21 ms·

Some observations on the final text of the European Digital Identity framework

169 points by raybb 3y ago

asdffdasasdf 3y ago
> We were concerned about the phrasing of Article 45, that lays down a requirement for browsers to recognize any certificate ... So same as today but with less steps? Most govs are already in you browser/OS CA list. And every single government force you to download their own cert and add to your browser at some point. There's no way to add that cert and say "limit this to gov.in only"! after you added that cert it is game over. e.g. https://pki.treas.gov/crl_certs.htm https://pki.treas.gov/crl_certs.htm https://www.bit.admin.ch/bit/en/home/themes/swiss-government-pki/certificate-service-provider-csp/rootzertifikate/swiss-government-root-ca-ii.html https://www.bit.admin.ch/bit/en/home/themes/swiss-government... plus all the gov CAs already in your browser (looking at firefox source they include, guangdong, taiwan, honkkong, netherlands and Greece. IOS 16 contains spain, belgium, something called "Government Root Certification Authority 00 B6 4B 88 07 E2 23 EE C8 5C 12 AD A6 0E 06 A1 F2" :shrug, greece, hk, Netherlands, Switzerland.
- barbazoo 3y ago
  > And every single government force you to download their own cert Is that true though? I’ve immigrated quite a bunch (western world only) and never had to download a certificate when interacting with the government.
  - Maken 3y ago
    They used yo. Now most governments just have their own "proper" CAs which are included by default in web browsers. If you look at the default CA list of Firefox or Chrome you will see most of them are public agencies.
    - theonlybutlet 3y ago
      I think Certificate transparency checks mean you should be able to tell if the certificate was fraudulently issued for a domain that is not with the CA. (This circumvents that.) In your scenario, if the domains CA is the government CA anyway, then it's fair game. Most domains' CA will be cloudflare or whatever not the government CA.
  - asdffdasasdf 3y ago
    here's one example, the brazil irs https://www.receita.gov.br/ https://www.receita.gov.br/ good lucky finding the cert if you didn't download your firefox in brazilian portuguese or didn't register you apple device in brazil. I mean, it is not difficult to find the cert, but it is a pain for travelers.
    - grotorea 3y ago
      The problem seems to be "wrong domain", not "CA not recognized". You sure you have the right URL?
      - asdffdasasdf 3y ago
        i'm mobile. probably got the wrong url. only have bookmarks for the ca certs https://www.gov.br/iti/pt-br/assuntos/repositorio/repositorio-ac-raiz https://www.gov.br/iti/pt-br/assuntos/repositorio/repositori...
        ric2b 3y ago
        But what do you need these certs for, is there a national website that gets an "insecure" warning if you visit it with a foreign version of Firefox?
        asdffdasasdf 3y ago
        yeah, the tax preparation website and others.
- Astraco 3y ago
  As far as I know my country doesn't force me to download any certificate, and Firefox doesn't have a cert issued by my government.
  - ysofunny 3y ago
    nonetheless your government can force your ISP to do so many things
    - droffel 3y ago
      Without a valid certificate, any ISP MITM attacks would be obvious
    - Astraco 3y ago
      Yeah, and send somebody to my house yo shot me in the head. But none of them is happening.
  - the_mitsuhiko 3y ago
    I’m curious though what CA your country uses for governmental services. Historically a lot of EU countries used some less than stellar CAs.
    - Astraco 3y ago
      My local government is using GlobalSign and the Tax Agency (and probably all of the central government) uses Entrust.
- kmeisthax 3y ago
  Currently the default trust list in your browser is solely decided by your browser. More specifically there's an organization called the CA/Browser Forum where all the browser vendors are. If you want to become a CA today, you go to the Forum, submit your proposal, and then the browser vendors decide whether or not you're trustworthy. If a CA misissues certificates or otherwise screws up security, that evidence goes to the Forum and then browsers decide how to deal with that CA. Notably, in the worst case scenario, the browser developers can and have decided to completely distrust an entire CA, completely destroying their business. This has happened multiple times. eIDAS changes this by, effectively, creating a special EU government analogue to the CA/Browser Forum. All browser developers in the EU have to trust eIDAS's CAs. This is a transfer of power from a voluntary industry consortium to appointed EU technocrats. All those existing government CAs are currently audited by CA/B. If Greece gets caught misissuing certificates they can have their CA roots revoked by the browser vendors. The concern is that under eIDAS, the EU could just not revoke the certificate, and the browser vendors' hands would be tied. They'd be forced to accept known bad CAs and every cert they sign, including the spyware ones.
  - ko27 3y ago
    > This is a transfer of power from a voluntary industry consortium to appointed EU technocrats Or a transfer of power from US-centric companies to actual sovereign bodies. I don't want to live in a cyberpunk world. This sounds good to me. Note that browsers are still allowed to remove them if they are compromised.
