TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Last Chance to fix eIDAS: Secret EU law threatens Internet security

548 点作者 mnot超过 1 年前

49 条评论

supriyo-biswas超过 1 年前
For anyone who’s about to say that surveillance isn’t the point of this legislation: it definitely is; we very recently saw Germany trying to MITM jabber.ru users[1], having a CA that can be asked to issue any certificate is definitely something that’d be used for surveillance purposes.<p>[1] <a href="https:&#x2F;&#x2F;notes.valdikss.org.ru&#x2F;jabber.ru-mitm&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;notes.valdikss.org.ru&#x2F;jabber.ru-mitm&#x2F;</a>
评论 #38111626 未加载
评论 #38111712 未加载
评论 #38114996 未加载
dang超过 1 年前
Related:<p><a href="https:&#x2F;&#x2F;mullvad.net&#x2F;en&#x2F;blog&#x2F;2023&#x2F;11&#x2F;2&#x2F;eu-digital-identity-framework-eidas-another-kind-of-chat-control&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;mullvad.net&#x2F;en&#x2F;blog&#x2F;2023&#x2F;11&#x2F;2&#x2F;eu-digital-identity-fr...</a><p><a href="https:&#x2F;&#x2F;alecmuffett.com&#x2F;article&#x2F;108139" rel="nofollow noreferrer">https:&#x2F;&#x2F;alecmuffett.com&#x2F;article&#x2F;108139</a><p>(via <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38109581">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38109581</a> and <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38109731">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=38109731</a> respectively, but we merged the comments hither)
NoboruWataya超过 1 年前
Very concerning. As a slight aside though, it is not a &quot;secret law&quot;. All EU laws are published on its website in every official language, and the vast majority of laws (including this one) must be publicly ratified by the directly elected European Parliament before coming effective.<p>They should tone down this kind of sensationalist clickbait that I would expect to find in UK tabloids. They probably think it helps them impress the urgency of the matter on the public but frankly it just makes me doubt the veracity of the claims made in the article (though in this case I trust Mozilla and would hope that they are not misrepresenting the content of the law itself).
评论 #38111447 未加载
评论 #38111601 未加载
评论 #38111430 未加载
评论 #38111445 未加载
calgoo超过 1 年前
So what happens to open source browsers? Will they be forced to implement it? Are the governments going to audit the code to make sure no one is releasing a version that has removed the government certs or are they going to outlaw open source browsers?<p>Again, this is not going to catch anyone with half a braincell that is trying to do something. This is just going to catch everyone else.<p>I wonder if this will tie into the BS that Google was trying to implement that would make it impossible to modify the webpage using adblockers etc. making it so you can&#x27;t navigate the web if you are using a uncertified browser.
评论 #38110721 未加载
5ersi超过 1 年前
If you are concerned by this proposals, then you should check out current CAs trusted by your browser - all those CAs can issue rogue certificates trusted by your browser, that can be used in MITM attack.<p>For example, CAs present in Firefox, that might give you pause: Beijing Certificate Authority, China Financial CA, Guang Dong CA<p>The CA system in browsers is inherently broken and it allows state actors to MITM you and see all your traffic if they: 1. have ability to capture IP traffic (requires cooperation with ISP) 2. have ability to generate rogue certificate via cooperation with CA
评论 #38112296 未加载
评论 #38112316 未加载
评论 #38112317 未加载
评论 #38112423 未加载
评论 #38112304 未加载
agarsev超过 1 年前
Just adding a perspective (not necessarily mine, I&#x27;m still on the fence) supporting this legislation from a tech-literate person in the EU.<p>The digital administration in my country has made my life so much easier. We all have mandatory ID cards since decades ago, but now they have a chip with some certs for auth, signing, etc. I can check my taxes, fill government forms, see any traffic tickets, sign official documents from my home thanks to this. However, as far as I understand, this relies on my user agent accepting some particular CAs. This is critical, to the point of my browser preventing me access to some parts of the administration if the CA is not up to date or recognised or whatever.<p>What this legislation proposes, if I understand it correctly, is putting in the hands of the government the power to administer (part of) this CA infrastructure. As with many EU-related legislation, this forcefully transfers power from private (often American) entities to EU governments. I guess when trust in your government is higher or equal to trust on private firms, this doesn&#x27;t sound so bad.<p>Not saying this is right or wrong, but maybe this helps understand why many people in the EU may not be so against this type of legislation.
