Australian Math Control- Coalition and Labor strike deal on inane anti-encrpytion bill, bill moves ahead to vote which is all but guaranteed to pass

[Syntaxvgm]

1 hour ago, LAwLz said:

Here is a very good article from EFF explaining why this bill is bad and exactly what would need to be changed (for example putting individual developers in prison if they do not comply with orders to make changes to their systems).

individual developers? FUCK

[Thaldor]

11 minutes ago, Syntaxvgm said:

individual developers? FUCK

Yeah, something that wasn't really talked in public a lot. There's apparently quite a severe punishments for companies/developers who would break nondisclosure parts of the bill, which basicly means if the developer comes out and says "Australian government fucked us, basicly all your data is now unencrypted and we recommend you to stop using this service because it's now a huge security risk" they can be sued and the maximum punishment is 2 years in prison.

 

I have said it at least couple of times that this bill is one huge fuck up. The more publicly talked "assistance requests" with implied fines if developer didn't "assist" enough is already really really bad. Now that there's also parts that punish developers if they disclose that Aussie gov fucked them (which every really securitywise company would do, because there's no better assurance for security than company transparency), this bill starts to feel like a good reason to cut the sea cable and hope that one murderous island would float away closer to antarctica and all politicans there would freeze to death.

[TVwazhere]

I'm not gonna like, I thought inane was a typo for insane....

[Syntaxvgm]

43 minutes ago, Thaldor said:

Yeah, something that wasn't really talked in public a lot. There's apparently quite a severe punishments for companies/developers who would break nondisclosure parts of the bill, which basicly means if the developer comes out and says "Australian government fucked us, basicly all your data is now unencrypted and we recommend you to stop using this service because it's now a huge security risk" they can be sued and the maximum punishment is 2 years in prison.

 

I have said it at least couple of times that this bill is one huge fuck up. The more publicly talked "assistance requests" with implied fines if developer didn't "assist" enough is already really really bad. Now that there's also parts that punish developers if they disclose that Aussie gov fucked them (which every really securitywise company would do, because there's no better assurance for security than company transparency), this bill starts to feel like a good reason to cut the sea cable and hope that one murderous island would float away closer to antarctica and all politicans there would freeze to death.

And companies will put the fall on the individual.

[suicidalfranco]

companies should just go "fuck it" and stop serving Australia.

[Syntaxvgm]

4 minutes ago, suicidalfranco said:

companies should just go "fuck it" and stop serving Australia.

they'd have ever increasing reasons not to serve the US as well if it not for being such a large economy

[BananaInSandals]

I bet those passing the bills are using 12345 as their password everywhere... Which part of end-to-end encryption does they failed to understand. Wikipedia has a super long essay... Oh wait. It's Australia we're talking about. They need like 10 years to load a wiki page. Nvm. Move along...

 

[LAwLz]

1 hour ago, Syntaxvgm said:

individual developers? FUCK

1 hour ago, Thaldor said:

Yeah, something that wasn't really talked in public a lot. There's apparently quite a severe punishments for companies/developers who would break nondisclosure parts of the bill, which basicly means if the developer comes out and says "Australian government fucked us, basicly all your data is now unencrypted and we recommend you to stop using this service because it's now a huge security risk" they can be sued and the maximum punishment is 2 years in prison.

 

I have said it at least couple of times that this bill is one huge fuck up. The more publicly talked "assistance requests" with implied fines if developer didn't "assist" enough is already really really bad. Now that there's also parts that punish developers if they disclose that Aussie gov fucked them (which every really securitywise company would do, because there's no better assurance for security than company transparency), this bill starts to feel like a good reason to cut the sea cable and hope that one murderous island would float away closer to antarctica and all politicans there would freeze to death. 

 

Not just that. As the EFF highlighted, the bill does not make it clear whether or not an individual within a company can be targeted. If the bill allows this (which is completely up for interpretation), the Australian government could tell an individual programmer at let's say Microsoft and go:

Quote

you need to build in this surveillance capability that we are requesting. You're not allowed to tell anyone, not even your boss or colleagues about it, and if you do you will get up to 5 years in prison.

 

 

But hey, someone on this forum said that this totally won't be abused because they trust their government. The non-disclosure part totally calms me down and make me trust them completely.

I completely trust the part where they are not very clear on what can and can't be forced with this bill, and the part where they don't describe what happens if the company being asked to comply disagrees that the changes won't introduce "systemic weaknesses" (which is also not well defined).

[Syntaxvgm]

9 minutes ago, LAwLz said:

 

Not just that. As the EFF highlighted, the bill does not make it clear whether or not an individual within a company can be targeted. If the bill allows this (which is completely up for interpretation), the Australian government could tell an individual programmer at let's say Microsoft and go:

 

 

But hey, someone on this forum said that this totally won't be abused because they trust their government. The non-disclosure part totally calms me down and make me trust them completely.

I completely trust the part where they are not very clear on what can and can't be forced with this bill, and the part where they don't describe what happens if the company being asked to comply disagrees that the changes won't introduce "systemic weaknesses" (which is also not well defined).

There's nothing worse than the government harassing you and making it so you're not allowed to tell anyone. 
We do that to people over here to, just we don't make individuals add security flaws. 

[CarlBar]

5 hours ago, Master Disaster said:

If that happens then it happens, there's not much the companies can do other than comply, leave or exactly as you said (and exactly as has happened in Belgium with lootboxes) they cut off one market entirely and serve everyone else.

 

Sure but imagine the public reaction if major companies pull out.

