Article 45 of eIDAS 2.0 will roll back web security by 12 years

The EU thinks they should be

https://www.f5.com/labs/articles/threat-intelligence/kazakhs...

But unlike Kazakhstan, the EU can actually ORDER browser makers to keep approving their backdoored certificates. And then mandate that anyone serving their own citizens use them.

Look at what the UK has already done with its “think of the children” bills. The UK is weaker than the EU

https://www.wired.com/story/the-uks-controversial-online-saf...

They might. It's how the US intelligence agencies route around laws that prohibit spying on US citizens. They spy on a 5-eyes nation's citizens (often the UK) who is spying on US citizens. Then they trade connections.

1. Good luck teaching 99% of people to be wary when they see the blue address bar. People generally do not understand address bars, which is a large part of why browsers removed the EV indicator.

2. There is a strong possibility that a future version of eIDAS will force businesses in the EU to get certificates from an eIDAS CA. At that point, people in the EU will be seeing the blue address bar constantly, and most of the time the certificate will in fact be legit.

I'm a bit out of the loop on modern security implementations. In theory though, I thought the purpose of certificates and certificate authorities was to certify that you're actually talking to who you think you're talking to?

A browser can still communicate security with any computer out there, regardless of corporate certs, etc. Or do the corporate firewalls block communications that they cannot inspect?

(Besides, macOS and Windows do let you tweak the trust store from their respective GUIs. There’s nothing stopping you from doing so.)

This is why eIDAS is so nuts - it forbids browsers from rolling out pro-user security measures.

Unfortunately, Article 45 states that certificates issued by EU-mandated CAs "shall not be subject to any mandatory requirements other than the requirements laid down in paragraph 1" and paragraph 1 does not allow browsers to reject certificates not published in CT logs.

Thus, EU-mandated CAs will be able to issue undetectable MitM certificates.

The certificate contains signatures from the CT logs. The browser can either accept those signatures or check the CT log itself. This "enforces" CT for the certificate of the site you're accessing, but not necessarily the CA. Of course if a certificate comes up that fails CT logging, that can raise scrutiny of the CA.

This is all based on the incorrect assumption that they can legislate how software is written, both inside and outside their borders.

At every step those that don’t follow the EU’s rules will get fined by the same apparatus as GDPR violators

But this misunderstands the situation anyway. The overwhelming majority of web clients that interpret CA data are provided by default in devices sold by companies with a clear interest in following the law; because if they don't they can't sell products.

[1] Which I won't engage on, except to say that this seems a lot more like "dumb mistake in the legislation" than "evil plot by an unelected metagovernment" to me. The hyperbole on issues like this gets out of control sometimes, and the EFF seems to be getting worse about it and not better over time. They used to be pretty cerebral.

Their claims center around "the current language is imprecise" and I'm having a really hard time seeing why that's a problem for a bill that hasn't even finished being written yet.

It does make a technically correct claim that QWACs are currently accepted by browsers. However, the reality is that QWACs are only accepted by browsers if the issuer fully complies with both CAB Forum baseline requirements, and Root program rules. The entire purpose of the clause in question is effectively to ensure an EU Bureaucracy is responsible for for setting rules instead of CAB Forum and Root programs.

Another example it is absolutely true that the eIDAS 2.0 regulars impose some certain weaker security requirements than current browsers.

A trivial example is that the response claims QWACs will comply with Brower's Certificate Transparency standards, but those standards are not in the regulation, and the regulation makes it clear that a browser cannot reject QWACS for other reasons not listed in the regulation.

Another example, Mozilla has found that CAs who simply request audits done to ETSI standards (the standards imposed by this regulation) will often end up with audits that are incomplete (unable to audit all relevant controls). This can happen for legitimate reasons, but the audit results don't provide enough details here, hence Mozilla added a requirement for an ETSI Audit Attestation Letter (AAL) that explains these limitations. Even worse, once the impediments are no longer in place, by often ETSI auditors do not re-audit the previously un-auditable controls for the last time period. Mozilla needed to impose additional rules including explaining what if any controls could not be audited, and also rules that the next audit must cover previously un-auditable controls for the previously issued audit, in addition to auditing for the that time period. Describing how to do this audits properly within in the ETSI context is complicated because the ETSI audit standards were not really designed to make such rules (Full audit of all controls over all timespans, re-auditing later if some controls could not be evaluated for any reason the first time) easy.

Thanks again EFF for so vigilantly watching against encroachment.

Is there any way to enact a permanent "no"?

An unfortunately there is no good way, no technology board of overseers, who takes away their (smart)phone priviledges when they don't behave.