Slashdot Mirror

I noticed the other day that ASIO (Australian Security Intelligence Organisation) throws a SHA-1 warning in Chrome ("This site uses a weak security configuration (SHA-1 signatures), so your connection may not be private").

https://www.asio.gov.au/About-...

Still almost two years left on the cert.

So I wonder:

1) Is this a terribly big deal and, as Chrome (i.e., Google) warns, should I be massively concerned that our chief intelligence agency is running with algorithms that are considered obsolete by the infosec community?!

or

2) Have they carefully looked at all the known SHA-1 weaknesses (and presumably several that are not known to the wider public) and determined the risk is acceptable and that (for example) people applying for jobs on their website are not in danger of having their details compromised?!

Chrome is being somewhat alarmist. Though, SOMEONE needs to as a log of admins just don't realize SHA-1 is a problem. Heck, lots of CAs let you buy them no problem still but really they are only good for really old devices that can't do other lengths.

On the other hand, the irony is thick when a Google product warning about possible eavesdropping while their entire industry and immense fortune was from exactly that.

I noticed the other day that ASIO (Australian Security Intelligence Organisation) throws a SHA-1 warning in Chrome ("This site uses a weak security configuration (SHA-1 signatures), so your connection may not be private").

https://www.asio.gov.au/About-...

Still almost two years left on the cert.

So I wonder:

1) Is this a terribly big deal and, as Chrome (i.e., Google) warns, should I be massively concerned that our chief intelligence agency is running with algorithms that are considered obsolete by the infosec community?!

or

2) Have they carefully looked at all the known SHA-1 weaknesses (and presumably several that are not known to the wider public) and determined the risk is acceptable and that (for example) people applying for jobs on their website are not in danger of having their details compromised?!

Cool, sign me up for a blackmaili^H^H^H^H^H^H^H public servant job!11

There you go

So... having access to a few unlicensed semi-automatic weapons on the off chance that you might want to over throw your own government is a good thing then?
If you think guns are what a modern government would use to keep control over you, you might have missed the importance of the control of information.
Not sure if you are aware of this if you want to talk about Australia - but there are laws here empowering ASIO
to bug my computer without my knowledge, take me away without my telling any one, including my family, and if a reporter reports on it the reporter can be thrown into jail.
The use of a modern army is all about the ability of a government to control the context in which their actions are evaluated. The USA went to war with Iraq, for instance, on the basis there was an imminent threat of weapons of mass destruction use. That that was not the case doesn't really seem to worry anybody. No one has been held to account about that. What do you think they would bring to bare if it was a local national issue and not some distant country?
If your government really thought you were likely to lead a rebellion, you would be put at such an informational disadvantage, the use of your weapons could only be seen as acts of terrorism. I would gather the FBI and alike would be watching you way before you considered actually using a gun. If you some how got to the point of using it, the army and all other resources would then be "permitted" to use any and all means at their disposal to put you down.
In the mean time, you are inclined to add an extra level of insurance by having a gun handy because everyone else out there has one - including the people who will break in. I was not suggesting that crime would disappear if the guns were wound back - far from it. However, as long as they are as available as they are - you are in a cycle of having to own them, where you would like to or not. Of the things I like about America - their gun laws are not to be emulated IMHO.

A: No. ASIO operates wherever threats to Australia and Australian interests occur, and its mandate is not limited geographically. The Organisation works collaboratively with international intelligence and security agencies to protect Australians and Australian interests and to enhance its capabilities.

I guess that's saying what I'd heard was only part of the full story.

Cheers-
Stolzy

ASIO is our FBI equivalent, ASIS is our CIA. Both are, um, not that highly respected and are seen as pretty incompetent. Something like this would be more likely to be done by the Australian Federal Police (AFP) or, possibly, the Australian Crime Commission (ACC), which deals with organised crime.

ASIO = Australian Security Intelligence Organisation
ASIS = Australian Secret Intelligence Service

(Obviously ASIS isn't that secret after all.)

ACT is *the capital* city of Australia, seat of federal government, part time home of australian pollies (politicians), home of australian federal public service, houses adf hq (moved from vic barracks in melbourne - my home), home of various australian intelligence agencies (asis, asio) , location for diplomatic embassies, etc. Also home of Australian National University, Andrew Tridgell of Samba and rsync fame.

Canberra is *not underfunded*. It is in a sense an *artifical* city created as a political compromise to house the australian capital - after a fight broke betweem Victoria and Sydney around federation around 1901. The solution Canberra, a territory created in the NSW outback. Its sole purpose it to house government and its associated functions.

as for being less influential ... in australia its the national capital and houses the federal government - q.e.d. As for the rest of the world ... what does it matter?

What does ASIO have to do with audio?

/me ducks

101.4 Possessing things connected with terrorist acts

(1) A person commits an offence if

(a) the person possesses a thing; and

(b) the thing is connected with preparation for, the engagement of a person in, or assistance in a terrorist act.

Penalty: Imprisonment for life.

(2) Absolute liability applies to paragraph (1)(b).

(3) A person commits an offence under subsection (1) even if the terrorist act does not occur.

(4) Subsection (1) does not apply if the person proves that he or she was not reckless with respect to the circumstance in paragraph (1)(b).

Note: A defendant bears a legal burden in relation to the matter in subsection (4) (see section 13.4).

(5) Section 15.4 (extended geographical jurisdiction--category D) applies to an offence against subsection (1).

That's just one subsection of a very draconian bill. I urge all Aussies to get a copy and read it. Looks like fun, doesn't it? Especially the bit about being guilty until you prove your innocence. Yes, it's not called the FBI in Australia. It's called ASIO and if the legislation gets passed it'll be just as dangerous.

Note: I don't think this guy has much to worry about though. It's the possibility that's frightening.

You thought that was bad? How about:

Trying 152.91.15.15...
Connected to www.asio.gov.au.
Escape character is '^]'.
HEAD / HTTP/1.0

HTTP/1.1 200 OK
Server: Microsoft-IIS/4.0
Date: Sun, 05 Dec 1999 00:21:19 GMT
Content-Type: text/html
Set-Cookie: ASPSESSIONIDGQGGQQPD=GFGIOFHCFOBKHKJFCCAPFNDG; path=/ Cache-control: private

No comments.

• • technical
    bandwidth - because of the lack of competition, Telstra has effectivly hindered any growth in high bandwidth access to the backbone. What access exists is too expensive, is inflexible. Telstra goes out of it's way to extract $ (and hugh profits) but any implementations of broadband is laughable.
    
    IT skills - it skills levels are good to very good, but there is a severe shortage coupled with a brain drain of top technical staff.
    
  
  
  • human rights
    privacy laws - lack of, hence allowing business, government and external bodies to push the limits of basic privacy and rights, that other countries take for granted.
    
    government censorship - federal government trying to force internet censorship that is technically very difficult even of it forces local ISP's for a lot of extra expenses.
    
    governent cracking - ASIO given rights to crack domestic computer systems with permission from the crown, no legal process can be involved.
    
    business - weak privacy laws allowing business (PBL) to attempt to capture, store and profile the entire country.
    
    
  
  
  • business
    business conservatism - banks, big business, the engines of change for the country are reluctant to go boots and all>.
    
    e-business's - toe-dipping, lack of funds, lack of business exploitation skills (not techincal skills) is holding back the growth of e-commerce.
    
    venture capital - venture capital is looking up. More vc's are looking at funding start-ups.
    
    
  
  
  • education -
    funding - funding to education is being cut (Monash University), privatisation and business driven courses is the word.
    
    course access - hard core science (and other non essential academic cources) are being replaced with vocational courses.