    - danielheath 3y ago
      Browsers are allowed to ask permission to remove them if they are compromised. They still have to receive that permission before they can do it.
      - dataking 3y ago
        I believe it is well understood by now that users tend to ignore security warnings; anyone serious about computer security will not accept this as a solution. We don't even apply security-critical patches reliably.
- tsimionescu 3y ago
  The game is not over just because you trust a CA. If they sign a certificate for a domain, they have to also publish that they did (in the CT logs) before browsers will accept it. If they do so for an entity that didn't ask for it, that will be investigated by browser and OS vendors and it may easily end up with the CA becoming untrusted.
  - theonlybutlet 3y ago
    Well this is it, they will no longer become untrusted. They can however, ask to have the offending certificate revoked if they have proof it's bad and once they have permission from the authorities (they kind of have to grant the permission if there's evidence but will be on the authorities timeline).
  - rcxdude 3y ago
    AFAIK there is no requirement for CT in this regulation, and it prevents browsers from requiring it to accept the certificates.
- neodypsis 3y ago
  In my own country, for digital signature purposes, the official Windows installer provided by the government adds the country's Central Bank's CA for any purposes, even for software signatures. If you have a company, they also force you to use their own application for making some annual declarations. That software asks for your OS user password using a home-brew dialog so that it can update itself. If you don't provide the password then it blocks and you can't make the obligatory declaration. If you don't send said declaration, you are liable for big fines...
  - theonlybutlet 3y ago
    Well that's dystopian.
    - neodypsis 3y ago
      The same central bank is asking banks (and other entities) for unanonymized information about costaricans, including bank deposits, to publish an "information package" indexed by geographical location. This under the pretext of being required by the IMF. I found it curious that nobody in the legislative commission (akin to a "congressional hearing") tasked with looking into the matter has mentioned the importance of differential privacy.
  - noodlesUK 3y ago
    I’m curious what country this is, if you’re willing to share. I’m surprised any business filing is using a desktop app rather than on the web these days.
    - neodypsis 3y ago
      Costa Rica. And before you can download some of the installers, they ask for your unique digital signature card number.
    - neodypsis 3y ago
      > I’m surprised any business filing is using a desktop app rather than on the web these days. It's a complete nightmare. If you want to use some other digital services you are restricted to specific browser versions, some only allow you to use Windows, and in some cases the unsigned installer is only available via HTTP.
- amluto 3y ago
  I filed the obvious bug against Firefox ten years ago :( https://bugzilla.mozilla.org/show_bug.cgi?id=953322 https://bugzilla.mozilla.org/show_bug.cgi?id=953322
  - devman0 3y ago
    Do browsers check the CAA records for a domain if they exist? Seems like that would solve the issue.
    - ekr____ 3y ago
      As far as I know, they do not. Even if they did, it doesn't really address the problem. In order to mount an effective impersonation attack, the attacker needs to either control the network or the DNS. In either case, they will generally be able to remove or change the CAA record; remember that DNSSEC deployment is comparatively rare and browsers do not verify DNSSEC in any case.
    - g_p 3y ago
      No, and the standard (RFC 6844) says they must not. That's because, in the eyes of the standard, a CAA record is applicable at time of issuance, but a valid certificate could have been previously issued (and still be valid), even though you've moved to a new CAA record for your next certificate. "Relying Applications MUST NOT use CAA records as part of certificate validation." For what you're looking for, DANE (RFC 6698) would be more useful and enable the browser to check the presented certificate against DNS (so effectively CAA on the client).
ganzuul 3y ago
Weasel words. "Running additional security checks" is certainly going to mean the UI checks, not anything on the backend. Cookie banners happened because US devs didn't steelman EU regs. Petty territorial behavior. This looks like someone trying not to learn their lesson.
- nonethewiser 3y ago
  > Cookie banners happened because US devs didn't steelman EU regs. What would steelmaning EU regs have looked like? Not really sure what you mean by this.
  - logifail 3y ago
    > What would steelmaning EU regs have looked like? A simple "decline [all]" / "accept" choice, not a huge list with dozens of sliders for dozens of options each labelled "legitimate interest" all of which are set to "Accept" by default?
  - ganzuul 3y ago
    A header to opt in instead of a banner... I'm sorry now I'm confused. Is UI design this hard? Is this neurotypical?
    - tempodox 3y ago
      Yes, stupid shit like punishing your users with abusive UI for regulations you dislike is neurotypical.
