It’s an opinion article, but I heavily agree with it. It’s really sad that technical decisions are made by chimps who can’t tell the difference between a computer and internet.
The eIDAS regulation makes an enormous change by mandating man-in-the-middle attack technology that it would be illegal for browser makers to defend against
How would this law affect websites with Onion Services (eg Facebook) that don’t use http at all, but Tor’s internal pinned end-to-end encryption with a pinned certificate tied to the .onion name?
This doesn’t affect websites as such - it’s the end clients, i.e. browsers that would be forced to accept gov issued CAs. I don’t see anyone going after TOR as it’s already a very niche thing, so it should be fine.
First it was Chat Control, and the US was flirting with it’s KOSA reform, now with elDAS 2.0 this all seems like global whac-a-mole for privacy. I read that elDAS was subject to approval behind closed doors in Brussels on November 8, What happened?
No idea about what happened behind the closed doors, if anything; but I feel like compiling your browser with a patchset that removes the restriction on CA removal is going to become a thing. Good thing I’m on Gentoo already.
The fight for privacy is not new, and it predates the internet by far.
The problem is that, in the past, the state was on your side in the fight for privacy. Today, it sides with Big Tech and whoever offers it the most data to conduct its own privacy violations, or pays our elected officials the most.
It’s a bit overwhelming when giant, unchecked and unaccountable monopolies and your own country, both with almost infinite resources and legal ways to do whatever they want with impunity, gang up on you at the same time.
Add comment