Apple urges Australian government not to weaken encryption with backdoors

[mr moose]

21 minutes ago, LAwLz said:

That sounds reasonable, but according to Australia (not sure if it was in the bill itself, or the author), things such as a system where police or intelligence agencies can access data stored on iCloud belonging to a specific person was not seen as a systemic weakness.

If you ask me, that is a systemic weakness, but apparently not to others.

 

Unless the bill itself specifies what systemic is, it is up for interpretation.

As you said, belongs to a specific person, can access data belonging to a "specific" person.   Not can access to data to one person and a whole heap of non related people.  Once the request involves innocent people it becomes a systemic weakness.

 

21 minutes ago, LAwLz said:

 

And if there is a disagreement, a court will decide and could order a developer to implement the things requited by the Attorney General or face consequences such as fines.

I cannot tell you which way the court will decide in any general context because they will decide on a case by case basis with the information that is relevant to that case.  You can keep creating scenarios and using what ifs until you finally get the answer you want, but it will be so far removed from the actual problem that it will be moot.

 

21 minutes ago, LAwLz said:

Again, you can not design a way into a system without that same tool or door also being applicable to others. It is impossible. So if the bill is written in the way you claim it is, then it is entirely useless.

You are making an absolute statement about all cloud services here,  You are claiming there is absolutely no way apple or facebook or MS can create a loophole that effects only one users account and not the rest of the system.  If you can create spyware and malware that only infects certain services and intercepts certain messages then as the company that produces the software they can seed one user with a different version that does not effect anyone else.  There are no absolutes in this, never say never.

21 minutes ago, LAwLz said:

Let me repeat that. It is impossible to design a way to gain access to information on a specific person, that can't be misused to gain access to information on another person. Just as impossible as designing a knife that can only stab bad people. Any such system proposed will entirely rely on good faith. That it could be misused, people people have promised that they won't misuse it.

Says who,  people keep arguing that the NSA already knows everything, if that is the case then there is a way.  Wiretapping an old landline only gives you access to the calls on that line,  seeding a Malware/spyware program to a specific user that extracts conversation from only that user is the digital equivalent.  I don't see how it is impossible for the maker of a messaging service to be able to make a special client for one specific user.  Especially if they code it to be a single use (i.e they update there services to reject that client after the warrant expires).

 

21 minutes ago, LAwLz said:

 

Again, then it is useless because it is impossible to design something which can only be used to target a single person, when other people use exact copies of the targeted system. If something works on one machine or user, it will work on all other machines or users.

 

Broken record.

21 minutes ago, LAwLz said:

And that can not be done. It is impossible to design a system in that way.

 

broken record

21 minutes ago, LAwLz said:

And it is the court which decides if a suggested change to a system can cause loss of privacy for everyone else. I already disagree with the example given in the bill, and I am sure there will be several disagreements in the future.

Well I guess that's stiff biscuits for you.  The service provider gets to put their evidence forward, it's not like the judge is just going to throw a dart and board with yes/no written on it.

21 minutes ago, LAwLz said:

This is not a black and white issue, where you can definitively say something is a systemic weakness, or definitively say that something poses a risk to other users. It is not as clear cut as you seem to believe, and I think leaving the decision to a court is dangerous.

 

Yes you can, does it effect the privacy of innocent users? yes = systemic weakness, no = warrant approved/upheld.

21 minutes ago, LAwLz said:

Would you be OK with this bill if instead of the Australian court being the arbiter, it was Kim Jong-un, Putin, Trump or some other highly controversial figure which may not share the same world view as you?

If your answer is no, then you are arguing from good faith.

Yeah, not sure how that argument makes any sense unless you are trying to argue that our whole culture, constitution and judicial system are about to take a 5 decade nose dive in mere days after the bill is past.   Just so you know, no one person in this country holds that power, in fact not even the government of the day holds that kind of power.

[leadeater]

@LAwLz @mr moose

Just be mindful not to overrun this thread with your conversation chain, if you suspect that it is unlikely that you are going to agree on certain points I would just summarize your positions on them rather than have a continual back and forward that is unlikely to have a resolution or agreement.

[mr moose]

15 minutes ago, leadeater said:

@LAwLz @mr moose

Just be mindful not to overrun this thread with your conversation chain, if you suspect that it is unlikely that you are going to agree on certain points I would just summarize your positions on them rather than have a continual back and forward that is unlikely to have a resolution or agreement.

How else do you expect a thread about Australia to get past 2 pages?