  - Tuna-Fish 3y ago
    Only use cookies to provide services that the user specifically asks you to provide. Never use the cookies to anything where the action wasn't initiated by the user. That way, nothing you do requires asking for consent and you don't need a stupid banner.
- agbrrw 3y ago
  >Cookie banners happened because US devs didn't steelman EU regs. EU sites have the same amount of cookie banners as US ones. (ie, all major sites have one)
theonlybutlet 3y ago
So basically: Governments are being given authority to create dodgey certificates, Browsers can't take it down if discovered unless they have evidence it's being used and will be harmful, and Browsers need to advise and wait for the requisite approval [of authorities] for when the browser can take it down (i.e. the authorities can decide how long it stays up). Or am I missing something?
- Astraco 3y ago
  I think they are just certs to identify yourself to EU or national insititutions for procedures (filling taxes and so), like the certs some European countries issue.
  - sigilis 3y ago
    The proposed certificate authorities can generate certificates for any entity, not just EU sites and not just new ones. They would have to be treated as valid, per the regulation. Trust is the critical component in the PKI infrastructure. When it’s subverted and you can’t just remove the offending authorities, then it’s not really working properly anymore.
    - devman0 3y ago
      Seems like moving to something like DANE would be a good way forward. Seems like having the site owners tell the public what cert should be expected via DNS with appropriate signatures would obviate the need for CAs. (Yes I realize that this just moves the trust anchor to the DNS root authority, but it does reduce the number of authorities you need to trust).
      - JoshTriplett 3y ago
        Lots of things would help protect against this, but this regulation purports to prevent the browser vendor from implementing any stronger security mechanisms than those specified by the regulation. If DANE prevented a certificate from one of these governmental CAs from being accepted, this regulation would try to prevent using DANE.
INTPenis 3y ago
I'm speaking as a naive end user here. BankID in Sweden turns 20 this year. I've been using it for 15 years. Started out as an app on Mac, Windows, now it's on your cellphone. People have critizied it but in 15 years I have yet to hear about a security issue with the app or the protocol. I have yet to hear about a problem with it. All I see are advantages. And Sweden isn't alone in using some sort of eID. So how come the EU can't just build on existing experience? Why are they making it more difficult?
- konschubert 3y ago
  One disadvantage: As a temporary visitor to Sweden, since you don’t have a personnummer, you’re fucked.
  - nextos 3y ago
    Yes, this is a huge problem. In fact, when looking into Swedish jobs, you are usually advised to try to get a personnummer ASAP to make your relocation as smooth as possible. Denmark also has similar problems with their digital ID. Any unusual scenario turns into a nightmare. For instance, I moved abroad during their transition from a codecard to an app, and I lost access to my bank account and all ID-linked services despite warning my bank about the potential problems months ahead of the forced transition. The only way to regain access is to travel back to Denmark and visit my bank or my local council.
    - dariosalvi78 3y ago
      an this is why a EU wide system is needed. I hold 3 digital identities (Spain, Italy and Sweden) and, believe me, it's not fun.
      - nextos 3y ago
        I agree, lack of standardization discourages freedom of movement. However, it is also necessary to make sure data privacy is factored in.
      - 3y ago
motohagiography 3y ago
This is pretty browser specific. To sidestep this, we only need new chat and forum protocols with clients that don't require implementing every concievable data format handler from the last 35 years.
shortsunblack 3y ago
The discussion around eIDAS lacks the nuance of digital sovereignty. You can have issues all you want with the legal text, but what we have here is a one-sided take that completely ignores any aspirations to digital sovereignty. U.S. already has shown it is willing to use major infrastructure to deal with its adversaries. That was shown as it weaponized the SWIFT payments system. U.S. routinely seizes domains owned by its U.S.-based registries. Browser vendors are not democratically ran institutions. One browser is owned by an ad broker and seller; the other browser is owned by an astroturfed* org that is 80% funded by the said ad broker and seller. Browsers not being allowed to stop their European users from accessing their European websites IS what I want. I do not want it to be possible for U.S. to coerce browsers to take out root stores to my bank, for instance. And as for security requirements, that's just a load of BS. eIDAS is A+B, not A or B. The security requirements in the legal text are equivalent or higher that of cabforum's, minus the certificate transparency bit. And that's a fair critique. Such mechanism needs to be discussed and plausibly adopted. And we have the democratic institutions for that discourse. It's called ETSI. And browser vendors