3 ms·

As far as I understand it, the main problem / risk is not that it's an eID system (which many EU countries already have), but that government CAs are being intr

As far as I understand it, the main problem / risk is not that it's an eID system (which many EU countries already have), but that government CAs are being introduced into browsers and devices without the possibility of removing them - even if those CAs don't conform to current CA standards like certificate transparency. We already have CAs from e.g. the German Bundesdruckerei in trust stores, that's not new, but those can be distrusted, if one wants to. The law may disallow this, and those CAs can be used to e.g. MitM TLS connections. See: https://blog.mozilla.org/netpolicy/files/2023/11/eIDAS-Industry-Letter.pdf https://blog.mozilla.org/netpolicy/files/2023/11/eIDAS-Indus... and https://nce.mpi-sp.org/index.php/s/cG88cptFdaDNyRr https://nce.mpi-sp.org/index.php/s/cG88cptFdaDNyRr

einarfd 3y ago
I was not aware of this part. Not being able to disable CA seems like a weird thing to add. In practice how much difference will this make, the list of trusted CA in browser seems to already be a bit of a problem? In any case what I want out of this legislation is that you can use an eID from country a in country b. That, that isn't possible is the main downside of the current setup.
- Thorrez 3y ago
  Major browsers today only accept CAs that use certificate transparency. This law will force them to accept CAs that don't use certificate transparency. If a CA misbehaves, browsers will distrust it. That happened to Symantec, which was the largest CA. This law will prevent browsers from distrusting CAs that misbehave. https://news.ycombinator.com/item?id=38112520 https://news.ycombinator.com/item?id=38112520
dvfjsdhgfv 3y ago
Technically, I can't imagine how this could be implemented. In the worst case, it would mean that everybody caring for privacy would use alternative builds. But realistically, a week after publishing the first browser with this kind of hostile certificate, we would have several hacks on how to disable it. It simply makes no sense at all.

einarfd 3y ago

I was not aware of this part. Not being able to disable CA seems like a weird thing to add. In practice how much difference will this make, the list of trusted CA in browser seems to already be a bit of a problem? In any case what I want out of this legislation is that you can use an eID from country a in country b. That, that isn't possible is the main downside of the current setup.

Thorrez 3y ago
Major browsers today only accept CAs that use certificate transparency. This law will force them to accept CAs that don't use certificate transparency. If a CA misbehaves, browsers will distrust it. That happened to Symantec, which was the largest CA. This law will prevent browsers from distrusting CAs that misbehave. https://news.ycombinator.com/item?id=38112520 https://news.ycombinator.com/item?id=38112520

dvfjsdhgfv 3y ago

Technically, I can't imagine how this could be implemented. In the worst case, it would mean that everybody caring for privacy would use alternative builds. But realistically, a week after publishing the first browser with this kind of hostile certificate, we would have several hacks on how to disable it. It simply makes no sense at all.