[leadeater]

4 minutes ago, mr moose said:

How else do you expect a thread about Australia to get past 2 pages?

Easy, make fun of Kiwi's which will reignite the great war of 1981. 100% historically accurate documentary on the war.

 

I'll leave it here though, that's enough being hypocritical about thread derailing.

[Thaldor]

9 hours ago, mr moose said:

You are making an absolute statement about all cloud services here,  You are claiming there is absolutely no way apple or facebook or MS can create a loophole that effects only one users account and not the rest of the system.  If you can create spyware and malware that only infects certain services and intercepts certain messages then as the company that produces the software they can seed one user with a different version that does not effect anyone else.  There are no absolutes in this, never say never. 

 

Says who,  people keep arguing that the NSA already knows everything, if that is the case then there is a way.  Wiretapping an old landline only gives you access to the calls on that line,  seeding a Malware/spyware program to a specific user that extracts conversation from only that user is the digital equivalent.  I don't see how it is impossible for the maker of a messaging service to be able to make a special client for one specific user.  Especially if they code it to be a single use (i.e they update there services to reject that client after the warrant expires).

That could be possible, but extremely expensive and I could believe Aussie government ain't gonna pay for that. That would need probably a lot of hassel and remaking how programs, apps and servers update themselves and would require putting updates behind logins (how many programs you know outside of Photoshop and other online licenced programs that update themselves only after login in? And even they just use your licence to connect to the server) and that would be just silly around 99% of time, because it would be too expensive and complicated compared to how it can be done and how it is done ("What is the current version on the server?" compared to "What is the current version for this user on the server?").

 

If you wanted to really make that kind of "loophole" without over complicating the whole updating process, you would basicly do just as the malwares and viruses that target specific systems do; Infect everything but only activate where the specific system is found. And that also is their greatest weakness, "everybody" has it but it only activates in specific conditions so reverse engineering it is safe just as long as you don't have that specific system that it's targeting (i.e. you don't need to fight against clock when the virus has encrypted your storage or other way made damage to your system to the extend you cannot continue using your system). Quite easy backdoor to misuse as long as you know how to reverse engineer software, all you need to do is to find out what that code is, edit it so that instead it targets any user and it sends their data to your server and then just push it through normal means.

 

Also making it single use would only creep up the price and probably the size of the program, because now not only you have to make that code once, but you need to make the program able to block that code and for every suspect modify that code enough that it can dodge the block for the earlier time you needed to use that kind of code. Also after few suspects black hats would again start to look for the differences and in no time find out what kind of pattern you use to collect that data and you basicly hand them the keys. Only way to block this would to make thing more complicated and expensive and comparing that in no time that would be hundreds of suspects it would start to be exremely expensive updating.

 

Also what is the difference between a single person and a specific person? Like isn't the only difference that the specific person is named while a single person can be just anyone who becomes a specific person if named?

[mr moose]

47 minutes ago, Thaldor said:

That could be possible, but extremely expensive and I could believe Aussie government ain't gonna pay for that. That would need probably a lot of hassel and remaking how programs, apps and servers update themselves and would require putting updates behind logins (how many programs you know outside of Photoshop and other online licenced programs that update themselves only after login in? And even they just use your licence to connect to the server) and that would be just silly around 99% of time, because it would be too expensive and complicated compared to how it can be done and how it is done ("What is the current version on the server?" compared to "What is the current version for this user on the server?").

I don't think it is that hard to do intentionally. And in cases were it is the law is specific that it cannot be forced.

47 minutes ago, Thaldor said:

If you wanted to really make that kind of "loophole" without over complicating the whole updating process, you would basicly do just as the malwares and viruses that target specific systems do; Infect everything but only activate where the specific system is found. And that also is their greatest weakness, "everybody" has it but it only activates in specific conditions so reverse engineering it is safe just as long as you don't have that specific system that it's targeting (i.e. you don't need to fight against clock when the virus has encrypted your storage or other way made damage to your system to the extend you cannot continue using your system). Quite easy backdoor to misuse as long as you know how to reverse engineer software, all you need to do is to find out what that code is, edit it so that instead it targets any user and it sends their data to your server and then just push it through normal means.

Doing it that way is the same as adding a back door, so that won't work and won't be permitted.

