Fw: [新聞] 歐盟打算監聽所有人的網路連線

[skycat2216 (skycat2216)]

※ [本文轉錄自 Gossiping 看板 #1bJtYBwx ]

作者: skycat2216 (skycat2216) 看板: Gossiping
標題: [新聞] 歐盟打算監聽所有人的網路連線
時間: Sat Nov 11 20:50:17 2023

備註請放最後面 違者新聞文章刪除

1.媒體來源:
The Register


2.記者署名:
Thomas Claburn

3.完整新聞標題:
Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

EFF warns incoming rules may return web 'to the dark ages of 2011'



-----------簡單的說明:----------
這算中國老早就做過的事
CNNIC發過這種證書，後來還買下其他證書發行商，導致CA開始不被信任
不過這次歐盟更狠，直接要求不得移除

4.完整新聞內文:

Lawmakers in Europe are expected to adopt digital identity rules that civil soci
ety groups say will make the internet less secure and open up citizens to online
 surveillance.

The legislation, referred to as eIDAS (electronic IDentification, Authentication
 and trust Services) 2.0, has been described as an attempt to modernize an initi
al version of the digital identity and trust service rules. The rules cover thin
gs like electronic signatures, time stamps, registered delivery services, and ce
rtificates for website authentication.

But one of the requirements of eIDAS 2.0 is that browser makers trust governme
nt-approved Certificate Authorities (CA) and do not implement security controls
beyond those specified by the European Telecommunications Standards Institute (E
TSI).

Under eIDAS 2.0, government-endorsed CAs – Qualified Trust Service Providers, o
r QTSPs – would issue TLS certificates – Qualified Website Authentication Cert
ificates, or QWACs – to websites.

But browser makers, if they suspect or detect misuse – for example, traffic int
erception – would not be allowed to take countermeasures by distrusting those c
ertificates/QWACs or removing the root certificate of the associated CA/QTSP fro
m their list of trusted root certificates.

Put simply: In order to communicate securely using TLS encryption – the technol
ogy that underpins your secure HTTPS connections – a website needs to obtain a
digital certificate, issued and digitally signed by a CA, that shows the website
 address matches the certified address. When a browser visits that site, the web
site presents a public portion of its CA-issued certificate to the browser, and
the browser checks the cert was indeed issued by one of the CAs it trusts, using
 the CA's root certificate, and is correct for that site.

If the certificate was issued by a known good CA, and all the details are correc
t, then the site is trusted, and the browser will try to establish a secure, enc
rypted connection with the website so that your activity with the site isn't vis
ible to an eavesdropper on the network. If the cert was issued by a non-trusted
CA, or the certificate doesn't match the website's address, or some details are
wrong, the browser will reject the website out of a concern that it's not connec
ting to the actual website the user wants, and may be talking to an impersonator
.

Here's one problem: if a website is issued a certificate from one of those afore
mentioned Euro-mandated government-backed CAs, that government can ask its frien
dly CA for a copy of that certificate so that the government can impersonate the
 website – or ask for some other certificate browsers will trust and accept for
 the site. Thus, using a man-in-the-middle attack, that government can intercept
 and decrypt the encrypted HTTPS traffic between the website and its users, allo
wing the regime to monitor exactly what people are doing with that site at any t
ime. The browser won't even be able to block the certificate.

As Firefox maker Mozilla put it:

This enables the government of any EU member state to issue website certificates
 for interception and surveillance which can be used against every EU citizen, e
ven those not resident in or connected to the issuing member state. There is no
independent check or balance on the decisions made by member states with respect
 to the keys they authorize and the use they put them to.

How that compares to today's surveillance laws and powers isn't clear right now,
 but that's the basically what browser makers and others are worried about: gove
rnment-controlled CAs being abused to issue certificates to websites that allow
for interception. If an administration tried using a certificate not issued by a
 trusted CA, browsers would reject the cert and connection, hence Europe's desir
e to make browser makers accept government-backed CAs.

Certificates and the CAs that issue them are not always trustworthy and browser
makers over the years have removed CA root certificates from CAs based in Turkey
, France, China, Kazakhstan, and elsewhere when the issuing entity or an associa
ted party was found to be intercepting web traffic. Many such problems have been
 documented in the past.

An authority purge of this sort occurred last December when Mozilla, Microsoft,
 Apple, and later Google removed Panama-based TrustCor from their respective
lists of trusted certificate providers.

Yet eIDAS 2.0 would prevent browser makers from taking such action when the CA h
as a government seal of approval.

"Article 45 forbids browsers from enforcing modern security requirements on cert
ain CAs without the approval of an EU member government," the Electronic Frontie
r Foundation (EFF) warned on Tuesday.

