Mozilla publishes position paper on the EU Digital Identity Framework

> Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

They did, you don't have to imagine it.

In 2009 they've signed a memorandum of understanding with 14 phone companies, which is why micro-B was the standard before type C. Apple was within those that signed it, and used a loophole in the text to ship a lightning-to-micro-B adapter instead.

Around 2016 they've realised micro-B was outdated and notified the signatories that they should switch to type C.

https://www.macrumors.com/guide/eu-charging-standard-proposa...

> Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

But they didn't. These people aren't that dumb, they told companies to settle on a standard, and now that we have a good standard that basically everyone follows they want to make a law to ensure everybody follows it. Bringing up a scenario where they did the right thing and argue "just imagine if they didn't do the right thing here, that would be a problem!" isn't a strong argument.

EU mandated GSM, which was a success, but we aren’t stuck with it still.

I don't understand the 'never gotten usb-C' part. Modern phones have more than enough space for two connectors. So usb-C next to a micro-B charging port is no problem.

After a while, almost all phone also have usb-C, most people like usb-C, so the industry can petition to replace micro-B with usb-C.

Are there any examples where the EU mandates legacy stuff that is no longer useful, but still has to be kept anyway?

For the record, the feedback period on the EU charging port directive proposal is still open until tomorrow: https://ec.europa.eu/info/law/better-regulation/have-your-sa...

I quickly glanced at a couple of the feedback documents they've got so far, and they seem to echo your concerns. We'll see if the parliament makes any changes.

On a slightly different angle, my frustration is that it's not done on a general standards or outcome based requirement. For example rather than dictating a specific thing or even standard like micro-USB, simply require, e.g., that 90% of all power cables must comply with an industry self-organized standard within 3 years of the final release and, e.g., that the largest firms must subsidize the compliance by the smallest firms in order to prevent gaming the system to drive the small companies out of business.

There is a rather significant and major issue that this change highlights; essentially all our politicians and bureaucrats see themselves as smart and wise enough to be central planners and masters of the universe … when the truth could not be farther from it.

USB-C is at least to some extent about standardization.

It's a less complicated issue, while nuanced, I think most of the details are manageable by a willing political actor.

It's also a known quantity.

This MOZ paper deals with much more complicated things.

I'm wary of involvement, I wonder if there are industry-led solutions that could be supported.

If MSFT, G, FB, AMZN could agree on something with the blessing of the EU and indirectly the US, I wonder if would happen very quickly.

That is a really, really obvious problem, so why do you think you are the first person on the planet who ever thought of it? And that nobody addressed it?

> But forcing everyone to use it until the end of time is ridiculous.

Correct, it is ridiculous you think anyone did that.

> Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

They did. We do have usb-c.

What makes you believe it's until the end of time? They did do it with micro USB also. From what I can see the mandate changes with the times, so if everything evolves I would assume that they'll update their requirements.

"It is just this" is something we hear very often when it is about user surveillance.

And then mandate sites use it for any age restricted content? Comes a year later. And everything against a backdrop that some EU members want encryption backdoors. Meanwhile we have safe e-commerce for years. No, thank you.

Thanks.

With the rise of the internet I now consider my identity to be valuable. So I don't give it away for free.

I personally don't want my identity checked unless I'm asking someone to trust me. And I'd rather use a trust-minimizing system before going there. You don't need your id checked when going to the restaurant or the theater. You need to check someone's id when they take your money and promise you something in return (and even then, there may be a better way).

> I don't see a single instance of trade being limited even if all transactions were between established identities.

Do you buy something if you need to send a copy of your id? Do you use a website if it requires Facebook connect?

The issues of tight tracking you mention would be amplified by widespread use of id checks so I think it's essential not to do them often.

Unless the entity that vouches for the identity or oversees transactions wanted to limit the ability of some disfavored participants, for some reason.

My point is there is no actual need, and all needs are contrived by policy for policy's sake, usually caused by security nerds (my people) whose rationale is identity because identity, and then we index on geeking out on writing security protocols without product use cases for the people subject to it.

The real problems in identity proofing are things like task delegation, substitute decision makers in elder care, parents doing things on behalf of their kids and kids asserting their parents permission, federation of user attributes with privacy, etc. These aren't difficult technical problems, except you need some way to transfer risk and accountability, which is an absolute quagmire. Universal digital identity (because let's face it, that's what it necessarily is) approaches these problems with a necessary component of a solution, but that's not what it's mainly going to be used for.

Maybe this yields a thought experiment where let's say I write an app for parents and kids where kids can use it to show they have their parents permission to be in a park after dark, walk to school by themselves, participation in a class trip, travel by themselves on a train or plane, get consent for emergency medical procedures, etc. Then that kid grows up and it switches from their parents to being a drivers license, age of majority card, school graduation certificates, their last STD test, list of employers and past salaries, speeding tickets, criminal records, lowest rated tweets, sexual partners etc. Sounds like it could be a real product right? Except that kid never wanted the stupid app that monitors them, the hovering parents who imposed it on them just use them as a source of narcisistic supply, and then their entire life is one of being subject to some proxy for these helicopter parents. The app is capitivity, or more accurately, entry into a panopticon that deprives them of their basic humanity. This is why digital identity is a terrible idea in pretty much every version I've seen so far. It's not chosen, it's imposed, and that's not a product, that's a mandate laundered through tech.