47 minutes ago, Thaldor said:

Also making it single use would only creep up the price and probably the size of the program, because now not only you have to make that code once, but you need to make the program able to block that code and for every suspect modify that code enough that it can dodge the block for the earlier time you needed to use that kind of code. Also after few suspects black hats would again start to look for the differences and in no time find out what kind of pattern you use to collect that data and you basicly hand them the keys. Only way to block this would to make thing more complicated and expensive and comparing that in no time that would be hundreds of suspects it would start to be exremely expensive updating.

I didn't mean make each program single use, I meant make they malware/spyware that they are going to use single use.   Besides, it was only a suggestion, I am not about keep making specific in detail software proposals. I believe there is always a way to do these things and were there isn't then at some point a choice between freedom and security will be made. Hopefully we never reach the point.

 

47 minutes ago, Thaldor said:

Also what is the difference between a single person and a specific person? Like isn't the only difference that the specific person is named while a single person can be just anyone who becomes a specific person if named?

there is no difference.   That is the whole point of the term systemic, it means that they cannot circumvent security and privacy where such circumvention goes beyond the scope of the entities listed on the warrant. 

 

 

 

I think some people might be taking this too far, The idea behind laws like this (like many laws) is not to be an absolute spanner in the works that will have 100% success rate.  when people think like that they become so bifurcated on it that they are willing to throw the baby out with the bath water. Well you can't get the baby 100% clean with this bath don't use it or throw the baby out with it.   It won't catch everyone, in fact there is a good chance it won't catch some of the more organised criminals.  But if it catches even 10% of the drug dealers because addicts don't properly encrypt there messages or cloud data then that is something they have now that they didn't have before.

[Amazonsucks]

If the security of a single person's version of x messenger app or encryption protocol is capable of being subverted, there is literally no way that it CANT be applied to everyone else's... 

 

If there is a way to do it to one, there is a way to do it to all. That's why they use Stingrays, malware, Cellbrite hacking tools, Finfisher, etc. and have for years. They have to break the device security, or get around the encryption currently.

 

These laws simply open the floodgates for reducing security and increasing the attack surface for everyone's devices, in order to cater to people who are technologically illiterate and copletely out of touch with how encryption or security works.

 

"But if it catches even 10% of the drug dealers because addicts don't properly encrypt there messages or cloud data then that is something they have now that they didn't have before."

 

Oh so you can get some 16 year old kid sellin dope while terrorists are unaffected by these BS laws? Wow finally he said something intellectually honest! 

 

Worse yet he implies that the ADDICTS will get caught, because the victims are totally the criminals that need to be caught in that example.

 

And because ruining the very fabric of security that protects banking transactions and private data that should remain private, like doctor patient interactions, attorney client interactions, etc. is worth it to nab the lowes hanging fruit? Lol great logic!

[Mira Yurizaki]

I want someone to cave in, then immediately after the backdoor's in place and we know politicians and government officials have it, someone hacks them to prove a point.

[Brooksie359]

On 10/15/2018 at 5:35 PM, Thaldor said:

Even Apple gets what that Aussie bill really is about, no matter if there is a small part that says "without weakening the encryption". Kind of hard to respect the laws if the laws demand you to provide help accessing encrypted data while having punishments not doing so "enough" and that "enough" is based on what a single official seems fit and even then laws say that you don't need to weaken the encryption. How the hell you are going to help someone accessing encrypted data without weakening the encryption and there's probably some politically seated person saying that "you don't manage to get us the data, you are going to be fined because you didn't help us as we wanted you to help us"?

Only if it was that easy. I don't know how harsh Aussies are with their punishments but if they are as trigger happy as EU there's really big weights on the scale. Apple not giving "enough" help to the officials and Aussies slap them with XX% of worldwide revenue fines and Apple cannot sell a single product in Aussieland before that fine is paid is quite a huge danger. And with Aussies the problem is quite real because they have had at least one government that didn't care about their political career and made the tighter gun laws reality, who knows are there still people in there who are ready to take the bullet and ban the sales of Apple products just because Apple didn't want to give them access to their encryptions.

Honestly if I were apple I would just say f it and not sell in Australia if this becomes law. There would be enough pressure for them to reverse the law and then they could simply return to selling there again. Australia is a releatively small market compared to the rest of the world and the damage done to the security of their devices might be enough to justify pulling out of the Australian market to prevent that damage. 

[Amazonsucks]

3 minutes ago, Brooksie359 said:

Honestly if I were apple I would just say f it and not sell in Australia if this becomes law. There would be enough pressure for them to reverse the law and then they could simply return to selling there again. Australia is a releatively small market compared to the rest of the world and the damage done to the security of their devices might be enough to justify pulling out of the Australian market to prevent that damage. 

