4 ms·

Can anyone comment on how this is likely to affect multinational entities like Apple? Given the Australian market is so small, would it not more sense to leave

Can anyone comment on how this is likely to affect multinational entities like Apple? Given the Australian market is so small, would it not more sense to leave the jurisdiction entirely rather than compromise security? Same goes for App makers like Signal. Why bother with Australia? (I'm Australian, and really don't want to see this happen FWIW, but it seems the rational decision)

lrvick 8y ago
Closed tools like Signal, Snapchat, Slack, Whatsapp, iMessage, Messenger, Hangouts etc will all make the promises about privacy you want to hear, but at the end of the day they are closed source and updates or commands can be sent to your handset to send plaintext to their servers at any time. The question is under what criteria this will happen. Insider abuse? Government order? To make money? Trying to make it illegal for companies to do this sort of thing on a country by country basis is worth pursuing, but it is not a real solution. We need to stop trying to use the law to enforce security. The solution is to use tools that take court ordered backdoors off the table. Support open and federated communications networks where anyone can build their own clients or servers where pressuring of any entity can't put community built clients at risk. There are a range of clients/protocols that meet this criteria such IRC with OTR, XMPP, IRCv3, Silence, Matrix.org. Take your pick, and convince your contacts to use that instead of companies where you have to just take their word for it they won't backdoor you as it suits them.
- cyphar 8y ago
  Signal is free software[1] -- GPLv3 in fact. Don't get me wrong, it has its own issues with Moxie having very strange views of the threat model (and being anti-federation and anti-distribution), but it is definitely not proprietary. I also concur with the Matrix.org recommendation. [1]: https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android
  - lrvick 8y ago
    Signal likes to throw around that they are free software but really that is more marketing than fact. The signal -client- is open source, but the server is closed. Yes partial server code is open, but running your own server is not allowed. The signal signed clients will only talk to the closed server and Moxie has made it clear he does not want forked clients or clients not built by his team connecting to his network. Open source f-droid builds are not permitted, and if you want updates you must use the play store builds. Those with open source phones must turn on unverified sources and risk man in the disk attacks to install the apk from the signal website. Security you can't fully verify, is just called marketing.
    - cyphar 8y ago
      > The signal -client- is open source, but the server is closed. Yes partial server code is open, but running your own server is not allowed. This is not true at all, the server is entirely AGPLv3[1]. You can run your own server, but they don't want to federate and don't want people to distribute forks of their code (that connect to their servers). What they want is irrelevant because the license they've put the code under explicitly allows you to do these things -- though arguably they are allowed to restrict connections to their servers because that's a freedom under AGPLv3. So while I agree (and I explicitly said I agreed in an earlier comment) with the problems with Signal -- you are not helping explain why Signal has issues by spreading misinformation about it being proprietary. It isn't proprietary nor is it unverifiable, instead it is run by a company that has no interest in federation or solving much more important issues with their service. That is a serious enough problem that you don't need to make up issues that will just discredit legitimate complaints. [1]: https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server
      - lrvick 8y ago
        It does look like they have moved away from closed server components like RedPhone and claim all sources are published now. I appreciate that correction. The source code for -a- signal server is a nice gesture for anyone that wants to build a signal fork but it does nothing to prove the signal server actually in use is fully open source and does not have last minute patches applied. Can't run my own for the real network so I must hope an employee won't be pressured into changing live systems or signing malicious client binaries at any time with no one noticing. Seems we both agree this is a real problem. Verifiable security and centralized trust are incompatible. I do still generally consider any code that can't be verified to be closed but I agree accuracy is important.
throwaway59229 8y ago
It seems that the bill [1] is intended to make it possible for ASIO/ASIS/ASD/whoever to force Apple, etc. to share their most powerful private keys (I.E. likely the keys burnt into the ROM bootloader of iOS devices), their source code and build processes. [2] It might appear from a cursory glance at the bill and the "Industry Assistance Factsheet" [3] that the bill would not allow for this sort of behavior (introducing backdoors), but the relevant section 317ZG of the bill only prohibits government agencies from requesting that companies build weaknesses or backdoors into their software but says nothing of the government doing the same. This is extraordinarily deceptive. So, Apple's response (and the response of other multinationals) is likely going to be to ensure that all devices that are sold on the Australian market are sold with an Australia-only root certificate/key which they'll be forced to share with the Australian government agencies but whose compromise won't affect business in other countries. It seems that doing business in Australia (as a multinational) is going to be like doing business in China, and no doubt there will be other countries that decide to not purchase Australian communications technology for fear of backdoors... [5] What a fucking farce this is. EDIT: I forgot to add that by writing the bill to allow for the above behavior, the total amount of TCNs and TANs that are required (for dragnet surveillance) is reduced substancially, and given that the only public reporting seems to be a rough yearly count, this is great for PR of a police-state as it means that only a handful of approvals have to be recorded. Also it's punishable by up to 5 years in jail if you reveal the existence of a TCN/TAN (except where required to in legal proceedings and to provide a total count of the number of TCNs/TANs received over the last >6 months). [1] https://www.homeaffairs.gov.au/consultations/Documents/the-assistance-access-bill-2018.pdf https://www.homeaffairs.gov.au/consultations/Documents/the-a... [2] See section 317E, subparagraph (f) of the bill which states that a "communications provider must [...] assist with the testing, modification, development or maintenance of a technology or capability." [3] https://www.homeaffairs.gov.au/consultations/Documents/industry-assistance-factsheet.pdf https://www.homeaffairs.gov.au/consultations/Documents/indus... [4] Section 317ZG of the bill: "a [request/notice] must not have the effect of requiring a _designated communications provider_ to implement or build a systemic weakness, or a systemic vulnerability, into form of electronic protection" [5] https://www.cnet.com/news/australia-to-ban-huawei-from-5g-rollout-amid-security-concerns/ https://www.cnet.com/news/australia-to-ban-huawei-from-5g-ro...

