4 ms·

Signal: The employee is required to intentionally alter the app to no longer provide security, such that some communication may be intercepted. They are not per

Signal: The employee is required to intentionally alter the app to no longer provide security, such that some communication may be intercepted. They are not permitted to publicly disclose that they have done this. Unfortunately, this goes deeper. The law may be capable of compelling Google or Apple of Australia to force deploy to your phone a malicious version of the Signal app with the "technical assistance notice".

deleted 8y ago
[deleted]
akvadrako 8y ago
If they are ever forced to do that and it becomes public knowledge, I think it will finally be enough for a critical mass of security-conscious people to buy phones with user-controlled platforms where it becomes impossible. In a way this might be a blessing.
- WrtCdEvrydy 8y ago
  No, they won't. They'll buy the newest Apple phone because it's 10 nanometers thinner and it's a status symbol. Apple Cloud was hacked and celebrity pictures were stolen and noone batted an eye.
  - lotsofpulp 8y ago
    Figuring out people's easy passwords and password recovery methods isn't a weakness in iCloud, and shouldn't be counted as hacking iCloud. And if you were concerned with security, and had to buy a smartphone, what device is better than an iPhone?
    - WrtCdEvrydy 8y ago
      > We didn't give random people loans in your name, your identity was stolen. When you shift responsibility from the provider to the customer, you play right into the security blame game.
      - lotsofpulp 8y ago
        Analogies are useful for illustrating a thought, not for supporting arguments. And identity theft (where the victim can do nothing to protect themselves) is not analogous in the first place. Using multi factor authentication, using long, difficult passwords, and don’t let your security questions be obvious. If someone knocks me out, uses my finger to TouchID into my bank’s app and transfer money, that’s the price I pay for the convenience of not wanting to login with my password. Same with using weak passwords and questions.
        WrtCdEvrydy 8y ago
        You can't seriously say that a multi-million dollar company can't enforce those security features by default. This is the same as having a car recall and having people dying before the letters reach their homes and saying 'they should have known this company's cars could explode'
        lotsofpulp 8y ago
        I don't understand the purpose of using analogies (valid or not) in this discussion. Apple could have forced people to use multi factor authentication, and whether or not they should have forced it is a separate discussion that can be had. But I was claiming that your original comment was that iCloud was "hacked" is incorrect, since it implies there was some weakness on Apple's technical backend.
        WrtCdEvrydy 8y ago
        Not forcing secure by default practices in your secure devices is a weakness on Apple's technical backend. Maybe they should take a couple of notes for their broken cloud implementation from another phone manufacturer in the space that takes security seriously: https://www.theguardian.com/commentisfree/2014/sep/30/iphone-6-encrypted-phone-data-default https://www.theguardian.com/commentisfree/2014/sep/30/iphone... https://www.cso.com.au/article/577197/apple-tells-ios-9-developers-use-https-exclusively/ https://www.cso.com.au/article/577197/apple-tells-ios-9-deve...
  - saagarjha 8y ago
    > Apple Cloud was hacked and celebrity pictures were stolen and noone batted an eye. iCloud was not hacked; the celebrities were spear phished: https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_photos https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_phot...
    - WrtCdEvrydy 8y ago
      > We didn't give random people loans in your name, your identity was stolen. When you shift responsibility from the provider to the customer, you play right into the security blame game.
      - indigo945 8y ago
        So, if I put a post-it with my PIN and SSN on my credit card and give that to a random stranger, it's the bank's fault?
        WrtCdEvrydy 8y ago
        So, the celebrities put their password in a post-it on their iPhone?
