Internet Society: Mandated Browser Root Certificates in the European Union’s eIDAS Regulation on the Internet

Relates to Mozilla posting similar concerns.

· · Web · 1 · 2 · 2

@jens This is bad, but then I also have to laugh at the idea that we fool ourselves into thinking we're secure when we *know* that many of the CAs are compromised. Any kind of security based on trust, is not security. Trent was killed by Snowden (although he was looking pretty ill before that).

@dentangle All security is based on trust. The question is only who to trust (and with what).

@jens I mean 3rd-party trust. aka. Trent. The CA model that TLS uses is inherently insecure and we know that many CAs are compromised. Yet we trust it anyway. Yet browsers will put up a warning for a certificate that I've personally created and verified (no trust involved). It's broken.

@dentangle I know what you meant.

I don't actually think 3rd-party trust is broken, either. I think it has its place and uses - for example, a CA for signing keys as part of a group (team?), and revocations to go along with it.

The TLS system is mostly broken because it's unidirectional and strictly hierarchical, and based on root authority. As a result, I have to trust everything or nothing, essentially.

But mostly this relates to key management, not to TLS itself.

@jens Aye - if you are in control of the CA, then TLS is fine. The browser situation is not (and never has been) any kind of security, unless you delete all the bundled CAs. Even certificate revocation was a late afterthought by browsers that took years to fix.

@dentangle All security has been an afterthought to the web, so who is surprised by this? 😂

@jens Most users, unfortunately. And sadly, a lot of techies who should know better. We are in the minority.

@jens to be fair, pretty much all the early Internet protocols had no security. telnet / gopher / dns. ssh coming along and saying "hey, perhaps we shouldn't send passwords across the network in cleartext" was quite a novel concept.

@dentangle Oh yeah! I can see HTTP in its historical context, and understand it as quite good - no arguments there!

Hindsight is 20/20, and all that.

@jens yeah, if we were to design the Internet from scratch now, we'd have very different design goals. Security, human rights + scaling to billions of nodes.

That it works at all is frankly amazing.

But then I look closer and realise the Internet doesn't, in fact, work.

And that's why we're trying to build a better one 🙂 Must take a closer look at your project when I get a moment. Sounds like there's a lot of overlap with our goals so I think we can help each other.

@dentangle Yes - I think there's *a lot* of overlap. The main thing is, we have some lines of communications open.

(for the hashtag crowd)

@jens So the EU mandating that browsers add some *more* dodgy CAs pre-bundled is bad, but it was already bad.

@dentangle Worse, CAs that may be more dodgy than the existing ones. It's particularly bad.

Some days I just want to see the web burn.

@jens You're not alone. The web has held back Internet innvovation in a big way. It was never designed to be our only interface to a compuiter or the Internet.

@dentangle I think I've made this argument all the way back in the early 00s when I realized base64 encoding for image transfer was (then) required and blew up dial up traffic by about a third.

It's laughable nowadays, really, but it hasn't *changed* (e.g. base64 images in CSS) - it's just not nearly as bad as other things.

@dentangle @jens

yep, the whole CA thing is a bag of nuts, that is broken in different ways in meany of the #openweb projects am involved in.

If you won't an example of the #geekproblem then this is a good one

How did we get into this mess?

@jens @dentangle

all understanding of reality (outside our personal experience) is based on trust.

Sign in to participate in the conversation
Finkhäuser Social

A private instance for the Finkhäuser family.