4 ms·

Why don't the browsers make the trusted CA root set a choice? Have a radio button selector between the "EU sanctioned", "Browser safe-default", and user select

Why don't the browsers make the trusted CA root set a choice? Have a radio button selector between the "EU sanctioned", "Browser safe-default", and user selectable? Make radio button panel really easy to find and update.

gruez 3y ago
What happens when you selected "Browser safe-default" but your bank's website presents an EU certificate? Sure, you can probably add a "trust only for this site" option, but soon enough users are going to get used to this and will blindly click that button every time the warning shows up, which kills the whole point.
- supriyo-biswas 3y ago
  Parent's suggestion is to accept the eIDAS certs only within the EU.
  - gruez 3y ago
    Are we reading the same comment? The one I'm reading only mentions having a "radio button selector" with no reference to making it geo specific. Regardless, even if it were geo specific, then what? I guess it's fine for american users, but what about all the EU users that might be getting MITMed?
    - supriyo-biswas 3y ago
      If the law mandates a MITM capability, and users in the EU don’t consider it important enough to oppose said law, there isn’t really a choice and the region scoped certs may be the only choice moving forward.
      - ThePowerOfFuet 3y ago
        There will be a fork of Firefox in that case.
        avh3 3y ago
        Right? I came here to look for potential remedies when this goes through. Forking browsers sounds like a good solution. Or am I missing something?
        agwa 3y ago
        Outside of the EU, browser vendors will continue to ship browsers without eIDAS CAs, so just VPN into a non-EU country to download your browsers. But you'll probably have to keep an EU version on hand in order to access EU gov sites, EU banks, and likely EU businesses if/when the EU government decides to force businesses to use eIDAS certs for their sites.
  - radicalbyte 3y ago
    The regulation should be changed such that the QWAC is only ever used to verify during an eIDAS transaction. The most practical way to achieve that is to legislate for a new API in the browser and implement this in the application layer. That will take some time to implement, however eIDAS itself will also take some time to implement. This would involve the browsers implementing a new eIDAS-only CA store within their browsers. Which is very easy to do as it's new and the API is regulated thus fixed. The verification flow would work by exchanging attributes (i.e. browser sends crypto-random message to server, server signs it, browser verifies). It adds work to the audit of eIDAS solutions (implementers will f** it up en masse as most of the involved parties are hopelessly bad) but it's better than the alternatives.
    - agwa 3y ago
      The browsers in fact proposed an alternative that decoupled eIDAS's real-world-identity verification from TLS connection verification, but the EU rejected it.
      - supriyo-biswas 3y ago
        Could you please link to the document in question for reference?
mardifoufs 3y ago
The EU seems to really hate not having control over things, so they will just mandate having some hard-coded certs, that are present regardless of choice. It's like a pathological thing in Europe, and the recent legislation coming from there seems very inspired by the great firewall. It's like they gave up on trying to actually innovate or grow a tech industry (composed of more than the odd successful euro tech corporation) after years of trying and now they are just banking on their market size to push more and more ridiculous legislation. I can't wait for that to backfire, or for corporations to not bother anymore (imo the GPDR is the only good thing that came out of this non stop spree of legislation, and that's almost half a decade old now). At least with China, whatever they do or restrict usually only affects their own home grown tech industry. The funny thing is that if the US gov seriously pushed for something similar to the recent laws (chatcontrol, client side scanning, the weird copyright laws, the "fake news" thing, etc), Europeans would call it fascism or typical American thirdworldism (which is extremely ironic regardless of context).
- sleevi 3y ago
  > and the recent legislation coming from there seems very inspired by the great firewall. https://www.europarl.europa.eu/RegData/etudes/STUD/2020/648784/IPOL_STU(2020)648784_EN.pdf https://www.europarl.europa.eu/RegData/etudes/STUD/2020/6487...
- supriyo-biswas 3y ago
  This is also the same reason why calling upon European citizens to see the negatives of the law and voice their concerns about it isn’t gonna work. Agree partly the GDPR though, since it requires disclosure about how collected data is gonna be used.
- sofixa 3y ago
  > imo the GPDR is the only good thing that came out of this non stop spree of legislation, and that's almost half a decade old now What do you think of the Digital Markets and Digital Services Acts?
- fullspectrumdev 3y ago
  One of the biggest reasons “the EU” can’t seem to home grow a tech industry is fragmentation - each member state has its own bizarre tax rules, and it’s extremely tedious/difficult, even today, to do cross border employment. A company based in Ireland for example, has a really hard time employing someone in Germany, without spinning up a “local branch” in Germany, and thus having to comply with German tax rules as well. Rules around contractors vary wildly and don’t simplify matters much. The “solution” is to accept the overheads of a company like Remote or similar who act as an employer of record, but that’s a bodge. No member state has any real incentive to simplify cross border employment/business rules, so it drags everyone down. It gets even worse for startups when rules around equity, etc, vary wildly country to country - some countries have extremely hostile tax rules around equity that may never be realized.