are welcome to participate in ETSI and give their suggestions of allowing certificate transparency. They aren't doing that; in good faith anyway! They're not participating in a democratic standards body, instead they're running propaganda campaigns trying to rile up their users. To sum up, I want EU to gain digital sovereignty. Some of critiques are valid (I certainly don't like EV-style UI prescriptions), others are just bullshit. Bullshit we saw before GDPR. "The internet is going to be destroyed!". The internet wasn't destroyed. The internet is better after GDPR. Democratic institutions are good, ad funded browsers engaging in practices with zero accountability aren't. *plausibly hyperbole; but I'm not sure seeing that Mozilla has shown itself to be useless, as it took pro-Google position in search engine anti-trust case
- JoshTriplett 3y ago
  > The security requirements in the legal text are equivalent or higher that of cabforum's, minus the certificate transparency bit. And that's a fair critique. Such mechanism needs to be discussed No, under no circumstances should browser vendors be forced to "discuss" the development and application of higher security standards with an adversary with a vested interest in holding those standards back. You cannot have a reasonable "discussion" with an entity that claims a regulatory veto. Certificate Transparency is a great example: it's a reliable way to detect MITM certificates. "Here's an established industry standard for detecting improperly issued certificates and rejecting them to prevent interception of communication, allowing revocation of misused CAs." "So what happens when law enforcement uses a CA to issue a certificate for interception pertaining to a warrant?" "Like we said, it detects improperly issued certificates and rejects them to prevent interception of communications, so we'd detect that and revoke the CA." Further conversation after that point goes very differently depending on whether the governmental entity is empowered to veto or not. > browser vendors are welcome to participate in ETSI and give their suggestions of allowing certificate transparency "suggestions"? It's their software; any mechanism that attempts to prevent them from defining their own stronger security standards is broken and should be destroyed via every possible route. If you want digital sovereignty, make a case for your requirements with the software people want to use. If that case is "we want to reduce security", you should lose; if you don't something is very wrong with the process.
gustavus 3y ago
So here's a scenario I haven't seen brought up yet. Elbonian hackers manage to steal the singing key of kneebonia who is part of the EU (and also does IT as well as you would expect a European national government to do) They start publishing a ton of their own certs and start MITM everything out the wazoo. In the current environment this is noted by the community quickly they respond and revoke the Kneebonian cert, they understand what is happening, they understand why it is happening, they understand why it is bad and they have a vested interest in stopping it. Compare under the EU rules. The browser vendors cannot now revoke the cert of their own violation without risking significant penalties. They start the process of trying to get it revoked. The individuals involved are largely beauracrats and civil servants the likes of Sir Humphrey. They do not understand the technical jargon they just know the nerds are getting upset. They'll work on discussing the proposed change by evaluating a written request in the Orwellian named "Committee for Public Internet Safety and Electronic Information Security and Cyber protection" this committee meets 3 times a year on March 31st, October 16th and February 29th. In the meantime the entire underlying security model of the internet is broken. Now some might say "well if it's an emergency they'll respond immediately there will be public outcry and people's lives being ruined." And if it becomes a big deal the EU will act promptly, they will create a taskforce immediately whose job will be to create a recommendation for individuals to serve in a committee to investigate the source of the problem and create a list of possible remediations that could resolve the problem, which it will then present to the parent committee who will draft a response..... Etc etc ad infenitum until everyone involved with the matter has died of old age, and if you think I'm exaggerating when has EU done anything quickly?
- izacus 3y ago
  Your case is exactly the same as some entity stealing the ability to issue passports for a country. Insinuating that people issuing national identifications don't understand the issue of forging said documents is some ridiculous techbro arrogance. We've been dealing with this shit for centuries and those "beaurocrats" you're insulting have probably gone through more more cases of fraud and forgery than you ever thought about in your life.
  - 3y ago
hknmtt 3y ago
historically, whatever a government gets involved in usually works out amazingly well. right?
- RandomLensman 3y ago
  Probably on average actually true (microprocessors and the internet come to mind, creation of "modern" cash back in antiquity, the formal code of law, sanitation, etc.), but with some colossal disasters in there, too.

