Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform
eidas-open-letter.org
eidas-open-letter.org
The Open Source Security Foundation (OpenSSF) has co-signed the Industry Joint Statement on Article 45 in the EU’s eIDAS Regulation, indicating that "Those provisions are likely to weaken the security of the Internet as a whole": https://openssf.org/blog/2023/11/02/openssf-co-signs-industr...
I wrote a summary of the countries in the world that have already undermined it, banned it or on the way to banning it:
https://community.qbix.com/t/the-coming-war-on-end-to-end-en...
To be clear: EU here is backdooring https encryption. While also moving to ban end-to-end encryption (Spain leading the way).
A world is possible where we have end-to-end encryption AND a ban on profiling people online without their consent.
But the governments when all is said and done don’t care about your privacy.
https://www.biometricupdate.com/202309/uk-passes-online-safe...
However this amendment is disgusting.
I was one of the many experts reviewing previous drafts; the timing and content of these changes are absolutely an attempt by security services to break security on the web.
Case in point: the DNS client never actually validates the DNSSEC signatures, the DNS server the client uses is supposed to do that, and then simply sets a flag that says "I validated this". Perfect for recursive DNS resolvers running on localhost, but terrible for security when applied as designed.
Another example: Firefox currently has encrypted client hello enables to encrypt the SNI information and help combat traffic analysis, but only if you enable DoH to ensure that the necessary DNS records are correct. Once again, Mozilla didn't trust DNSSEC to work right and opted to trust DoH servers on their word.
In truth, DNSSEC isn't widely used, at least not internationally. Some TLDs have high DNSSEC usages, often because their registrar advocates for securing DNS, but with companies like Amazon failing to produce DNSSEC software that doesn't cause massive outages and TLDs like .nz going down for a day because of bad policies and management, many people don't bother.
It's a shame, really, because DANE would've fixed so many problems. I attribute its failure mostly to the design decisions the people behind DNSSEC made when they released the protocol.
It would basically make services like Let's Encrypt unnecessary and would move us close to a world where email encryption and validation works by default.
DNSSEC sucks ass.
The "we" reading this post? Yeah, probably.
The internet population as a whole? Absolutely not, nowhere close.
I've been using Adblock or its descendants since the original Firefox extension where downloadable filter lists were a separate addon, and every time I have to browse a mainstream web site when using a "normal" person's computer it blows my mind how bad the experience is with all kinds of extra iframes I never normally see full of ads moving around, modals, etc. without even getting in to video content.
Normal people don't troubleshoot things like we do, if it doesn't work they try to do the same thing over and over again until they get bored or annoyed and then either move on or call one of us to "fix it".
My comment was about the perspective of the website owner, not the website user. The website owner certainly doesn't want to be routed around and have the website die. So the website owner will avoid HPKP.
That should've been a clear problem when architecting this system for anyone that knows how PKI works. Control and transparency around CAs (especially roots) is extremely important for web security.
Did they not consider issuing citizens with WebAuthn certificates, or working with browser vendors to support using client certificates (since they'd only need to be trusted by the server, not the client)?
I am confused.
The funny thing is that several European governments have actually operated certificate authorities of their own, and they worked just fine.
It's so stupid, because the rest of the eIDAS is a pretty good idea.
From what I can tell, this stupid addendum is the result of the certificate authority industry, which were mad that nobody trusts EV certificates anymore (because they never added the security they promised in the first place).
To be clear: EU here is backdooring https encryption which protects most communication, not signing. While also moving to ban end-to-end encryption (Spain leading the way).
I also hope that our community produces tools to allow the cert stack on our OSes to be purged of these certificates.
EDIT: for clarification, they banned disclosing it in initial communications like emails. They can do same for browsers. Apple also successfully banned apps from disclosing links to buying stuff online etc.
Well, if Spirit Airlines is in fact being ingenuous, then they're -at best- one of the good guys demonstrating Why We Can't Have Nice Things.
What happens is that -in some countries I've visited- people can legally advertise a particular sticker price, and then when you actually go to pay, you pay a very different amount. That threw me for a loop the first time I encountered it. I felt they were being tremendously dishonest.
Where I live, you are totally permitted and encouraged to also provide an itemized price breakdown, but the sticker price is what I'm paying you at the end of the day. No surprises for the consumer.
please give a source for that. That's the spin some airlines gave it, but as far as I understood the new requirement was to list the full price including taxes and fees in advertisements. This could be seen as hiding the fees and taxes, but the Airlines are still allowed to list fees and taxes.
In Europe, listing the full price is mandated for all industries as far as I know. Feels bad as a customer to not know what you will have to pay upfront, like it is in most industries in the US. But it also feels weird to me that this ruling was only applied to the air travel industry.
