4 ms·
Yes, it's FUD. But it's only FUD because they don't need a new backdoor. They already have one. It's the automatic update system, which ironically has to be
by rstuart4133 4y ago
Yes, it's FUD. But it's only FUD because they don't need a new backdoor. They already have one.
It's the automatic update system, which ironically has to be there for security updates. The automatic update system means on devices that identify their customers, the act demands any software provider not only provide access to the device via that mechanism, they must also provide assistance such as writing software the host OS won't complain about when it is downloaded using the mechanism. That is why it's called the Assistance and Access act, 2018. It provides access to just about any device, and forces the manufacturer to any and all assistance required to get that access.
Devices that identify their users are ubiquitous. Anybody that sells you something in anticipation of getting an ongoing revenue stream from it will have to identify you. That includes Android, Windows, iOS, your Samsung TV, ... Any device that asks you to register with an email address or phone number can be targeted exactly. The act does devote many words to saying all bugs and spying devices must be targeted very specifically like it's some huge restriction, while never going out of it's way to make it plain just about all devices can now be targeted specifically.
And yes, security updates are systemic weakness. In fact I refuse to own stuff that is supposed to be highly secure that does allow security updates. Think security tokens, SIMs, credit cards, ... If it's broken I'll go down to the store and anonymously buy a new one thank you. And because security updates are a systemic weakness - the long and flowing waffle in the act about no introducing systemic vulnerabilities is there purely as a smoke screen. They don't need to introduce new systemic vulnerabilities - they already have a perfectly good one.
- Youden 4y agoTrue that an update system could be used maliciously. I wonder though: if the keys needed to sign an update are stored in say an American or Korean HSM and no person located in Australia has access, can the Australian government still compel their use?