7 ms·

They are not targeting people like you. Bots are the target. If you look like a bot, how are they going to distinguish?

KronisLV 2y ago
> If you look like a bot, how are they going to distinguish? Some non-existant system of attesting that I'm person X (possibly through an e-ID card) who has issued a client certificate Y (cert chain, using my e-ID cert to sign) to be used with my device Z (presumably with a device fingerprint or IP range attached to the cert). Of course, this would mean no privacy, but that's not that different from being signed in through Google as an identity provider, we'd just shift the mechanism to be universal (like client certs already are). One of the options that would take more coordination than will probably happen (though very similar to some e-signature solutions in EU, which we already use) but I could see using something like that for a variety of professional/service sites, since signing in with the e-ID card directly is already a thing on some sites here (government sites, banking sites, utilities sites).
- rad_gruchalski 2y ago
  Okay. Do that globally. And solve the ddos problem as you’re on it. If you add transparent tls termination, edge, caching, dns… maybe I’ll have a look! I had a guy like that working with me. Blocked every possible tracker, disabled javascript, used some niche browser, proton mail, and then complains that google doesn’t allow him to sign in. I get it, privacy and what not. But the guy was an outlier. Some random blogs, product pages aren’t gov, most likely have no way to opt-in for gov eID (maybe they aren’t based in the EU), and they only care that their service is available fast globally and that they get ddos protection for free (plus some other convenience features).
  - KronisLV 2y ago
    > Do that globally. We already do a simpler version of that with TLS and HTTPS, there are globally trusted root certs that ship with most OSes and browsers. It's just that we haven't extended the same approach to client certs and identity verification, instead having a bunch of walled gardens and governments running legacy methods of figuring out who someone is, as opposed to various eID mechanisms. If I trust news.ycombinator.com because I trust ISRG Root X1, I might similarly trust John Doe's iPhone because I trust the government of France's CA, as a hypothetical, as long as the certification chain is valid there. It's a problem that's technically solvable (say, in 20-50 years), but won't get done because good luck getting a bunch of governments to collaborate on that across the world. It's actually a surprise that we have TLS in the first place.
    - rad_gruchalski 2y ago
      We cannot get them to agree on cookie banners and you’re talking about something much more complicated. Hey, by the way, would you trust some Chinese or Russian root certificate? The question is irrelevant, frankly. Consider this: you’re living in Germany today. You trust the German government. They handle all your logins using that eID. What if in February AfD comes to power? Do you still trust the German government? Governments are formed by people. Different people have different interests.
      - KronisLV 2y ago
        > We cannot get them to agree on cookie banners and you’re talking about something much more complicated. Another good example of something that’s technically feasible and not that complex, but was made infeasible due to either ignorance or malice, with all of the dark UI patterns and scummy behaviour. > Hey, by the way, would you trust some Chinese or Russian root certificate? Most people already do: https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/root_store.md https://chromium.googlesource.com/chromium/src/+/main/net/da... For example: CN=CFCA EV ROOT,O=China Financial Certification Authority,C=CN CN=GDCA TrustAUTH R5 ROOT,O=GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.,C=CN CN=UCA Global G2 Root,O=UniTrust,C=CN CN=UCA Extended Validation Root,O=UniTrust,C=CN CN=vTrus ECC Root CA,O=iTrusChina Co.,Ltd.,C=CN CN=vTrus Root CA,O=iTrusChina Co.,Ltd.,C=CN If there’d be an issue of not wanting to support a certain