Hacker News Reader

Comment by donmcronald | Hacker News Reader

> This upper bar on security may even ban browsers from enforcing Certificate Transparency, an IETF technical standard that ensures a CA’s issuing history can be examined by the public in order to detect malfeasance.

I don't quite understand that. How does a browser enforce CT? Even if a browser queries CT logs, they're not that helpful without any context, right? How would a browser get anything useful from the logs beyond knowing a certificate was published to the logs?

Isn't it the job of the domain owner to monitor those logs since they're the only one that's going to know definitively if a certificate is illegitimate?

View on HN

Browsers enforce Certificate Transparency by rejecting certificates which aren't published in CT logs. A certificate that is published in CT logs isn't necessarily legitimate, but at least it's public so domain owners can detect it and raise the alarm if the certificate is illegitimate.

Unfortunately, Article 45 states that certificates issued by EU-mandated CAs "shall not be subject to any mandatory requirements other than the requirements laid down in paragraph 1" and paragraph 1 does not allow browsers to reject certificates not published in CT logs.

Thus, EU-mandated CAs will be able to issue undetectable MitM certificates.

Do you happen to have the full text you're referring to? I cannot find that on Google and the one I'm reading says something else. I also couldn't find it on eff's post

I can't seem to find it anywhere. This line leads me to think it isn't public, which is crazy:

> The text isn't final yet, but is subject to approval behind closed doors in Brussels on November 8.

Unfortunately, the text is being drafted in secret and the latest version has not been released publicly. I have seen a leaked copy but I don't have permission to post it. I can attest that the various posts and letters speaking against eIDAS are accurately representing the text.

I know this isn't a satisfying answer, but blame the EU for drafting legislation in secret.

Why are we arguing about something still in the drafting stage, then? If they're still working on it, they're still working on it. It's not even finished to the stage where the public or the parliament can review it. There's probably stuff in there they're still thinking through and will eventually delete.

Laws don't go from secret drafting, straight to law. They get public comments, the parliament has to vote on them, the commission has to vote on them (I think - something like that), they go back to drafting to make an amended version that's more acceptable, etc etc... of course the unfinished draft version isn't acceptable.

This isn't the first time everyone's got upset about an unfinished EU law. All previous times, it was shot down by the EU Parliament, who are supposed to represent the citizens.

Because this is not the “start of drafting” but roughly “final text that is largely a rubber stamp approval.” This is the output of having been through the the trilogue process - where the Parliament would/has shut things down before - and not been shut down.

[1] https://en.m.wikipedia.org/wiki/Formal_trilogue_meeting

Ah, so every CA in Europe just lost trustworthiness due to their government.

Delist European CAs until they get their shit together.

When Kazakhstan tried pulling this the browser vendors did that to them and were able to because Kazakhstan couldn’t imprison their executives and employees to compel compliance. The EU on the other hand can and will.

How would the EU punish Google, who is an American company? At most, the EU affects things within its borders. They have no say on the greater Internet.

The EU had better invest in its own browser if it intends to outlaw encryption.

By locking up it's executives in Europe or seizing it's property in Europe. Both of which it has in far greater quantities than Kazakhstan did.

Ah, I see. So at minimum, they'd need strategies to move assets out of the region while complying to some degree, until the assets were safe.

A better example would be Brave or another smaller organisation.

Big multinationals have employees and assets everywhere that can be threatened.

However smaller organisations operating from a single jurisdiction can only be threatened by their local government (or at least with the consent of their local government).

I thought about Brave, but because they repackage Blink, the EU could choose to go upstream and target the engine rather than the browser, and Google ends up part of the equation anyway.

Firefox is in the US, right? Pale Moon is too iirc and they forked Gecko to make Goanna.

It's very hard for legal tools to change open source engines. Even if they compelled code changes from the engine maker, the downstream browsers could modify the engine code before putting it in their browsers. This is especially true for configuration type changes, like which certificate authorities to trust or which websites to blacklist.

> A certificate that is published in CT logs isn't necessarily legitimate, but at least it's public so domain owners can detect it and raise the alarm if the certificate is illegitimate.

Oh yeah. I can't believe I didn't put that together. Thanks for spelling it out :-)

> How does a browser enforce CT?

The certificate contains signatures from the CT logs. The browser can either accept those signatures or check the CT log itself. This "enforces" CT for the certificate of the site you're accessing, but not necessarily the CA. Of course if a certificate comes up that fails CT logging, that can raise scrutiny of the CA.

Reply on news.ycombinator.com