评论 #38111735 未加载
评论 #38111744 未加载
评论 #38111733 未加载
评论 #38111781 未加载
评论 #38111820 未加载
jruohonen超过 1 年前
From:<p><a href="https:&#x2F;&#x2F;data.consilium.europa.eu&#x2F;doc&#x2F;document&#x2F;ST-14959-2022-INIT&#x2F;en&#x2F;pdf" rel="nofollow noreferrer">https:&#x2F;&#x2F;data.consilium.europa.eu&#x2F;doc&#x2F;document&#x2F;ST-14959-2022-...</a><p>Article 45(2): &quot;Qualified certificates for website authentication referred to in paragraph 1 shall be recognised by web-browsers. For those purposes web-browsers shall ensure that the identity data provided using any of the methods is displayed in a user friendly manner. Web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1, with the exception of enterprises, considered to be microenterprises and small enterprises in accordance with Commission Recommendation 2003&#x2F;361&#x2F;EC in the first 5 years of operating as providers of web-browsing services.&quot;<p>Article 45a(3): &quot;A qualified electronic attestation of attributes issued in one Member State shall be recognised as a qualified electronic attestation of attributes in any other Member State&quot;.<p>Article 45a(4): &quot;An attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source shall be recognised as an attestation of attributes issued by or on behalf of a public sector body responsible for an authentic source in all Member States.&quot;
评论 #38111936 未加载
评论 #38128107 未加载
评论 #38110231 未加载
评论 #38111171 未加载
phasmantistes超过 1 年前
Fundamentally, the whole issue with eIDAS comes down to one thing: you cannot mandate trust.<p>If it&#x27;s mandated, it isn&#x27;t trust. It&#x27;s something else. By mandating that browsers &quot;trust&quot; certain CAs, they&#x27;re breaking the entire trust model of the internet.<p>My only question is whether they truly don&#x27;t understand this, do understand it but don&#x27;t care, or are actively interested in destroying that trust.
judiisis超过 1 年前
India is also preparing legislation for OS and browser having their CA, they also launched their own web browser challenge <a href="https:&#x2F;&#x2F;iwbdc.in&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;iwbdc.in&#x2F;</a> .They were earlier removed due to unauthorised issuances <a href="https:&#x2F;&#x2F;pkic.org&#x2F;2014&#x2F;07&#x2F;24&#x2F;in-the-wake-of-unauthorized-certificate-issuance-by-the-indian-ca-nic-can-government-cas-still-be-considered-trusted-third-parties&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;pkic.org&#x2F;2014&#x2F;07&#x2F;24&#x2F;in-the-wake-of-unauthorized-cert...</a>
评论 #38128180 未加载
评论 #38123679 未加载
fuoqi超过 1 年前
If certificates issued by those CAs will be tied to independent (from EU) certificate transparency (CT) services and to specific national top-level domains, then I am completely fine with this. After a big number of websites in Russia (including the biggest bank in the country) have effectively lost access to the CA infrastructure used by commonly used browsers, I don&#x27;t think any honest person can say that the current status quo is robust enough. So it looks like EU simply hedges against this potential infrastructure risk.<p>To mitigate the MitM risk I believe that CT and limiting CA to specific top-level domains (so a hypothetical RU CA would not be able to issue certificates for .eu or .com) should be sufficient enough.
评论 #38110797 未加载
perihelions超过 1 年前
Ignorant question: what happens if Mozilla or Brave or whoever says fuck that, we&#x27;re not complying? What&#x27;s the enforcement mechanism for non-EU-based devs publishing FOSS freely on the global internet?
评论 #38111726 未加载
galadran超过 1 年前
<a href="https:&#x2F;&#x2F;eidas-open-letter.org" rel="nofollow noreferrer">https:&#x2F;&#x2F;eidas-open-letter.org</a><p>The open letter signed by 300+ researchers, professors and experts.
pxeger1超过 1 年前
I’m assuming this another… misguided… attempt by the security services to make their jobs easier. The grip that intelligence communities apparently have on our governments is ridiculous. Why do they have such influence?
