4 ms·

Parent's suggestion is to accept the eIDAS certs only within the EU.

gruez 3y ago
Are we reading the same comment? The one I'm reading only mentions having a "radio button selector" with no reference to making it geo specific. Regardless, even if it were geo specific, then what? I guess it's fine for american users, but what about all the EU users that might be getting MITMed?
- supriyo-biswas 3y ago
  If the law mandates a MITM capability, and users in the EU don’t consider it important enough to oppose said law, there isn’t really a choice and the region scoped certs may be the only choice moving forward.
  - ThePowerOfFuet 3y ago
    There will be a fork of Firefox in that case.
    - avh3 3y ago
      Right? I came here to look for potential remedies when this goes through. Forking browsers sounds like a good solution. Or am I missing something?
      - agwa 3y ago
        Outside of the EU, browser vendors will continue to ship browsers without eIDAS CAs, so just VPN into a non-EU country to download your browsers. But you'll probably have to keep an EU version on hand in order to access EU gov sites, EU banks, and likely EU businesses if/when the EU government decides to force businesses to use eIDAS certs for their sites.
radicalbyte 3y ago
The regulation should be changed such that the QWAC is only ever used to verify during an eIDAS transaction. The most practical way to achieve that is to legislate for a new API in the browser and implement this in the application layer. That will take some time to implement, however eIDAS itself will also take some time to implement. This would involve the browsers implementing a new eIDAS-only CA store within their browsers. Which is very easy to do as it's new and the API is regulated thus fixed. The verification flow would work by exchanging attributes (i.e. browser sends crypto-random message to server, server signs it, browser verifies). It adds work to the audit of eIDAS solutions (implementers will f** it up en masse as most of the involved parties are hopelessly bad) but it's better than the alternatives.
- agwa 3y ago
  The browsers in fact proposed an alternative that decoupled eIDAS's real-world-identity verification from TLS connection verification, but the EU rejected it.
  - supriyo-biswas 3y ago
    Could you please link to the document in question for reference?

Are we reading the same comment? The one I'm reading only mentions having a "radio button selector" with no reference to making it geo specific. Regardless, even if it were geo specific, then what? I guess it's fine for american users, but what about all the EU users that might be getting MITMed?

supriyo-biswas 3y ago
If the law mandates a MITM capability, and users in the EU don’t consider it important enough to oppose said law, there isn’t really a choice and the region scoped certs may be the only choice moving forward.
- ThePowerOfFuet 3y ago
  There will be a fork of Firefox in that case.
  - avh3 3y ago
    Right? I came here to look for potential remedies when this goes through. Forking browsers sounds like a good solution. Or am I missing something?
    - agwa 3y ago
      Outside of the EU, browser vendors will continue to ship browsers without eIDAS CAs, so just VPN into a non-EU country to download your browsers. But you'll probably have to keep an EU version on hand in order to access EU gov sites, EU banks, and likely EU businesses if/when the EU government decides to force businesses to use eIDAS certs for their sites.

radicalbyte 3y ago

The regulation should be changed such that the QWAC is only ever used to verify during an eIDAS transaction. The most practical way to achieve that is to legislate for a new API in the browser and implement this in the application layer. That will take some time to implement, however eIDAS itself will also take some time to implement. This would involve the browsers implementing a new eIDAS-only CA store within their browsers. Which is very easy to do as it's new and the API is regulated thus fixed. The verification flow would work by exchanging attributes (i.e. browser sends crypto-random message to server, server signs it, browser verifies). It adds work to the audit of eIDAS solutions (implementers will f** it up en masse as most of the involved parties are hopelessly bad) but it's better than the alternatives.

agwa 3y ago
The browsers in fact proposed an alternative that decoupled eIDAS's real-world-identity verification from TLS connection verification, but the EU rejected it.
- supriyo-biswas 3y ago
  Could you please link to the document in question for reference?