10 ms·
VPNSecure moves company from Australia to Hong Kong due to anti-encryption regs
- lysp 8y agoCompany moving from AU to HK. AU company had to remove canary, but new HK company will have a canary. Reading between the lines...
- 345gxsagdf 8y agoThey would have had to remove it anyway, VPNSecure was breaking the 2015 law by publishing a canary in the first place: https://www.schneier.com/blog/archives/2015/03/australia_outla.html https://www.schneier.com/blog/archives/2015/03/australia_out... Section 182A of the new law says that a person commits an offense if he or she discloses or uses information about "the existence or non-existence of such a [journalist information] warrant." The penalty upon conviction is two years imprisonment. 'straya. If ya got keys, we want em, and stfu
- cyphar 8y agoWarrant canaries (statements about the existence or nonexistence of a notice) for TARs, TANs, and TCNs are all illegal and are punishable with 5 years imprisonment.
- xfitm3 8y agoUnder AU or HK law?
- cyphar 8y agoAustralian law, though it's not one law -- each new kind of secret warrant-like capability has wording to the effect of "disclosure of the existence or nonexistence of a [secret warrant] is an offense punishable by $x years imprisonment." In this case I was referring to the Assistance and Access Act 2018 (the new anti-encryption law) which has such wording for notices under the new legislation.
- pandapower2 8y agoHong Kong seems an odd choice. Or at least a short sighted choice. Right now its an ok place to operate but given the slow erosion of Hong Kong's independence will it still be in 1 year? 5 years?
- judge2020 8y agoThe treaty that gives Hong Kong its independence (but still being called China) is the Sino-British Joint Declaration [1], which grants independence for 50 years, until 2047. this was also a thing for Macau [2] 1: https://en.wikipedia.org/wiki/Sino-British_Joint_Declaration https://en.wikipedia.org/wiki/Sino-British_Joint_Declaration 2: https://en.wikipedia.org/wiki/Joint_Declaration_on_the_Question_of_Macau https://en.wikipedia.org/wiki/Joint_Declaration_on_the_Quest...
- saagarjha 8y agoWithout much knowledge of the geopolitical landscape, how does this treaty stop China from invading Hong Kong? Presumably they’d face some consequences from the rest of the world, but would it be worth it?
- j16sdiz 8y agoNothing. In fact, the Foreign Ministry have delined it have any practical meaning and "the document no longer binds China": https://www.reuters.com/article/us-hongkong-anniversary-china/china-says-sino-british-joint-declaration-on-hong-kong-no-longer-has-meaning-idUSKBN19L1J1 https://www.reuters.com/article/us-hongkong-anniversary-chin...
- est 8y agoChina has to invade Hong Kong? The PLA already has a permanent base there, with ground troops and a substancial helicopter squad.
- NeedMoreTea 8y agoChina started chipping away at that agreement almost immediately. At first Beijing "just" restricted the continuing progress toward democracy. They'd promised to leave that to HK. Now they're much more active about it, intervening in law, freedom of press, day to day administration, the make up of the legislature, etc. Then there's the kidnappings of booksellers and publishers, and continual pro Beijing immigration. Seems right to be very wary of any promises writ there.
- olliej 8y agoUhhh “security legislation in Australia is scary, let’s move to ... chine?” (I recognize HK is special, but let’s be real: China can make HK do whatever it wants)
- andrewstuart 8y agoIt's really strange that Microsoft, Amazon and Apple and Google seem to be OK with the Australian laws. I would have expected them to pull out too.
- Mirioron 8y agoMaybe they just don't care until they're sued because they won't comply?
- duality 8y agoDo they have data centers in Australia?
- andrewstuart 8y agoYes: https://techcrunch.com/2018/04/02/microsoft-launches-2-new-azure-regions-in-australia/ https://techcrunch.com/2018/04/02/microsoft-launches-2-new-a... https://cloud.google.com/about/locations/sydney/ https://cloud.google.com/about/locations/sydney/ https://docs.aws.amazon.com/sns/latest/dg/sms_supported-countries.html https://docs.aws.amazon.com/sns/latest/dg/sms_supported-coun... And the issue for Apple is more that the government can require Apple to secretly install backdoors into the iPhone - that's my understanding although maybe wrong?
- jpatokal 8y agoThere is indeed a Google Cloud Platform region in Sydney, but that's for GCP customer data only, not consumer Gmail etc. There are no "main" Google DCs in Australia: https://www.google.com/about/datacenters/inside/locations/ https://www.google.com/about/datacenters/inside/locations/ I would presume the same applies to Microsoft and Amazon.
- thejosh 8y agoOf course, and they are also the one of the most expensive regions :).
- a012 8y ago
- marak830 8y agoAside from what everyone else has stated on these comments, unless they remove all Australian staff it won't matter, they can still be compelled to do whatever the aus govt wants.
- Thorrez 8y agoCouldn't employees in Hong Kong revert the changes and alert the media?
- netheril96 8y agoBut you may not know. Some security vulnerabilities are quite hard to spot, even to experts.
- isostatic 8y agoNo more than a bad actor simply paying $xxx to the developer.
- apexalpha 8y agoWhy? you can just let the Hong Kong staff hold necessary keys.
- marak830 8y agoIndeed, but would you prefer to have staff you know are reliable, or to be constantly worried that every commit may contain a portion that will lead into a future loophole.
- vectorEQ 8y agoeveryone has their price, so it's always possible something is going to happen, but moving places atleast gives them chance that they don't get lawsuit immediately, and gives more opportunity to resist. as a nation you can't touch someone in another nation unless the host nation cooperates. not sure how china vs australia relationships are, but i'm assuming these people didn't move to that specific country just at random....
- rajadigopula 8y agoTried them once. Their windows app by default only connects at 128 bit encryption! Had a chat with their CS and they tried to convince 128 bit is enough. Stopped after the trial.
- dtx1 8y agoYou seem to be knowledgeable. My VPN Provider uses 256-AES-CBC by default, at least for my particular configuration. Is that appropriate?
- diafygi 8y ago128 bit AES (assuming that's what you meant) can certainly be good enough. https://security.stackexchange.com/a/19762 https://security.stackexchange.com/a/19762
- booblik 8y agoDoes this law apply to Attlasian as well? Their stock price is not concerned.