country, then removing such a group of CAs from a store would be trivial for a particular service, same as with the above. Plus, the opposite is also viable, if for example the Russian govt. wanted to allow anyone to verify whether particular requests come from their citizens, they might also run their own CA akin to https://www.bleepingcomputer.com/news/security/russia-creates-its-own-tls-certificate-authority-to-bypass-sanctions/ https://www.bleepingcomputer.com/news/security/russia-create... except that the attack vector would change from MitM to fake identities being issued by them as needed (but since the server is the one doing the verification, it might as well drop the CA when desired). > What if in February AfD comes to power? Revoking the eID and anything dependent on it would be akin to your passport being taken away. Essentially the modern day digital equivalent of getting your Google account banned by some bot, if you use that account for auth in a bunch of places. Fundamentally, that’s no different from the reality that we already face - my regular eID could also be taken away if my own government felt like it, same as with my bank account and other assets. Client certs themselves are nothing new, same for PKI. It’s a cool technology that could but presently cannot solve the problem of client identity globally, because we just can’t have nice things and order.
- gruez 2y ago
  Between what you described and having to run a vaguely standard browser config, I'll take the latter, thanks.
- peanut-walrus 2y ago
  Ok, what does the venn diagram of: 1) People who anonymize their IP, use Linux, a browser with noscript, etc 2) People who are OK with having a government issued digital id and having to use it to access the internet ...look like, in your opinion?
  - Dylan16807 2y ago
    Well, proof of having an ID can be done anonymously. Cloudflare even worked on a system for that kind of thing.
    - rad_gruchalski 2y ago
      A non-citizen living in Germany without the German eID because they’re not a citizen. Their country of origin doesn’t have any of that. I guess they don’t exist in that setup? Seems like a steep hill to climb on to solve some random login with captcha problem. Binding login interaction to some government issued id…who’s entitled here. Sounds like throwing a baby out with the bathwater.
      - HeatrayEnjoyer 2y ago
        Then have them go through the captcha process that already exists
    - peanut-walrus 2y ago
      Yeah, this is at least being discussed now for eID. Getting it to a point where it is actually usable for everyone and trusted by everyone will not be easy though. But even in the best case, this would cover maybe 5-10% of internet users in 5 years. What do you do with the other 90% ?
  - deleted 2y ago
    [deleted]
Hizonner 2y ago
Their problem. They are not entitled to make it other people's problem.
- scarface_74 2y ago
  If I have a process that works for 95% of the people, why should I care about outliers who use Linux behind a VPN on a heavily customized version of Firefox?
  - Hizonner 2y ago
    Because they are standards compliant and you aren't, and you are legally required to provide an unsubscribe service or whatever without undue barriers around it.
    - scarface_74 2y ago
      For unsubscribe - yes. Everything else - no. But if I am using standards and they have an ad blocker that blocks some of the functioning of my site, am I also required to test my site against that?
      - luckylion 2y ago
        > Everything else - no. I'd include _everything_ important in the "yes" category. If I cannot access the customer panel to update settings or notify them of a bug that is affecting me because I'm using Firefox ("works for 95% of users"), they're just not keeping up their end of the contract. Remember, 95% excludes everything but chromium/webkit-engines.
        scarface_74 2y ago
        Every SaaS company I’ve worked for has had a compatibility matrix where we say what we support. If we lost customers who were running a highly customized Firefox on Linux, so be it. Every company decides which customers are worth going after.

