We rely on myGov, but can we trust its code?
Millions of Australians use myGov to access essential services like Medicare, the ATO, and Centrelink. The myGov Code Generator app is one of the options for enhancing myGov login security.
But is it actually secure? Services Australia, the agency who publishes it, claims it is. But when I requested the app’s source code under Freedom of Information (FOI) laws, Services Australia refused, arguing that releasing the code would help “nefarious actors” and compromise security. In other words: “Security by Obscurity”.
True security requires transparency. Hiding the code prevents independent experts from auditing the system for flaws. It also denies secure access to government services for people who do not live in the Google or Apple “walled gardens”, or to people with disabilities and culturally and linguistically diverse cohorts who cannot use the app as designed, but who could use modified or translated versions.
A merits review at the Administrative Review Tribunal (ART)
After years of waiting for the OAIC’s review of Services Australia’s access refusal decision - which they punted on due to the technical nature of the matter - I applied to the Administrative Review Tribunal (ART) for review. In this proceeding I will challenge the government’s claim that hiding public, publicly-funded software is necessary and in the public interest.
This is not just a fight about source code—it is a fight for the right to know how our government’s essential digital infrastructure works, and for the right to make it better for everyone.
The government will use taxpayers’ money (probably lots of it!) to employ top legal counsel to defend their position of secrecy and control. I need your help to level the playing field in this fight for transparency, security, and freedom.
One plausible reason for hiding the source code is that if Service Australia was forced to fully open source it, it would be trivial for bad actors to make knock-off clones that look and behave identically, while doing other bad things. We all know Google and Apple wouldnt do anything to prevent that happening…
Maybe a middle ground of releasing the code, but not the assets (images, style sheets, etc) could be reached?
Either way, I’ll still interested, and I might contribute after doing a bit more reading of his past case.
I disagree.
Its just a 2fa code generator? Or have I misunderstood.
“Just a 2fa code generator” is still a good phishing target. Stealing the 2fa seeds would be incredibly valuable for a bad actor. Which is exactly why it should be audited.
It does look incredibly basic though, its basically a “my-first-android-app”. So extremely trivial to recreate, which does somewhat nullify my original point about app clones.
I would be a bit more interested in the MyID app (Made by the ATO, but used more boardly), which has a lot more risk involved (Uploading ID documents, facial data etc).
I guess you’re right about 2fa seeds, but I do wonder why the play store isn’t awash with dodgy 2fa seed generators. I’m not naive enough to believe that everything from the play store is “secure” but do they do some kind of rudimentary screening?
There are a lot of tfa apps in the store, and search does seem to surface the brand name ones first, but there are a few no-name ones as well:
https://play.google.com/store/apps/details?id=twofa.account.authenticator https://play.google.com/store/apps/details?id=com.authenticator.twofa.otp.password.authentication
I don’t know that they are legit or not, but they exist.
I suspect if someone wanted to do this, they would use a fraudulent ad campaign to sent people directly to the store listing, rather than hope for the playstore search to find people.
And based on my experience with Google, they do fuck all screening, it’s mostly just checks to ensure you have a privacy policy, no checks that the policy is actually followed…
They could modify the original apps apks already anyway
Sure, but having the full source makes that even easier.