We rely on myGov, but can we trust its code?

Millions of Australians use myGov to access essential services like Medicare, the ATO, and Centrelink.  The myGov Code Generator app is one of the options for enhancing myGov login security.

But is it actually secure?  Services Australia, the agency who publishes it, claims it is.  But when I requested the app’s source code under Freedom of Information (FOI) laws, Services Australia refused, arguing that releasing the code would help “nefarious actors” and compromise security.  In other words: “Security by Obscurity”.

True security requires transparency. Hiding the code prevents independent experts from auditing the system for flaws.  It also denies secure access to government services for people who do not live in the Google or Apple “walled gardens”, or to people with disabilities and culturally and linguistically diverse cohorts who cannot use the app as designed, but who could use modified or translated versions.