What's the problem they're trying to solve here? Is it just lobbying fortthe return of special EV certificates or is there actually some kind of government issue that these people are trying to solve?
I find mitm fears related to CAs rather funny when everybody uses cloudflare anyway.
As much as I despise Cloudflare, at least in Germany the pandemic has shown that authorities can't be trusted with data even if taken with the best of intentions.
At best, you're "forced to trust" a DDoS protection vendor, not cloudflare specifically. I'm sure there are DDoS protection vendors that are "rooted in [...] (EU) jurisdiction". Also, switching between such vendors is pretty trivial, much easier than trying to trying to lobby the government into stopping surveillance.
If I had to name one off the top of my head it would be ovh.
>And where you get the firm conviction that both cloudflare and existing CA's aren't tapped already?
"why don't you let the government mandate encryption backdoors? Your messaging app is probably already backdoored already"
I can be sure they're doing a good job, because I can see them doing a good job, and have no reason to believe they're suppressing any bad news. Are you making a theoretical argument here? In other words, are you simply claiming that the current state of affairs is bad because google/mozilla/apple can go rogue and do bad things?
As for transparency, AFAIK both google and mozilla have their certificate policy discussions available to the public, eg. https://groups.google.com/a/chromium.org/g/blink-dev/c/eUAKw...
>We have no idea so we happily live in illusion that they aren't pushing anything nefarious
This sounds like argument from ignorance. ie. "we have no idea whether they're not pushing anything nefarious, therefore we should assume they're pushing something nefarious". If you think they're acting nefariously, by all means mention it here. Don't go beating around the bushes with vague accusations that they might be doing something bad, and use that to justify the government stepping in.
Yes I am simply claiming that the current state of affairs is bad because google/mozilla/apple can go rogue and do bad things. I'm not claiming they necessarily are. But history teaches us that great power brings corruption, they aren't so much different from Microsoft some decades ago.
The government's past and current push to ban encryption (or similar efforts) aren't "vague".
>Yes I am simply claiming that the current state of affairs is bad because google/mozilla/apple can go rogue and do bad things. I'm not claiming they necessarily are. But history teaches us that great power brings corruption, they aren't so much different from Microsoft some decades ago.
You have to trust the browser makers regardless. If you want to prevent browser makers from going rogue (eg. sending your browsing data directly to them), you'd need far more comprehensive regulation than this. The only thing this does is force your browser to trust additional set of entities. In that respect, this legislation is quite pointless, because we haven't seen browser makers unfairly exclude upstart CAs. I suppose the regulation might be worth keeping around just in case, but I'm not really convinced of the cost/benefit. As I see it the benefit is that if browser makers decide to go rogue and exclude new CAs, this will allow EU and/or member states to issue their own certificates. The downside is that EU and/or member states can issue TLS certificates to MITM connections. Am I missing anything?
Certificate authorities like Camerfirma[1] were revoked from all browsers because of numerous policy violations. This legislation is intended to force browsers to accept their certificates.