评论 #38110433 未加载
评论 #38110791 未加载
Hard_Space超过 1 年前
Wow - this one really crept up on me, after years of seeing it shot down in flames by people who actually understand the technology, and the implications (not least, the security implications). I wonder if the recent passing of the UK act emboldened them..?
galadran超过 1 年前
<a href="https:&#x2F;&#x2F;last-chance-for-eidas.org&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;last-chance-for-eidas.org&#x2F;</a>
galadran超过 1 年前
Title should probably be: &quot;Last Chance to fix eIDAS: Secret EU law threatens Internet security&quot;
评论 #38111111 未加载
matthews2超过 1 年前
How will this be enforced? If Mozilla or Google added some hard coded certificate into a new browser version, what if a distribution like Debian patched it out? Or if a user can delete it from the certificate stores themselves?
评论 #38110667 未加载
评论 #38110692 未加载
评论 #38111947 未加载
johnfonesca超过 1 年前
eIDAS is a cartel created to protect the business interests of EU biggest certification authorities.
评论 #38111511 未加载
runnedrun超过 1 年前
Does anyone know what the supposed benefits are for this kind of bill? Are proponents overtly advocating for increased surveillance ability?
评论 #38110901 未加载
评论 #38110956 未加载
评论 #38111074 未加载
评论 #38119014 未加载
radicalbyte超过 1 年前
It&#x27;s worth noting that the technical team have a github where issue such as this can be raised.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;eu-digital-identity-wallet">https:&#x2F;&#x2F;github.com&#x2F;eu-digital-identity-wallet</a>
评论 #38115955 未加载
sirwitti超过 1 年前
I&#x27;d like to see what the european court of justice will have to say about this, should this actually become law.
kmeisthax超过 1 年前
So, the law says browsers have to trust eIDAS keys, but it doesn&#x27;t say browsers can&#x27;t complain about it, right?<p>Like, put the eIDAS keys in a special &quot;signed under protest&quot; trust root, and throw up a bunch of scary warnings about how the EU is forcing Mozilla to trust those keys whenever they are used. Phrase it so that people who think &quot;SSL warning&quot; means &quot;click advanced and &#x27;i know the risks&#x27;&quot; understand that this is equivalent to letting the CIA read your text messages.
评论 #38131501 未加载
jruohonen超过 1 年前
Oh dear, shooting on one&#x27;s foot once again.<p>Fortunately, they cannot forbid a natural person from removing any given certificate. If this passes, I am sure we have blacklists and scripts for these in no time.
评论 #38110766 未加载
评论 #38111260 未加载
anonymousnotme超过 1 年前
As far as certificate authorities (CAs) build into the browser: One way around this might be that the browsers ship with the CA as required by law, but that one can disable&#x2F;delete the CA via the UI. I would guess that a law would be passed that says that the browser can&#x27;t disable&#x2F;delete certain CAs (perhaps this one also says that). There can be a list of various government CAs that one might want to disable. This does not help if governments can pressure CAs to issue an alernate CA for use in MITM. Does any of the CA transaprency help? What about a way to have people endorse a certficate (i.e. reputation)?
jeremiahlee超过 1 年前
EU citizens wanting to oppose the current eIDAS proposal can use my edit of the open letter to send to their Members of European Parliament: <a href="https:&#x2F;&#x2F;www.jeremiahlee.com&#x2F;posts&#x2F;2023-eu-eidas-feedback&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.jeremiahlee.com&#x2F;posts&#x2F;2023-eu-eidas-feedback&#x2F;</a>
PeterStuer超过 1 年前
Honest question, so please bear with me.<p>How would an EU government that uses the Internet for servicing its citizens tell those citizens that the site they are accessing to provide very sensitive information is realy the government&#x27;s and not some other actor&#x27;s mitm&#x27;ed snooping conduit without having control of their own root CA?<p>Is demanding browsers distributed to EU citizens to carry this certificate different from demanding phone companies to route emergency service numbers correctly?<p>Ofc I can see the &#x27;dark&#x27; potential for a mandated cert. Is this realy different from current browsers ubiquitously storing trusted root certificates from CA&#x27;s issued by private companies residing in states with very serious compelled secret goverment access laws and regulations?
评论 #38128139 未加载
评论 #38129669 未加载
pandastronaut超过 1 年前
Candid question : if this is european legislation, how browser editor would handle this regional specific requirement ? Provide several flavor of their browser ? I doubt people and companies from outside europe would agree to use a european flavored version of their browser.