169 points by raybb 3y ago

> We were concerned about the phrasing of Article 45, that lays down a requirement for browsers to recognize any certificate ... So same as today but with less steps? Most govs are already in you browser/OS CA list. And every single government force you to download their own cert and add to your browser at some point. There's no way to add that cert and say "limit this to gov.in only"! after you added that cert it is game over. e.g. https://pki.treas.gov/crl_certs.htm https://pki.treas.gov/crl_certs.htm https://www.bit.admin.ch/bit/en/home/themes/swiss-government-pki/certificate-service-provider-csp/rootzertifikate/swiss-government-root-ca-ii.html https://www.bit.admin.ch/bit/en/home/themes/swiss-government... plus all the gov CAs already in your browser (looking at firefox source they include, guangdong, taiwan, honkkong, netherlands and Greece. IOS 16 contains spain, belgium, something called "Government Root Certification Authority 00 B6 4B 88 07 E2 23 EE C8 5C 12 AD A6 0E 06 A1 F2" :shrug, greece, hk, Netherlands, Switzerland.

barbazoo 3y ago
> And every single government force you to download their own cert Is that true though? I’ve immigrated quite a bunch (western world only) and never had to download a certificate when interacting with the government.
- Maken 3y ago
  They used yo. Now most governments just have their own "proper" CAs which are included by default in web browsers. If you look at the default CA list of Firefox or Chrome you will see most of them are public agencies.
  - theonlybutlet 3y ago
    I think Certificate transparency checks mean you should be able to tell if the certificate was fraudulently issued for a domain that is not with the CA. (This circumvents that.) In your scenario, if the domains CA is the government CA anyway, then it's fair game. Most domains' CA will be cloudflare or whatever not the government CA.
- asdffdasasdf 3y ago
  here's one example, the brazil irs https://www.receita.gov.br/ https://www.receita.gov.br/ good lucky finding the cert if you didn't download your firefox in brazilian portuguese or didn't register you apple device in brazil. I mean, it is not difficult to find the cert, but it is a pain for travelers.
  - grotorea 3y ago
    The problem seems to be "wrong domain", not "CA not recognized". You sure you have the right URL?
    - asdffdasasdf 3y ago
      i'm mobile. probably got the wrong url. only have bookmarks for the ca certs https://www.gov.br/iti/pt-br/assuntos/repositorio/repositorio-ac-raiz https://www.gov.br/iti/pt-br/assuntos/repositorio/repositori...
      - ric2b 3y ago
        But what do you need these certs for, is there a national website that gets an "insecure" warning if you visit it with a foreign version of Firefox?
        asdffdasasdf 3y ago
        yeah, the tax preparation website and others.
Astraco 3y ago
As far as I know my country doesn't force me to download any certificate, and Firefox doesn't have a cert issued by my government.
- ysofunny 3y ago
  nonetheless your government can force your ISP to do so many things
  - droffel 3y ago
    Without a valid certificate, any ISP MITM attacks would be obvious
  - Astraco 3y ago
    Yeah, and send somebody to my house yo shot me in the head. But none of them is happening.
- the_mitsuhiko 3y ago
  I’m curious though what CA your country uses for governmental services. Historically a lot of EU countries used some less than stellar CAs.
  - Astraco 3y ago
    My local government is using GlobalSign and the Tax Agency (and probably all of the central government) uses Entrust.
kmeisthax 3y ago
Currently the default trust list in your browser is solely decided by your browser. More specifically there's an organization called the CA/Browser Forum where all the browser vendors are. If you want to become a CA today, you go to the Forum, submit your proposal, and then the browser vendors decide whether or not you're trustworthy. If a CA misissues certificates or otherwise screws up security, that evidence goes to the Forum and then browsers decide how to deal with that CA. Notably, in the worst case scenario, the browser developers can and have decided to completely distrust an entire CA, completely destroying their business. This has happened multiple times. eIDAS changes this by, effectively, creating a special EU government analogue to the CA/Browser Forum. All browser developers in the EU have to trust eIDAS's CAs. This is a transfer of power from a voluntary industry consortium to appointed EU technocrats. All those existing government CAs are currently audited by CA/B. If Greece gets caught misissuing certificates they can have their CA roots revoked by the browser vendors. The concern is that under eIDAS, the EU could just not revoke the certificate, and the browser vendors' hands would be tied. They'd be forced to accept known bad CAs and every cert they sign, including the spyware ones.