lrvick 8y ago

Closed tools like Signal, Snapchat, Slack, Whatsapp, iMessage, Messenger, Hangouts etc will all make the promises about privacy you want to hear, but at the end of the day they are closed source and updates or commands can be sent to your handset to send plaintext to their servers at any time. The question is under what criteria this will happen. Insider abuse? Government order? To make money? Trying to make it illegal for companies to do this sort of thing on a country by country basis is worth pursuing, but it is not a real solution. We need to stop trying to use the law to enforce security. The solution is to use tools that take court ordered backdoors off the table. Support open and federated communications networks where anyone can build their own clients or servers where pressuring of any entity can't put community built clients at risk. There are a range of clients/protocols that meet this criteria such IRC with OTR, XMPP, IRCv3, Silence, Matrix.org. Take your pick, and convince your contacts to use that instead of companies where you have to just take their word for it they won't backdoor you as it suits them.

cyphar 8y ago
Signal is free software[1] -- GPLv3 in fact. Don't get me wrong, it has its own issues with Moxie having very strange views of the threat model (and being anti-federation and anti-distribution), but it is definitely not proprietary. I also concur with the Matrix.org recommendation. [1]: https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android
- lrvick 8y ago
  Signal likes to throw around that they are free software but really that is more marketing than fact. The signal -client- is open source, but the server is closed. Yes partial server code is open, but running your own server is not allowed. The signal signed clients will only talk to the closed server and Moxie has made it clear he does not want forked clients or clients not built by his team connecting to his network. Open source f-droid builds are not permitted, and if you want updates you must use the play store builds. Those with open source phones must turn on unverified sources and risk man in the disk attacks to install the apk from the signal website. Security you can't fully verify, is just called marketing.
  - cyphar 8y ago
    > The signal -client- is open source, but the server is closed. Yes partial server code is open, but running your own server is not allowed. This is not true at all, the server is entirely AGPLv3[1]. You can run your own server, but they don't want to federate and don't want people to distribute forks of their code (that connect to their servers). What they want is irrelevant because the license they've put the code under explicitly allows you to do these things -- though arguably they are allowed to restrict connections to their servers because that's a freedom under AGPLv3. So while I agree (and I explicitly said I agreed in an earlier comment) with the problems with Signal -- you are not helping explain why Signal has issues by spreading misinformation about it being proprietary. It isn't proprietary nor is it unverifiable, instead it is run by a company that has no interest in federation or solving much more important issues with their service. That is a serious enough problem that you don't need to make up issues that will just discredit legitimate complaints. [1]: https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server
    - lrvick 8y ago
      It does look like they have moved away from closed server components like RedPhone and claim all sources are published now. I appreciate that correction. The source code for -a- signal server is a nice gesture for anyone that wants to build a signal fork but it does nothing to prove the signal server actually in use is fully open source and does not have last minute patches applied. Can't run my own for the real network so I must hope an employee won't be pressured into changing live systems or signing malicious client binaries at any time with no one noticing. Seems we both agree this is a real problem. Verifiable security and centralized trust are incompatible. I do still generally consider any code that can't be verified to be closed but I agree accuracy is important.

throwaway59229 8y ago

It seems that the bill [1] is intended to make it possible for ASIO/ASIS/ASD/whoever to force Apple, etc. to share their most powerful private keys (I.E. likely the keys burnt into the ROM bootloader of iOS devices), their source code and build processes. [2] It might appear from a cursory glance at the bill and the "Industry Assistance Factsheet" [3] that the bill would not allow for this sort of behavior (introducing backdoors), but the relevant section 317ZG of the bill only prohibits government agencies from requesting that companies build weaknesses or backdoors into their software but says nothing of the government doing the same. This is extraordinarily deceptive. So, Apple's response (and the response of other multinationals) is likely going to be to ensure that all devices that are sold on the Australian market are sold with an Australia-only root certificate/key which they'll be forced to share with the Australian government agencies but whose compromise won't affect business in other countries. It seems that doing business in Australia (as a multinational) is going to be like doing business in China, and no doubt there will be other countries that decide to not purchase Australian communications technology for fear of backdoors... [5] What a fucking farce this is. EDIT: I forgot to add that by writing the bill to allow for the above behavior, the total amount of TCNs and TANs that are required (for dragnet surveillance) is reduced substancially, and given that the only public reporting seems to be a rough yearly count, this is great for PR of a police-state as it means that only a handful of approvals have to be recorded. Also it's punishable by up to 5 years in jail if you reveal the existence of a TCN/TAN (except where required to in legal proceedings and to provide a total count of the number of TCNs/TANs received over the last >6 months). [1] https://www.homeaffairs.gov.au/consultations/Documents/the-assistance-access-bill-2018.pdf https://www.homeaffairs.gov.au/consultations/Documents/the-a... [2] See section 317E, subparagraph (f) of the bill which states that a "communications provider must [...] assist with the testing, modification, development or maintenance of a technology or capability." [3] https://www.homeaffairs.gov.au/consultations/Documents/industry-assistance-factsheet.pdf https://www.homeaffairs.gov.au/consultations/Documents/indus... [4] Section 317ZG of the bill: "a [request/notice] must not have the effect of requiring a _designated communications provider_ to implement or build a systemic weakness, or a systemic vulnerability, into form of electronic protection" [5] https://www.cnet.com/news/australia-to-ban-huawei-from-5g-rollout-amid-security-concerns/ https://www.cnet.com/news/australia-to-ban-huawei-from-5g-ro...