6 ms·

First time that I read about this scary Australian backdoor stuff. As a (very happy) client of Fastmail, I regret to have to look for other options. Are Austr

First time that I read about this scary Australian backdoor stuff. As a (very happy) client of Fastmail, I regret to have to look for other options. Are Australian legislators really that clueless? There seems to be a very strong incentive against making business with Australian companies.

lfam 7y ago
Do you think it's different in other countries? Everywhere, the email service will have to give your emails to the police when they come knocking...
- JumpCrisscross 7y ago
  > Everywhere, the email service will have to give your emails to the police when they come knocking The Australian law is broader and contains fewer checks than anything comparable in the developed world. It lets law enforcement compel, with no oversight and in secret, any Australian "to re-engineer software and hardware under their control, so that it can be used to spy on their users" [1]. (Australia has no bill of rights [2].) The American analog is an intelligence agency getting a national security letter [3] stamped by a FISA court [4]. The order can compel disclosure of information on hand, but cannot compel a product to be re-engineered [5]. [1] https://www.eff.org/deeplinks/2018/12/new-fight-online-privacy-and-security-australia-falls-what-happens-next https://www.eff.org/deeplinks/2018/12/new-fight-online-priva... [2] https://www.nytimes.com/2018/09/04/opinion/australia-encryption-surveillance-bill.html?module=inline https://www.nytimes.com/2018/09/04/opinion/australia-encrypt... [3] https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter [4] https://en.wikipedia.org/wiki/United_States_Foreign_Intelligence_Surveillance_Court https://en.wikipedia.org/wiki/United_States_Foreign_Intellig... [5] https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute
  - deleted 7y ago
    [deleted]
  - pavlov 7y ago
    > "The order can compel disclosure of information on hand, but cannot compel a product to be re-engineered." OTOH this could be unnecessary at large American companies because the needs of national security services may have been engineered in. Thinking of Room 641A [1], etc. [1] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
    - JumpCrisscross 7y ago
      > this could be unnecessary at large American companies because the needs of national security services may have been engineered in That's voluntary co-operation. The situation is far from perfect in the United States, but Australia is an extreme case.
- latexr 7y ago
  > Everywhere, the email service will have to give your emails to the police when they come knocking Not if you’re Ladar Levison running Lavabit in 2013. He opted to shut down the service instead of complying: https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
  - lfam 7y ago
    That service was worse than anything else because it failed to provide the crucial "availability" property. And in the end he gave the keys to the government anyways. So he failed on every count.
  - enriquto 7y ago
    Notice that lavabit reopened again in 2017, and is now even open for new customers. I will try it, but I'm a bit scared of the likelihood that it will be closed again. Changing your email address is no small hassle, and I am already pretty happy with my fastmail one.
    - LyndsySimon 7y ago
      > Changing your email address is no small hassle I moved my addresses over to my own domain (lyndsysimon.com) many years ago, way back when I was still using gmail as my provider. I've since switched a couple of times, and have never had to change my address. These days I use Protonmail. I like it for what it is, and it checks all of my "privacy" boxes, but the search functionality leaves much to be desired. I understand the technical limitations that constrain that, but I still wish there were more options.
    - chappi42 7y ago
      If you are pretty happy with fastmail, why switch? They will only access your email with a court order (fine with me). If you don't want this, I'd try ProtonMail, they encrypt the email, i.e. are unable to provide email content in clear text. The price is that email handling is (much) more painful.
mfer 7y ago
Two thoughts... First, compare practical law impacts if you look elsewhere. For example, in the US the gov can get email from providers that's more than 180 days old without a warrant. Second, Fastmail like Google, Microsoft, and most others has access to your email. They comply with court orders for email like other providers. Fastmail has noted the gov doesn't need a backdoor to get to email. Same with other companies in other countries.
- unicornfinder 7y ago
  Indeed. Not to mention, even if your own email isn't compromised, if you send email to someone else who's is, it's irrelevant. Email shouldn't be used for things that are particularly private to begin with.
  - t0astbread 7y ago
    Then what else should?
  - enriquto 7y ago
    > Email shouldn't be used for things that are particularly private to begin with. To begin with, governments should not be able to access your non-particularly private stuff without an explicit court order.
- JumpCrisscross 7y ago
  > in the US the gov can get email from providers that's more than 180 days old without a warrant With a warrant signed by a judge. Also, if the keys are on your device the service has nothing to turn over. The court can't force the provider to engineer in a backdoor. None of those checks or limitations apply in Australia.
  - Forbo 7y ago
    In the US, FISA courts can authorize technical assistance orders to force compliance. https://en.wikipedia.org/wiki/Protect_America_Act_of_2007#3._Requirement_to_assist https://en.wikipedia.org/wiki/Protect_America_Act_of_2007#3....
Deimorz 7y ago
Why do you need to switch? That regulation is irrelevant for Fastmail and changes nothing for them, as they've explained multiple times: https://fastmail.blog/2018/12/21/advocating-for-privacy-aabill-australia/ https://fastmail.blog/2018/12/21/advocating-for-privacy-aabi...
- enriquto 7y ago
  I appreciate your link, which I had not found by a fast scan of the fastmail docs. It certainly answers some of my questions. However the line of argument of this text is so-so. They say that the regulation is "irrelevant for them" because "it is highly unlikely that...". The words "highly unlikely", however, do not really mean anything and the argument falls down. Besides that part, most of their text seems quite honest, clear and compelling. Βut I would appreciate that they delve precisely into these "highly unlikely" cases.
  - Deimorz 7y ago
    I honestly don't understand what you're talking about. The word "unlikely" isn't even in the post I linked. They could always decrypt your data. They don't need to add a backdoor, because they've always had full access. Nothing changes at all.
    - enriquto 7y ago
      > I honestly don't understand what you're talking about. The word "unlikely" isn't even in the post I linked. The crucial point of the post concerns the possibility that fastmail developers are forced to introduce secretly a government backdoor. This possibility is briefly dismissed as follows: > There are also concerns that individual employees may be forced to build a backdoor, without being able to alert their employer. While frightening for anyone working in technology, we believe this fear is largely unfounded [1]. Most organisations have practices (pair programming, code reviews, risk evaluations) that would reveal such behaviour quickly. The only reason given for the word "unfounded" is an article on zdnet [1], that explains the reasons why these backdoors are unlikely (but does not rule out the fact that they are possible). The word "unlikely" comes from the title of this article. [1] https://www.zdnet.com/article/australias-encryption-laws-are-highly-unlikely-to-dragoon-employees-in-secret/ https://www.zdnet.com/article/australias-encryption-laws-are...