Are you kidding? Apple already completely undermined their iCloud security to get into the Chinese market. You think they actually care about privacy? They're almost as bad as Google.

[Brooksie359]

1 minute ago, Amazonsucks said:

Are you kidding? Apple already completely undermined their iCloud security to get into the Chinese market. You think they actually care about privacy? They're almost as bad as Google.

China has over a billion people. Yeah that big of a market they will take a hit for. Australia is much smaller in comparison and wouldn't hurt their bottom line nearly as much. 

[Thaldor]

15 minutes ago, mr moose said:

-snip-

I believe there is always a way to do these things and were there isn't then at some point a choice between freedom and security will be made. Hopefully we never reach the point.

-snip-

I think some people might be taking this too far, The idea behind laws like this (like many laws) is not to be an absolute spanner in the works that will have 100% success rate.  when people think like that they become so bifurcated on it that they are willing to throw the baby out with the bath water. Well you can't get the baby 100% clean with this bath don't use it or throw the baby out with it.   It won't catch everyone, in fact there is a good chance it won't catch some of the more organised criminals.  But if it catches even 10% of the drug dealers because addicts don't properly encrypt there messages or cloud data then that is something they have now that they didn't have before.

Basicly we are at that point already when we must choose between security and accessibility. What I have followed there's no problems when officials or the developer can access the data of the suspect, and I think probably every company that can help the officials helps them. The problem becomes when the companies cannot help the officials and these kind of laws always strike to that part and there just isn't a magic wording that can make secure accessible.

 

Just like many coutries have made laws about logging network traffic and that's because criminals started using proxies and VPNs to mask themselves. Of course not all VPN providers wanted to comply with those laws because the whole point of the VPN is the anonymity of the user and these laws basicly took part of that away, so they simply moved to some countries that are hard to reach juridically and don't require network traffic logging because that was the only way to provide that anonymity to their customers. And I believe quite many governments who have made laws for logging network traffic are now thinking more laws against VPNs because the first ones were made useless because, well they were bad all around for everyone except officials and knowledge about VPN providers who don't keep logs are spreading and even the "10%" (I think the percentage is higher) of the drug dealers are starting to know about VPNs and how useful they are for them.

 

IIRC this Aussie bill goes with 3 stages: First they ask, second they demand with forcing fines and third they take "stronger" measures to ensure co-operation. The scary part is the moment they start to hit the fines to the table and if those are taken to the court the government has the almost as fearful as "think about the children" or "Hitler" -card in their hands: the "Just think about the victim"-card. Even if that card wasn't played still the company has the lower hand because defending with probably only "we cannot do that without endangering everyone by breaking the whole encryption" isn't the most strongest defence as long as there's even little humanity included in the judgement. And if the company looses they are in the real problem, they cannot access the data, but while they cannot they will be facing the fines and the chance for that third stage, whatever it may include. And, I wouldn't like to use this argument, the officials won't be taking some normal rape or murder or junker as the first one to test this in the courtroom, they are going to wait until there's something worser because even if the court must handle every case separately, they still must be consistent with their judgements. And then there's just the PR side of things, how many companies are ready to try out to get the fines dropped without giving the data when the press is going to feast with the case as company defending the criminals rights.

[Amazonsucks]

7 minutes ago, Brooksie359 said:

China has over a billion people. Yeah that big of a market they will take a hit for. Australia is much smaller in comparison and wouldn't hurt their bottom line nearly as much. 

https://thenewdaily.com.au/money/finance-news/2018/02/20/apple-iphone-popularity-australia/
 

I think that should explain why they care about the Australian market. I know a lot of Australians who are loyal to Apple. Maybe something in the water idk.

 

Also, they may have over a billion people, but very few can afford overpriced stuff from Apple.

[Curufinwe_wins]

Yeah this is a bad idea. But most governments dont actually understand technology or the ideology that the does do exactly what you tell it to, without exception, or factoring desire, intent, or identity. 

 

It's like rule 1 of coding, there is no faulty program, only faulty programmers.

 

(And yes, I understand there are extremely niche side cases where this isnt true, but by and large, all issues are the result of human design in the implementation. Our computers do not yet completely arbitrarily generate code.)

[Brooksie359]

On 10/16/2018 at 4:32 AM, mr moose said:

Isn't it obvious? you are trying to make this an on/off thing. It's not there are varying degrees of access that can be denied.

