3 ms·

Everyone commenting against it are just following the bandwagon that "controlled b the state = bad". No one has a compelling argument against the implementation

Everyone commenting against it are just following the bandwagon that "controlled b the state = bad". No one has a compelling argument against the implementation proposal. I don't think this is as a red flag as the other EU proposal which are very threatening to privacy and security, like Chat Control and the mandatory EU-wide government CA root certificate. EDIT: a quick search shows up that this can actually be the eIDAS. if it's the latter, it's a big problem.

isodev 3y ago
The part of the eIDAS that's problematic is the enforced browser certificate configuration which is just one aspect of the whole thing (and probably will be removed from the final version). Conspiracy theories aside, having my electronic id recognized anywhere in the EU will save a lot of "scan and upload a PDF of your ID" moments. Not to mention the convenience of managing access to my data from the comfort of my sofa.
- Ekaros 3y ago
  Scanning and uploading PDF feels just crazy... The scans pictures and whatever can be stored, and with modern photo edits even reused. Single one-time authentication flow makes so much more sense from security viewpoint.
- xinayder 3y ago
  I agree with that. Several countries already have their own electronic ID - Estonia, Netherlands (they have a digital wallet app available on F-Droid), Italy. This is just standardization, which is a benefit. The eIDAS problem is not even about having a root certificate in place but severely lowering the bar for the security aspects of the root certificates and mandating browsers to accept it even if those certificates use weak cryptographic algorithms.
  - lunarimiso 3y ago
    Funny how when it comes to EU themselves, it OK to skimp on the security. But when it us, we have to abide by 1000x different EN certs, that are either outdated, unreasonable or unnecessary. In general, I am losing my trust and positive view on EU..
    - lock-the-spock 3y ago
      Don't buy the simplified narrative... it's a complex process and this is far from a final text. Moreover, the legislative bodies legislate principles, the implementation still will need to be done by technical experts in a secure way.
lock-the-spock 3y ago
No disagreement in substance but I want to stress that the things you mention are all by different entities. The EU is basically a meta government (supranational organisation) with the commission playing the role of government and ministries, accompanied by a parliament and the council of member state ministers/heads of state as upper house, and then various agencies and bodies you'd also expect to see nationally. EU would be when there's a final legislation, before that it is largely proposals (commission) or individual instituripns' views (parliament or council) and often various other entities are also cited as 'eu' positions even when they only represent a certain position/role or often even are just lobbies (BusinessEurope for example). All this just to say that often what is given as an "EU view" is not actuall a consensus but a proposal or negotiating position.

isodev 3y ago

The part of the eIDAS that's problematic is the enforced browser certificate configuration which is just one aspect of the whole thing (and probably will be removed from the final version). Conspiracy theories aside, having my electronic id recognized anywhere in the EU will save a lot of "scan and upload a PDF of your ID" moments. Not to mention the convenience of managing access to my data from the comfort of my sofa.

Ekaros 3y ago
Scanning and uploading PDF feels just crazy... The scans pictures and whatever can be stored, and with modern photo edits even reused. Single one-time authentication flow makes so much more sense from security viewpoint.
xinayder 3y ago
I agree with that. Several countries already have their own electronic ID - Estonia, Netherlands (they have a digital wallet app available on F-Droid), Italy. This is just standardization, which is a benefit. The eIDAS problem is not even about having a root certificate in place but severely lowering the bar for the security aspects of the root certificates and mandating browsers to accept it even if those certificates use weak cryptographic algorithms.
- lunarimiso 3y ago
  Funny how when it comes to EU themselves, it OK to skimp on the security. But when it us, we have to abide by 1000x different EN certs, that are either outdated, unreasonable or unnecessary. In general, I am losing my trust and positive view on EU..
  - lock-the-spock 3y ago
    Don't buy the simplified narrative... it's a complex process and this is far from a final text. Moreover, the legislative bodies legislate principles, the implementation still will need to be done by technical experts in a secure way.

lock-the-spock 3y ago

No disagreement in substance but I want to stress that the things you mention are all by different entities. The EU is basically a meta government (supranational organisation) with the commission playing the role of government and ministries, accompanied by a parliament and the council of member state ministers/heads of state as upper house, and then various agencies and bodies you'd also expect to see nationally. EU would be when there's a final legislation, before that it is largely proposals (commission) or individual instituripns' views (parliament or council) and often various other entities are also cited as 'eu' positions even when they only represent a certain position/role or often even are just lobbies (BusinessEurope for example). All this just to say that often what is given as an "EU view" is not actuall a consensus but a proposal or negotiating position.