[turbinemonkey]

QWACs exist to provide a more stringent and user-accessible way to assert a website's identity, mostly to foil phishing and other exploits that regular certificate systems don't address well. Where does this cross into censorship at all?

[sidewndr46]

When the government decides not to issue certificates to websites they don't like.

[turbinemonkey]

Oh, stop. Tinfoil-hatting like this is how privacy and internet freedom activism gets a bad rap.

QWAC certs are only for "high value" sites: banks, government services, etc. They can only be issued by "Qualified Trust Service Providers" (e.g. digisign, D-TRUST, etc -- not governments), and cost many hundreds of euros. Your blog and mastodon instance and 98% of businesses just aren't affected.

People operating in "high risk" sectors that need access to payment infra (porn, drugs, etc) are, as always, going to have a hard time. That's a worthy conversation, but nothing about QWAC or eIDAS is about "the government not issuing certs to people they don't like".

[sidewndr46]

This is how total control of a platform always starts. Google starts with Android and just does digital signing for applications through their store. Until they achieve control of the platform, then suddenly you can't load your own applications without them signing it either.

Secure Boot is just a technology for those that need it, until Microsoft decides it's mandatory for everyone.

[gzread]

It's not really tinfoil hatting, EU countries already deny privileges based on political affiliation and so on. Germany shut down a Muslim cultural center for refusing to censor a speech by someone who came from Gaza, merely because of the fact they came from Gaza. Limiting government power is still something the EU needs - they're not all good.

[layer8]

It’s not the government that is issuing the website certificates.

[sidewndr46]

So who is issuing it then? Some private industry who can just silence anyone they don't like?