Unfortunately, this goes deeper. The law may be capable of compelling Google or Apple of Australia to force deploy to your phone a malicious version of the Signal app with the "technical assistance notice".
The truth is that such interception is normal, in Australia, in other countries.
AA is two things. 1st, the government there legalizing an already existing practise to cover their own liability in the event that the grey practise is eventually exposed. Especially amid the current public awareness of privacy.
Next, more importantly, AA is to get around recent security patches that rendered previous vectors now impossible to use, since these collections were often done covertly. It's law compensating for where a much relied on covert method no longer works. Thus, the 11th hour urgency.
The cover story that it is this huge privacy catastophe is just more noise, to distract from the big story; how interceptions like this have been going on for more than a decade.
If not, is the law capable of compelling your telephone vendor to ship you an upgrade that weakens its upgrade testing enough that Apple/Google can ship you such an upgrade?
And if this article is trustworthy, this isn't hypothetical, it's already happening right now. Right now people are being served with orders to do things like this and if they tell anyone (including the company they work for and are in essence "attacking"), they can kiss their life goodbye.
That's what makes it so scary. A programmer that is living in Aus that works for Google or Apple could one day get a notice that they are now mandated to modify code for an unknown reason with the threat of prison if they don't or if they tell anyone. Technically even programmers that don't work for those companies can be compelled to make contributions to open source software to introduce vulnerabilities or exploits, and again there is literally nothing the person can do except follow orders or go to jail forever.
Put that way, it sounds like a feature, doesn't it? But perhaps a little implausible?
What if Apple or Google changes the OS security mechanism itself?
(This has other consequences: if a developer releases the same apk to several stores, but it's signed by different certificates on each store, a user who installed the apk from one store will not be able to upgrade it using the other store.)
Easily checked, run jarsigner -verify -verbose -certs some.apk on an APK of your choice. I ran it on 31 just now, no cross-signing visible anywhere.
In a way this might be a blessing.
They'll buy the newest Apple phone because it's 10 nanometers thinner and it's a status symbol.
Apple Cloud was hacked and celebrity pictures were stolen and noone batted an eye.
When you shift responsibility from the provider to the customer, you play right into the security blame game.
Using multi factor authentication, using long, difficult passwords, and don’t let your security questions be obvious. If someone knocks me out, uses my finger to TouchID into my bank’s app and transfer money, that’s the price I pay for the convenience of not wanting to login with my password. Same with using weak passwords and questions.
This is the same as having a car recall and having people dying before the letters reach their homes and saying 'they should have known this company's cars could explode'
Apple could have forced people to use multi factor authentication, and whether or not they should have forced it is a separate discussion that can be had. But I was claiming that your original comment was that iCloud was "hacked" is incorrect, since it implies there was some weakness on Apple's technical backend.
Maybe they should take a couple of notes for their broken cloud implementation from another phone manufacturer in the space that takes security seriously:
https://www.theguardian.com/commentisfree/2014/sep/30/iphone...
https://www.cso.com.au/article/577197/apple-tells-ios-9-deve...
iCloud was not hacked; the celebrities were spear phished: https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_phot...
When you shift responsibility from the provider to the customer, you play right into the security blame game.
Phishing. I think your comment is pretty disingenuous as Apple has generally showed a strong commitment to privacy and security.
When you shift responsibility from the provider to the customer, you play right into the security blame game.
>According to court filings, Collins stole photos, videos and sometimes entire iPhone backups from at least 50 iCloud accounts and 72 Gmail accounts, “mostly belonging to celebrities,” between November 2012 and September 2014, when the photos were posted online.
https://www.washingtonpost.com/news/the-intersect/wp/2016/03...
Replace "Signal" with "OpenBSD" and watch the freaking fireworks.
(Why OpenBSD? De Raadt hasn't promised to be "nicer" recently. Linus has.)