lfam 7y ago

Do you think it's different in other countries? Everywhere, the email service will have to give your emails to the police when they come knocking...

JumpCrisscross 7y ago
> Everywhere, the email service will have to give your emails to the police when they come knocking The Australian law is broader and contains fewer checks than anything comparable in the developed world. It lets law enforcement compel, with no oversight and in secret, any Australian "to re-engineer software and hardware under their control, so that it can be used to spy on their users" [1]. (Australia has no bill of rights [2].) The American analog is an intelligence agency getting a national security letter [3] stamped by a FISA court [4]. The order can compel disclosure of information on hand, but cannot compel a product to be re-engineered [5]. [1] https://www.eff.org/deeplinks/2018/12/new-fight-online-privacy-and-security-australia-falls-what-happens-next https://www.eff.org/deeplinks/2018/12/new-fight-online-priva... [2] https://www.nytimes.com/2018/09/04/opinion/australia-encryption-surveillance-bill.html?module=inline https://www.nytimes.com/2018/09/04/opinion/australia-encrypt... [3] https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter [4] https://en.wikipedia.org/wiki/United_States_Foreign_Intelligence_Surveillance_Court https://en.wikipedia.org/wiki/United_States_Foreign_Intellig... [5] https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute
- deleted 7y ago
  [deleted]
- pavlov 7y ago
  > "The order can compel disclosure of information on hand, but cannot compel a product to be re-engineered." OTOH this could be unnecessary at large American companies because the needs of national security services may have been engineered in. Thinking of Room 641A [1], etc. [1] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
  - JumpCrisscross 7y ago
    > this could be unnecessary at large American companies because the needs of national security services may have been engineered in That's voluntary co-operation. The situation is far from perfect in the United States, but Australia is an extreme case.
latexr 7y ago
> Everywhere, the email service will have to give your emails to the police when they come knocking Not if you’re Ladar Levison running Lavabit in 2013. He opted to shut down the service instead of complying: https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
- lfam 7y ago
  That service was worse than anything else because it failed to provide the crucial "availability" property. And in the end he gave the keys to the government anyways. So he failed on every count.
- enriquto 7y ago
  Notice that lavabit reopened again in 2017, and is now even open for new customers. I will try it, but I'm a bit scared of the likelihood that it will be closed again. Changing your email address is no small hassle, and I am already pretty happy with my fastmail one.
  - LyndsySimon 7y ago
    > Changing your email address is no small hassle I moved my addresses over to my own domain (lyndsysimon.com) many years ago, way back when I was still using gmail as my provider. I've since switched a couple of times, and have never had to change my address. These days I use Protonmail. I like it for what it is, and it checks all of my "privacy" boxes, but the search functionality leaves much to be desired. I understand the technical limitations that constrain that, but I still wish there were more options.
  - chappi42 7y ago
    If you are pretty happy with fastmail, why switch? They will only access your email with a court order (fine with me). If you don't want this, I'd try ProtonMail, they encrypt the email, i.e. are unable to provide email content in clear text. The price is that email handling is (much) more painful.

