We rely on myGov, but can we trust its code?
Millions of Australians use myGov to access essential services like Medicare, the ATO, and Centrelink. The myGov Code Generator app is one of the options for enhancing myGov login security.
But is it actually secure? Services Australia, the agency who publishes it, claims it is. But when I requested the app's source code under Freedom of Information (FOI) laws, Services Australia refused, arguing that releasing the code would help "nefarious actors" and compromise security. In other words: "Security by Obscurity".
True security requires transparency. Hiding the code prevents independent experts from auditing the system for flaws. It also denies secure access to government services for people who do not live in the Google or Apple "walled gardens", or to people with disabilities and culturally and linguistically diverse cohorts who cannot use the app as designed, but who could use modified or translated versions.
A merits review at the Administrative Review Tribunal (ART)
After years of waiting for the OAIC's review of Services Australia's access refusal decision - which they punted on due to the technical nature of the matter - I applied to the Administrative Review Tribunal (ART) for review. In this proceeding I will challenge the government's claim that hiding public, publicly-funded software is necessary and in the public interest.
This is not just a fight about source code—it is a fight for the right to know how our government's essential digital infrastructure works, and for the right to make it better for everyone.
The government will use taxpayers' money (probably lots of it!) to employ top legal counsel to defend their position of secrecy and control. I need your help to level the playing field in this fight for transparency, security, and freedom.
I think a better approach would be:
-
Support conventional TOTP codes that any other 2FA app supports
-
Give passkeys first-class support (currently there is a bug where a passkey login is not counted as a real login, so you could lose your account due to inactivity if you don't login with a password in a while)
-
Support disabling SMS 2FA due to its security issues, although maybe don't remove it yet globally due to the need to support older devices and less technical users.
I know some are wary about passkeys because they are often tied to a device, but common password managers now have great support for it (such as bitwarden and keepassXC) and you could even use a physical key instead.