4 ms·

It looks like they want to be able to selectively install backdoored software for individual targets. [1] I.e. they could force apple to deliver a patched whats

by lixtra 8y ago

It looks like they want to be able to selectively install backdoored software for individual targets. [1] I.e. they could force apple to deliver a patched whatsapp that disables encryption on the device or sends information to a third party. [1] https://www.homeaffairs.gov.au/consultations/Documents/explanatory-document.pdf https://www.homeaffairs.gov.au/consultations/Documents/expla... p. 8 and 9

mtgx 8y ago
That's how it could work for other app developers, but in WhatsApp's case, WhatsApp is already capable of replacing users' encryption key with its own. https://www.theguardian.com/technology/2017/jan/13/whatsapp-design-feature-encrypted-messages https://www.theguardian.com/technology/2017/jan/13/whatsapp-... It's a shame much of the crypto community was "skeptical" at the time that WhatsApp would use this capability for anything other than sending users "lost messages", because it's exactly the kind of thing I would expect companies that want to comply with secret (or otherwise) government orders to implement, while having a "reasonable" public excuse for implementing such a feature.
rswail 8y ago
They're not allowed to ask for a "systemic" change, which I think is how they're trying to get around the impossibility of an app providing stuff it doesn't have. They can ask/demand that whatsapp delivers an app update that only targets a particular person or persons, with some sort of backdoor, but not one that is a backdoor for all users. Of course, there's a whole cost thing there as well as whether an overseas corporation is required to co-operate with AU law enforcement. So theoretically, they could say "Whatsapp, give us a backdoored app. Telstra, push this app to these phones." Or course, Whatsapp could argue that releasing a backdoored app is creating a "systemic vulnerability" which is specifically carved out of the requirements to co-operate.
- aplummer 8y ago
  Explained like that, it does just seem like a really hard to implement wiretap. Not necessarily the worst thing if it’s per user with the right warrants etc.
  - rswail 8y ago
    Yeah, I'm being nice to them. They'll carefully under-interpret "systemic" to allow for back doors if they can.

by lixtra 8y ago

mtgx 8y ago

That's how it could work for other app developers, but in WhatsApp's case, WhatsApp is already capable of replacing users' encryption key with its own. https://www.theguardian.com/technology/2017/jan/13/whatsapp-design-feature-encrypted-messages https://www.theguardian.com/technology/2017/jan/13/whatsapp-... It's a shame much of the crypto community was "skeptical" at the time that WhatsApp would use this capability for anything other than sending users "lost messages", because it's exactly the kind of thing I would expect companies that want to comply with secret (or otherwise) government orders to implement, while having a "reasonable" public excuse for implementing such a feature.

rswail 8y ago

They're not allowed to ask for a "systemic" change, which I think is how they're trying to get around the impossibility of an app providing stuff it doesn't have. They can ask/demand that whatsapp delivers an app update that only targets a particular person or persons, with some sort of backdoor, but not one that is a backdoor for all users. Of course, there's a whole cost thing there as well as whether an overseas corporation is required to co-operate with AU law enforcement. So theoretically, they could say "Whatsapp, give us a backdoored app. Telstra, push this app to these phones." Or course, Whatsapp could argue that releasing a backdoored app is creating a "systemic vulnerability" which is specifically carved out of the requirements to co-operate.

aplummer 8y ago
Explained like that, it does just seem like a really hard to implement wiretap. Not necessarily the worst thing if it’s per user with the right warrants etc.
- rswail 8y ago
  Yeah, I'm being nice to them. They'll carefully under-interpret "systemic" to allow for back doors if they can.