> irrespective of how clearly untrustworthy that company is.

Isn't that a bit of an exaggeration? Surely what the EU is proposing is that browsers have to accept just those companies which pay the necessary fee and which some EU body declares to be trustworthy.

You're right, though, that this still adds to the attack surface, because now you have to trust not just your browser vendor, and all the CAs that they trust, but also this EU body and all the CAs that they trust.

(For those who haven't been following, here's what the EFF has to say about it: https://www.eff.org/fa/deeplinks/2021/12/eus-digital-identit... )

What’s to prevent the EU from declaring itself trustworthy?

Its courts? At least that is the only thing that keeps the EU Commission from going full police state.

The EU Commission? You mean, the one without an actual police force or army, or any say over the member states' criminal legislation? That Commission?

PESCO and Europol exist. Not a body of the EU commission, but still.

> or any say over the member states' criminal legislation? That Commission?

One of the jobs of the commission is deciding whether member states are in line with their treaty obligations, that includes any laws passed by said member states.

> At least that is the only thing that keeps the EU Commission from going full police state.

Such an extraordinary claim.

Are you able to provide any evidence that supports your claim that at any time the EU Commission tried to go "full police state", and that courts kept that from happening?

The Commission and the Parliament can do whatever they want but it's the Council that de facto has the final word on everything that matters.

The EU court can only rule using laws written by the EU

That EFF page is really weird - English text, but right-aligned, with question marks to the left of the text, as if the text had been translated from a RTL language (Farsi perhaps given the /fa/ in the link?)

From the looks of it the EU wants to push out a wide spread identity management system, which is fine.

It's unclear to me after a brief perusal why they can't use a normal root certificate, or create their own along a letsencrypt line (indeed that would be a great benefit having another widespread free ACME powered certificate authority, one funded by the taxpayer), with the same protections and transparency as LE.

>That EFF page is really weird - English text, but right-aligned, with question marks to the left of the text, as if the text had been translated from a RTL language (Farsi perhaps given the /fa/ in the link?)

It's just a Farsi link to an English article that's automatically applying RTL styling, the original version of the page in English looks fine.

https://www.eff.org/deeplinks/2021/12/eus-digital-identity-f...

Let me guess - this landing page gives green, certified by TotallyNotNSONoWaySir Ltd

So paying to a browser is good buy paying to a government is bad?

The browser vendors know what they are doing. The government has no idea.

As if browser vendors never included any shady or incompetent root CA?

For example: https://www.techtarget.com/searchsecurity/news/252436120/230...

Firefox seems to include root CA from the governments of: Hong Kong (so China?), Spain, Turkey, Tunisia, Netherlands.

And when they find evidence of a CA misbehaving they revoke them, as here, they don’t go to the EU and say “hey we think you need to re audit this company” and then wait a few months/years while the business continues to pay the EU to remain in the root stores.

Wtf are you talking about?

You don’t pay a browser to get your roots included.

You file a bug report, and provide the supporting documentation and audits. If the relevant root program considers your supporting documentation sufficient, they include you.

You cannot pay a root program to include your root certa, and any CA that was found to have done so would likely find other programs considering that to be a red flag.

It's actually interesting.

Three of the major trust stores are also OS vendors. Microsoft, Apple and Google.

Each of those three actually just has a rather opaque "send us an email and we'll talk about it" type process. I don't think there's any implication that you can or should pay them money (indeed Microsoft is clear that there is "No Fee" for this), clearly none of these organisations is desperate for cash. But it's actually unclear what you can do besides maybe send email and hope.

Mozilla's process is as you state to file a Bugzilla bug. You go in a big queue and there's eventually a public discussion on m.d.s.policy once you get to the front of the queue.

Now, in theory there is no relationship between Mozilla's transparent process and say, Apple or Microsoft. Indeed even for Google there's only a rather thin relationship, the final decision is theirs but they do say you need to talk to Mozilla.

But in practice the Mozilla process matters most.

Do you know details on how they are planning to enforce this in open-source browsers?

> illegal in the EU for a browser to drop a CA, even when they’re caught doing objectively fraudulent acts.

Right now Mozilla, Microsoft and many other privately owned root certificate mainterns control whether or not CA are trust worthy. I actually see your statement the other way around, it would be illegal for browser to support a CA when the EU deems it as untrustworthy.

Do you really think that a CA shady enough for the EU to reject would not have already been rejected by the various root programs?

I do not, hence this seems to be a non issue.

Browser vendors could solve the issue by distributing two editions of their browsers, one only trusting certificates accepted by the EU and one rejecting all the certificates in the list by the EU.