44 ms·

> can coerce citizens and companies to install backdoors into their companies software [1] No, no it can't. I don't know how the media managed to get this so w

> can coerce citizens and companies to install backdoors into their companies software [1] No, no it can't. I don't know how the media managed to get this so wrong and how so many people just accepted it without questioning it. The law explicitly limits, and limited from the start, the effect that a government request could have [0]: a request cannot introduce a "systemic weakness". Some relevant quotes of what a systemic weakness can entail: - "one or more actions that would render systemic methods of authentication or encryption less effective" - [when targeting a particular person] "any act or thing that will, or is likely to, jeopardise the security of any information held by any other person." Note that this is a restriction on the "effect" that a notice can have. It's not just the the government can't ask for this, it's that the government can't ask for anything that would result in this. So no, there are no backdoors. What there is, is a a requirement to assist when it can be done in a way that doesn't have any of these effects. For example if the government wanted to intercept WhatsApp messages, it could require that WhatsApp introduce a hard-coded identifier into the app and if a user matches that identifier, then copies of every message would be sent to the Australian government. This doesn't introduce any systemic weakness and doesn't compromise anybody else's data, so should be permitted. And I don't see how the above could be considered a "backdoor", as it requires that the app be pushed through the app store, a capability that WhatsApp already has. [0]: http://classic.austlii.edu.au/au/legis/cth/consol_act/ta1997214/s317zg.html http://classic.austlii.edu.au/au/legis/cth/consol_act/ta1997...

peterkelly 6y ago
Any property of a system that makes it possible to intercept the communication of specific users is, in and of itself, a systemic weakness.
- throwaway9d0291 6y ago
  I agree and were a company to not already have that capability and the government were to request it, such a request would be legally worthless per the aforementioned law. However pretty much every closed-source communication tool already has this systemic weakness, so the government doesn't have to ask for it to be introduced. WhatsApp, Facebook, Google etc. can all, today, as we speak, choose to push out an app update with code to send plaintext copies of a specific person's messages to Australian law enforcement/intelligence. There's nothing new here. Open-source tools though do not have this vulnerability. Signal for example has reproducible builds and the Australian government cannot require it to remove them so that it can covertly intercept individuals' messages. My point here is that contrary to reporting in the tech media, the law doesn't and cannot require that any backdoors be introduced. It can only require that existing ones be used.

peterkelly 6y ago

Any property of a system that makes it possible to intercept the communication of specific users is, in and of itself, a systemic weakness.

throwaway9d0291 6y ago
I agree and were a company to not already have that capability and the government were to request it, such a request would be legally worthless per the aforementioned law. However pretty much every closed-source communication tool already has this systemic weakness, so the government doesn't have to ask for it to be introduced. WhatsApp, Facebook, Google etc. can all, today, as we speak, choose to push out an app update with code to send plaintext copies of a specific person's messages to Australian law enforcement/intelligence. There's nothing new here. Open-source tools though do not have this vulnerability. Signal for example has reproducible builds and the Australian government cannot require it to remove them so that it can covertly intercept individuals' messages. My point here is that contrary to reporting in the tech media, the law doesn't and cannot require that any backdoors be introduced. It can only require that existing ones be used.