Hacker News Reader

Comment by hurryer | Hacker News Reader

> The EU absolutely has an interest in preventing a US (or Chinese or whatever) entity from falsely certifying an EU site.

EU is varied with all kinds of interests and geopolitical orientations.

For example Hungary. Should we let Hungary certify an EU site?

View on HN

Hungary, Spain and Cyprus are voting for breaking end-to-end encryption.

Hungary is run by now already authorian Orban. Spain has a history of spying their political opponents with Pegasus spyware. Yes, we definitely want to give this guys any authority to tap any of our wire traffic.

https://www.wired.com/story/europe-break-encryption-leaked-d...

That's not at all what I said. The EU has a government, and I don't think anyone particularly disputes which government is the EU government. (I suppose one might argue that .tw is a bit different, but that's a whole different discussion, and somehow the DNS root servers know what to return for SOA and NS queries for tw.)

I'm saying that I think it really would be reasonable for the EU to require that browser follow a specified mechanism to restrict which certificates are valid for .eu. And it would be reasonable for Hungary to use the same mechanism to restrict .hu. So browsers would only accept a certificate for a .hu domain if it was signed according to standard PKIX and CA/B Forum rules and had whatever standardized attestation was required from .hu.

If it were that Only *.hu could be signed by a Hungarian-approved CA, then that would be one thing.

However the proposed legislation does not, apparently, say this.

Reply on news.ycombinator.com