Does this mean that if I take my iphone into an Apple Store in Australia for repair that a Genius could load unknown software (under legal compulsion) without Apple itself knowing?
Yes.
This is a civil rights nightmare.
Australian parliament passes encryption laws unamended
191–200 of 415 posts
Re: Australian parliament passes encryption laws unamended
#192Does this mean that if I take my iphone into an Apple Store in Australia for repair that a Genius could load unknown software (under legal compulsion) without Apple itself knowing?
Yes
Re: Australian parliament passes encryption laws unamended
#193Earlier quoted context omitted.
Fastmail, don't forget. With a somewhat heavy heart, but I shall be cancelling my service there.
i wonder if this would affect other, non autstralian mail providers (protonmail for instance).
No it does not, as we fall solely under Swiss jurisdiction since we don't have a presence in Australia.
Re: Australian parliament passes encryption laws unamended
#194I am an Australian software developer and am currently getting https://www.lifepim.com ready for release which, funnily enough has the main selling point as "Your data is private, secure and free from adverts" - what a joke. The scary part is not knowing how the law is going to be implemented - I am hopeful that smart people work on the implementation of it in terms of practicality. If it is an on request thing "give…
Don't launch in Australia. Or don't launch in Europe. GDPR and this legislation are in direct conflict. Pick a market...
Nothing bad about GDPR, since it's actually made to protect citizens.
Re: Australian parliament passes encryption laws unamended
#195Doesn't this also effect git repositories maintained by Australians? (I say this as an Australian who wants secure software) All it takes is one malicious npm package
No, it doesn't effect git repositories maintained by Australians. They have already been created.
However, it almost certainly does affect them.
Re: Australian parliament passes encryption laws unamended
#196Earlier quoted context omitted.
Don't launch in Australia. Or don't launch in Europe. GDPR and this legislation are in direct conflict. Pick a market...
Can launches can be targeted (legally) to a country? The site is hosted in London and am already GDPR compliant - wonder if this is means it is not under Australian laws?
If the business is registered in Australia then you're under Australian laws, regardless of where it's hosted.
All my hosting is done in the US, but that doesn't mean any of my businesses are necessarily American.
Re: Australian parliament passes encryption laws unamended
#197Some of the comments so far seem to suggest that this bill would require software to include backdoors. However, it looks like [the bill's PDF]( https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi... ) includes: > Division 7—Limitations > 317ZG Designated communications provider must not be required to implement or build a systemic weakness or systemic vulnerability etc. > (1) A technical assistance notice o…
Thank you for this, there is a lot of doomsaying in this thread but this reads to me that it would be possible to refuse requests based on these limitations.
The problem is that you are reading it as though the words mean what a technical person means by "systemic weakness" (such as weakening the crypto in an app in order to target a user). This is not what the words mean (and this entire bill and discussion around it is full of Orwellian doublespeak -- they redefine the word "backdoor" to mean 0-day for instance).
The words aren't defined at all in the bill (which should be a massive red flag), but even the amendments that include definitions completely miss the point and basically imply that only something like Dual_EC_DRBG is considered a "systemic weakness".
There is a lot of doomsaying because it is very seriously, no-kidding bad. Not to mention that denying such a request should almost certainly be done with some very serious (and expensive) legal advice.
Re: Australian parliament passes encryption laws unamended
#198Earlier quoted context omitted.
Realistically, if you were a developer not in the chain of command and asked to do this: Would you? Could you? You would be knowingly putting your name to a vulnerability, and if someone asks then you have to keep it a secret and feign incompetence. Then if they revert your change you'll have to re-implement it. If you do tell your superiors (which would be most likely what would happen, even before writing the code)…
If you think about logistics they'd have to make contact with people in the company to even find out who the devs are who are capable of making a backdoor. That would probably tip off others in the company as to what was happening anyway. You'd think they'd essentially have to serve the whole dev team with the secret order. I think you could immediately resign. It's not a slavery bill... is it?
There's LinkedIn, there's social media, there's actually keeping a record of who enters and leaves a company's premises. There's heading down to the bar after work on Friday. There's community events and meetups.
Re: Australian parliament passes encryption laws unamended
#199Earlier quoted context omitted.
Employees of a company may also be served, and required not to tell their employer. So a company may not know if they are compromised.
I seriously wonder how that would work in practice? "Hey Joey, will you work on the fizzibizzi feature that does xyz?" I can't, I have other stuff to do? "What kind of stuff? This feature is the top priority for the whole team?" I JUST CAN'T TELL YOU OKAY!!!
Also, you can't ask anyone else on the team for help implementing it.
These backdoors are going to be the worst code possible. What kind of crap quality code do you think a single dev under threat of jail time and the pressure of not being able to communicate with his co-workers or legal representation is going to pump out?
Re: Australian parliament passes encryption laws unamended
#200Earlier quoted context omitted.
There are so many loopholes in this thing. One predominant thing to keep in mind is the legal onus that is put on a company that does not comply . The basic gems are that I got from reading the draft legislation was: - If you have server side encryption, & we want you to decrypt a particular person's data, then we expect you to do so - ad infinitum. - If you do client side encryption then we expect you to put into pl…
Does the legislation say they can do this without justification though? Can they just ask for anyones information or does there need to be some sort of warrant?
It doesn't need a warrant, and the requirements are varied. None of them require judicial review.
* TARs and TANs both generally require that an agency be investigating a serious crime (one that takes). There are some toy protections against abuse but they're basically meaningless (the AG or chief officer needs to be "satisfied" that it's reasonable and a few other token requirements -- need I remind you that we imprison refugees in sub-human conditions without the right to a trial, so "reasonable" is a stretch).
* TCNs are even more general. They can be done purely "in the interests of national security".