3 ms·

So, is it time to distrust every ssl cert issued by Australian cert provider? Is there a list?

lowpro 8y ago
I'm not sure there are Australian cert providers... at least the government (gov.au) uses common ones such as Entrust and Digicert, and companies like Atlassian use Digicert.
- deleted 8y ago
  [deleted]
kevin_b_er 8y ago
You would also need to distrust any ssl cert a multinational company's australians can access, as the law can compel and gag them to steal your ssl cert. All Australian residents and citizens, including potentially abroad, are now legislated to be untrustworthy when it comes to holding any cryptographic secrets or access to systems of your customers.
- gruez 8y ago
  In light of what happened to symantec, wosign, and startcom, I would expect smart CAs to pull out of Australia, or at least spin off their Australian operations to a separate entity.
- jacques_chester 8y ago
  > including potentially abroad On my reading of the A&A bill there was no extra-territoriality clauses, so I think it only applies within Australia. However, I am not a lawyer and this is not legal advice.
  - shakna 8y ago
    It also appears to apply to Australian citizens living abroad, potentially making dual-citizens into covert actors.
    - jacques_chester 8y ago
      Do you know which clause gives it extra-territoriality? I didn't see one in my pass over it.
      - shakna 8y ago
        The devil is in the details. 317c, defining "communications provider". > 5. the person provides a service that facilitates, or is ancillary or incidental to, the provision of an electronic service that has one or more end‑users in Australia > 6. the person develops, supplies or updates software used, for use, or likely to be used, in connection with: > (a) a listed carriage service; or > (b) an electronic service that has one or more end‑users in Australia > 8. the person manufactures or supplies components for use, or likely to be used, in the manufacture of a facility for use, or likely to be used, in Australia There's several more. A communications provider, under the given definitions is not bound to be on Australian soil, but rather interacting with Australia as a nation. Applying this law to those of different nationality is difficult, and unlikely to succeed, however those of dual-citizenship can be held accountable. This opinion I have, that the law does apply to those internationally, is one I have seen supported by several law firms I have occasional contact with. Probably aided by: > 317F. This Part extends to every external Territory. > 317ZC.4 Part 4 of the Regulatory Powers (Standard Provisions) Act 2014, as it applies in relation to section 317ZB of this Act, extends to: > (a) every external Territory; and > (b) acts, omissions, matters and things outside Australia. > 317ZD (Enforceable Undertakings). > Part 6 of the Regulatory Powers (Standard Provisions) Act 2014, as it applies in relation to section 317ZB of this Act, extends to: > (a) every external Territory; and > (b) acts, omissions, matters and things outside Australia. There's a few more - but as the Act is stating it is enforceable to both external Territories and acts, omissions, matters and things outside Australia, I do think the most likely reading is that 'acts' can be enforced upon Australians living outside the borders.
        jacques_chester 8y ago
        "External Territories" here means Christmas Island, the Australian Antarctic Territory etc etc. When I say "extra-territoriality" I mean the application of law outside of Australia's borders. The "acts, ommissions, matters and things" appears to give extra-territoriality to subject matter but not to legal personalities (ie companies and people). The "communications provider" part is very broad, and while in Australia I am definitely covered by it. But the courts will not generally interpret legislation as having extra-territorial effect unless it explicitly says so. Otherwise every Act would need a stuff like "ps. the Fisheries Amendments (Rex Hunt Is A Wanker) Act is non-territorial". My question is not about whether a legal personality (ie, a company) is affected if they have a physical-legal presence in Australia, because of course they are affected. My question is whether someone like me, who is outside Australia's boundaries, can be served a notice while I am out of the country. On my reading it's still a "no". But I am still not a lawyer.

I'm not sure there are Australian cert providers... at least the government (gov.au) uses common ones such as Entrust and Digicert, and companies like Atlassian use Digicert.

deleted 8y ago
[deleted]

kevin_b_er 8y ago

You would also need to distrust any ssl cert a multinational company's australians can access, as the law can compel and gag them to steal your ssl cert. All Australian residents and citizens, including potentially abroad, are now legislated to be untrustworthy when it comes to holding any cryptographic secrets or access to systems of your customers.

gruez 8y ago
In light of what happened to symantec, wosign, and startcom, I would expect smart CAs to pull out of Australia, or at least spin off their Australian operations to a separate entity.
jacques_chester 8y ago
> including potentially abroad On my reading of the A&A bill there was no extra-territoriality clauses, so I think it only applies within Australia. However, I am not a lawyer and this is not legal advice.
- shakna 8y ago
  It also appears to apply to Australian citizens living abroad, potentially making dual-citizens into covert actors.
  - jacques_chester 8y ago
    Do you know which clause gives it extra-territoriality? I didn't see one in my pass over it.
    - shakna 8y ago
      The devil is in the details. 317c, defining "communications provider". > 5. the person provides a service that facilitates, or is ancillary or incidental to, the provision of an electronic service that has one or more end‑users in Australia > 6. the person develops, supplies or updates software used, for use, or likely to be used, in connection with: > (a) a listed carriage service; or > (b) an electronic service that has one or more end‑users in Australia > 8. the person manufactures or supplies components for use, or likely to be used, in the manufacture of a facility for use, or likely to be used, in Australia There's several more. A communications provider, under the given definitions is not bound to be on Australian soil, but rather interacting with Australia as a nation. Applying this law to those of different nationality is difficult, and unlikely to succeed, however those of dual-citizenship can be held accountable. This opinion I have, that the law does apply to those internationally, is one I have seen supported by several law firms I have occasional contact with. Probably aided by: > 317F. This Part extends to every external Territory. > 317ZC.4 Part 4 of the Regulatory Powers (Standard Provisions) Act 2014, as it applies in relation to section 317ZB of this Act, extends to: > (a) every external Territory; and > (b) acts, omissions, matters and things outside Australia. > 317ZD (Enforceable Undertakings). > Part 6 of the Regulatory Powers (Standard Provisions) Act 2014, as it applies in relation to section 317ZB of this Act, extends to: > (a) every external Territory; and > (b) acts, omissions, matters and things outside Australia. There's a few more - but as the Act is stating it is enforceable to both external Territories and acts, omissions, matters and things outside Australia, I do think the most likely reading is that 'acts' can be enforced upon Australians living outside the borders.
      - jacques_chester 8y ago
        "External Territories" here means Christmas Island, the Australian Antarctic Territory etc etc. When I say "extra-territoriality" I mean the application of law outside of Australia's borders. The "acts, ommissions, matters and things" appears to give extra-territoriality to subject matter but not to legal personalities (ie companies and people). The "communications provider" part is very broad, and while in Australia I am definitely covered by it. But the courts will not generally interpret legislation as having extra-territorial effect unless it explicitly says so. Otherwise every Act would need a stuff like "ps. the Fisheries Amendments (Rex Hunt Is A Wanker) Act is non-territorial". My question is not about whether a legal personality (ie, a company) is affected if they have a physical-legal presence in Australia, because of course they are affected. My question is whether someone like me, who is outside Australia's boundaries, can be served a notice while I am out of the country. On my reading it's still a "no". But I am still not a lawyer.