  - xvector 8y ago
    > Apple Cloud was hacked and celebrity pictures were stolen and noone batted an eye. Phishing. I think your comment is pretty disingenuous as Apple has generally showed a strong commitment to privacy and security.
    - WrtCdEvrydy 8y ago
      > We didn't give random people loans in your name, your identity was stolen. When you shift responsibility from the provider to the customer, you play right into the security blame game.
  - GeekyBear 8y ago
    The celebgate phishing attacks involved more Google accounts than Apple accounts. >According to court filings, Collins stole photos, videos and sometimes entire iPhone backups from at least 50 iCloud accounts and 72 Gmail accounts, “mostly belonging to celebrities,” between November 2012 and September 2014, when the photos were posted online. https://www.washingtonpost.com/news/the-intersect/wp/2016/03/16/the-shockingly-simple-way-the-nude-photos-of-celebgate-were-stolen/ https://www.washingtonpost.com/news/the-intersect/wp/2016/03...
Arnt 8y ago
Will your phone accept an app upgrade which has been signed by Google or Apple instead of by Signal? If not, is the law capable of compelling your telephone vendor to ship you an upgrade that weakens its upgrade testing enough that Apple/Google can ship you such an upgrade?
- somebehemoth 8y ago
  My understanding is that it would not due to the different app signing certificate. This would be a new application unless Apple or Google signs the app using certificate forgery or similar.
  - Klathmon 8y ago
    The Australian government could just force Google or Apple to make updates to their OS to not enforce signatures for some apps, or put in vulnerabilities that could be used by them to bypass signature checking at all.
    - coldcode 8y ago
      Good luck with that.
    - coldcode 8y ago
      Good luck with that. How do you have any idea its running in Australia or belongs to an Australian?
      - Klathmon 8y ago
        I'm not a lawyer, but from what I hear any Australian employees can be compelled to change code and be threatened with prison if they tell anyone. Any companies with any presence in Aus can be given demands and gag orders to ensure they can't talk about what is happening. And if this article is trustworthy, this isn't hypothetical, it's already happening right now. Right now people are being served with orders to do things like this and if they tell anyone (including the company they work for and are in essence "attacking"), they can kiss their life goodbye. That's what makes it so scary. A programmer that is living in Aus that works for Google or Apple could one day get a notice that they are now mandated to modify code for an unknown reason with the threat of prison if they don't or if they tell anyone. Technically even programmers that don't work for those companies can be compelled to make contributions to open source software to introduce vulnerabilities or exploits, and again there is literally nothing the person can do except follow orders or go to jail forever.
underbulb 8y ago
Don't be fooled by the narrative on the amendment. The truth is that such interception is normal, in Australia, in other countries. AA is two things. 1st, the government there legalizing an already existing practise to cover their own liability in the event that the grey practise is eventually exposed. Especially amid the current public awareness of privacy. Next, more importantly, AA is to get around recent security patches that rendered previous vectors now impossible to use, since these collections were often done covertly. It's law compensating for where a much relied on covert method no longer works. Thus, the 11th hour urgency. The cover story that it is this huge privacy catastophe is just more noise, to distract from the big story; how interceptions like this have been going on for more than a decade.
msla 8y ago
> Signal: The employee is required to intentionally alter the app to no longer provide security, such that some communication may be intercepted. They are not permitted to publicly disclose that they have done this. Replace "Signal" with "OpenBSD" and watch the freaking fireworks. (Why OpenBSD? De Raadt hasn't promised to be "nicer" recently. Linus has.)

