This is a shit show. People complain a lot about the UK breaking encryption and meanwhile the EU is doing the same, at a higher level without people even noticing.
Here the TL:DR; for anyone unfamiliar with the subject: eIDAS includes a lot of useful stuff but also requires browser to include CA designed by member states. Including a CA means that entity can issue SSL certificates that will be accepted / valid on those browser > this means the countries controlling those CA's can simply argue "national security" and have those CA's issue SSL certificates for ANY domain they would like and then use them to launch a man-in-the-middle attack against anyone they would like to. :)
How long before the devs or an extension give us the option to manually distrust CAs?
The proposed legislation says that browsers "can't do adicional validations on the certificates from the CA" (more or less this wording) meaning a simple check CAA DNS check from a browser would be against said legislation.
Does a "warning, cert issued by a government agency" count as additional validation?
Or maybe everyone is going to use cert pinning now. Or Firefox is going to stop trusting all CAs and make you verify each CA yourself. Which is a terrible idea for the average user.
Does a “warning, cert issued by a government agency” count as additional validation?
From what I gather they can't do that either.
Or maybe everyone is going to use cert pinning now.
Same as above. This would be effectively "adicional validations on the certificates".
Or Firefox is going to stop trusting all CAs and make you verify each CA yourself. Which is a terrible idea for the average user.
Would be legal but annoying. Bet they would legislate to force their CAs / be exempt from that user verification.
without people even noticing.
Have you been living under a rock
Shit, the EU's really on a roll with these draconian laws. There's also the "chat control" bullshit that'll wreck end-to-end encryption (see eg https://mullvad.net/en/chatcontrol for a list of sources)
The eu is very upset about this opposition, and published a hit piece “fact checking” pdf against it.
I would've been more surprised if EU wasn't arguing in favour of their proposal
What can we do about it? Especially if we’re not EU citizens?
This is a shit show. People complain a lot about the UK breaking encryption and meanwhile the EU is doing the same, at a higher level without people even noticing.
Here the TL:DR; for anyone unfamiliar with the subject: eIDAS includes a lot of useful stuff but also requires browser to include CA designed by member states. Including a CA means that entity can issue SSL certificates that will be accepted / valid on those browser > this means the countries controlling those CA's can simply argue "national security" and have those CA's issue SSL certificates for ANY domain they would like and then use them to launch a man-in-the-middle attack against anyone they would like to. :)
How long before the devs or an extension give us the option to manually distrust CAs?
The proposed legislation says that browsers "can't do adicional validations on the certificates from the CA" (more or less this wording) meaning a simple check CAA DNS check from a browser would be against said legislation.
Does a "warning, cert issued by a government agency" count as additional validation?
Or maybe everyone is going to use cert pinning now. Or Firefox is going to stop trusting all CAs and make you verify each CA yourself. Which is a terrible idea for the average user.
From what I gather they can't do that either.
Same as above. This would be effectively "adicional validations on the certificates".
Would be legal but annoying. Bet they would legislate to force their CAs / be exempt from that user verification.
Have you been living under a rock
Shit, the EU's really on a roll with these draconian laws. There's also the "chat control" bullshit that'll wreck end-to-end encryption (see eg https://mullvad.net/en/chatcontrol for a list of sources)
The eu is very upset about this opposition, and published a hit piece “fact checking” pdf against it.
I would've been more surprised if EU wasn't arguing in favour of their proposal
What can we do about it? Especially if we’re not EU citizens?