Discussion
What if I were to tell you that Trump could knock any (or all) of over 20 million¹ European web sites off the Web tomorrow by picking up the phone to one US organisation: Let’s Encrypt.
We desperately need an independent, not-for-profit ACME provider in the EU paid for by our taxes.
¹ This is just based on one firm’s analytics (https://trends.builtwith.com/websitelist/LetsEncrypt/EUROPE). Others put LE use at 50-60% of all web sites.
@aral @EUCommission isn't #letsencrypt run by the @eff ?
American, yes. But also nonprofit, and? Probably the least likely to ever capitulate to tyrrants? Also yes!
There are definitely more important internet-hills to die on than this, but exactly nobody should be against a European equivalent. The more not-for-profit Certificate Authorities the better, I say!
@aral @EUCommission
Pretty sure ISRG would tell him to get fucked.
@aral @EUCommission The issue goes far beyond digital certificates; it is a matter of digital sovereignty. When Europe’s internet infrastructure depends on a single entity outside its borders, technological independence becomes an illusion. In the digital age, sovereignty begins with having alternatives, not merely with having laws🍉⚘.
@aral
I'd like to add free ACME based S/MIME certificates to the wishlist.
There _is_ even an existing EU solution for that already, at the Barcelona Polytechnic Uni. But they lack funds and their root certificate isn't integrated in typical OSses or Email clients.
This is such low hanging fruit, @EUCommission that it's unthinkable how this hasn't been done years ago already.
@aral
Yeah, Trump is the immediate concern. However, your suggestion might be frying pan -> fire. Who knows who might be in charge of the EU at some future point. Senior EU officials endorsing W Social is just a warning sign
Something more independent of any government is required. Getting certificate authorities included in browsers and email clients etc., shouldn't be that difficult. Funding might be more of a challenge.
Full disclosure: my country isn't even an EU member.
@fitheach @aral @EUCommission No, getting CAs included should be *more* difficult. Each additional CA is another party that can backdoor *anyone*.
The goal needs to be getting rid of CAs, but minimizing the number we have as long as they're still needed, fixing DNS so that the root cannot be compromised by one rogue nation, and ultimately moving away from a centralized hierarchical name system to an autonomous/self-sovereign one.
@aral Remove the most abusive from power.
@aral @EUCommission A community and non-profit effort (CACert.org and currently making a sad impression) has existed for a long time but it needs to be embraced by browsers and operating systems. https://en.wikipedia.org/wiki/CAcert.org So this needs to be done better than CACert.org did.
There's also the Moxie Marlinspike proposal https://en.wikipedia.org/wiki/Convergence_%28SSL%29 to do trust of SSL certificates different.
And in these times of crisis and a burning planet, as a note to self and others : Years ago Autistici/Inventati (The friendly email and blogs hoster from Italy, and under threat by USA) before Let's Encrypt became popular, used importing of the CA part for SSL certificate in your browser. Not plug and play for common users but it is a way to use SSL when everything else fails.
@aral idk about this one.
By the same logic every site on the Internet could be disrupted by a call to the CEO of ICANN, which is a US-based organization. Or knock out the entire .de TLD with a call to IANA.
Diversify everything away from US organizations, sure, but AWS and Microsoft are real threats. Trump has these CEOs on speed dial and they can’t help but jump to kiss his orange ass at every opportunity.
By contrast, it’s not clear that anyone at the ISRG would even return his call.
@mick Not every web site via ICAAN, no. (See the conversation we were having about that recently following the recent .org incident.)
AWS/Cloudflare/Microsoft, etc. are big threats, indeed.
But also this.
And they wouldn’t have to return his call. They’d be taking to the FBI agents that just broke down their door.
@aral when the FBI wants to suspend a domain they work with the registry and/or registrar to pull it.
If it’s outside their jurisdiction they work with Interpol to do the same.
It’s hard to imagine law enforcement demanding a CRL entry for a target certificate - not least of all because doing so is, at worst, a minor inconvenience to the target website.
@aral @EUCommission
Let’s not look at the clearing systems for Visa, Mastercard, Paypal, Amex, Applepay et al, ad nauseam.
We really handed our collective knackers to these gangsters on a plate with a nice sharp knife.
there's ZeroSSL from Austria! 🇦🇹 
"part of HID Global" 🇺🇸 (Texas)
@cadusilva And even if it wasn’t: a commercial company is not the same thing.
@aral would be nice something like deSEC but for ACME.
@aral I do agree ... but don't give away that kind of info 😅 @EUCommission
@aral @EUCommission There is one European provider I know of; Actalis https://www.actalis.com/activate-free-plan
However I don't think they are non-profit if I understand 'S.p.a.' correctly and Wikipedia is correct: https://en.wikipedia.org/wiki/Societ%C3%A0_per_azioni
Also for more European alternatives, check out https://european-alternatives.eu/categories
@bjorn @EUCommission Yeah, there are only commercial providers at the moment. Very different to having a Let’s Encrypt alternative.
@aral @EUCommission Honestly the way things are going here in Canada, you may as well add us. While you are at it, don't forget DNS eh?
Install bonfire.cafe
Get the full app experience