> If you look like a bot, how are they going to distinguish? Some non-existant system of attesting that I'm person X (possibly through an e-ID card) who has issued a client certificate Y (cert chain, using my e-ID cert to sign) to be used with my device Z (presumably with a device fingerprint or IP range attached to the cert). Of course, this would mean no privacy, but that's not that different from being signed in through Google as an identity provider, we'd just shift the mechanism to be universal (like client certs already are). One of the options that would take more coordination than will probably happen (though very similar to some e-signature solutions in EU, which we already use) but I could see using something like that for a variety of professional/service sites, since signing in with the e-ID card directly is already a thing on some sites here (government sites, banking sites, utilities sites).

rad_gruchalski 2y ago
Okay. Do that globally. And solve the ddos problem as you’re on it. If you add transparent tls termination, edge, caching, dns… maybe I’ll have a look! I had a guy like that working with me. Blocked every possible tracker, disabled javascript, used some niche browser, proton mail, and then complains that google doesn’t allow him to sign in. I get it, privacy and what not. But the guy was an outlier. Some random blogs, product pages aren’t gov, most likely have no way to opt-in for gov eID (maybe they aren’t based in the EU), and they only care that their service is available fast globally and that they get ddos protection for free (plus some other convenience features).
- KronisLV 2y ago
  > Do that globally. We already do a simpler version of that with TLS and HTTPS, there are globally trusted root certs that ship with most OSes and browsers. It's just that we haven't extended the same approach to client certs and identity verification, instead having a bunch of walled gardens and governments running legacy methods of figuring out who someone is, as opposed to various eID mechanisms. If I trust news.ycombinator.com because I trust ISRG Root X1, I might similarly trust John Doe's iPhone because I trust the government of France's CA, as a hypothetical, as long as the certification chain is valid there. It's a problem that's technically solvable (say, in 20-50 years), but won't get done because good luck getting a bunch of governments to collaborate on that across the world. It's actually a surprise that we have TLS in the first place.
  - rad_gruchalski 2y ago
    We cannot get them to agree on cookie banners and you’re talking about something much more complicated. Hey, by the way, would you trust some Chinese or Russian root certificate? The question is irrelevant, frankly. Consider this: you’re living in Germany today. You trust the German government. They handle all your logins using that eID. What if in February AfD comes to power? Do you still trust the German government? Governments are formed by people. Different people have different interests.
    - KronisLV 2y ago
      > We cannot get them to agree on cookie banners and you’re talking about something much more complicated. Another good example of something that’s technically feasible and not that complex, but was made infeasible due to either ignorance or malice, with all of the dark UI patterns and scummy behaviour. > Hey, by the way, would you trust some Chinese or Russian root certificate? Most people already do: https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/root_store.md https://chromium.googlesource.com/chromium/src/+/main/net/da... For example: CN=CFCA EV ROOT,O=China Financial Certification Authority,C=CN CN=GDCA TrustAUTH R5 ROOT,O=GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.,C=CN CN=UCA Global G2 Root,O=UniTrust,C=CN CN=UCA Extended Validation Root,O=UniTrust,C=CN CN=vTrus ECC Root CA,O=iTrusChina Co.,Ltd.,C=CN CN=vTrus Root CA,O=iTrusChina Co.,Ltd.,C=CN If there’d be an issue of not wanting to support a certain country, then removing such a group of CAs from a store would be trivial for a particular service, same as with the above. Plus, the opposite is also viable, if for example the Russian govt. wanted to allow anyone to verify whether particular requests come from their citizens, they might also run their own CA akin to https://www.bleepingcomputer.com/news/security/russia-creates-its-own-tls-certificate-authority-to-bypass-sanctions/ https://www.bleepingcomputer.com/news/security/russia-create... except that the attack vector would change from MitM to fake identities being issued by them as needed (but since the server is the one doing the verification, it might as well drop the CA when desired). > What if in February AfD comes to power? Revoking the eID and anything dependent on it would be akin to your passport being taken away. Essentially the modern day digital equivalent of getting your Google account banned by some bot, if you use that account for auth in a bunch of places. Fundamentally, that’s no different from the reality that we already face - my regular eID could also be taken away if my own government felt like it, same as with my bank account and other assets. Client certs themselves are nothing new, same for PKI. It’s a cool technology that could but presently cannot solve the problem of client identity globally, because we just can’t have nice things and order.
gruez 2y ago
Between what you described and having to run a vaguely standard browser config, I'll take the latter, thanks.
peanut-walrus 2y ago
Ok, what does the venn diagram of: 1) People who anonymize their IP, use Linux, a browser with noscript, etc 2) People who are OK with having a government issued digital id and having to use it to access the internet ...look like, in your opinion?
- Dylan16807 2y ago
  Well, proof of having an ID can be done anonymously. Cloudflare even worked on a system for that kind of thing.
  - rad_gruchalski 2y ago
    A non-citizen living in Germany without the German eID because they’re not a citizen. Their country of origin doesn’t have any of that. I guess they don’t exist in that setup? Seems like a steep hill to climb on to solve some random login with captcha problem. Binding login interaction to some government issued id…who’s entitled here. Sounds like throwing a baby out with the bathwater.
    - HeatrayEnjoyer 2y ago
      Then have them go through the captcha process that already exists
  - peanut-walrus 2y ago
    Yeah, this is at least being discussed now for eID. Getting it to a point where it is actually usable for everyone and trusted by everyone will not be easy though. But even in the best case, this would cover maybe 5-10% of internet users in 5 years. What do you do with the other 90% ?
- deleted 2y ago
  [deleted]

Hizonner 2y ago

Their problem. They are not entitled to make it other people's problem.

scarface_74 2y ago
If I have a process that works for 95% of the people, why should I care about outliers who use Linux behind a VPN on a heavily customized version of Firefox?
- Hizonner 2y ago
  Because they are standards compliant and you aren't, and you are legally required to provide an unsubscribe service or whatever without undue barriers around it.
  - scarface_74 2y ago
    For unsubscribe - yes. Everything else - no. But if I am using standards and they have an ad blocker that blocks some of the functioning of my site, am I also required to test my site against that?
    - luckylion 2y ago
      > Everything else - no. I'd include _everything_ important in the "yes" category. If I cannot access the customer panel to update settings or notify them of a bug that is affecting me because I'm using Firefox ("works for 95% of users"), they're just not keeping up their end of the contract. Remember, 95% excludes everything but chromium/webkit-engines.
      - scarface_74 2y ago
        Every SaaS company I’ve worked for has had a compatibility matrix where we say what we support. If we lost customers who were running a highly customized Firefox on Linux, so be it. Every company decides which customers are worth going after.