With this idiotic, mandated arrangement, it would be impossible for an end user to tell whether they were speaking directly to example.com or to the government's MITM proxy.
    - immibis 3y ago
      Well, yes? Part of the government issuing certificates for people is that those certificates shall be accepted as proof of identity, including in browsers. I'm not sure how else you'd like to do that. Maybe they issue certificates but nobody accepts them? No, that way is madness. > and ban them from validating the security of the certs signed by those CAs. I'm going to need a source on that one, chief. Are you talking about this part? > To that end, web-browsers should ensure support and interoperability with Qualified certificates for website authentication pursuant to Regulation (EU) No 910/2014. They should recognise and display Qualified certificates for website authentication to provide a high level of assurance, allowing website owners to assert their identity as owners of a website and users to identify the website owners with a high degree of certainty. Maybe you are talking about this? > For those purposes web-browsers shall ensure that the identity data provided using any of the methods is displayed in a user friendly manner. Frankly, displaying the fact that a government issued identity certificate is used seems to me to be the exact opposite of a MITM, but what do I know? Where does it say that if google.com has Angela Merkel's personal certificate instead of Google's one, the browser shall present it as a secure connection?
      - phendrenad2 3y ago
        I recommend reading the eff.org article linked above. It states: "Article 45 forbids browsers from enforcing modern security requirements on certain CAs without the approval of an EU member government. Which CAs? Specifically the CAs that were appointed by the government, which in some cases will be owned or operated by that selfsame government." and: "The current text of Article 45 requires that browsers trust CAs appointed by governments, and prohibits browsers from enforcing any security requirements on those CAs beyond what is approved by ETSI. In other words, it sets an upper bar on how much security browsers can require of CAs" and: "This upper bar on security may even ban browsers from enforcing Certificate Transparency" If you can't connect the dots and understand why people are upset, I can't help you.
- immibis 3y ago
  Government-issued identity verification is at least as good as private-entity-issued identity verification, since, you know, the government is the one with the databases of identities.
redder23 3y ago
It's not FUD it's the truth, they OBVIOUSLY want to control everything and remove privacy and enable government surveillance. They have just proven that by trying over and over again. They just know they can not blatantly outlaw Linux or things like that, that is why they try to sneak in shit like this with some buried text on the legislation. If they could at the flip of a finger outlaw Linux and things like that and impose total control, they would for sure do it instantly. It's just that it's too established, too common so there would be too much outrage, so they try to break encryption this way instead. If they had their way, they would have a total control!
- immibis 3y ago
  This is the bill, right? There may be a newer version I didn't find. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52021PC0281 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Can you indicate which parts are objectionable on the grounds of leading to a totalitarian surveillance dystopia?
  - Saline9515 3y ago
    It's a slippery slope. In my language (french), we call it "sausage politics", where you take small slices of your freedom one by one. This regulation is unwanted by anyone in the EU, creates security risks, and relies mainly on "trust me I won't do anything bad", that we all know is not going to happen. Also, laws can't be reverted in the EU semi-dictatorial regime, so, such things are really dangerous. Each year that goes, I'm thinking of a plan to leave, as our freedoms get lower and lower. Recently, the digital services' EU gauleiter declared that "content calling for rebellion" should be deleted from social media. Same goes with AML, and with the digital ID, where your government will have a single key allowing to know every service you're registered to. And let's not speak about the CBDC.
  - redder23 3y ago
    I will not do what you ask because you will not believe it anyway. You are desperately clinging on to some failed mindset that they are out for you because you like that they force Apple to use USB-C or whatever. You also seem not to read the actual point of the objection everyone has. They want to SPY ON EU citizens! WTF are you not understanding about this? Its all explained in the EFF article and countless others that are on top of HN right now. If you not see the INTENTIONS and the slow creeping dystopia you are blind. I am not going to search some specific text part out for you that proves that, its perfectly obvious for people who follow just a little bit of news and have common sense.