deleted 8y ago

[deleted]

akvadrako 8y ago

If they are ever forced to do that and it becomes public knowledge, I think it will finally be enough for a critical mass of security-conscious people to buy phones with user-controlled platforms where it becomes impossible. In a way this might be a blessing.

WrtCdEvrydy 8y ago
No, they won't. They'll buy the newest Apple phone because it's 10 nanometers thinner and it's a status symbol. Apple Cloud was hacked and celebrity pictures were stolen and noone batted an eye.
- lotsofpulp 8y ago
  Figuring out people's easy passwords and password recovery methods isn't a weakness in iCloud, and shouldn't be counted as hacking iCloud. And if you were concerned with security, and had to buy a smartphone, what device is better than an iPhone?
  - WrtCdEvrydy 8y ago
    > We didn't give random people loans in your name, your identity was stolen. When you shift responsibility from the provider to the customer, you play right into the security blame game.
    - lotsofpulp 8y ago
      Analogies are useful for illustrating a thought, not for supporting arguments. And identity theft (where the victim can do nothing to protect themselves) is not analogous in the first place. Using multi factor authentication, using long, difficult passwords, and don’t let your security questions be obvious. If someone knocks me out, uses my finger to TouchID into my bank’s app and transfer money, that’s the price I pay for the convenience of not wanting to login with my password. Same with using weak passwords and questions.
      - WrtCdEvrydy 8y ago
        You can't seriously say that a multi-million dollar company can't enforce those security features by default. This is the same as having a car recall and having people dying before the letters reach their homes and saying 'they should have known this company's cars could explode'
        lotsofpulp 8y ago
        I don't understand the purpose of using analogies (valid or not) in this discussion. Apple could have forced people to use multi factor authentication, and whether or not they should have forced it is a separate discussion that can be had. But I was claiming that your original comment was that iCloud was "hacked" is incorrect, since it implies there was some weakness on Apple's technical backend.
        WrtCdEvrydy 8y ago
        Not forcing secure by default practices in your secure devices is a weakness on Apple's technical backend. Maybe they should take a couple of notes for their broken cloud implementation from another phone manufacturer in the space that takes security seriously: https://www.theguardian.com/commentisfree/2014/sep/30/iphone-6-encrypted-phone-data-default https://www.theguardian.com/commentisfree/2014/sep/30/iphone... https://www.cso.com.au/article/577197/apple-tells-ios-9-developers-use-https-exclusively/ https://www.cso.com.au/article/577197/apple-tells-ios-9-deve...
- saagarjha 8y ago
  > Apple Cloud was hacked and celebrity pictures were stolen and noone batted an eye. iCloud was not hacked; the celebrities were spear phished: https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_photos https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_phot...
  - WrtCdEvrydy 8y ago
    > We didn't give random people loans in your name, your identity was stolen. When you shift responsibility from the provider to the customer, you play right into the security blame game.
    - indigo945 8y ago
      So, if I put a post-it with my PIN and SSN on my credit card and give that to a random stranger, it's the bank's fault?
      - WrtCdEvrydy 8y ago
        So, the celebrities put their password in a post-it on their iPhone?
- xvector 8y ago
  > Apple Cloud was hacked and celebrity pictures were stolen and noone batted an eye. Phishing. I think your comment is pretty disingenuous as Apple has generally showed a strong commitment to privacy and security.
  - WrtCdEvrydy 8y ago
    > We didn't give random people loans in your name, your identity was stolen. When you shift responsibility from the provider to the customer, you play right into the security blame game.
- GeekyBear 8y ago
  The celebgate phishing attacks involved more Google accounts than Apple accounts. >According to court filings, Collins stole photos, videos and sometimes entire iPhone backups from at least 50 iCloud accounts and 72 Gmail accounts, “mostly belonging to celebrities,” between November 2012 and September 2014, when the photos were posted online. https://www.washingtonpost.com/news/the-intersect/wp/2016/03/16/the-shockingly-simple-way-the-nude-photos-of-celebgate-were-stolen/ https://www.washingtonpost.com/news/the-intersect/wp/2016/03...

Arnt 8y ago

Will your phone accept an app upgrade which has been signed by Google or Apple instead of by Signal? If not, is the law capable of compelling your telephone vendor to ship you an upgrade that weakens its upgrade testing enough that Apple/Google can ship you such an upgrade?

somebehemoth 8y ago
My understanding is that it would not due to the different app signing certificate. This would be a new application unless Apple or Google signs the app using certificate forgery or similar.
- Klathmon 8y ago
  The Australian government could just force Google or Apple to make updates to their OS to not enforce signatures for some apps, or put in vulnerabilities that could be used by them to bypass signature checking at all.
  - coldcode 8y ago
    Good luck with that.
  - coldcode 8y ago
    Good luck with that. How do you have any idea its running in Australia or belongs to an Australian?
    - Klathmon 8y ago
      I'm not a lawyer, but from what I hear any Australian employees can be compelled to change code and be threatened with prison if they tell anyone. Any companies with any presence in Aus can be given demands and gag orders to ensure they can't talk about what is happening. And if this article is trustworthy, this isn't hypothetical, it's already happening right now. Right now people are being served with orders to do things like this and if they tell anyone (including the company they work for and are in essence "attacking"), they can kiss their life goodbye. That's what makes it so scary. A programmer that is living in Aus that works for Google or Apple could one day get a notice that they are now mandated to modify code for an unknown reason with the threat of prison if they don't or if they tell anyone. Technically even programmers that don't work for those companies can be compelled to make contributions to open source software to introduce vulnerabilities or exploits, and again there is literally nothing the person can do except follow orders or go to jail forever.

underbulb 8y ago

Don't be fooled by the narrative on the amendment. The truth is that such interception is normal, in Australia, in other countries. AA is two things. 1st, the government there legalizing an already existing practise to cover their own liability in the event that the grey practise is eventually exposed. Especially amid the current public awareness of privacy. Next, more importantly, AA is to get around recent security patches that rendered previous vectors now impossible to use, since these collections were often done covertly. It's law compensating for where a much relied on covert method no longer works. Thus, the 11th hour urgency. The cover story that it is this huge privacy catastophe is just more noise, to distract from the big story; how interceptions like this have been going on for more than a decade.

msla 8y ago

> Signal: The employee is required to intentionally alter the app to no longer provide security, such that some communication may be intercepted. They are not permitted to publicly disclose that they have done this. Replace "Signal" with "OpenBSD" and watch the freaking fireworks. (Why OpenBSD? De Raadt hasn't promised to be "nicer" recently. Linus has.)