4 ms·

So, what happens to Signal in Australia if the bill passes?

by jwr 8y ago

kevin_b_er 8y ago
Signal would have to find a way to send a special app to you which does not encrypt or specially encrypts in order to funnel data to AU government. If it does not, it becomes illegal. Considering signal warns people if the key changes, it probably means Signal is now illegal as it might be physically/mathematically impossible to satisfy the law. Secure communication is now illegal in Australia.
- CiPHPerCoder 8y ago
  Or they'll have the carriers in Australia push an OS update that specifically exfiltrates your Signal session keys to the government. Then it won't matter what Signal does or doesn't do, they can still get what they want.
  - JoshTriplett 8y ago
    > Or they'll have the carriers in Australia push an OS update One of many reasons you should not have your carrier control your OS update channel.
- zmmmmm 8y ago
  I haven't checked the text that passed but I think non-feasibility is a defense. Which might mean that this just inspires a new round of canarying and end-to-end encryption wrapping to defeat the bill. However presumably there are very few companies willing to die on that hill, and it may be too expensive to fight those battles.
ta7683287632 8y ago
They can only compel companies within (incorporated in?) Australia is my understanding, not foreign companies. This is a sad day for a government going out of control; I didn't elect representatives to be this over-reaching or to ignore the wishes of the people like this; again under that old chestnut guise of "Terror!". Doesn't even need a warrant, just a nod from an ex-magistrate, and I'm sure the right ones can always be found. But I suspect this'll be a testbed for the other Five Eyes; if the public don't make a big noise, I'd expect to see this in the UK, US, NZ and Canada etc pretty soon.
hvklos 8y ago
Compromised version dropped onto phone of a target? Most people are reliant on App Stores for their apps, so that will be a likely vector. We don’t run checksums on desktop software, let alone software from App Stores.
- rocqua 8y ago
  How easy is it to target a play-store update? I doubt google allows binaries to be targeted to individuals, so you'd need to push the update to a rather large set, and have the update only activate for the target. That isnt very covert.
  - hvklos 8y ago
    They’d probably try to compel app stores to support individual targeting as a first step. If the Australian versions haven’t shut down in the next few weeks, it’s a pretty sure bet that they’ll have been compromised.
parliament32 8y ago
Australia can't enforce its laws on a foreign company, especially considering Signal doesn't generate any revenue in Australia (afaik). Best they could do is find some way to block it (like the great firewall of China does with any sites/services that won't comply with their filter demands).

So, what happens to Signal in Australia if the bill passes?

by jwr 8y ago

So, what happens to Signal in Australia if the bill passes?

Signal would have to find a way to send a special app to you which does not encrypt or specially encrypts in order to funnel data to AU government. If it does not, it becomes illegal. Considering signal warns people if the key changes, it probably means Signal is now illegal as it might be physically/mathematically impossible to satisfy the law. Secure communication is now illegal in Australia.

CiPHPerCoder 8y ago
Or they'll have the carriers in Australia push an OS update that specifically exfiltrates your Signal session keys to the government. Then it won't matter what Signal does or doesn't do, they can still get what they want.
- JoshTriplett 8y ago
  > Or they'll have the carriers in Australia push an OS update One of many reasons you should not have your carrier control your OS update channel.
zmmmmm 8y ago
I haven't checked the text that passed but I think non-feasibility is a defense. Which might mean that this just inspires a new round of canarying and end-to-end encryption wrapping to defeat the bill. However presumably there are very few companies willing to die on that hill, and it may be too expensive to fight those battles.

ta7683287632 8y ago

They can only compel companies within (incorporated in?) Australia is my understanding, not foreign companies. This is a sad day for a government going out of control; I didn't elect representatives to be this over-reaching or to ignore the wishes of the people like this; again under that old chestnut guise of "Terror!". Doesn't even need a warrant, just a nod from an ex-magistrate, and I'm sure the right ones can always be found. But I suspect this'll be a testbed for the other Five Eyes; if the public don't make a big noise, I'd expect to see this in the UK, US, NZ and Canada etc pretty soon.

hvklos 8y ago

Compromised version dropped onto phone of a target? Most people are reliant on App Stores for their apps, so that will be a likely vector. We don’t run checksums on desktop software, let alone software from App Stores.

rocqua 8y ago
How easy is it to target a play-store update? I doubt google allows binaries to be targeted to individuals, so you'd need to push the update to a rather large set, and have the update only activate for the target. That isnt very covert.
- hvklos 8y ago
  They’d probably try to compel app stores to support individual targeting as a first step. If the Australian versions haven’t shut down in the next few weeks, it’s a pretty sure bet that they’ll have been compromised.

parliament32 8y ago

Australia can't enforce its laws on a foreign company, especially considering Signal doesn't generate any revenue in Australia (afaik). Best they could do is find some way to block it (like the great firewall of China does with any sites/services that won't comply with their filter demands).