5 ms·

Here's a brief of companies that could/might be impacted. I don't agree that server location is sufficient enough protection. Correct me if wrong, but can't the

by rrggrr 8y ago

Here's a brief of companies that could/might be impacted. I don't agree that server location is sufficient enough protection. Correct me if wrong, but can't the authorities compel the Aussie company's directors to hand over foreign server credentials? Xero Atlassian Canva Fastmail 99 Designs

kevin_b_er 8y ago
Good angle. But we're not just talking about headquartered companies. Cloudflare has datacenters in Brisbane, Melbourne, Perth, and Sydney and an office in Sydney. Could they be compelled to hand over your website's certificate that they have because they're the front end load balancing proxy for your website?? That way the police can man in the middle your website. Cloudflare would be gagged from telling you they gave away your private TLS certificate you entrusted them with.
- nybble41 8y ago
  Spin off Cloudflare Australia as an independent subcontractor of Cloudflare International. Give customers a choice of whether to enable Australian proxies for their site. Use distinct certificates for the proxies in each region, with short expiration times to limit the damage if a certificate falls into the wrong hands.
- komali2 8y ago
  My understanding is an Australian cloudflare employee could be compelled to, yeah, hand over certificates, without telling their boss they did so.
- xucheng 8y ago
  By this logic, there is no need to compel Cloudflare to handover the private TLS key. They can just compel any CA based in Australia to sign a fake cert. Or directly compelling OS vendors (Google, Apple, Microsoft,etc) to make government cert as a root CA.
  - kevin_b_er 8y ago
    A fraudulently issued cert compelled by government might be detected by CA reporting. This was already done to watch for direct government controlled CAs issuing bad certs. Stealing your own existing cert is less likely to be detected.
alexis_fr 8y ago
Atlassian is a UK company. Obviously half employees including directors are in Australia, so that opens up to pression anyway, just like Japan could in theory compell a director of a foreign company by threatening to jail him on a fortuitous tax accusation. The directors would never be so square as to not comply, right?
- guitarbill 8y ago
  Yes, while they were founded in Australia, the parent company Atlassian Corporation Plc is located in the UK (presumably for stock market reasons?). But they still have subsidiaries in Australia, which arguably does a lot of work given that at least a third of their employees are in Australia, and so would be subject to the local laws. The employees could be compelled to bypass things and not be allowed to talk about it to anybody, including the parent company.

by rrggrr 8y ago

kevin_b_er 8y ago

Good angle. But we're not just talking about headquartered companies. Cloudflare has datacenters in Brisbane, Melbourne, Perth, and Sydney and an office in Sydney. Could they be compelled to hand over your website's certificate that they have because they're the front end load balancing proxy for your website?? That way the police can man in the middle your website. Cloudflare would be gagged from telling you they gave away your private TLS certificate you entrusted them with.

nybble41 8y ago
Spin off Cloudflare Australia as an independent subcontractor of Cloudflare International. Give customers a choice of whether to enable Australian proxies for their site. Use distinct certificates for the proxies in each region, with short expiration times to limit the damage if a certificate falls into the wrong hands.
komali2 8y ago
My understanding is an Australian cloudflare employee could be compelled to, yeah, hand over certificates, without telling their boss they did so.
xucheng 8y ago
By this logic, there is no need to compel Cloudflare to handover the private TLS key. They can just compel any CA based in Australia to sign a fake cert. Or directly compelling OS vendors (Google, Apple, Microsoft,etc) to make government cert as a root CA.
- kevin_b_er 8y ago
  A fraudulently issued cert compelled by government might be detected by CA reporting. This was already done to watch for direct government controlled CAs issuing bad certs. Stealing your own existing cert is less likely to be detected.

alexis_fr 8y ago

Atlassian is a UK company. Obviously half employees including directors are in Australia, so that opens up to pression anyway, just like Japan could in theory compell a director of a foreign company by threatening to jail him on a fortuitous tax accusation. The directors would never be so square as to not comply, right?

guitarbill 8y ago
Yes, while they were founded in Australia, the parent company Atlassian Corporation Plc is located in the UK (presumably for stock market reasons?). But they still have subsidiaries in Australia, which arguably does a lot of work given that at least a third of their employees are in Australia, and so would be subject to the local laws. The employees could be compelled to bypass things and not be allowed to talk about it to anybody, including the parent company.