"Which CAs? Specifically the CAs that were appointed by the government, which in
 some cases will be owned or operated by that selfsame government. That means cr
yptographic keys under one government's control could be used to intercept HTTPS
 communication throughout the EU and beyond."

The foundation added the rules "returns us to the dark ages of 2011, when certif
icate authorities could collaborate with governments to spy on encrypted traffic
 — and get away with it."

Mozilla and a collection of some 400 cyber security experts and non-governmental
 organizations published an open letter last week urging EU lawmakers to clari
fy that Article 45 cannot be used to disallow browser trust decisions.

"If this comes to pass it would enable any EU government or recognized third par
ty country to begin intercepting web traffic and make it impossible to stop with
out their permission," the letter warns. "There is no independent check or balan
ce on this process described in the proposed text."

In an email to The Register, a Mozilla representative added, "Mozilla is deeply
 concerned by the proposed legislation and is continuing to engage with key stak
eholders in the final stages of the trilogue process. We are committed to securi
ty and privacy on the Internet and have been heartened by the outpouring of supp
ort from civil society groups, cyber security experts, academics, and the public
 at large on this issue. We are hopeful that this heightened scrutiny will motiv
ate EU negotiators to change course and deliver regulation with suitable safegua
rds."

Google has also raised concerns about how Article 45 might be interpreted. "We a
nd many past and present leaders in the international web community have signifi
cant concerns about Article 45's impact on security," the Chrome security team
argued, and urged EU lawmakers to revise the legal language.

According security researcher Scott Helme, the latest regulatory language – whi
ch has not been made public – is still problematic.

The EFF says the legislative text "is subject to approval behind closed doors in
 Brussels on November 8." ®



5.完整新聞連結 (或短網址)不可用YAHOO、LINE、MSN等轉載媒體:
https://www.theregister.com/2023/11/08/europe_eidas_browser/


6.備註:
CNNIC跟沃通：老鄉，你好，希望你比我們死的還慘

歐盟敢這麼做，我一定DDoS爆破他們伺服器，如果可以，我連他們的機密都要挖出來
這已經不是可以玩五樓哽的東西了，你能想像對岸監聽全世界的一切通訊嗎？

--
※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 111.82.109.225 (臺灣)
※ 文章網址: https://www.ptt.cc/bbs/Gossiping/M.1699707019.A.EBB.html*[m
※ 發信站: 批踢踢實業坊(ptt.cc)
※ 轉錄者: skycat2216 (111.82.109.225 臺灣), 11/11/2023 21:56:27
※ 編輯: skycat2216 (111.82.109.225 臺灣), 11/11/2023 21:57:13
※ 編輯: skycat2216 (111.82.109.225 臺灣), 11/11/2023 22:00:52
→ skycat2216: 已徵得版主Arelies同意
推 greenpeace21: 這超嚴重的 怎大家沒反應?
推 maximper79: big brother 看著
推 Bencrie: 一層不夠就加兩層
→ skycat2216: 因為他們覺得歐盟管不到自己
推 Ceelo: 什麼稜鏡計畫
→ Medic: 要如何阻止別家侵犯隱私 就是自己先來XD
→ kaj1983: 全民公敵逆
→ ienet788: 只要沒有隱私就沒有侵犯問題，這很對岸
→ ienet788: 阿
→ kaj1983: 電影劇情竟然要在現實生活出現了
推 MK47: 這超白爛的
推 auva: https://imgur.com/aBYod2F
→ auva: https://imgur.com/lVDA6MB
推 SakeruMT: >>距離一有犯罪念頭就逮捕的進度>>>>>
推 a27588679: 太扯了吧 歐盟明顯越線了
推 ltytw: 嘔盟本來就管東管西
推 dos01: 所有人也不包含我們吧 就...沒我們的事啊
推 wahaha99: 問題是怎麼做的到?
→ wahaha99: 所有的通訊都是加密過的,他們有位數夠多
→ wahaha99: 的量子電腦了?
→ wahaha99: 然後是如何過濾這麼龐大的資料量?
→ wahaha99: 要用多強大的硬體、多大的頻寬、多少的
→ wahaha99: 儲存容量?
→ wahaha99: 老實說,很多陰謀論或是政府真的想做的事
→ wahaha99: 在現實中顯得很「不現實」
老哥，問題是有個東西叫MITM
所以才會有CA證書以驗證站點持有者
打個比方好了，我今天擁有A.com，找某家合法，受信任的CA買了證書簽了這個域名跟我的I
P之間的聯繫，
當你連上來卻不知道我究竟是不是真的A.com，要求驗證我的合法性的時候
我只需要掏出這個證書，你就知道我一定有這個域名