At the end of the day the high court has the verdict.  The government can't just fine a company or instigate a punishment because they didn't get what they wanted, they have to charge them which means they have to prove the request was fair and reasonable.

Actually I'm arguing from the bill as written.

Whilst nothing has guarantees of anything, I am confident this bill will not get misused and if it does the high court will be unbiased a fair.  I have yet to see the high court rule in favor of the government on most social justice issues.  I.E when it comes to human rights and innocent people the high court tends to tell the government to go back and rethink the law.  We do have a constitution for a reason.

Yes, things do change in the future, dumb laws that don;t work get over turned, in fact we have more dumb laws changed than oppressive laws made.

Nope, it is a law like any other,  we have many laws that you can claim are just as ambiguous, or rely on the courts too much or don't account for this that or the other thing, however we don;t have that much a of a problem with misuse of power.  In fact contrary to popular belief it is the opposite here,  we are one of the most open and transparent countries for laws and business.

Apple has alot of money and likely some very good lawyers so for them to be pushing back saying this will lead to the weakening of security says that it can in fact be abused. Your entire argument is that a body of government will rule in a certain matter but at the end of the day it's just a selected group if people and the reason why they rule the way they do is because of the people that make up that group. If that group of people changes then the way they rule could change as well. 

[Brooksie359]

23 minutes ago, Amazonsucks said:

https://thenewdaily.com.au/money/finance-news/2018/02/20/apple-iphone-popularity-australia/
 

I think that should explain why they care about the Australian market. I know a lot of Australians who are loyal to Apple. Maybe something in the water idk.

 

Also, they may have over a billion people, but very few can afford overpriced stuff from Apple.

By their numbers there are only 50 million iPhone users in the world. That seems off to me tbh. 

[Amazonsucks]

20 minutes ago, Brooksie359 said:

By their numbers there are only 50 million iPhone users in the world. That seems off to me tbh. 

Why? Thats a lot of people. 

[mr moose]

1 hour ago, Thaldor said:

Basicly we are at that point already when we must choose between security and accessibility. What I have followed there's no problems when officials or the developer can access the data of the suspect, and I think probably every company that can help the officials helps them. The problem becomes when the companies cannot help the officials and these kind of laws always strike to that part and there just isn't a magic wording that can make secure accessible.

That's the bit people are getting confused with, no one is claiming these laws make anything more secure or less secure.   All this law says is that if there is a way to give authorities certain data then they must, if there isn't then they both they can't and don't have to.

1 hour ago, Thaldor said:

Just like many coutries have made laws about logging network traffic and that's because criminals started using proxies and VPNs to mask themselves. Of course not all VPN providers wanted to comply with those laws because the whole point of the VPN is the anonymity of the user and these laws basicly took part of that away, so they simply moved to some countries that are hard to reach juridically and don't require network traffic logging because that was the only way to provide that anonymity to their customers. And I believe quite many governments who have made laws for logging network traffic are now thinking more laws against VPNs because the first ones were made useless because, well they were bad all around for everyone except officials and knowledge about VPN providers who don't keep logs are spreading and even the "10%" (I think the percentage is higher) of the drug dealers are starting to know about VPNs and how useful they are for them.

That is different to this bill, this bill doesn't in any way make it illegal to further secure services for clients, nor does it make it possible for authorities to enforce a backdoor into any encrypted or otherwise secure service.  Countries that are considering outlawing VPN's will do so for their own reasons, whether we agree with them or not is a different story.

1 hour ago, Thaldor said:

IIRC this Aussie bill goes with 3 stages: First they ask, second they demand with forcing fines and third they take "stronger" measures to ensure co-operation. The scary part is the moment they start to hit the fines to the table and if those are taken to the court the government has the almost as fearful as "think about the children" or "Hitler" -card in their hands: the "Just think about the victim"-card. Even if that card wasn't played still the company has the lower hand because defending with probably only "we cannot do that without endangering everyone by breaking the whole encryption" isn't the most strongest defence as long as there's even little humanity included in the judgement. And if the company looses they are in the real problem, they cannot access the data, but while they cannot they will be facing the fines and the chance for that third stage, whatever it may include. And, I wouldn't like to use this argument, the officials won't be taking some normal rape or murder or junker as the first one to test this in the courtroom, they are going to wait until there's something worser because even if the court must handle every case separately, they still must be consistent with their judgements. And then there's just the PR side of things, how many companies are ready to try out to get the fines dropped without giving the data when the press is going to feast with the case as company defending the criminals rights.