mfer 7y ago

Two thoughts... First, compare practical law impacts if you look elsewhere. For example, in the US the gov can get email from providers that's more than 180 days old without a warrant. Second, Fastmail like Google, Microsoft, and most others has access to your email. They comply with court orders for email like other providers. Fastmail has noted the gov doesn't need a backdoor to get to email. Same with other companies in other countries.

unicornfinder 7y ago
Indeed. Not to mention, even if your own email isn't compromised, if you send email to someone else who's is, it's irrelevant. Email shouldn't be used for things that are particularly private to begin with.
- t0astbread 7y ago
  Then what else should?
- enriquto 7y ago
  > Email shouldn't be used for things that are particularly private to begin with. To begin with, governments should not be able to access your non-particularly private stuff without an explicit court order.
JumpCrisscross 7y ago
> in the US the gov can get email from providers that's more than 180 days old without a warrant With a warrant signed by a judge. Also, if the keys are on your device the service has nothing to turn over. The court can't force the provider to engineer in a backdoor. None of those checks or limitations apply in Australia.
- Forbo 7y ago
  In the US, FISA courts can authorize technical assistance orders to force compliance. https://en.wikipedia.org/wiki/Protect_America_Act_of_2007#3._Requirement_to_assist https://en.wikipedia.org/wiki/Protect_America_Act_of_2007#3....

Deimorz 7y ago

Why do you need to switch? That regulation is irrelevant for Fastmail and changes nothing for them, as they've explained multiple times: https://fastmail.blog/2018/12/21/advocating-for-privacy-aabill-australia/ https://fastmail.blog/2018/12/21/advocating-for-privacy-aabi...

enriquto 7y ago
I appreciate your link, which I had not found by a fast scan of the fastmail docs. It certainly answers some of my questions. However the line of argument of this text is so-so. They say that the regulation is "irrelevant for them" because "it is highly unlikely that...". The words "highly unlikely", however, do not really mean anything and the argument falls down. Besides that part, most of their text seems quite honest, clear and compelling. Βut I would appreciate that they delve precisely into these "highly unlikely" cases.
- Deimorz 7y ago
  I honestly don't understand what you're talking about. The word "unlikely" isn't even in the post I linked. They could always decrypt your data. They don't need to add a backdoor, because they've always had full access. Nothing changes at all.
  - enriquto 7y ago
    > I honestly don't understand what you're talking about. The word "unlikely" isn't even in the post I linked. The crucial point of the post concerns the possibility that fastmail developers are forced to introduce secretly a government backdoor. This possibility is briefly dismissed as follows: > There are also concerns that individual employees may be forced to build a backdoor, without being able to alert their employer. While frightening for anyone working in technology, we believe this fear is largely unfounded [1]. Most organisations have practices (pair programming, code reviews, risk evaluations) that would reveal such behaviour quickly. The only reason given for the word "unfounded" is an article on zdnet [1], that explains the reasons why these backdoors are unlikely (but does not rule out the fact that they are possible). The word "unlikely" comes from the title of this article. [1] https://www.zdnet.com/article/australias-encryption-laws-are-highly-unlikely-to-dragoon-employees-in-secret/ https://www.zdnet.com/article/australias-encryption-laws-are...