- ko27 3y ago
  > This is a transfer of power from a voluntary industry consortium to appointed EU technocrats Or a transfer of power from US-centric companies to actual sovereign bodies. I don't want to live in a cyberpunk world. This sounds good to me. Note that browsers are still allowed to remove them if they are compromised.
  - danielheath 3y ago
    Browsers are allowed to ask permission to remove them if they are compromised. They still have to receive that permission before they can do it.
    - dataking 3y ago
      I believe it is well understood by now that users tend to ignore security warnings; anyone serious about computer security will not accept this as a solution. We don't even apply security-critical patches reliably.
tsimionescu 3y ago
The game is not over just because you trust a CA. If they sign a certificate for a domain, they have to also publish that they did (in the CT logs) before browsers will accept it. If they do so for an entity that didn't ask for it, that will be investigated by browser and OS vendors and it may easily end up with the CA becoming untrusted.
- theonlybutlet 3y ago
  Well this is it, they will no longer become untrusted. They can however, ask to have the offending certificate revoked if they have proof it's bad and once they have permission from the authorities (they kind of have to grant the permission if there's evidence but will be on the authorities timeline).
- rcxdude 3y ago
  AFAIK there is no requirement for CT in this regulation, and it prevents browsers from requiring it to accept the certificates.
neodypsis 3y ago
In my own country, for digital signature purposes, the official Windows installer provided by the government adds the country's Central Bank's CA for any purposes, even for software signatures. If you have a company, they also force you to use their own application for making some annual declarations. That software asks for your OS user password using a home-brew dialog so that it can update itself. If you don't provide the password then it blocks and you can't make the obligatory declaration. If you don't send said declaration, you are liable for big fines...
- theonlybutlet 3y ago
  Well that's dystopian.
  - neodypsis 3y ago
    The same central bank is asking banks (and other entities) for unanonymized information about costaricans, including bank deposits, to publish an "information package" indexed by geographical location. This under the pretext of being required by the IMF. I found it curious that nobody in the legislative commission (akin to a "congressional hearing") tasked with looking into the matter has mentioned the importance of differential privacy.
- noodlesUK 3y ago
  I’m curious what country this is, if you’re willing to share. I’m surprised any business filing is using a desktop app rather than on the web these days.
  - neodypsis 3y ago
    Costa Rica. And before you can download some of the installers, they ask for your unique digital signature card number.
  - neodypsis 3y ago
    > I’m surprised any business filing is using a desktop app rather than on the web these days. It's a complete nightmare. If you want to use some other digital services you are restricted to specific browser versions, some only allow you to use Windows, and in some cases the unsigned installer is only available via HTTP.
amluto 3y ago
I filed the obvious bug against Firefox ten years ago :( https://bugzilla.mozilla.org/show_bug.cgi?id=953322 https://bugzilla.mozilla.org/show_bug.cgi?id=953322
- devman0 3y ago
  Do browsers check the CAA records for a domain if they exist? Seems like that would solve the issue.
  - ekr____ 3y ago
    As far as I know, they do not. Even if they did, it doesn't really address the problem. In order to mount an effective impersonation attack, the attacker needs to either control the network or the DNS. In either case, they will generally be able to remove or change the CAA record; remember that DNSSEC deployment is comparatively rare and browsers do not verify DNSSEC in any case.
  - g_p 3y ago
    No, and the standard (RFC 6844) says they must not. That's because, in the eyes of the standard, a CAA record is applicable at time of issuance, but a valid certificate could have been previously issued (and still be valid), even though you've moved to a new CAA record for your next certificate. "Relying Applications MUST NOT use CAA records as part of certificate validation." For what you're looking for, DANE (RFC 6698) would be more useful and enable the browser to check the presented certificate against DNS (so effectively CAA on the client).

ganzuul 3y ago

Weasel words. "Running additional security checks" is certainly going to mean the UI checks, not anything on the backend. Cookie banners happened because US devs didn't steelman EU regs. Petty territorial behavior. This looks like someone trying not to learn their lesson.

