mjec

HTTP got basic auth, which is crap because plaintext password transmission happens...

Plaintext submission happens with HTML forms too. The problem with Basic is the password goes with every request. That means you're exposing a long term credential to a higher risk. We want to exchange the long term credential for a short term one, ideally scope limited. That is far less catastrophic to revoke, and gives you some power of granularity (you can at the very least have some operations prompt for the password again). It also means you can limit risk on the server: only one page has access to the long term credentials, which can be more easily audited, or even hosted on dedicated servers.

WebAuthn has been the real savior here. Real cryptography has always been desirable for this, and removing per-site passwords is honestly just a bonus.

Pardon my ignorance, but why don't companies run their own nameservers?

I get why you don't want to run email - it's highly reputation driven. But as far as I can tell, running nameservers is no harder than running webservers or DB servers. HA is potentially even easier, because the system was designed that way from day zero.

I'm not suggesting I'd run one for my personal website, but twitter and github are already managing distributed networks for this. What are the services Dyn and others provide that are so invaluable?

There is an existing solution to give you this protection, it's called port knocking.

Ah good yes, please do generate all of my passwords on the server side and then send them via HTTP.

Shouldn't this "advice" demand substantiation or evidence?

I think so, and evidently so do others. Already a gentleman by the name of Brendan Molloy has put in an FOI request for the documents on which this advice was based: https://www.righttoknow.org.au/request/documents_informing_t...

Also, what does that bit about "commercial-in-confidence" mean?

The AEC does conduct some elections on a fee-for-service basis - things like union elections. They use a version of the same system to tally votes in those elections too. They say that the two systems are totally inseparable, to the point where you can't just cut out the code used in industrial elections. They also say revealing the code (though keep in mind it would still be copyrighted, so couldn't be used by any other organisation) would cause them significant commercial disadvantage. Because they have particular efficiency in the way their software operates which causes them to be more competitive.

As you might suspect, I disagree with pretty much every part of what they claim there.

The algorithm is public

Clearly so -- except the AEC explicitly say "The algorithm is the trade secret."[1] Which to me says they don't know what algorithm means.

[1] http://easycount.mjec.net/2013-12-09-aec-to-mjec.pdf at paragraph 57.

Write to your Senator, say the AEC's refusal to comply[1] with Senate Order 330[2] is wrong and you'd like it challenged.

(Note that while it was moved by a Greens Senator, I'm not affiliated with the Greens and this is not a party political thing that's going on)

Failing that, maybe consider donating to my fund to fight this decision in court: http://pozi.be/easycountaat?ra=247325

[1] http://lee-rhiannon.greensmps.org.au/sites/default/files/ron...

[2] http://lee-rhiannon.greensmps.org.au/content/news-stories/up...

The Electoral Commission has since refused to comply with the Senate order to release the source code: http://lee-rhiannon.greensmps.org.au/sites/default/files/ron...