The comments here are disappointing. The gulf between cryptopurists and software that people actually use remains wide.
Advocating for privacy in Australia
41–50 of 112 posts
Re: Advocating for privacy in Australia
#42Earlier quoted context omitted.
Funny how wanting to keep your personal correspondence private is now being conflated with “above the law”. The concrete bunker thing is a ridiculous diversion. Why are you even bringing that up? I understand that privacy is a difficult problem especially when subject to legislation but bunkers have nothing to do with it. You will obviously provide user information to government on request, you and your staff maintai…
On the bunker issue, many people seem to expect us to be like some Sealand with armed forces fighting off hostile government ships. No service actually works like that, and the aren't really jurisdictions where you can just tell the police to go jump. You'll get your uplinks disconnected and your payment systems frozen if there's a high enough value target in there. A Sealand-like service makes no sense as a product…
I’m genuinely sorry if I have been a bit rude, dismissive and sarcastic in my comments.
My point, I suppose is that there are ways to architect systems such that concrete bunkers are un-necesary and irrelevant.
The simplest such systems do involve trust in you. I suppose to a first order you are trustworthy since you have explained you will hand over user data upon request according to the laws you are subject to. This is a sane business decision.
Finally, a solid stance against at least business surveillance is a great start.
Re: Advocating for privacy in Australia
#43So the article's tl;dr is basically: "We're advocating for privacy, but we aren't going to try to offer you any. We never did, and we certainly won't now that this law passed. You're on your own." Is this supposed to be a PR-positive announcement from FastMail, because I can't quite tell?!
The problem is simply that you expect the impossible. Either you give the factual power to access your emails to some party, then whoever you give that power to can as a matter of fact access your emails, and in particular that means that they can be coerced into accessing your emails, or you don't give them the power, then they can't. You are demanding that they offer a product where they have the power to access yo…
Not sure what you are getting at exactly, but you can provide browser based email where the browser using J.S. decrypts the email. Obviously need to figure a way to make that AA proof.
Re: Advocating for privacy in Australia
#44Earlier quoted context omitted.
Funny how wanting to keep your personal correspondence private is now being conflated with “above the law”. The concrete bunker thing is a ridiculous diversion. Why are you even bringing that up? I understand that privacy is a difficult problem especially when subject to legislation but bunkers have nothing to do with it. You will obviously provide user information to government on request, you and your staff maintai…
"We don't place ourselves above the law" - AKA we don't believe we are better placed than a judge to know whether sufficient evidence has been presented to allow law enforcement access to data about a user of our platform. Unless you're starting from a premise that bad actors don't exist, and the police never do anything of value, there needs to be a facility by which police perform the role we expect of them in a ci…
> a judge
Thats the problem here. Computers (smartphone/laptop/server/toaster/etc) are/will continue to hold most intimate and private data about a individual. Do you want all that disclosed on one person's word ? I dont. I dont think there can be any check-and-balance that absolutely prevent any person from giving a malicious order. One bad disclose order can be enough to ruin a life. Is that jurisdiction willing to be liable for the compensation (if compensation is even possible) ?
I believe Internet is a country of its own. Its a virtual world, it has no physical manifestation. There is no need to invade Internet to secure physical world.
Re: Advocating for privacy in Australia
#45Earlier quoted context omitted.
"We don't place ourselves above the law" - AKA we don't believe we are better placed than a judge to know whether sufficient evidence has been presented to allow law enforcement access to data about a user of our platform. Unless you're starting from a premise that bad actors don't exist, and the police never do anything of value, there needs to be a facility by which police perform the role we expect of them in a ci…
> a judge Thats the problem here. Computers (smartphone/laptop/server/toaster/etc) are/will continue to hold most intimate and private data about a individual. Do you want all that disclosed on one person's word ? I dont. I dont think there can be any check-and-balance that absolutely prevent any person from giving a malicious order. One bad disclose order can be enough to ruin a life. Is that jurisdiction willing to…
That's a nice theory - but computers exist in the real world. I have a sticker on the back of my laptop from our NYI datacentre which says "there is no cloud, it's just somebody else's computer".
There's also no check and balance the absolutely prevents somebody punching me in the face and ruining my life, but I still walk down busy streets.
If you have a problem with the concept of judges as the arbiter of limits on the powers of law enforcement, I am keen to hear your workable alternative that doesn't have worse downsides.
Re: Advocating for privacy in Australia
#46EDIT: note that I'm probably wrong, see reply below by @brongondwana!