但現在歐盟只需要自己簽一個A.com的證書，就能說這域名他有，騙你跟他建立加密連線，
然後轉頭跟我再建立加密連線
這中間那段已解密的時間歐盟就能看到一切資料

至於流量跟儲存, GFW同等級的設備大概就十來架F-16V的價錢，儲存也不需要全部儲存
推 RaiGend0519: 笑死，對岸好歹只管牆內
推 dos01: 這法案八成只是想要管特定人士
→ dos01: 不會是真的同時間管所有人 就算你知道同時
→ RaiGend0519: 歐盟這個牆內牆外全部都要管
→ dos01: 間所有人的連線也沒意義
推 wahaha99: 看了一下內容，要政府當CA的方式來管
→ wahaha99: 太荒謬了,他要發瘋就自己去
→ wahaha99: 這篇新聞真的不是把俄羅斯誤植成歐盟?
推 dos01: 看了一下 裡面提到土耳其 中國 哈薩克
→ dos01: 大概跟詐騙有關吧 比較奇怪的是還有法國
推 Richun: 那段是說有攔截流量的，通常是政府想查才
推 AI007: 美國: 笑死，太慢了
→ Richun: 會出現，名單內國家都有審查言論的前科吧?
推 dos01: 所以我覺得法國跟這些東西放在一起很奇怪
推 RaiGend0519: 裡面提到的點是給政府權利可以跟CA要
→ RaiGend0519: 某個網站的授權/認證，由此政府就可
→ RaiGend0519: 以藉由冒充/模仿該網站以中間人攻擊
→ RaiGend0519: 的方式去攔截使用者的HTTPS資訊
→ RaiGend0519: 並同時解密
推 RaiGend0519: 而且瀏覽器沒有辦法阻止
→ RaiGend0519: 真能成這比對岸屌上百倍有餘
推 MK47: 中國應該很驚訝 原來可以這麼侵犯的嗎XD
→ MK47: 就像強姦犯看到印度高手也要高呼真會玩
推 intela03252: 歐盟嘛，大概的做法就是要求社群網
→ intela03252: 站必須在歐盟有需要的時候提供所有
→ intela03252: 用戶的監控影音資料，至於要怎麼做
→ intela03252: 當然是你社群網站自己想辦法，辦不
→ intela03252: 到就不能在歐盟營運
→ intela03252: 至於範圍當然是夠大的公司才會有此
→ intela03252: 限制，然後都剛好是美國公司
推 cmcmisgod: 未來言論審查會不會直接抓關鍵字就通
→ cmcmisgod: 報
→ cmcmisgod: DC還能講幹話嗎
→ RaiGend0519: 極端點可能...連在網銀輸入的帳密都
→ RaiGend0519: 能到手
→ ILoveElsa: 我覺得你們根本看不懂就跟著發病
推 dos01: 我還真的看不太懂他想幹嘛 可以幫翻譯一下
→ dos01: 嗎?
推 FXW11314: 我看看能不能回一篇簡單講一下好了
推 RaiGend0519: 其實都是旁敲側擊，敲碗專業文
推 kevin1221: 違憲了
→ scarbywind: 看起來是留洞吧 有需要歐盟才會鑽
→ scarbywind: 光認證來說是沒有多要求社群網站要額
→ scarbywind: 外留啥紀錄
推 Data000: 那也要他們想tap你吧？
→ Data000: 雖然這麼說，但很難保證政府無限擴張
→ Data000: *不會無限擴張
→ DazaiOsamu: NetWatch
推 jerrylin: how???
推 h311013: 是不是VPN公司抖內給歐盟啊，衝浪鯊魚…
→ skycat2216: 48樓，CNNIC跟沃通：
※ 編輯: skycat2216 (111.82.109.225 臺灣), 11/12/2023 02:22:23
※ 編輯: skycat2216 (111.82.109.225 臺灣), 11/12/2023 02:31:20
推 taieger: 這個很嚴重 幫高調
→ ksng1092: 所以...有電蝦點嗎XD
推 jeffguoft: 牛逼
推 phoque: 去D啊 而且能挖機密的話改簽證也沒問題
→ phoque: 等你用正義還給我們乾淨的網路世界喔
推 ziggs8308: 推文一堆看不懂瞎起鬨的= =
噓 viewer1946: 帶風向是不是啊
推 zxcchiou: 中國 正在筆記中
推 Hurricaneger: 西台灣早就監聽不知道多久了…
推 pokjg: 歐盟跟我們關係是？
→ imsmalling95: 厲害了我的國 阿搞錯
推 JonDoe297: 哇喔