Hacker News Reader

Comment by phicoh | Hacker News Reader

I wonder why QWACs are less secure than DV.

There is an argument why EV should be treated the same a DV I'm not buying that argument but for the moment let's accept it as true.

However, now Mozilla is arguing that EV is less secure than DV. That seems weird to me.

Currently, browsers have root certificates for lots of countries. I can imagine that for a country it becomes a huge problem if suddenly a major browser decides to reject certificates used by that country's government.

Of course, it would be nice if country certificates could be restricted to country specific resources. Maybe mozilla should push for that.

View on HN

I see two issues at play.

Not all European CAs meet browsers' root programs requirements. Forcing everyone to accept those certs weakens all root programs (Mozilla's, Microsoft's, etc).

There is also the concern that special indicators displayed with a certificate can mislead users. A scummy company with an EV cert isn't any more trustworthy than if they had a DV cert, but browsers want to be careful not to imply a fancy logo makes the site any safer.

I doubt there is any text that browsers have to enable those certs by default outside the EU.

It could weaken protection for people in the EU, but then the way forward is to make requirements for root certs mandatory in the EU.

Maybe I missed it, but did the document require special UI elements for EU certs?

Yes. It requires the EU Trustmark, a logo designed through a secondary-school competition, to be displayed with certain colors and sizing, as directed through Implementing Acts (which have the force of law, but decided at the Commission level).

> Not all European CAs meet browsers' root programs requirements.

That sounds like a huge problem, why should EU trust that USA handles trust certificates well? Of course they would want to regulate this instead of leaving that extremely large security hole open, letting USA alone decide what counts as secure or not is not in EU's interests.

I think it is a legitimate concern in both directions. Who should users trust more: Mozilla or their local government? Some countries have tried to use local PKI to spy on citizens. Mozilla has taken steps in the past to prevent abuse. On the other hand, can Mozilla accept an Iranian CA even if they can match the root program's requirements?

Amusingly, Mozilla rejected the US government's request to add the federal PKI to the root store.

Trust in government is typically a lot higher in EU than most other parts of the world, so you can't really compare. I know Americans often wants private companies to protect them from governments, but in EU people typically wants their government to protect them from private companies. I trust my government way more than I trust Mozilla, Google, Microsoft and Apple combined, it isn't even close.

Mozilla has identified issues with CAs that are part of eIDAS. The severity of these issues can be debated, but the nice part of Mozilla's root program is that these are publicly debated. For example, the community identified repeated issues with the CA Certinomis and after failures to improve they were distrusted. Is it a good thing that the EU says that doesn't matter and Certinomis certs must be trusted as part of eIDAS?

https://drive.google.com/file/d/1DgJe-Ku4u66JF2D6zha28tSKxPB...

https://wiki.mozilla.org/CA/Certinomis_Issues

Mozilla argues in their paper that once governments in one part of the world start forcing browsers include root certificates, governments in other parts of the world will start doing the same shortly after. You might trust your government more, but you certainly wouldn't trust arbitrary governments more.

Furthermore, I have seen nothing wrong in mozilla's stewardship of the root certificate program in the decades it's been running, whereas mozilla points to deficiencies in the EU's certificate programs. This is to be expected since running a root store is not one of the EU's specialties. I would trust that government most that defers to private companies in areas where they lack expertise.

> Who should users trust more: Mozilla or their local government?

Is that really a question to be taken seriously? One is a private organization, completely unaccounted for and in a foreign jurisdiction, who sets their own rules and follows up on themselves.

The other is accountable and audited by independent auditors in a system which upholds separation of power and keeps independent media?

(Just to clarify: Neither Mozilla or anyone else should accept QWAC or any other standard in the face of legitimate concerns, of course. That's not what trust means.)

When it comes to international relations I would depend on (not exactly trust, but close enough) my government more than Mozilla. When it comes to browser implementation topics I trust Mozilla more than any government.

There is nothing intrinsic to any system of government that would make any of them good at solving technical issues on their own.

No one said they should. The EU should at least meet the same if not better standards. Instead they are trying to make an objectively less secure system.

Are the TSP audit requirements less strict than what the browsers’ root programs require?

Mozilla says so.

https://drive.google.com/file/d/1DgJe-Ku4u66JF2D6zha28tSKxPB...

I can't speak with authority, but my reading of PKI issues suggests Google is just as strict, while Microsoft and Apple are less strict. However, that just might be because MS and Apple are less public with their root programs.

One element that results in less security is that it becomes more difficult to replace.

For example, QWACs cannot legally be automated (e.g. via ACME), because of certain restrictions applied to needing to validate the natural or legal person making the certificate request. This actually was an issue for one CA (BuyPass) that tried to support ACME but ran afoul of the framework.

While originally QWACs were proposed as optional, regulation such as PSD2 attempts to make them mandatory for (financial services) servers to obtain. If one of those keys is compromised, then the server wishing you obtain a replacement certificate may have to wait weeks to obtain such a certificate, or make an in-person visit to the CA (e.g. the post office).

A considerable number of compromised or misissued certificates have failed to been revoked on the industry-agreed upon timelines (24 hours or 5 days, depending), because of challenges CAs have faced because their customers haven’t (or legally can’t) automate replacement, and because the additional information in the certificate requires manual validation, despite having no technical impact on the TLS connection.

Not being able to automatically renew certificates seems like a rather minor point in the bigger picture.

I get QWAC goes against the trend of phasing out EV certs. But isn’t the real issue that the browsers don’t trust TSP audits carried out for EU member states?

It’s actually a huge issue - look at how eliminating a key difficulty in obtaining certificates massively increased HTTPS adoption (via LetsEncrypt and others)

Similarly, automation affects how easy or hard it is to replace a CA, for example, if moving to distrust a CA. If you rely on QWAC attributes, you can only use QWAC CAs, and changing CAs becomes significantly more complex.

The audit issue is definitely an issue: the audits used are fundamentally different than what browsers try to achieve, and so having to adopt the lower standard definitely impacts user security. However, my point was that in addition to those concerns, the technical design itself results in less robust and less agile systems, and that makes things less secure.

Most browser vendors do business in the EU. And governments in general have a right to set standards for products and services.

In some sense, Firefox could be an exception, because Mozilla doesn't seem to do a lot of advertising in the EU.

It is not like Apple, Google, or Microsoft can say: we don't really care about the EU, we just remove the browser from products we distribute (directly or through third parties) in the EU.

They're not saying EVs or QWACs are themselves less secure than DV. Rather they are saying that they aren't more secure (because of difficulties interpreting them) and so leading users to place more trust in them can hurt the consumers.

QWACS are untrustworthy because they can be issued by a CA that is not publicly audited.

But the way I understand it, a QWAC is an identity certificate, issued to users, not to websites. AIUI, websites are to be compelled to accept such user-certs in lieu of a password. Well, I don't see what that has to do with the contents of the root store - that controls the website identities that my browser will accept, not the user-identity that the website accepts.

I read the position paper, but not the regulation. I'd like to see a better explanation of the regulation.

QWACs are for web sites, not users. CAs have to be audited as a TSP in order to issue them and be approved by the member state.

Reply on news.ycombinator.com