nonethewiser 3y ago
> Cookie banners happened because US devs didn't steelman EU regs. What would steelmaning EU regs have looked like? Not really sure what you mean by this.
- logifail 3y ago
  > What would steelmaning EU regs have looked like? A simple "decline [all]" / "accept" choice, not a huge list with dozens of sliders for dozens of options each labelled "legitimate interest" all of which are set to "Accept" by default?
- ganzuul 3y ago
  A header to opt in instead of a banner... I'm sorry now I'm confused. Is UI design this hard? Is this neurotypical?
  - tempodox 3y ago
    Yes, stupid shit like punishing your users with abusive UI for regulations you dislike is neurotypical.
- Tuna-Fish 3y ago
  Only use cookies to provide services that the user specifically asks you to provide. Never use the cookies to anything where the action wasn't initiated by the user. That way, nothing you do requires asking for consent and you don't need a stupid banner.
agbrrw 3y ago
>Cookie banners happened because US devs didn't steelman EU regs. EU sites have the same amount of cookie banners as US ones. (ie, all major sites have one)

theonlybutlet 3y ago

So basically: Governments are being given authority to create dodgey certificates, Browsers can't take it down if discovered unless they have evidence it's being used and will be harmful, and Browsers need to advise and wait for the requisite approval [of authorities] for when the browser can take it down (i.e. the authorities can decide how long it stays up). Or am I missing something?

Astraco 3y ago
I think they are just certs to identify yourself to EU or national insititutions for procedures (filling taxes and so), like the certs some European countries issue.
- sigilis 3y ago
  The proposed certificate authorities can generate certificates for any entity, not just EU sites and not just new ones. They would have to be treated as valid, per the regulation. Trust is the critical component in the PKI infrastructure. When it’s subverted and you can’t just remove the offending authorities, then it’s not really working properly anymore.
  - devman0 3y ago
    Seems like moving to something like DANE would be a good way forward. Seems like having the site owners tell the public what cert should be expected via DNS with appropriate signatures would obviate the need for CAs. (Yes I realize that this just moves the trust anchor to the DNS root authority, but it does reduce the number of authorities you need to trust).
    - JoshTriplett 3y ago
      Lots of things would help protect against this, but this regulation purports to prevent the browser vendor from implementing any stronger security mechanisms than those specified by the regulation. If DANE prevented a certificate from one of these governmental CAs from being accepted, this regulation would try to prevent using DANE.

INTPenis 3y ago

I'm speaking as a naive end user here. BankID in Sweden turns 20 this year. I've been using it for 15 years. Started out as an app on Mac, Windows, now it's on your cellphone. People have critizied it but in 15 years I have yet to hear about a security issue with the app or the protocol. I have yet to hear about a problem with it. All I see are advantages. And Sweden isn't alone in using some sort of eID. So how come the EU can't just build on existing experience? Why are they making it more difficult?

konschubert 3y ago
One disadvantage: As a temporary visitor to Sweden, since you don’t have a personnummer, you’re fucked.
- nextos 3y ago
  Yes, this is a huge problem. In fact, when looking into Swedish jobs, you are usually advised to try to get a personnummer ASAP to make your relocation as smooth as possible. Denmark also has similar problems with their digital ID. Any unusual scenario turns into a nightmare. For instance, I moved abroad during their transition from a codecard to an app, and I lost access to my bank account and all ID-linked services despite warning my bank about the potential problems months ahead of the forced transition. The only way to regain access is to travel back to Denmark and visit my bank or my local council.
  - dariosalvi78 3y ago
    an this is why a EU wide system is needed. I hold 3 digital identities (Spain, Italy and Sweden) and, believe me, it's not fun.
    - nextos 3y ago
      I agree, lack of standardization discourages freedom of movement. However, it is also necessary to make sure data privacy is factored in.
    - 3y ago

motohagiography 3y ago

This is pretty browser specific. To sidestep this, we only need new chat and forum protocols with clients that don't require implementing every concievable data format handler from the last 35 years.

