News for hackers. Stuff that matters.

A comment on Some observations on the final text of the European Digital Identity framework. Parent comment

Re:Some observations on the final text of the European Digit... by Maken on Friday November 24, 2023 @02:08PM (#38407090)
They used yo. Now most governments just have their own "proper" CAs which are included by default in web browsers. If you look at the default CA list of Firefox or Chrome you will see most of them are public agencies.
[ Parent | on HN ]
Re:Some observations on the final text of the European Digit... by theonlybutlet on Friday November 24, 2023 @02:21PM (#38407217)
I think Certificate transparency checks mean you should be able to tell if the certificate was fraudulently issued for a domain that is not with the CA. (This circumvents that.)

In your scenario, if the domains CA is the government CA anyway, then it's fair game. Most domains' CA will be cloudflare or whatever not the government CA.

[ Parent | on HN ]