The common method to deal with avian influenza is killing all the livestock when one case is detected. Your comparison is scary and uncanny, but well aligned with how violent the pandemic has been handled by various governments.

Governments though can do that through their own passive demand. Ie., they can issue proper smartcards/tokens for citizens to identify themselves with, and then say that those can (and eventually must) be used for electronic interactions with the government itself (taxes being a big one but they'd easily be useful for a range of stuff). Follow/improve open standards. With something good, open and convenient private usage will naturally follow. Government can also by definition get involved with the issue of legal liability and fix BS like "identity theft" by shifting liability for businesses who do not meet good authentication standards. Doing it that way also creates room for fixing serious issues in practice before a natural rollout, as it starts by the government dogfooding its own standard. And if a lot of sites demand it, browsers will respond absent overwhelming reason not to, which itself is a good form of pressure to get said overwhelming reasons fixed.

I'm very doubtful though that trying to just directly legislate how software universally works though bypassing process is a good idea. Massive room for abuse as well.

When this becomes widespread then you can expect to have to authenticate this way everywhere. Want to make a Twitter account? Please authenticate with your government ID. Facebook? Of course. Video games? You bet.

South Korea already has these retirements for (some of) their video games.

We spend trillions on e-commerce with "normal" user accounts that worked just fine. Some cases of thefts and other crimes that doesn't warrant any action in my opinion. Meanwhile we have a huge problem with governmental surveillance, which is a worse crime than theft depending on how you grade it.

I guess that depends what you expect from society and government.

Do you expect that everything runs like an extremely powerful well oiled machine, where 100% interoperability likely means complete surveillance? A seemingly technocratic dystopian reality where every impulse is quantified and catalogued? I think its naive to believe that governments don't want more money, power and control over its citizens and government likely will be extracting more with every optimization the system makes.

Or would you rather an extremely powerful machine that is disjointed, highly flawed and laden with inconvenience in-so-that society doesn't really know who you are? Where the individual has more freedom and liberty, but as a result there is more crime and less "safety". A world where powerful anti-social forces are at play, such as disinformation campaigns, polarization of discourse, fringe movements and revolution.

The commonality is they are both driven by technology. We have built an extremely powerful machine and that has introduced enormous complexity into our society. This complexity equates to entropy and either we pull it together with draconian government policy, or the system unravels.

> A proper online identity framework is long due though.

Due by whom, and for what?

We use BankID for this in Norway (and elsewhere in Scandinavia I think).

> A proper online identity framework is long due though [..]

You're entitled to your opinion but for me, it's a firm "No, thanks".

I feel considerably more comfortable* carrying a paper document which proves my vaccination/negative test than I do using any kind of government-approved app on my phone.

* that's putting it mildly

The proposed regulation requires that QWACs MUST be accepted and recognized as such, such as using the European List of Trusted Lists as part of the root store.

That is, if a QWAC is issued by a CA that is not part of the browser root store, it must not be rejected (as any other untrusted certificate would be).

Perhaps I'm out of the loop, but the EU attempting to make it illegal to distribute web browsers that don't include certain features is unexpected (and deeply worrying) to me.

It would be compelled speech if the law required the browsers to say that a connection is secure when its creators don't want it to.

https://en.wikipedia.org/wiki/Compelled_speech

Whether or not it would violate the 1st amendment would be up to the courts to decide.

It appears to be more of a UI issue where the legal entity name is shown along side or sometimes in place of the URL which can be misleading.

To compound problems legal entity names are not required to be unique across states or countries so an EV certificate for a popular company name can be obtained in another geography and presented to the user on an attacker controlled domain.

https://www.bleepingcomputer.com/news/security/extended-vali...

> such authority

Key word "such". Prescribing which certificates I am obligated to trust is many many steps beyond e.g. banning DRM circumvention (which is itself a step too far IMO).

Not the browsers will be reprimanded. That would be webservices like Youtube that only allows browsers providing a certified ID to let users look at the more controversial cat pictures. It is an extremely transparent power grab.

> Not all European CAs meet browsers' root programs requirements.

That sounds like a huge problem, why should EU trust that USA handles trust certificates well? Of course they would want to regulate this instead of leaving that extremely large security hole open, letting USA alone decide what counts as secure or not is not in EU's interests.

I doubt there is any text that browsers have to enable those certs by default outside the EU.

It could weaken protection for people in the EU, but then the way forward is to make requirements for root certs mandatory in the EU.

Maybe I missed it, but did the document require special UI elements for EU certs?

Are the TSP audit requirements less strict than what the browsers’ root programs require?

Not being able to automatically renew certificates seems like a rather minor point in the bigger picture.

I get QWAC goes against the trend of phasing out EV certs. But isn’t the real issue that the browsers don’t trust TSP audits carried out for EU member states?

QWACs are for web sites, not users. CAs have to be audited as a TSP in order to issue them and be approved by the member state.