Yes the bill has three stages, that is basically three opportunities for the authorities to request help and make their case,  they can issue a fine, but like all fines in Australia the company can choose not to pay it and go to court instead, the court is impartial in Australia so the government would have to be absolutely sure the request it made was within the guidelines, which means it is highly improbably that a company will get fined for not helping the authorities with services they can that are within the limitations of this bill.   The limitations I linked to before is a very important document that sets out what requests cannot be made and do not have to be upheld.  Essentially trying to fine apple for not complying with a backdoor request would be like trying to fine someone for J-walking when there is a video and 30 witnesses of that person in a court house 100Km away at he alleged time of the event.

 

1 hour ago, Brooksie359 said:

Apple has alot of money and likely some very good lawyers so for them to be pushing back saying this will lead to the weakening of security says that it can in fact be abused. Your entire argument is that a body of government will rule in a certain matter but at the end of the day it's just a selected group if people and the reason why they rule the way they do is because of the people that make up that group. If that group of people changes then the way they rule could change as well. 

BP has a lot good lawyers and money, so when they lobby the government for changes to law it must be because they only want whats best for you. For every lawyer employed by company A there is a lawyer employed by company B to counter.   Also are these thee same lawyers that like to sue for rounded corners and swipe to unlock?

 

Yes the government is a selected group, but unlike many other countries, our parliament is actually split into not just two parties (there are 3 that control the senate) but individuals within each party are allowed to cross the floor and vote against or amend bills as they see fit.  This makes the system rather robust, with only a few exceptions of bills that have gone through that were almost immediately upended with a change of government.  And the fact they changed the laws still stands testimony to the ability of the government to not only change,  but for laws to change as well if they are considered to have been failures in their goals.

[desertcomputer]

4 hours ago, Amazonsucks said:

Are you kidding? Apple already completely undermined their iCloud security to get into the Chinese market. You think they actually care about privacy? They're almost as bad as Google.

Well not really if they created a separated icloud just for china needs and doesn't effect other countries. Apple rents server in China so in most case date coming into data-center are log and not encrypted and plus most people in China use wechat and that service already have basically access to most of phone data already, there isn't really any need for icloud data unless for small majority that don't use wechat or any china based services.

[79wjd]

3 hours ago, Amazonsucks said:

Why? Thats a lot of people. 

Because Apple sold over a billion iPhones in less than a decade, over 10 million 6/6s's during launch week, and about 40 million iPhones in a single quarter: https://en.wikipedia.org/wiki/IPhone_7#Sales.

 

50 million users is stupid low.

[mr moose]

2 hours ago, 79wjd said:

Because Apple sold over a billion iPhones in less than a decade, over 10 million 6/6s's during launch week, and about 40 million iPhones in a single quarter: https://en.wikipedia.org/wiki/IPhone_7#Sales.

 

50 million users is stupid low.

I was under the impression that current active iphones was 80+million.

[DeLorian]

Wow, this is really stupid. Providing access to the police is one thing, even though I don't agree with it, but it opens up the potential exploits for hackers and other abusers. I wonder if certain apps will have their 'Australian' version with these 'features'. I'm glad that I'm not in Australia and with my NordVPN for encryption. 

 

But you know, I'm wondering one thing: if the law enforcement really wants, they will get what they want. NSA at least. I'm thinking about Tails OS maybe.

[LAwLz]

23 hours ago, mr moose said:

As you said, belongs to a specific person, can access data belonging to a "specific" person.   Not can access to data to one person and a whole heap of non related people.  Once the request involves innocent people it becomes a systemic weakness.

All requests which deals with making changes to the overall system in some way always, without exception, involves innocent people unless 100% of the users of a service are criminals.

It is not possible to make any type of change which does not directly or indirectly involve all other users too.

 

 

23 hours ago, mr moose said:

I cannot tell you which way the court will decide in any general context because they will decide on a case by case basis with the information that is relevant to that case.  You can keep creating scenarios and using what ifs until you finally get the answer you want, but it will be so far removed from the actual problem that it will be moot.

That's the thing though. I do not want a system where a court rules on whether or not weaknesses should be created, or systems for extracting information about people.

I do not trust any court, or any person at all, to have that power. Like I said earlier, in a properly secure system only an authorized person should be able to access the information, even if for example the developers are held at gunpoint. Of course, in systems like Facebook messenger Facebook has given themselves authority to view the content, but in that case the proper way of handling information is to not give authorization to others.

 

It's a really basic concept of security.