How much tax there is to pay is not my problem as a consumer. The only thing that matters is how much it will cost me to get the thing. Everything one must pay, including all fees and taxes should be included. Listing these will only cause unnecessary confusion and is often done in a deceptive manner.
It has nothing to do with adding root certificates to browsers. These are consumer protection laws against deceptive advertising. It may be surprising to Americans but in most of Europe, thanks to such laws, the price you see is usually the exact price you are paying. No taxes, fees or tips, it is all included, which I think is better for everyone.
I believe on iOS you can do it with an MDM profile.
Last Chance to fix eIDAS: Secret EU law threatens Internet security - https://news.ycombinator.com/item?id=38109494 - Nov 2023 (280 comments)
The intel agencies of different countries act as checks and balances against each other, to some degree. In some countries there are enough different intel agencies that they act as checks and balances against each other.
However, the voice of the public is a great additional check on their behavior, especially when amplified by mainstream media and social media. Our elected officials want to be re-elected. Many will change their tune if they feel there is enough outcry that it might affect their poll numbers. And this is the only legal way to effect change in many countries.
Do you have any evidence for this?
Those representatives in a position to affect the arc of the actions here, especially those who work in the civilian sphere regularly, need all manner of support now.
https://security.stackexchange.com/questions/189647/what-hap...
EDIT: for context
There's a difference between certificates distributed with the OS and certificates added to the OS by a user. Right now Firefox ignores both.
This change ONLY picks up the certificates added to the OS by a user. Firefox will continue to ignore the certificates included with the OS store by default.
EDIT: for clarity, something I should have done from the beginning, I checked the affected code, they clearly remove warnings around security.enterprise_roots.enabled preference and enable it by default. This is the preference that was added back in the day to control if the browser will allow root certificates added to the OS no matter the source (user or system context) and now they change it to true by default. I think this provides more clarity but feel free to search the affected code for references that indicate that only part of the root certificate store is trusted
>[Suggested wording]: By default, Firefox will now use TLS trust anchors (e.g., certificates) ADDED to the operating system by the user or an administrator. This works on Windows, macOS, and Android, and it can be turned off in the "Privacy & Security" section of Firefox settings, under "Certificates".
If you think all of these descriptions have been wrong all along from the code, that'd definitely be worth bringing up on Bugzilla. Personally I'm happy to have it enabled by default vs always needing to remember to do so if it's working as described. I think support for one's own CAs should be encouraged even the overall UX around running your own CA is mediocre right now.
----
0: https://support.mozilla.org/en-US/kb/how-disable-enterprise-... :
>"Mozilla has added an Enterprise Roots preference to Firefox as a solution to the problem. This preference can be used to import any root certificate authorities (CAs) that have been added to the operating system, to resolve your TLS connection error. You can determine if a website is relying on an imported root certificate by clicking the Site Information icon in the address bar."
Every OS has an API for this, why should I need to go into the special super secret debug settings to tell an application "trust the system you're running on and use the damn API already".
* Warn when a new root is user for the first time.
* Warn when a site changes its root cert.
* Warn when a root cert is used for DNS names that shouldnt belong to it, e.g. wrong tld.
In a broader context, the question who you trust when will become more and more important. E.g. deepfakes might push us all to digitally sign their real messages. I don't think the current root certificate systems can survive the deluge of mistrust generated by AI.
I also don't know how certificate pinning is impacted by this (which would mean that simply creating another cert from a EU root cert would at the very least be noticable)
Next they will ban other certs other than their own. Like Dubai did or Monaco.
https://community.qbix.com/t/the-coming-war-on-end-to-end-en...
BUT to be clear the governments shouldn’t be compromising the security of their own people and organisations in the first place. We can’t technology our way out of this behaviour!
It would be trivial to make a plugin to warn the user of this, at which point they know they're under surveillance which would be worse than just doing human surveillance IMO.
I say this with the upmost request to their politicians, but their politicians have no clue what they're doing. They clearly don't understand how any of this works. None of what they propose can solve the issues they claim they want to solve. Not this, not client-side scanning, nothing. I genuinely wonder who's "advising" them on this stuff and what their true motives are.
It's sad to see the EU like this but nothing lasts forever. I feel sad for the next generations. They'll be the ones to bare the full brunt of these misguided regulations.
Do the web browsers & operating systems face the same bootstrapping problem at the moment? At some point they must get their first certificate without using a certificate protected connection?
Edit - in the context of service which exists pre regulation, the client certificate could also be derived from the user's existing login credentials.
As soon as you download and install an OS via an MITMed connection, it's over.
[0]: https://www.youtube.com/watch?v=JmjRhmk800U
"Governments have agendas, and agendas change" "We may not be perfect, but the safest hands are still our own"