评论 #38114132 未加载
lakomen超过 1 年前
It&#x27;s like, anything coming from the EU lately in regards to IT is a totalitarian nightmare
varispeed超过 1 年前
Seems like some politicians from EU commission had parents in Stasi, KGB and other organisations and became allured by the stories of watching other people, learning they secrets or perhaps even seeing their naked photographs.<p>So these pervs now want to do the same. For what?
surfingdino超过 1 年前
This is concerning, but I still have faith in big orgs&#x27; and governments&#x27; inability to do a simple thing right while paying consultancies a lot of money for it. I have experience implementing banking infrastructure using eIDAS for participant identification and I know how CAs and financial institutions do not get eIDAS. They make rookie mistakes and deny they&#x27;ve done something wrong for months while blaming the other party and seeking regulatory exemptions. I&#x27;d be surprised if the EU governments were able to implement it. What wouldn&#x27;t surprise me would be them blaming browser devs for it.
demarq超过 1 年前
People are already self censoring what they really think on social media, this will push people to self censor in private convos.<p>At that point you’ve got to wonder what happens to democracy, when people are afraid to exchange ideas
评论 #38115886 未加载
JanisErdmanis超过 1 年前
Contrary to the majority of opinions here, I see this as a reasonable development for the state’s sovereignty, which will positively affect the decentralisation of certificate authorities. I hope that unprofessional negligence by European authorities will produce enough precedents and evidence to show that certificate authorities can’t be trusted blindly, and we will end up with transparent certificate authorities and web browsers which will audit every certificate with public logs with the help of History Trees.
verisimi超过 1 年前
Lololol<p>&quot;We need to be able to break security so we can see all your data, to keep you safe! Terrorists! Child abuse!&quot;<p>&quot;hmm yeah, but who&#x27;s going to keep me safe from you?&quot;
lacoolj超过 1 年前
EU is not the only place with insane laws like this in the pipeline. USA has been trying to introduce this kind of thing (EARN IT Act 2023) as well, under the guise of &quot;preventing child trafficking&quot;.<p>Terrifying times we live in where we may not even be able to keep our medical or financial information private anymore because of a handful of people voting on something they don&#x27;t understand.
algesten超过 1 年前
To protect myself or my company, what about a pihole (or similar) that rejects any TLS connection attempted with certs signed by these root CA?
评论 #38111581 未加载
评论 #38111555 未加载
xinayder超过 1 年前
Does someone else think it&#x27;s an extreme coincidence that we have Chat Control and now this in place? Pretty sure the negotiations around Chat Control revolve on this eIDAS being approved, that way you don&#x27;t &quot;undermine&quot; encryption because, well, you have the keys to decrypt everything.
diego_sandoval超过 1 年前
The proposal is so obscene that I doubt Apple, Google or even Microsoft would ever comply with it.
评论 #38111241 未加载
评论 #38111214 未加载
j45超过 1 年前
Maybe LLms can help people more effectively engage with their political representatives on topics like this.<p>I’m increasingly convinced that this type of legislation will continue to proliferate until legislation banning it is not pushed for and put in place.
phendrenad2超过 1 年前
In the EU they will take something that should be a standard, make it an actual law, and pretend it isn&#x27;t about spying on you, and expect you to believe it. Very 1984.
Jensson超过 1 年前
There is nothing there that says every service must use specific certificates, just that browsers should accept certain ones. So this in no way breaks encryption for apps who care, this only reduces security on apps that wants to reduce security.<p>For example, if you use private &quot;e2echat.com&quot; it can still use safe certs and be safe, the risk is only that &quot;governmentchat.com&quot; will use bad certs, which was already a risk.
