VPNSecure moves company from Australia to Hong Kong due to anti-encryption regs | Hacker News Reader

VPNSecure moves company from Australia to Hong Kong due to anti-encryption regs

reddit.com

113 pointslysp36 comments

Hong Kong seems an odd choice. Or at least a short sighted choice. Right now its an ok place to operate but given the slow erosion of Hong Kong's independence will it still be in 1 year? 5 years?

The treaty that gives Hong Kong its independence (but still being called China) is the Sino-British Joint Declaration [1], which grants independence for 50 years, until 2047.

this was also a thing for Macau [2]

1: https://en.wikipedia.org/wiki/Sino-British_Joint_Declaration

2: https://en.wikipedia.org/wiki/Joint_Declaration_on_the_Quest...

This is the law in theory however, China has stated that the declaration is a "historical document that no longer has any realistic meaning" [1]

1: https://m.scmp.com/news/hong-kong/politics/article/2100779/s...

China started chipping away at that agreement almost immediately.

At first Beijing "just" restricted the continuing progress toward democracy. They'd promised to leave that to HK.

Now they're much more active about it, intervening in law, freedom of press, day to day administration, the make up of the legislature, etc. Then there's the kidnappings of booksellers and publishers, and continual pro Beijing immigration.

Seems right to be very wary of any promises writ there.

Without much knowledge of the geopolitical landscape, how does this treaty stop China from invading Hong Kong? Presumably they’d face some consequences from the rest of the world, but would it be worth it?

Nothing. In fact, the Foreign Ministry have delined it have any practical meaning and "the document no longer binds China":

https://www.reuters.com/article/us-hongkong-anniversary-chin...

China has to invade Hong Kong? The PLA already has a permanent base there, with ground troops and a substancial helicopter squad.

Agreed. Seems like Singapore or Taipei would be a better option.

Would be interesting to read the reasoning behind their location choice. Maybe some employees already lived there?

Aside from what everyone else has stated on these comments, unless they remove all Australian staff it won't matter, they can still be compelled to do whatever the aus govt wants.

everyone has their price, so it's always possible something is going to happen, but moving places atleast gives them chance that they don't get lawsuit immediately, and gives more opportunity to resist. as a nation you can't touch someone in another nation unless the host nation cooperates. not sure how china vs australia relationships are, but i'm assuming these people didn't move to that specific country just at random....

I'm a more casual developer just to put that out there, but I'm Australian. Since this law came out, I have definitely lost a few contracts. Eg you can see in their eyes when they hear my accent. Yes it's just from my point of view, and I'm probably also shaking more birds out of the tree than really exist, but it's my belief.

Irrespective of that view though , any Aussie programmer who lives abroad(such as myself), have to consider what would be waiting if we visited family and friends.

I can honestly say I'd make a stand, screw the consequences, but what about everyone else? I'm a headstrong bastard(too much haha), but others have families to consider (I do as well, but my wife supports me on this position).

I moved to Japan for my wife, that doesn't mean we planned to stay here forever, while I do want to now, I know quite a few Aussies here that want to return eventually.

Why? you can just let the Hong Kong staff hold necessary keys.

Indeed, but would you prefer to have staff you know are reliable, or to be constantly worried that every commit may contain a portion that will lead into a future loophole.

Couldn't employees in Hong Kong revert the changes and alert the media?

But you may not know. Some security vulnerabilities are quite hard to spot, even to experts.

No more than a bad actor simply paying $xxx to the developer.

Uhhh “security legislation in Australia is scary, let’s move to ... chine?” (I recognize HK is special, but let’s be real: China can make HK do whatever it wants)

China is malicious, Australia is incompetent. I assume malicious is easier to deal with than incompetent?

But there are many other options

Right? Leaving Aussie makes sense, choosing HK as your alternative is where it becomes nonsense

It's really strange that Microsoft, Amazon and Apple and Google seem to be OK with the Australian laws. I would have expected them to pull out too.

Wait until customers migrate away from Australia.

Maybe they just don't care until they're sued because they won't comply?

Do they have data centers in Australia?

Yes:

https://techcrunch.com/2018/04/02/microsoft-launches-2-new-a...

https://cloud.google.com/about/locations/sydney/

https://docs.aws.amazon.com/sns/latest/dg/sms_supported-coun...

And the issue for Apple is more that the government can require Apple to secretly install backdoors into the iPhone - that's my understanding although maybe wrong?

There is indeed a Google Cloud Platform region in Sydney, but that's for GCP customer data only, not consumer Gmail etc. There are no "main" Google DCs in Australia:

https://www.google.com/about/datacenters/inside/locations/

I would presume the same applies to Microsoft and Amazon.

Of course, and they are also the one of the most expensive regions :).

Company moving from AU to HK.

AU company had to remove canary, but new HK company will have a canary.

Reading between the lines...

They would have had to remove it anyway, VPNSecure was breaking the 2015 law by publishing a canary in the first place: https://www.schneier.com/blog/archives/2015/03/australia_out...

Section 182A of the new law says that a person commits an offense if he or she discloses or uses information about "the existence or non-existence of such a [journalist information] warrant." The penalty upon conviction is two years imprisonment.

'straya. If ya got keys, we want em, and stfu

Warrant canaries (statements about the existence or nonexistence of a notice) for TARs, TANs, and TCNs are all illegal and are punishable with 5 years imprisonment.

Under AU or HK law?

Australian law, though it's not one law -- each new kind of secret warrant-like capability has wording to the effect of "disclosure of the existence or nonexistence of a [secret warrant] is an offense punishable by $x years imprisonment." In this case I was referring to the Assistance and Access Act 2018 (the new anti-encryption law) which has such wording for notices under the new legislation.

Tried them once. Their windows app by default only connects at 128 bit encryption! Had a chat with their CS and they tried to convince 128 bit is enough. Stopped after the trial.

128 bit AES (assuming that's what you meant) can certainly be good enough.

https://security.stackexchange.com/a/19762

You seem to be knowledgeable. My VPN Provider uses 256-AES-CBC by default, at least for my particular configuration. Is that appropriate?

Does this law apply to Attlasian as well? Their stock price is not concerned.

Reply on news.ycombinator.com