Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Australian parliament passes encryption laws unamended

abc.net.au

Post reply on HN
Print view View original

101–110 of 415 posts

Re: Australian parliament passes encryption laws unamended

#101

Post by acutesoftware »

ashildr wrote: post #89
acutesoftware wrote: post #38

I am an Australian software developer and am currently getting https://www.lifepim.com ready for release which, funnily enough has the main selling point as "Your data is private, secure and free from adverts" - what a joke. The scary part is not knowing how the law is going to be implemented - I am hopeful that smart people work on the implementation of it in terms of practicality. If it is an on request thing "give…

I’m sure your customers will believe you if you say that your government did not tell you to lie about backdoors and weaknesses in your products security.

That's the scary part about this - a company is not allowed to tell people when the data was accessed

Re: Australian parliament passes encryption laws unamended

#102

Post by [deleted] »

ashildr wrote: post #99
rswail wrote: post #40

Earlier quoted context omitted.

The best discussion I've found in terms of the legislation is at [1]. The most insidious part to me as a programmer, is the definition of a "Designated Communications Provider" which (amongst others) includes (S317C, item 6): "the person develops, supplies or updates software used, for use, or likely to be used, in connection with: (a) a listed carriage service; or (b) an electronic service that has one or more end-u…

So australian software developers have become pretty much toxic now?

[deleted]

Re: Australian parliament passes encryption laws unamended

#103

Post by acutesoftware »

marcus_holmes wrote: post #87
acutesoftware wrote: post #38

I am an Australian software developer and am currently getting https://www.lifepim.com ready for release which, funnily enough has the main selling point as "Your data is private, secure and free from adverts" - what a joke. The scary part is not knowing how the law is going to be implemented - I am hopeful that smart people work on the implementation of it in terms of practicality. If it is an on request thing "give…

Don't launch in Australia. Or don't launch in Europe. GDPR and this legislation are in direct conflict. Pick a market...

Can launches can be targeted (legally) to a country? The site is hosted in London and am already GDPR compliant - wonder if this is means it is not under Australian laws?

Re: Australian parliament passes encryption laws unamended

#104

Post by robryan »

boyter wrote: post #45
artichokeheart wrote: post #22

To anyone with a business from anywhere else in the world. Yes please do, publicly and loudly, cease to deal with us (Australia) due to the very real possibility that all of you private and commercially sensitive communications will be monitored and recorded (Also given the five eyes agreement shared with other countries.) Australia already have a history of using their spy services for commercial gain. https://en.m.…

+1 block us. Apple if you are reading this stop selling us iPhones. Australians need to feel the pain of this otherwise nothing will change. 1 billion dollars wiped from Atlassian already. I’m hoping the markets react more and destroy the industry here. Might want to assume that all Australian developers are now potentially compromised.

Possible it will go nowhere. How can Apple for example provide a backdoor for imessage which isn't a systemic weakness?

Re: Australian parliament passes encryption laws unamended

#105

Post by yreg »

mcv wrote: post #78
healsjnr1 wrote: post #15

This is another thing that adds to my deep sense of shame to live in this country (sadly, that list is long and growing). This bill does nothing to prevent the kinds of things it is intended to prevent. The apps this law targets were engineered specifically to prevent this kind of interference. The idea that passing legislation will suddenly change that, magically allowing decryption of messages is beyond idiotic. Th…

> OpenVPN They'll probably want a backdoor in that too.

No reason for them to be getting it.

Re: Australian parliament passes encryption laws unamended

#106

Post by cmroanirgo »

_Nat_ wrote: post #43

Some of the comments so far seem to suggest that this bill would require software to include backdoors. However, it looks like [the bill's PDF]( https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi... ) includes: > Division 7—Limitations > 317ZG Designated communications provider must not be required to implement or build a systemic weakness or systemic vulnerability etc. > (1) A technical assistance notice o…

There are so many loopholes in this thing. One predominant thing to keep in mind is the legal onus that is put on a company that does not comply.

The basic gems are that I got from reading the draft legislation was:

- If you have server side encryption, & we want you to decrypt a particular person's data, then we expect you to do so - ad infinitum.

- If you do client side encryption then we expect you to put into place a system that allows us to decrypt a particular person's data. (One assumes that a modification should be made for the particular client such that their data can be gathered in an unencrypted manner).

So, irrespective of the caveats that you've mentioned, the bill still stands. The caveats you've mentioned are the standard bait-and-switch style legalese, to make it sound more palatable. I'd assume that in reality, it's up to the company (at their own legal cost) to prove that what needs to be created is in fact, a back door.

Re: Australian parliament passes encryption laws unamended

#107

Post by Tor3 »

brokenmachine wrote: post #32
artichokeheart wrote: post #22

To anyone with a business from anywhere else in the world. Yes please do, publicly and loudly, cease to deal with us (Australia) due to the very real possibility that all of you private and commercially sensitive communications will be monitored and recorded (Also given the five eyes agreement shared with other countries.) Australia already have a history of using their spy services for commercial gain. https://en.m.…

God this is so true. I am so ashamed of our so-called representatives. Please, Apple, do what you know is right and disable all iPhones in Australia. Google, please do the same with Android. If you have a website, geoblock Australia from it. Quarantine us from the world. We are sick and will infect you all.

> If you have a website, geoblock Australia from it.

Just did.. won't even respond to icmp. My Tokyo and UK sites.

Re: Australian parliament passes encryption laws unamended

#108

Post by atemerev »

artichokeheart wrote: post #22

To anyone with a business from anywhere else in the world. Yes please do, publicly and loudly, cease to deal with us (Australia) due to the very real possibility that all of you private and commercially sensitive communications will be monitored and recorded (Also given the five eyes agreement shared with other countries.) Australia already have a history of using their spy services for commercial gain. https://en.m.…

While you are probably correct, the world needs to urgently stop doing any business with China first.

And since it’s not going to happen, other countries beyond China unfortunately start to get some funny ideas, too...

Re: Australian parliament passes encryption laws unamended

#109

Post by netheril96 »

boyter wrote: post #54
sn41 wrote: post #41

Okay - a quick question: how does bitbucket deal with this, since Atlassian is an Australian company? Am I making an error here?

1 billion lost from the company already. I am hoping for them to depart Australia for good on this.

> 1 billion

Is that metaphorical or actual number? If latter, I am interested in the source.

Re: Australian parliament passes encryption laws unamended

#110

Post by cmroanirgo »

schappim wrote: post #50
_Nat_ wrote: post #43

Some of the comments so far seem to suggest that this bill would require software to include backdoors. However, it looks like [the bill's PDF]( https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi... ) includes: > Division 7—Limitations > 317ZG Designated communications provider must not be required to implement or build a systemic weakness or systemic vulnerability etc. > (1) A technical assistance notice o…

What does this mean for Zero-knowledge systems?

You must build a custom made back door. eg. Something like ProtonMail would need to inject some extra javascript so that the government could obtain a copy before encryption, I expect.

If I were to write some software of this nature these days, I'd make sure that the client would be aware of any changes in the api - sort of like a personal warrant canary. (Note that a warrant canary is legal in this legislation).

Post reply on HN