<story><title>A planned EU regulation about website certificates is causing concern</title><url>https://www.feistyduck.com/bulletproof-tls-newsletter/issue_86_eu_plans_to_mandate_less_secure_certificates_in_browsers</url></story><parent_chain><item><author>AnIdiotOnTheNet</author><text>Probably browsers will remove it anyway and deal with EU in court if they make a stink about it.&lt;p&gt;As it is, browser companies[0] are the sole authority on what is and isn&amp;#x27;t a valid CA. At least the EU leadership is elected.&lt;p&gt;[0] and let&amp;#x27;s be realistic here, this means Google.</text></item><item><author>JoshTriplett</author><text>&amp;gt; In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance.&lt;p&gt;And what happens when one of those institutions violates existing widespread CA policy, such as by issuing a certificate for MITM purposes, or otherwise making the web less secure? Right now, browsers can simply remove such CAs based on their established policy. (This isn&amp;#x27;t a hypothetical; browsers &lt;i&gt;have&lt;/i&gt; had to remove CAs for such misbehavior in the past.)</text></item><item><author>toyg</author><text>This title is clickbait. The proposed amendment to the framework is just excessively bureaucratic around the management of cert authorities. This might potentially result in browsers accepting certificates from authorities with a slightly dubious track record (according to browser vendors), yes, but the certificates themselves will not necessarily be &amp;quot;less secure&amp;quot; - which the layman typically interprets as &amp;quot;cryptographically weaker&amp;quot;.&lt;p&gt;In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance.&lt;p&gt;In fact, as time passes and authorities become more and more tech savvy, I expect this sort of thing to happen more and more. There is a lot of unaccountable authority (eh) in internet infrastructure, with special companies like Google and Microsoft (and yes, Mozilla too) effectively holding the keys to many kingdoms. Even if such power is used scarcely and wisely, there &lt;i&gt;is&lt;/i&gt; a question of legitimacy.</text></item></parent_chain><comment><author>jcranmer</author><text>&amp;gt; and let&amp;#x27;s be realistic here, this means Google.&lt;p&gt;Actually, it doesn&amp;#x27;t. There are four main browser CA root stores: Apple, Microsoft, Mozilla, and Google, and these are also the root stores of their respective operating systems (if you&amp;#x27;re on Linux, you&amp;#x27;re using Mozilla&amp;#x27;s root store, because distros do not want to run anything themselves).&lt;p&gt;Furthermore, the Microsoft, Google, and Mozilla root stores all also require inclusion in the common CA database, which is run by Mozilla. Also, Mozilla (and maybe Google) require CAs to participate in Mozilla&amp;#x27;s public lists, especially when it comes to notifying people of big CA security oopsies--all of the big CA issues have come to light on that list, and the coordination of the responses by browsers has been done by Mozilla.&lt;p&gt;So the biggest authority on who a valid CA is? &lt;i&gt;Mozilla&lt;/i&gt;.</text></comment>
<story><title>A planned EU regulation about website certificates is causing concern</title><url>https://www.feistyduck.com/bulletproof-tls-newsletter/issue_86_eu_plans_to_mandate_less_secure_certificates_in_browsers</url></story><parent_chain><item><author>AnIdiotOnTheNet</author><text>Probably browsers will remove it anyway and deal with EU in court if they make a stink about it.&lt;p&gt;As it is, browser companies[0] are the sole authority on what is and isn&amp;#x27;t a valid CA. At least the EU leadership is elected.&lt;p&gt;[0] and let&amp;#x27;s be realistic here, this means Google.</text></item><item><author>JoshTriplett</author><text>&amp;gt; In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance.&lt;p&gt;And what happens when one of those institutions violates existing widespread CA policy, such as by issuing a certificate for MITM purposes, or otherwise making the web less secure? Right now, browsers can simply remove such CAs based on their established policy. (This isn&amp;#x27;t a hypothetical; browsers &lt;i&gt;have&lt;/i&gt; had to remove CAs for such misbehavior in the past.)</text></item><item><author>toyg</author><text>This title is clickbait. The proposed amendment to the framework is just excessively bureaucratic around the management of cert authorities. This might potentially result in browsers accepting certificates from authorities with a slightly dubious track record (according to browser vendors), yes, but the certificates themselves will not necessarily be &amp;quot;less secure&amp;quot; - which the layman typically interprets as &amp;quot;cryptographically weaker&amp;quot;.&lt;p&gt;In practice, this would simply move a little bit of control over the list of accepted authorities from browser vendors to EU institutions, which is not terribly unreasonable a stance.&lt;p&gt;In fact, as time passes and authorities become more and more tech savvy, I expect this sort of thing to happen more and more. There is a lot of unaccountable authority (eh) in internet infrastructure, with special companies like Google and Microsoft (and yes, Mozilla too) effectively holding the keys to many kingdoms. Even if such power is used scarcely and wisely, there &lt;i&gt;is&lt;/i&gt; a question of legitimacy.</text></item></parent_chain><comment><author>dane-pgp</author><text>&amp;gt; Probably browsers will remove it anyway and deal with EU in court if they make a stink about it.&lt;p&gt;A more direct and confrontational approach would be for browser companies to do what website owners have effectively done, which is to agree in advance to implement some sort of annoying pop-up (shown every time the browser updates) saying &amp;quot;Do you want the EU to weaken your security and enable spying? [Yes] [No]&amp;quot;, like those annoying cookie pop-ups.&lt;p&gt;The difference being, of course, that the cookie pop-ups are designed to dark-pattern users into giving away their rights, and to blame the EU unfairly, whereas these browser pop-ups would be to help protect users&amp;#x27; rights and to correctly blame the EU (assuming the regulation passes).</text></comment>