<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0mm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">And what about all those international travellers who order Optus services (for example) who don’t have, and aren’t entitled to have, a MyGov account?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0mm 0mm 0mm">
<p class="MsoNormal" style="margin-left:36.0pt"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> AusNOG <ausnog-bounces@ausnog.net>
<b>On Behalf Of </b>Giles Pollock<br>
<b>Sent:</b> Tuesday, 27 September 2022 13:48<br>
<b>Cc:</b> ausnog@ausnog.net<br>
<b>Subject:</b> Re: [AusNOG] Optus Hack<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Had the same thought, and it's good in principle, until you get that obnoxious little thought creeping into your head "yeah... but what if MyGov got hacked too?"<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">I suspect we'll end up with something akin to that down the track, as the information already exists across multiple government databases by law anyway. Might get interesting for non citizens though?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">(It probably will wind up all the sovcit types too who will start throwing around their favourite catchphrases - NWO, world government, UN control, etc)<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">On Tue, Sep 27, 2022 at 1:40 PM jay binks <<a href="mailto:jaybinks@gmail.com">jaybinks@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0mm 0mm 0mm 6.0pt;margin-left:4.8pt;margin-right:0mm">
<div>
<p class="MsoNormal" style="margin-left:36.0pt">mmm I was just bouncing something like this around in my head.<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:0mm;margin-right:0mm;margin-bottom:12.0pt;margin-left:36.0pt">
In a perfect world, you could utilise MYGov infrastructure...<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Carriers could get a UUID that represents a "Know your customer" Data validation that occurred between carriers and "MyGov", where the customer was MFA prompted (with the MyGov ID service) to say "Confirm you
want to identify yourself to XXXX".<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Then the carrier would only be required to retain that UUID for the MFA Verified auth transaction.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">(and be explicitly instructed NOT to retain PII other than an email address to send invoices)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Anyways... back to the real world.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">On Tue, 27 Sept 2022 at 13:06, Nick Adams <<a href="mailto:ausnog@narkov.com" target="_blank">ausnog@narkov.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0mm 0mm 0mm 6.0pt;margin-left:4.8pt;margin-right:0mm">
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">See the "Australia Card"[1] for why the Federal government probably couldn't provide central identification/auth services. It is politically very challenging...despite the obvious benefits it would provide.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">[1] <a href="https://en.wikipedia.org/wiki/Australia_Card" target="_blank">
https://en.wikipedia.org/wiki/Australia_Card</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div id="m_8756478220392611292m_-8916055799584140862sig129256752">
<div>
<p class="MsoNormal" style="margin-left:36.0pt">--<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Nick Adams<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">On Tue, 27 Sep 2022, at 12:39 PM, Michael Kahl wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt" id="m_8756478220392611292m_-8916055799584140862qt">
<div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Is there any legal obligation to store sensitive ID information in its original form? Storing a hashed version only would be sufficient to prove the details had been collected and verify any future ID verification
requirements without actually retaining the sensitive data.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Separately, should the government provide an opt in two factor ID verification service for critical services such as telco, utilities, banking, etc? There are privacy concerns, however if implemented correctly
they wouldn't be collecting any further information than what they legally have access to now.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">On Tue, Sep 27, 2022 at 11:12 AM Nathan Brookfield <<a href="mailto:Nathan.Brookfield@iperium.com.au" target="_blank">Nathan.Brookfield@iperium.com.au</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0mm 0mm 0mm 6.0pt;margin-left:4.8pt;margin-right:0mm">
<div>
<p class="MsoNormal" style="margin-left:36.0pt">They’re legally obligated to retain it but why it’s on the API and why it’s not encrypted.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Looking at the data some fields are hashed and then repeated in the bloody clear :(<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">On 27 Sep 2022, at 11:02, <a href="mailto:glenn.satchell@uniq.com.au" target="_blank">
glenn.satchell@uniq.com.au</a> wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">My understanding was that the data included the 100 points of ID info. Why are they retaining this? Surely after confirming the 100 points there only needs to be a record "100 points provided"=true and not retain
the actual details. This goes back to only keeping the private data you need.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Glenn<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">On 2022-09-27 10:49, Damien Gardner Jnr wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> Personally, I find putting Authentication on my API endpoints to be a<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> FANTASTIC first step towards API security. And then not even using<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> public IP addresses in test environments is a pretty good second<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> step.. </onlyhalfsarcasticherewhydoesthiskeephappening><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> On Tue, 27 Sept 2022 at 10:46, Bevan Slattery <<a href="mailto:bevan@slattery.net.au" target="_blank">bevan@slattery.net.au</a>><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> Hi everyone,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> Obviously a big week in telco and cybersecurity. As part of my work<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> I am on the Australian Cyber Security Industry Advisory Committee as<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> an industry representative.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> I am keen to look at opening up a dialogue with more and more telco,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> DC and Cloud CISO’s on what they are doing around this issue and<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> looking to take a proactive step towards best practice on customer<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> data and system security.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> There will be some pretty serious consequences of this hack on the<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> industry and importantly we need to make sure we are as best placed<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> to help each other continually increase in security posture through<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> best practice, but also working with each other as an industry.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> Are people keen on having a online/VC session sometime in the next<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> few weeks where like-minded industry participants get together and<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> discuss security, retention, encryption, threat detection etc.? If<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> so, just ping me directly and if there is enough interest I will<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> send out an invitation to the list for a call.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> Cheers<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> [b]<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> _______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> AusNOG mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> <a href="mailto:AusNOG@ausnog.net" target="_blank">
AusNOG@ausnog.net</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">>> <a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">
https://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> --<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> Damien Gardner Jnr<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> VK2TDG. Dip EE. GradIEAust<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> <a href="mailto:rendrag@rendrag.net" target="_blank">
rendrag@rendrag.net</a> - <a href="http://www.rendrag.net/" target="_blank">http://www.rendrag.net/</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> --<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> We rode on the winds of the rising storm,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> We ran to the sounds of thunder.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> We danced among the lightning bolts,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> and tore the world asunder<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> _______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> AusNOG mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> <a href="mailto:AusNOG@ausnog.net" target="_blank">
AusNOG@ausnog.net</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">> <a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">
https://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">AusNOG mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><a href="mailto:AusNOG@ausnog.net" target="_blank">AusNOG@ausnog.net</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">AusNOG mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><a href="mailto:AusNOG@ausnog.net" target="_blank">AusNOG@ausnog.net</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">AusNOG mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><a href="mailto:AusNOG@ausnog.net" target="_blank">AusNOG@ausnog.net</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:36.0pt">_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@ausnog.net" target="_blank">AusNOG@ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
</div>
<p class="MsoNormal" style="margin-left:36.0pt">-- <o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt">Sincerely<br>
<br>
Jay<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:36.0pt">_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@ausnog.net" target="_blank">AusNOG@ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>