The fewer people or entities have access to something, the more secure it is. If 100 people have access then there is a bigger risk of data leaks or malicious use than if 1 person has access.

 

 

23 hours ago, mr moose said:

You are making an absolute statement about all cloud services here,  You are claiming there is absolutely no way apple or facebook or MS can create a loophole that effects only one users account and not the rest of the system.  If you can create spyware and malware that only infects certain services and intercepts certain messages then as the company that produces the software they can seed one user with a different version that does not effect anyone else.  There are no absolutes in this, never say never.

The reason why I say it is impossible, is because it is. There is no way of creating a loophope which only affects one user.

Even in your own example, it is not possible to ensure that the compromised version of the program isn't seeded to other users too. If company X can seed user Y a compromised version of a program, then there is nothing technical stopping them from seeding it to user Z, A, B and C too. Again, we're back to relying on good faith rather than technical merits, which I absolutely hate because faith and belief have no place in security.

Not to mention the massive layer of complexity such a system adds. You're basically need an entirely new development branch which needs testing too. It heavily encourages companies to just compromise the entire system and make the malicious version the standard one. Now, you might say that's up to the company to decide, but if they are forced between hiring more people to keep up with the increased complexity, or just compromising their product some companies will take the former, and that's bad. It is bad that they are forced to choose to begin with, because it incentivizes companies to make less secure products.

 

Don't "never say never" me when you are actually asking for something impossible.

You really are asking people to create a knife that can only stab bad people, and then going "there are no absolutes, never say never" when told it can't be done.

 

 

23 hours ago, mr moose said:

Says who,  people keep arguing that the NSA already knows everything, if that is the case then there is a way.

They don't. Stop listening to clueless people on LTT. Also, NSA spies on everyone and it has already had catastrophic effects on the world of security. Do I need to remind you about WannaCry? That attack would not have happened if it wasn't for the NSA.

 

 

23 hours ago, mr moose said:

Broken record.

Right back at you. Stop demanding impossible things and maybe I'll stop telling you that they are impossible.

At the end of the day, it is impossible to provide access to more people without reducing security because giving more people access inherently increases the risk of data leaks or misuse. That is why security certifications in the style of ISO/IEC 27001, and essentially every single security guide and manufacturer recommendations are strict when it comes to not providing more people with access than absolutely necessary. Because for every additional person who has access, the risk of misuse and leaks increases.

 

 

23 hours ago, mr moose said:

Well I guess that's stiff biscuits for you.  The service provider gets to put their evidence forward, it's not like the judge is just going to throw a dart and board with yes/no written on it.

Again, I don't like the idea that a judge can force companies to compromise their systems to begin with. And it's not like it's rare to see judges who don't have a firm understanding of how software works make incorrect rulings.

 

 

23 hours ago, mr moose said:

Yes you can, does it effect the privacy of innocent users? yes = systemic weakness, no = warrant approved/upheld.

Yeah... No. It's not that simple. Can you give me an example which gives police access to a person's data, which can not be misused on an innocent user?

Remember, seeding that user a compromised version is not an acceptable answer because it indirectly effects the privacy of innocent users by opening up the possibility for them to get seeded the malicious version too.

That is one example of where it isn't straight forward because all of a sudden we are dealing with the possibility of malicious actions, we are dealing with trust that they won't misuse the power, and we're dealing opening up potential abuse in future, currently unrelated cases.

 

 

23 hours ago, mr moose said:

Yeah, not sure how that argument makes any sense unless you are trying to argue that our whole culture, constitution and judicial system are about to take a 5 decade nose dive in mere days after the bill is past.   Just so you know, no one person in this country holds that power, in fact not even the government of the day holds that kind of power.

My point was that your reasoning stems from trust in your courts. I was trying to point that out by replacing the court with someone you don't trust, to see how your opinion changed. My point was that security should not rely on your trust in someone. A properly secured system should still be secure even if the judicial system did take a 5 decade nose dive. I don't want the security of my data to rely on judges and other people. I want it strictly reliant on the technical merits of the implementation, not my trust in other people.

So let me ask you again, would you be OK with this bill if it said the Australian court had to take orders from Kim, Putin and Trump in the case of arguments whether or not a proposed change is reasonable and not detrimental to other users?

If your arguments aren't based on good faith, then it should not matter who makes the decisions, right?

[mr moose]

1 hour ago, LAwLz said:

All requests which deals with making changes to the overall system in some way always, without exception, involves innocent people unless 100% of the users of a service are criminals.