 

The lockbox situation isn't really analogous. It's forced companies to stop selling lockboxes in belgium. it hasn't forced them to stop selling any games at all in belgium.

[Master Disaster]

2 hours ago, CarlBar said:

 

Sure but imagine the public reaction if major companies pull out.

 

The lockbox situation isn't really analogous. It's forced companies to stop selling lockboxes in belgium. it hasn't forced them to stop selling any games at all in belgium.

And neither will requiring a master key stop anybody from doing chat in Australia. I don't understand your point.

[CarlBar]

4 hours ago, Master Disaster said:

And neither will requiring a master key stop anybody from doing chat in Australia. I don't understand your point.

 

The piece you quoted was talking about what happens if someone, (say the EU), passes a law requiring a company to not have a master key.. They can't oporate in both countries at the same time if that happens.

[Canada EH]

On 12/5/2018 at 1:08 PM, Syntaxvgm said:

force tech companies to keep end to end encryption keys for the government (or others) to access.

Why not just use an encryption system that the aussies do not have access to!

[Canada EH]

8 hours ago, Syntaxvgm said:

We do that to people over here to, just we don't make individuals add security flaws. 

Where is here?

But the corporations give the backdoor to CSIS and the like.

[Syntaxvgm]

2 minutes ago, Canada EH said:

Why not just use an encryption system that the aussies do not have access to!

any server in the company. Also any company that has a location in Australia but has offshore servers may still be targeted? 

Oh, and the having the government individual developers (without the company knowing) add backdoor under secrecy and jail time if not or they tell. It's really vague. 

[CarlBar]

14 minutes ago, Canada EH said:

Where is here?

But the corporations give the backdoor to CSIS and the like.

 

As noted it's super vague. The way it's written if you operate in Aus period you can be targeted. Thats what makes this such a problematic law.

 

Germany for example requires companies to remove swastika's from products they sell in germany. But outside of germany companies can do what they want. The way Aus's law is written if Germany's anti-Swastika regulation worked them same they could require a company to not include them in any product they sell worldwide.

[Guest]

They probably already do spy on the phones might as well be more transparent about it. Realistically don't put anything on your phone or the internet that could hurt your future or blackmail etc. It's common sense and its been proven hackers can access it anyway. 

[bitsandpieces]

Time to dust off those Nokia 3310s and go back to physical mail

[jagdtigger]

Just pull out of there and lets see how they manage without basic things like bank's for instance...

[captain_to_fire]

On 12/7/2018 at 9:50 AM, RorzNZ said:

They probably already do spy on the phones might as well be more transparent about it. Realistically don't put anything on your phone or the internet that could hurt your future or blackmail etc. It's common sense and its been proven hackers can access it anyway. 

Does NZ have similar legislation? I hope there’s none, other than the fact that they’re a member of Five Eyes. 

[Guest]

6 hours ago, captain_to_fire said:

Does NZ have similar legislation? I hope there’s none, other than the fact that they’re a member of Five Eyes. 

Not yet, but its well known the government have access to the infrastructure etc, so I wouldn't be surprised. There was that thing with Kim Dotcom in which it was confirmed he was being spied on, so could be if you are a past offender, you are being monitored. 

[leadeater]

16 hours ago, RorzNZ said:

Not yet, but its well known the government have access to the infrastructure etc, so I wouldn't be surprised. There was that thing with Kim Dotcom in which it was confirmed he was being spied on, so could be if you are a past offender, you are being monitored. 

GCSB has fairly robust internet monitoring and analysis here, end to end encryption is still secure in that what is being secured can't be read/unencrypted but they can still gather the information as to where it's going, how much, how often etc. With enough probable cause they can seek a search warrant to search electronic devices of the person(s) of interest. This can be said of most countries too, frameworks and capabilities are all very similar but differences come in the legal side of it and how those systems operate in each country i.e. the exact same written law in a different country can have differing results going through court systems and Attorney General's.

 

Australia as far as internet goes is a basket case, that was clear after the whole 'Great firewall of Australia' happened. Once that happened it was a good sign a bunch of idiots had the controlling influence in internet legislation over there.

 

On 12/7/2018 at 2:50 PM, RorzNZ said:

They probably already do spy on the phones might as well be more transparent about it. Realistically don't put anything on your phone or the internet that could hurt your future or blackmail etc. It's common sense and its been proven hackers can access it anyway. 

Phones, calls and text messages for sure, that's well confirmed now. Send a text message with enough key words and threatening content/context and it will get flagged, you can take a guess at some of the key words .

 

Text based communication on a mobile phone is much more secure using an internet service and your data plan.

[Sauron]

They'll find out they can't enforce it at some point... encrypted traffic is indistinguishable from unencrypted traffic as long as both sides agree on the encryption method. It's still just a bunch of numbers.

On 12/6/2018 at 11:31 AM, RejZoR said:

Why not just return to plain text everything ffs...

Even then, what IS plain text? You could read a file that looks perfectly normal when in reality every letter, or word, or sentence or what have you is mapped to something completely different for the author and the recipient.

[Trik'Stari]

Like I said (it appears to have been deleted) if someone would kindly build in such a back door, then grab some private communications between a member of government and their mistress/rent-boy, make those communications public,

 

Oh look, privacy is now a basic human right. At the least it would be specified only for them which just proves the point that governments should live in fear of those they govern.

[leadeater]

1 minute ago, Trik'Stari said:

Like I said (it appears to have been deleted)

Think you said that in the other topic, no comments have actually been hidden in this one yet, which I have to say is a great thing to see