Hacker News Reader

Comment by parasense | Hacker News Reader

I think the Browsers should swing the axe the other direction. Indicate the website is broken when EV certificates are present. Also, indicate all websites are broken if/or when the Root-CA-trust ever be forcefully extended to include EV CA authorities, in particular state backed authorities.

I'm not sure about the EU, but forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech. Regrettably I would not be surprised if EU took a more authoritarian stance.

View on HN

"forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech."

I understand the issues mentioned in passing scammy actors as legitimate but, in which way your rights to speech would be vulnerated?

It would be compelled speech if the law required the browsers to say that a connection is secure when its creators don't want it to.

https://en.wikipedia.org/wiki/Compelled_speech

Whether or not it would violate the 1st amendment would be up to the courts to decide.

The cancer label warnings in California aren't violating any free speech, this is the same thing so it wouldn't violate it. All the browsers would say is "The European Union has verified the identity of this site owner" or something similar.

I feel there is a big difference between a mandated warning label (California cancer labels), Vs a mandated endorsement like forcing browses to say that unsecure connection is secure.

Sure there is a big difference, but not from the perspective of free speech. Both cases forces you to display a label even if you don't want to show it to people. It is understood that the label isn't your speech, hence it doesn't limit your free speech rights.

You might object to this for other reasons, but free speech isn't a good reason.

>"The cancer label warnings in California aren't violating any free speech"

That's because it's commercial speech [0] attached to a sale of a product, which gets a reduced level of protection. I'm don't think that you could, in the US, compel non-commercial software to express messages like "We trust this CA". Mozilla has a 1st amendment right to not trust to CA's, and to tell their users why they don't trust the CA; to boycott a CA; to implement this in code and ship it.

[0] https://crsreports.congress.gov/product/pdf/IF/IF11072 ("The First Amendment: Categories of Speech")

> Mozilla has a 1st amendment right to not trust to CA's, and to tell their users why they don't trust the CA; to boycott a CA; to implement this in code and ship it.

Nothing so far says that Mozilla can't tell its users that EU trusts this but Mozilla doesn't. However it is clear that it is intended to force Mozilla to at least gives the user the choice to trust EU on this.

The part where they're forced to provide the EU's alternative version is still compelled speech.

The decision of trusting or not trusting a CA has an expressive character; it's not pure machine math. Some of the decisions are political speech, even: "we don't like the policies of country X, therefore we'll boycott their root certificate". (Roughly characterized)

I'm not sure I follow. How are EV certificates weak? They use the same cyphers and just have extra validation on the owner/domain.

It appears to be more of a UI issue where the legal entity name is shown along side or sometimes in place of the URL which can be misleading.

To compound problems legal entity names are not required to be unique across states or countries so an EV certificate for a popular company name can be obtained in another geography and presented to the user on an attacker controlled domain.

https://www.bleepingcomputer.com/news/security/extended-vali...

> I'm not sure about the EU, but forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech. Regrettably I would not be surprised if EU took a more authoritarian stance.

Care to expand on this? I have a hard time making any sort of connection.

I don't see how the USA's first amendment is at all applicable to the EU.

Reply on news.ycombinator.com