gruez 3y ago

What happens when you selected "Browser safe-default" but your bank's website presents an EU certificate? Sure, you can probably add a "trust only for this site" option, but soon enough users are going to get used to this and will blindly click that button every time the warning shows up, which kills the whole point.

supriyo-biswas 3y ago
Parent's suggestion is to accept the eIDAS certs only within the EU.
- gruez 3y ago
  Are we reading the same comment? The one I'm reading only mentions having a "radio button selector" with no reference to making it geo specific. Regardless, even if it were geo specific, then what? I guess it's fine for american users, but what about all the EU users that might be getting MITMed?
  - supriyo-biswas 3y ago
    If the law mandates a MITM capability, and users in the EU don’t consider it important enough to oppose said law, there isn’t really a choice and the region scoped certs may be the only choice moving forward.
    - ThePowerOfFuet 3y ago
      There will be a fork of Firefox in that case.
      - avh3 3y ago
        Right? I came here to look for potential remedies when this goes through. Forking browsers sounds like a good solution. Or am I missing something?
        agwa 3y ago
        Outside of the EU, browser vendors will continue to ship browsers without eIDAS CAs, so just VPN into a non-EU country to download your browsers. But you'll probably have to keep an EU version on hand in order to access EU gov sites, EU banks, and likely EU businesses if/when the EU government decides to force businesses to use eIDAS certs for their sites.
- radicalbyte 3y ago
  The regulation should be changed such that the QWAC is only ever used to verify during an eIDAS transaction. The most practical way to achieve that is to legislate for a new API in the browser and implement this in the application layer. That will take some time to implement, however eIDAS itself will also take some time to implement. This would involve the browsers implementing a new eIDAS-only CA store within their browsers. Which is very easy to do as it's new and the API is regulated thus fixed. The verification flow would work by exchanging attributes (i.e. browser sends crypto-random message to server, server signs it, browser verifies). It adds work to the audit of eIDAS solutions (implementers will f** it up en masse as most of the involved parties are hopelessly bad) but it's better than the alternatives.
  - agwa 3y ago
    The browsers in fact proposed an alternative that decoupled eIDAS's real-world-identity verification from TLS connection verification, but the EU rejected it.
    - supriyo-biswas 3y ago
      Could you please link to the document in question for reference?

mardifoufs 3y ago

The EU seems to really hate not having control over things, so they will just mandate having some hard-coded certs, that are present regardless of choice. It's like a pathological thing in Europe, and the recent legislation coming from there seems very inspired by the great firewall. It's like they gave up on trying to actually innovate or grow a tech industry (composed of more than the odd successful euro tech corporation) after years of trying and now they are just banking on their market size to push more and more ridiculous legislation. I can't wait for that to backfire, or for corporations to not bother anymore (imo the GPDR is the only good thing that came out of this non stop spree of legislation, and that's almost half a decade old now). At least with China, whatever they do or restrict usually only affects their own home grown tech industry. The funny thing is that if the US gov seriously pushed for something similar to the recent laws (chatcontrol, client side scanning, the weird copyright laws, the "fake news" thing, etc), Europeans would call it fascism or typical American thirdworldism (which is extremely ironic regardless of context).

sleevi 3y ago
> and the recent legislation coming from there seems very inspired by the great firewall. https://www.europarl.europa.eu/RegData/etudes/STUD/2020/648784/IPOL_STU(2020)648784_EN.pdf https://www.europarl.europa.eu/RegData/etudes/STUD/2020/6487...
supriyo-biswas 3y ago
This is also the same reason why calling upon European citizens to see the negatives of the law and voice their concerns about it isn’t gonna work. Agree partly the GDPR though, since it requires disclosure about how collected data is gonna be used.
sofixa 3y ago
> imo the GPDR is the only good thing that came out of this non stop spree of legislation, and that's almost half a decade old now What do you think of the Digital Markets and Digital Services Acts?
fullspectrumdev 3y ago
One of the biggest reasons “the EU” can’t seem to home grow a tech industry is fragmentation - each member state has its own bizarre tax rules, and it’s extremely tedious/difficult, even today, to do cross border employment. A company based in Ireland for example, has a really hard time employing someone in Germany, without spinning up a “local branch” in Germany, and thus having to comply with German tax rules as well. Rules around contractors vary wildly and don’t simplify matters much. The “solution” is to accept the overheads of a company like Remote or similar who act as an employer of record, but that’s a bodge. No member state has any real incentive to simplify cross border employment/business rules, so it drags everyone down. It gets even worse for startups when rules around equity, etc, vary wildly country to country - some countries have extremely hostile tax rules around equity that may never be realized.