---
One problem not being addressed is that via #AABill data access requests can now be submitting without warrants issued by a judge, so it removes the judicial oversight.
Also this law says that all such requests need to be "reasonable", but it doesn't define what that means. For example is blanket surveillance reasonable? AFAIK this law doesn't say. And companies like FastMail cannot report abuse publicly, or the people responsible risk 10 years in jail.
Couple this with the fact that Australia is part of the "Five Eyes", being the only country without a "Bill of Rights", it means that agencies like the NSA could use Australia for their dirty work.
Please correct me if I'm wrong, I haven't read the actual bill, just random commentary on the net.
I'm a FastMail customer, but reading this blog article is leaving me worried, because FastMail keeps mentioning "lawful warrants", but from what I've read warrants aren't needed anymore.
It's pretty sad. I've seen many Australian software companies doing a good job, like FastMail here and their reputation is now tarnished due to incompetent politicians. The wave of populism and stupidity has been spreading.
Re: Advocating for privacy in Australia
#47Earlier quoted context omitted.
We never offered, and never claimed to offer, a safe haven for people who have broken the law in both Australia and their own country to hide from the police. We don't place ourselves above law enforcement. We don't have data trading agreements with anybody, and we don't sell or provide backdoor channels - we only provide data in response to lawful warrants. That's the right amount of privacy and the right tradeoff w…
> We never offered, and never claimed to offer, a safe haven for people who have broken the law in both Australia So are you saying that just by offering end-to-end encryption yourselves would be "helping people who have broken the law"? Well, at least it's good to know where you stand and to have this in the public record, in case someone mistakenly thinks that Fastmail is a good alternative to other end-to-end encr…
We've never wanted to be an end-to-end encrypted service provider - there's purely routing blobs of opaque data around. It's not an interesting problem, and it's at direct odds with "email is your electronic memory".
https://fastmail.blog/2018/02/14/email-is-your-electronic-me...
End-to-end encryption is great for "this message will self destruct in 5 seconds" type instant messaging, but I have a friend who recently forgot her password on an "end-to-end encrypted" email service and lost all her emails. Not a great choice, though luckily she hadn't been using it long, so she didn't lose many memories.
An extreme black-and-white view on confidentiality vs the other parts of security is poor threat modeling, and we especially don't like the idea of selling snakeoil where we claim a level of confidentiality from ourselves which is not supportable by facts.
Re: Advocating for privacy in Australia
#48Earlier quoted context omitted.
The data hasn't ever been stored in Australia. All our data is currently stored in the USA and Netherlands. Of course the "people are planning to leave us because of the hamhanded way you introduced this legislation" is a major part of all our feedback to legislators. The AABill happened the way it did in Australia because our politics is particularly broken right now (seriously, we have a minority government which h…
>anything at all which happened would be blamed on them not supporting the bill. Which is idiotic, since the LNP would blame Labor either way, as they do for every single other failure they (the LNP) are responsible for. I wish Labor had some fucking guts once in a while.
Labor are happy to take this power, and blame the power grab on the others.
Re: Advocating for privacy in Australia
#49EDIT: note that I'm probably wrong, see reply below by @brongondwana! --- One problem not being addressed is that via #AABill data access requests can now be submitting without warrants issued by a judge, so it removes the judicial oversight. Also this law says that all such requests need to be "reasonable", but it doesn't define what that means. For example is blanket surveillance reasonable? AFAIK this law doesn't…
We've never done blanket surveillance, and specifically mention "individual users" in the blog post. There's been a lot of FUD about warrants not being needed - I think the ZDNet article we linked covers that very well:
"[a judge doesn't have to sign off on the specific method by which data is requested] However there must be an underlying warrant to access communications under the Telecommunications (Interception and Access) Act or the Surveillance Devices Act or state-level equivalents."
So the request still requires a warrant that specifies which communications are to be intercepted, but not a warrant that specifies how the interception is to be performed.
Sadly, random commentary on the net does tarnish reputations every bit as well as facts :(
Re: Advocating for privacy in Australia
#50Good writeup. Since I can already see not everyone here actually read the article, here are some highlights. > Law enforcement has always been able to request information from us through the Telecommunications Act with a lawful warrant. Because we have the ability to decrypt all data, there is no need to make changes that circumvent encryption. ... While FastMail is not directly affected, we don’t support this legisl…
I wonder why no one has ever made PGP user-friendly.
Some might argue whatsapp or signal or Telegram E2E is exactly that. I talk about the email.