Conversation

Notices

1. Embed this notice
   Parade du Grotesque 💀 (paradegrotesque@mastodon.sdf.org)'s status on Wednesday, 08-Nov-2023 04:34:11 JST Parade du Grotesque 💀

   If that piece of _____ eIDAS 2.0 ever passes, the only ways to maintain security will be:

   - download the "International" version of, say Firefox, or:

   - download an untampered version of the Mozilla CAs from abroad, or:

   - blacklist the updates of your browser, so it stays on a pre-eIDAS version and untampered CA (less than ideal for security reasons).

   Am I doing this right?

   Either way, I suspect this is yet something that will only affect the less tech-savy.

   • Embed this notice
     Joe Ortiz (joeo10@mastodon.sdf.org)'s status on Wednesday, 08-Nov-2023 05:33:19 JST Joe Ortiz

     in reply to

     • fedops 💙💛

     @fedops @ParadeGrotesque The issue in this case is the EU telling these browsers that they're in charge of CA security and We'll install a backdoor into the certificates. As the EFF says, this will set web security back 12 years at least.

   • Embed this notice
     Parade du Grotesque 💀 (paradegrotesque@mastodon.sdf.org)'s status on Wednesday, 08-Nov-2023 05:33:21 JST Parade du Grotesque 💀

     in reply to

     • fedops 💙💛
     • Joe Ortiz

     @fedops

     See these links, courtesy of @joeo10 :

     https://www.techdirt.com/2023/11/03/eu-tries-to-slip-in-new-powers-to-intercept-encrypted-web-traffic-without-anyone-noticing/

     https://www.eff.org/deeplinks/2023/11/article-45-will-roll-back-web-security-12-years

   • Embed this notice
     fedops 💙💛 (fedops@fosstodon.org)'s status on Wednesday, 08-Nov-2023 05:33:21 JST fedops 💙💛

     in reply to

     • Joe Ortiz

     @ParadeGrotesque @joeo10 mh interesting, thanks. Not great.

     I actually see this as an issue for the OS more so than a browser. With Firefox for example maintaining its own certificate store it should be doable to just remove the problematic certificates. But on android or windows with browsers that use the OS store it would become really problematic.

   • Embed this notice
     fedops 💙💛 (fedops@fosstodon.org)'s status on Wednesday, 08-Nov-2023 05:33:22 JST fedops 💙💛

     in reply to

     @ParadeGrotesque is that really so? The only thing I see so far are requirements for operators of certificate authorities. Which personally I think is a good idea, based on the amount of fly-by-night outfits.

     But I don't claim to have anything approaching the complete picture. Pointers appreciated. 👍