It is not possible to make any type of change which does not directly or indirectly involve all other users too.

 

 

That's the thing though. I do not want a system where a court rules on whether or not weaknesses should be created, or systems for extracting information about people.

I do not trust any court, or any person at all, to have that power. Like I said earlier, in a properly secure system only an authorized person should be able to access the information, even if for example the developers are held at gunpoint. Of course, in systems like Facebook messenger Facebook has given themselves authority to view the content, but in that case the proper way of handling information is to not give authorization to others.

 

It's a really basic concept of security.

The fewer people or entities have access to something, the more secure it is. If 100 people have access then there is a bigger risk of data leaks or malicious use than if 1 person has access.

 

 

The reason why I say it is impossible, is because it is. There is no way of creating a loophope which only affects one user.

Even in your own example, it is not possible to ensure that the compromised version of the program isn't seeded to other users too. If company X can seed user Y a compromised version of a program, then there is nothing technical stopping them from seeding it to user Z, A, B and C too. Again, we're back to relying on good faith rather than technical merits, which I absolutely hate because faith and belief have no place in security.

Not to mention the massive layer of complexity such a system adds. You're basically need an entirely new development branch which needs testing too. It heavily encourages companies to just compromise the entire system and make the malicious version the standard one. Now, you might say that's up to the company to decide, but if they are forced between hiring more people to keep up with the increased complexity, or just compromising their product some companies will take the former, and that's bad. It is bad that they are forced to choose to begin with, because it incentivizes companies to make less secure products.

 

Don't "never say never" me when you are actually asking for something impossible.

You really are asking people to create a knife that can only stab bad people, and then going "there are no absolutes, never say never" when told it can't be done.

 

 

They don't. Stop listening to clueless people on LTT. Also, NSA spies on everyone and it has already had catastrophic effects on the world of security. Do I need to remind you about WannaCry? That attack would not have happened if it wasn't for the NSA.

 

 

Right back at you. Stop demanding impossible things and maybe I'll stop telling you that they are impossible.

At the end of the day, it is impossible to provide access to more people without reducing security because giving more people access inherently increases the risk of data leaks or misuse. That is why security certifications in the style of ISO/IEC 27001, and essentially every single security guide and manufacturer recommendations are strict when it comes to not providing more people with access than absolutely necessary. Because for every additional person who has access, the risk of misuse and leaks increases.

 

 

Again, I don't like the idea that a judge can force companies to compromise their systems to begin with. And it's not like it's rare to see judges who don't have a firm understanding of how software works make incorrect rulings.

 

 

Yeah... No. It's not that simple. Can you give me an example which gives police access to a person's data, which can not be misused on an innocent user?

Remember, seeding that user a compromised version is not an acceptable answer because it indirectly effects the privacy of innocent users by opening up the possibility for them to get seeded the malicious version too.

That is one example of where it isn't straight forward because all of a sudden we are dealing with the possibility of malicious actions, we are dealing with trust that they won't misuse the power, and we're dealing opening up potential abuse in future, currently unrelated cases.

 

 

My point was that your reasoning stems from trust in your courts. I was trying to point that out by replacing the court with someone you don't trust, to see how your opinion changed. My point was that security should not rely on your trust in someone. A properly secured system should still be secure even if the judicial system did take a 5 decade nose dive. I don't want the security of my data to rely on judges and other people. I want it strictly reliant on the technical merits of the implementation, not my trust in other people.

So let me ask you again, would you be OK with this bill if it said the Australian court had to take orders from Kim, Putin and Trump in the case of arguments whether or not a proposed change is reasonable and not detrimental to other users?

If your arguments aren't based on good faith, then it should not matter who makes the decisions, right?

You just want an absolute system and anything that isn't you have issues with. It's fine if you don't trust the judicatory, everyone's entitled to their own opinions on that. But if we take that stance on everything then you will have nothing.  Because no laws will be allowed to be passed at all, the police will not be allowed to do their job, all data will be considered unethically obtained therefore no evidence exists anymore.  You are only happy with what will essentially lead to a chaotic existence.

 

 

[Amazonsucks]

9 hours ago, 79wjd said:

Because Apple sold over a billion iPhones in less than a decade, over 10 million 6/6s's during launch week, and about 40 million iPhones in a single quarter: https://en.wikipedia.org/wiki/IPhone_7#Sales.

 

50 million users is stupid low.

People tend to throw them on the e waste pile every year though. Theyre not a Lexus or Rolls Royce or something that people would keep around forever.