shortsunblack 3y ago

The discussion around eIDAS lacks the nuance of digital sovereignty. You can have issues all you want with the legal text, but what we have here is a one-sided take that completely ignores any aspirations to digital sovereignty. U.S. already has shown it is willing to use major infrastructure to deal with its adversaries. That was shown as it weaponized the SWIFT payments system. U.S. routinely seizes domains owned by its U.S.-based registries. Browser vendors are not democratically ran institutions. One browser is owned by an ad broker and seller; the other browser is owned by an astroturfed* org that is 80% funded by the said ad broker and seller. Browsers not being allowed to stop their European users from accessing their European websites IS what I want. I do not want it to be possible for U.S. to coerce browsers to take out root stores to my bank, for instance. And as for security requirements, that's just a load of BS. eIDAS is A+B, not A or B. The security requirements in the legal text are equivalent or higher that of cabforum's, minus the certificate transparency bit. And that's a fair critique. Such mechanism needs to be discussed and plausibly adopted. And we have the democratic institutions for that discourse. It's called ETSI. And browser vendors are welcome to participate in ETSI and give their suggestions of allowing certificate transparency. They aren't doing that; in good faith anyway! They're not participating in a democratic standards body, instead they're running propaganda campaigns trying to rile up their users. To sum up, I want EU to gain digital sovereignty. Some of critiques are valid (I certainly don't like EV-style UI prescriptions), others are just bullshit. Bullshit we saw before GDPR. "The internet is going to be destroyed!". The internet wasn't destroyed. The internet is better after GDPR. Democratic institutions are good, ad funded browsers engaging in practices with zero accountability aren't. *plausibly hyperbole; but I'm not sure seeing that Mozilla has shown itself to be useless, as it took pro-Google position in search engine anti-trust case

JoshTriplett 3y ago
> The security requirements in the legal text are equivalent or higher that of cabforum's, minus the certificate transparency bit. And that's a fair critique. Such mechanism needs to be discussed No, under no circumstances should browser vendors be forced to "discuss" the development and application of higher security standards with an adversary with a vested interest in holding those standards back. You cannot have a reasonable "discussion" with an entity that claims a regulatory veto. Certificate Transparency is a great example: it's a reliable way to detect MITM certificates. "Here's an established industry standard for detecting improperly issued certificates and rejecting them to prevent interception of communication, allowing revocation of misused CAs." "So what happens when law enforcement uses a CA to issue a certificate for interception pertaining to a warrant?" "Like we said, it detects improperly issued certificates and rejects them to prevent interception of communications, so we'd detect that and revoke the CA." Further conversation after that point goes very differently depending on whether the governmental entity is empowered to veto or not. > browser vendors are welcome to participate in ETSI and give their suggestions of allowing certificate transparency "suggestions"? It's their software; any mechanism that attempts to prevent them from defining their own stronger security standards is broken and should be destroyed via every possible route. If you want digital sovereignty, make a case for your requirements with the software people want to use. If that case is "we want to reduce security", you should lose; if you don't something is very wrong with the process.

gustavus 3y ago

So here's a scenario I haven't seen brought up yet. Elbonian hackers manage to steal the singing key of kneebonia who is part of the EU (and also does IT as well as you would expect a European national government to do) They start publishing a ton of their own certs and start MITM everything out the wazoo. In the current environment this is noted by the community quickly they respond and revoke the Kneebonian cert, they understand what is happening, they understand why it is happening, they understand why it is bad and they have a vested interest in stopping it. Compare under the EU rules. The browser vendors cannot now revoke the cert of their own violation without risking significant penalties. They start the process of trying to get it revoked. The individuals involved are largely beauracrats and civil servants the likes of Sir Humphrey. They do not understand the technical jargon they just know the nerds are getting upset. They'll work on discussing the proposed change by evaluating a written request in the Orwellian named "Committee for Public Internet Safety and Electronic Information Security and Cyber protection" this committee meets 3 times a year on March 31st, October 16th and February 29th. In the meantime the entire underlying security model of the internet is broken. Now some might say "well if it's an emergency they'll respond immediately there will be public outcry and people's lives being ruined." And if it becomes a big deal the EU will act promptly, they will create a taskforce immediately whose job will be to create a recommendation for individuals to serve in a committee to investigate the source of the problem and create a list of possible remediations that could resolve the problem, which it will then present to the parent committee who will draft a response..... Etc etc ad infenitum until everyone involved with the matter has died of old age, and if you think I'm exaggerating when has EU done anything quickly?

izacus 3y ago
Your case is exactly the same as some entity stealing the ability to issue passports for a country. Insinuating that people issuing national identifications don't understand the issue of forging said documents is some ridiculous techbro arrogance. We've been dealing with this shit for centuries and those "beaurocrats" you're insulting have probably gone through more more cases of fraud and forgery than you ever thought about in your life.
- 3y ago

hknmtt 3y ago

historically, whatever a government gets involved in usually works out amazingly well. right?

RandomLensman 3y ago
Probably on average actually true (microprocessors and the internet come to mind, creation of "modern" cash back in antiquity, the formal code of law, sanitation, etc.), but with some colossal disasters in there, too.