News for hackers. Stuff that matters.
Re:Dissection of COVIDSafe (Android): Australian government'... by discordance on Sunday April 26, 2020 @08:09AM (#22986552)
I would love to trust them more, but the Australian government does not have a good track record with regards to privacy. Two such recent examples:

- Australian's browser history is being provided to law enforcement even though that practice was excluded from the original intent and law [0]

- Australia passed laws in 2018 which enable law enforcement to compel tech companies into inserting backdoors into their software [1]

0: https://www.theguardian.com/world/2020/feb/07/web-browsing-h...

1: https://www.wired.com/story/australia-encryption-law-global-...

Re:Dissection of COVIDSafe (Android): Australian government'... by Daishiman on Sunday April 26, 2020 @03:09PM (#22989343)
The Australian government is not a single monolothic institution. It's a set of hundreds of thousands of people with different agendas and intentions. You cannot assign singular agency to the entire government; rather we have to go case-by-case to understand the implications of programs like these.
Re:Dissection of COVIDSafe (Android): Australian government'... by roenxi on Sunday April 26, 2020 @07:01PM (#22991101)
That is a little like saying the human body isn't a single organism because, say, the digestive tract operates with its own agency and intention outside of conscious control. It isn't correct; the politicians in the government have a very high level of agency around what ends up being fed into the institutions and what agendas and intentions are allowed to rise to power.

This isn't the step that gets us to a dystopian future, but it is so cheap and convenient for government to take programs like this and expand them every single time there is a crisis that it may as well be assumed to be coming if people don't kick up a stink each and every time.

We don't need perfect safety. We've can't have perfect safety. Having perfect, technologically enforced safety will create systems that will become corrupted and evil with a high, high likelihood. I don't want the government to have the ability figure out who I'm talking too at all; I'd rather we went in the exact opposite direction of this app and put legal barriers in place to them even asking. COVID-19 is horrible, but it will pass. This tracking strategy will not.

Re:Dissection of COVIDSafe (Android): Australian government'... by hilbert42 on Sunday April 26, 2020 @08:22PM (#22991657)
"I'd rather we went in the exact opposite direction of this app and put legal barriers in place to them even asking. COVID-19 is horrible, but it will pass. This tracking strategy will not.".

Absolutely damn correct brother! 10/10.

Re:Dissection of COVIDSafe (Android): Australian government'... by cmroanirgo on Sunday April 26, 2020 @04:24PM (#22989917)
Yes. But it is the government that creates the law.

Parent also forgot to mention mandatory data retention laws. All isps must retain history of internet traffic for ¿2 years.

That telephone numbers are used in this app should also be regarded as a breach of the referendum we had about the Australia Card back in the 80's. (It is illegal to tie citizens to a number for the sake of tracking, which is exactly what this does...). Which is why scomo (Scott Morrison, the PM) is asking for this app to be voluntary.

Re:Dissection of COVIDSafe (Android): Australian government'... by mickotron on Tuesday April 28, 2020 @02:59AM (#23004266)
This only matters if it's mandatory, which voting is in Australia. This app is voluntary. Whether it has passed or not yet, legislation is planned to make it illegal to force anyone to download or use it. So trying it to a phone number is ok if it's totally voluntary. Also because users are not identified by their phone number under normal circumstances, this is also ok. If someone steals or leaks the key used to encrypt/decrypt all TempIds for all users, or can figure out a pattern in the generation of future TempIds for users, they can possibly tie people to their phone number and identify them. However under normal use there is no way to identify someone, well unless they can snoop the broadcast/encounter json messages and get your device ID and toe that to you
Re:Dissection of COVIDSafe (Android): Australian government'... by driverdan on Sunday April 26, 2020 @05:31PM (#22990445)
That makes it worse. A well-intentioned, well-meaning government org could create something with proper privacy controls and then another part of the government with worse intentions could get their hands on the data.
Re:Dissection of COVIDSafe (Android): Australian government'... by hilbert42 on Sunday April 26, 2020 @08:27PM (#22991686)
"A well-intentioned, well-meaning government org<...>"

Yuh, has there ever been one? If so where and when? (I've been around quite some years now and I've never seen one anywhere.)

Re:Dissection of COVIDSafe (Android): Australian government'... by godelski on Monday April 27, 2020 @02:19AM (#22993345)
Never attribute to malice what can be just as easily attributed to stupidity. While there are clear bad actors, I do believe that many do think what they are doing is for the best. Few people are actually evil, most are just stupid. I'd consider that a win considering that we're chimps that are barely able to communicate with one another even when we speak the same language.
Re:Dissection of COVIDSafe (Android): Australian government'... by Sophistifunk on Sunday April 26, 2020 @08:08PM (#22991549)
Bollocks. We can attribute to them the desire to gobble up power to control what we can and can't do on the internet and surveil us, because that's the way they all behave.
Re:Dissection of COVIDSafe (Android): Australian government'... by hilbert42 on Sunday April 26, 2020 @08:18PM (#22991624)
"The Australian government is not a single monolothic institution. It's a set of hundreds of thousands of people with different agendas and intentions."

Correct! Once we had two camps, you either voted for one or the other. That's all gone now, Identity Politics unfortunately killed the simple life off years ago.

Re:Dissection of COVIDSafe (Android): Australian government'... by hilbert42 on Sunday April 26, 2020 @08:11PM (#22991579)
Have you ever thought why the Australian Government is so far ahead in such matters?

Perhaps it has something to do with the bloody-mined, overly-timid sheep that continually vote these bastards into government year after year—despite the current surfeit of draconian law.

Don't forget there's been no stomach to rock the boat in this country for decades and also we haven't had an effective Opposition for many years.

