EU Article 45 requires that browsers trust certificate authorities appointed by governments::The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from…
you seem to know what you are talking about and I looked into this very long ago, maybe you can help me understand.
From what I can understand reading most of the article this forces browsers to accept the certificates, but it doesn’t force the websites to use them, right?
So what is stopping Firefox from showing a warning (like the lock icon being orange, but it could also be a more intrusive message) stating that the certificate was issued by a country and/or doesn’t fullfil modern security standards in case one of these CAs is used?
On top of that, the CA doesn’t really encrypt the private key of the domain, it just adds a signature stating that the message with the salt and the public key are legit, right? everyone seems to think the government itself will be able to passively see the traffic, but if I remember correctly they would have to gateway the whole transaction (I’m guessing the browser will also have a cache of keys and this could become a bit tricky to do in a global way)
But of course we all know how technologically illiterate governments are (there could be one good, but there will be some “less good” for sure). So yeah, it does sound like a horrible idea to begin with. Because if a CA starts being insecure nowadays browsers can just remove them and go with their life, but if there is a law forcing browsers wouldn’t be able to.
I’m just curious about the specifics in case I’m outdated on what I remember.
Regarding what a browser like Firefox can do, they aren’t allowed to impose any stricter checks or requirements than what the EU’s standards body permits and they must trust them, according to these rules. That means that the warning you suggested likely wouldn’t be allowed.
As for it not happening passively, your right that it would need to be actively man in the middled. It would be fairly easy to detect but what could be done about it? The browser is required to trust it, additional checks can’t be enforced, and the CA involved wouldn’t be allowed to be distrusted without the relevant government’s permission. It then becomes a game of who blinks first, the browser vendors potentially pulling out of a country or the EU entirely or a government that for some reason thinks it’s in the right by intercepting traffic for the children, against terrorism, or whatever excuse they come up with.
Well why couldnt firefox implemwnt the check anyways and have it trigger only if the signature is valid. That way the only proof the EU would have would be if they where activly performing man in the middle. Whats the eu gonna do ban them when they catch browsers catching them spying, think of the public outrage that would cause. Think of the headline “Browser xyz banned in EU after it caught EU spying on citizen”.