评论 #38110341 未加载
评论 #38111017 未加载
评论 #38110482 未加载
Aerbil313超过 1 年前
Call it surveillance or whatever. It really isn’t. Trust and power as manifested by modern technology was and should be a reflection of real life trust and power. Historically, human societies’ governing bodies had all the power to exert as they wish on their citizens. Past couple decades were a deviation from this normal, not in the real but in the online world. You could work against the values of your own government without them being able to find and catch you. This legislation is just a correction to the resulting power imbalance, as the online world has increasingly more power on real world.<p>I think we’ll see the internet and digital ecosystems being segregated into separate parts with boundaries correlating to those of nation-states more and more by the year. As a member of a nation who is not exactly very comfortable with a US-dominant world, I’m all in for it. It’s a national security issue for me. Knowing that some three letter agencies on the other side of the world can surveil me against my rights as per my country’s laws. Or that payment systems (Visa&#x2F;Mastercard), or Google Maps (you don’t know how vital of a service it is) or satellite internet[1] can stop working if US and her allies determine my time has come.<p>Developing technologies has a power-centralizing effect, and very often it creates a disadvantage for everyone else who didn’t invent the thing first. Not exactly the world I’d have pictured as a desirable one had I lived 5 centuries ago. Maybe read some Ted Kaczynski?<p>1: Elon Musk stopped Starlink service in Gaza. They have no communications with the outside world.
评论 #38126419 未加载
ryukoposting超过 1 年前
I&#x27;ve generally been supportive of the EU&#x27;s web regulations, but this is utter insanity.
2-718-281-828超过 1 年前
you&#x27;d almost think that the &#x2F;ˌiːˈjuː&#x2F; is bent on subverting the internet. i&#x27;m experiencing fatigue from news like that already. can&#x27;t they just stick with what they do best, standardizing vegetables and banning british sausages?
moogly超过 1 年前
If they want to push more people to use the dark web, this would do it.
elric超过 1 年前
Could someone link to some actually helpful writeups on eIDAS? The linked article doesn&#x27;t mention what eIDAS is about, only vague but strongly worded language about it having to be stopped, with no justifications or even what it is.<p>The comments too are less helpful than usual. A lot FUD and anti-EU sentiment (which may or may not be warranted, but there&#x27;s very little objective reasoning going on).<p>Addendum: yes, people could look it up, but given the strong call to action (&quot;last chance to fix eIDAS!&quot;), I would suggest that the onus to provide clear information is on the authors. You can barely get people to care about privacy at all, let alone when so little information is provided.
评论 #38160084 未加载
workfromspace超过 1 年前
<a href="https:&#x2F;&#x2F;archive.ph&#x2F;Ilhes" rel="nofollow noreferrer">https:&#x2F;&#x2F;archive.ph&#x2F;Ilhes</a> (because it&#x27;s a NRD-newly registered domain which my dns-hole blocks)<p>Also brief info about website (for the ones who doesn&#x27;t want to visit an unknown domain without knowing):<p>A Mozilla website for open letter by 300+ cyber security experts, researchers and NGOs.
mindcrash超过 1 年前
Not just &quot;internet security&quot;. There has been discussion that they want to use eIDAS for a <i>lot</i> of things like identification in general and even a health passport.<p>Consider that last thing. We have this thing called bodily integrity [1], which guarantees everybody has self-ownership regarding their body and thus what can be done with it.<p>However, in the COVID period, it was clear as day that those who govern us dont give a rats ass about something like bodily integrity and going as far as taking away freedom of movement in order to make people comply with injecting themselves with a - until this very day - <i>experimental</i> vaccine.<p>Now consider what TPTB could do with a powerful toy like eIDAS.<p>So no, it is not &quot;just&quot; about internet security. Its about slowly and surely stripping away every human right you have as a EU citizen.<p>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Bodily_integrity" rel="nofollow noreferrer">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Bodily_integrity</a>
评论 #38120453 未加载
bjornsing超过 1 年前
I’m so tired of this shitstorm of crap EU regulation. Death by a thousand cuts…
mbwgh超过 1 年前
The following quote from former Jean-Claude Juncker, president of the European Commission sums up the way the EU seems to work quite nicely:<p>&quot;We decide on something, leave it lying around and wait and see what happens. If no one kicks up a fuss, because most people don&#x27;t understand what has been decided, we continue step by step until there is no turning back.&quot;[0]<p>[0] - <a href="https:&#x2F;&#x2F;en.wikiquote.org&#x2F;wiki&#x2F;Jean-Claude_Juncker" rel="nofollow noreferrer">https:&#x2F;&#x2F;en.wikiquote.org&#x2F;wiki&#x2F;Jean-Claude_Juncker</a>
评论 #38111932 未加载
评论 #38111460 未加载
评论 #38114121 未加载
评论 #38111102 未加载
评论 #38119974 未加载