Re:Dissection of COVIDSafe (Android): Australian government'... by jfoster on Sunday April 26, 2020 @03:04PM (#22989319)
Do you honestly believe that they are trying to do something other than stem the harm from this pandemic, or are you just protesting about something they did in the past that you're not happy about? If it is the latter, have you considered the harm that your protest may be doing?
Re:Dissection of COVIDSafe (Android): Australian government'... by healsjnr1 on Sunday April 26, 2020 @04:45PM (#22990102)
It is a combination of their previous behavior plus the behavior of the various agencies.

For example: https://www.theguardian.com/australia-news/2020/apr/23/gover...

The fact that law enforcement even asked for this would be to many people completely unacceptable.

It's why, despite their efforts to assuage people, so many people will not trust this government.

The backdoor legislation means that at a later date, after the code is released, they could request a backdoor to the app and _no one_ could talk about it. All the legal provisions are there.

Re:Dissection of COVIDSafe (Android): Australian government'... by GordonS on Sunday April 26, 2020 @06:39PM (#22990935)
This just goes to show that the police and security services will stop at nothing to increase surveillance of the general population.

It beggars belief that the police see COVID-19 as an opportunity in such an overt manner - but you can bet the security services see it as an opportunity in a much more circumspect manner.

Re:Dissection of COVIDSafe (Android): Australian government'... by dabbledash on Sunday April 26, 2020 @06:31PM (#22990871)
I honestly believe that they will not bypass any opportunity to increase surveillance and that any kind of tracking that is normalized now will be expanded in the future.

I don’t believe that the people pushing this knowingly have bad intentions, but all the last decades have taught is “never give an inch.”

Re:Dissection of COVIDSafe (Android): Australian government'... by endual on Sunday April 26, 2020 @05:31PM (#22990440)
That's a false dichotomy. They could be totally fine with the intent of this app, but concerned with its potential secondary effects. And "something they did in the past" suggests they have stopped doing it.
Re:Dissection of COVIDSafe (Android): Australian government'... by wavegeek on Sunday April 26, 2020 @07:46PM (#22991388)
> "something they did in the past" suggests they have stopped doing it.

No it doesn't. All evidence of their proclivities is from the past. It means they have form, a record, of bad behaviour.

Remember how the use of the Tax File Number was going to be strictly limited? And have you noticed you cannot scratch your bum without quoting it now?

Mission creep is a thing.

My own impression from observing his public behaviour is that Scott Morrison is a lying liar who tells lies when convenient to himself.

Re:Dissection of COVIDSafe (Android): Australian government'... by ifthenorelse on Monday April 27, 2020 @02:32AM (#22993417)
Yes, and Scotty will use the crisis to lower company tax and regulations, whilst thousands of poor souls line up at Centrelink. It's sad. The app is poorly conceived and probably useless. This is how we sleepwalk into a surveillance dystopia. But if it tracks politicians' illicit dalliances and time with lobyists, property developers and tax haven financiers, that could be useful. Just need a bureaucrat to do a copy and paste, then send to Wikileaks.
Re:Dissection of COVIDSafe (Android): Australian government'... by wavegeek on Sunday April 26, 2020 @07:42PM (#22991352)
Income tax was introduced as a "temporary measure" to pay for WWII.

Fool me once shame on you, fool me twice, shame on me.

Re:Dissection of COVIDSafe (Android): Australian government'... by godelski on Monday April 27, 2020 @02:19AM (#22993349)
I assume you mean WWI? https://en.wikipedia.org/wiki/Income_tax#Timeline_of_introdu...

If we're talking Australia. If the US, well... Civil War.

But to the sentiment of the comment, I completely agree. That is explicitly why we need the "burn the system down" type of people that I mentioned. they bring to light these kinds of topics and considerations.

Re:Dissection of COVIDSafe (Android): Australian government'... by throwaway9d0291 on Monday April 27, 2020 @07:58AM (#22994978)
> Australia passed laws in 2018 which enable law enforcement to compel tech companies into inserting backdoors into their software

No, it didn't. The bill had language specifically intended to address these concerns. Read the bill [0]. The relevant part is under Part 15 > Division 7 > 317ZG, which you can also see at [1].

This section explicitly forbids the government from requesting that a provider "build a systemic weakness, or a systemic vulnerability, into a form of electronic protection". It also forbids the government from asking a provider to preserve such a weakness.

It also explicitly indicates that this definition includes:

- "a reference to implement or build a new decryption capability in relation to a form of electronic protection"

- "a reference to one or more actions that would render systemic methods of authentication or encryption less effective"

So no, the government did not pass a bill that allows them to request encryption backdoors.

These weren't even amendments made later, this language was present from the very first version of the bill [2].

The reporting around this was simply atrocious and made me lose a lot of respect for news sources I'd otherwise have thought were respectable. Just read Wired's article:

"Systemic vulnerability means a vulnerability that affects a whole class of technology, but does not include a vulnerability that is selectively introduced to one or more target technologies that are connected with a particular person," the Australian law says. In other words, intentionally weakening every messaging platform out there with the same backdoor wouldn't fly, but developing tailored access to individual messaging programs, like WhatsApp or iMessage, is allowed."

They cherry-pick a quote from part of the legislation but just so happen to ignore the rest of section 317ZG, which invalidates their claims.

Other publications were even worse, they couldn't even point to which parts of the law were objectionable.

If you would like to disagree with my assertions, please provide evidence-based claims, as I have.

[0]: https://www.legislation.gov.au/Details/C2018C00495

[1]: http://www5.austlii.edu.au/au/legis/cth/consol_act/ta1997214...

[2]: https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...