5 ms·

Not sure OP is the same as the GitHub developer, but I want to applaud whoever took the time to write out this idea in a professional yet understandable manner.

Not sure OP is the same as the GitHub developer, but I want to applaud whoever took the time to write out this idea in a professional yet understandable manner. I had fun reading the paper. Unfortunately this idea is (mostly) dead in the water if it sticks with its current implementation. The reason is that both Android and iOS now engage in MAC address randomization specifically to prevent being tracked by their unique IDs. This "feature" was previously commercialized by stores and private surveillance to track people moving around in a city or indoor building. Fixing this is not impossible. Instead of Bluetooth tracking, the app could simply just record your location every poll update and save it locally. There is no invasion of privacy if the location file is never uploaded to the cloud. When someone tests positive, they could just have their location file uploaded (anonymously) and every device could cross check its location history with the infected person's. Technology is likely not the barrier here. Notifying and training medical personnel to effectively use the app is, and getting the general public to "buy in" will cost an absolute fortune (in advertising dollars) for little to no return. This is one of those network paradox problems where you need lots of people for the network to be useful, but the network has to be useful to attract lots of people. How do you solve that?

jackweirdy 7y ago
I’m not sure if Bluetooth MAC randomisation is different, but on iOS WiFi MAC randomisation only happens when location services are disabled: https://9to5mac.com/2014/09/26/more-details-on-how-ios-8s-mac-address-randomization-feature-works-and-when-it-doesnt/ https://9to5mac.com/2014/09/26/more-details-on-how-ios-8s-ma...
thanksforfish 7y ago
> they could just have their location file uploaded (anonymously) Anonymity is going to be hard, even with traditional methods, but I don't think a person's location history can ever be anonymous. Especially when presented with timestamps and spanning days. People generally spend a lot of time, or at least their night, in their home. > This is one of those network paradox problems where you need lots of people for the network to be useful, but the network has to be useful to attract lots of people. How do you solve that? Bake it into an existing app that already has the network, I.E. Facebook.
- georgeam 7y ago
  In principle it could be installed as a system/default app on Android and iOS by Google and Apple respectively. Even more reach for people that haven't installed Facebook.
- c22 7y ago
  I think you can get around this. Break the physical space up into blocks, say 100' square. Break the time component into 1 hour blocks. Concatenate the space and time components and hash them, then upload the hashes. If someone wants to see if they've potentially been exposed they can just hash their own time/location history and see if it gets a hit against the database.
  - LyndsySimon 7y ago
    In a sense urban area, that would help. In small towns, or out in the country? Not a chance.
    - c22 7y ago
      Why not? To correlate any meaningful data an attacker would have to reverse a significant portion of the database. The most serious attack I see would be a brute force over time of Bob's location segment. At most this gives Eve retroactive information about when Bob was home after Bob has tested positive and uploaded his data. It still doesn't give any insight into where Bob went when he left except perhaps in extremely sparse areas. Our imaginary service can help reduce the impact of this attack further by rate limiting requests and discarding old data as soon as it's no longer relevant. This failure mode is probably still less intrusive than the current system of asking people in quarantine to detail all of their recent movements. Ironically, you might achieve better anonymity by making the time and space boundaries smaller, but at the expense of more false negatives when checking for exposure.
  - sunemai 7y ago
    If you are able to check whether you've been in a "dangerous" space-time box yourself, then you are probably also able to check where these boxes are, I suppose? One way would be brute force hashing all possible space-time blocks and comparing with the public hashed list. This mechanism was why I abandoned the space-time box approach to begin with - but if you have an idea for a workaround, please get in touch!
mycall 7y ago
You could do an idea pull request.
- nexuist 7y ago
  Good idea. Just did!
sunemai 7y ago
The "buy in" issue is why I consider using Denmark (which is where I live) as an initial test area before internationalization: Danes are generally well educated, and they have a high trust in public authorities compared to many other countries. The use of open source software is also widespread in Denmark. So an app/server solution developed with 100% transparency on GitHub could easily be pushed to everybody by public authorities - under the critical assumption that we can both make it work technically, and make it completely anonymous. Just for reference, the same "scale problem" is also the challenge with ordinary vaccines, as I understand it: They don't really need to give 100% protection to each individual. The critical point is that if a large enough percentage of the population has the vaccine, the R_0 parameter of the given disease will drop below 1, and the exponential spreading turns into an exponential decline.

jackweirdy 7y ago

I’m not sure if Bluetooth MAC randomisation is different, but on iOS WiFi MAC randomisation only happens when location services are disabled: https://9to5mac.com/2014/09/26/more-details-on-how-ios-8s-mac-address-randomization-feature-works-and-when-it-doesnt/ https://9to5mac.com/2014/09/26/more-details-on-how-ios-8s-ma...

thanksforfish 7y ago

> they could just have their location file uploaded (anonymously) Anonymity is going to be hard, even with traditional methods, but I don't think a person's location history can ever be anonymous. Especially when presented with timestamps and spanning days. People generally spend a lot of time, or at least their night, in their home. > This is one of those network paradox problems where you need lots of people for the network to be useful, but the network has to be useful to attract lots of people. How do you solve that? Bake it into an existing app that already has the network, I.E. Facebook.

georgeam 7y ago
In principle it could be installed as a system/default app on Android and iOS by Google and Apple respectively. Even more reach for people that haven't installed Facebook.
c22 7y ago
I think you can get around this. Break the physical space up into blocks, say 100' square. Break the time component into 1 hour blocks. Concatenate the space and time components and hash them, then upload the hashes. If someone wants to see if they've potentially been exposed they can just hash their own time/location history and see if it gets a hit against the database.
- LyndsySimon 7y ago
  In a sense urban area, that would help. In small towns, or out in the country? Not a chance.
  - c22 7y ago
    Why not? To correlate any meaningful data an attacker would have to reverse a significant portion of the database. The most serious attack I see would be a brute force over time of Bob's location segment. At most this gives Eve retroactive information about when Bob was home after Bob has tested positive and uploaded his data. It still doesn't give any insight into where Bob went when he left except perhaps in extremely sparse areas. Our imaginary service can help reduce the impact of this attack further by rate limiting requests and discarding old data as soon as it's no longer relevant. This failure mode is probably still less intrusive than the current system of asking people in quarantine to detail all of their recent movements. Ironically, you might achieve better anonymity by making the time and space boundaries smaller, but at the expense of more false negatives when checking for exposure.
- sunemai 7y ago
  If you are able to check whether you've been in a "dangerous" space-time box yourself, then you are probably also able to check where these boxes are, I suppose? One way would be brute force hashing all possible space-time blocks and comparing with the public hashed list. This mechanism was why I abandoned the space-time box approach to begin with - but if you have an idea for a workaround, please get in touch!

mycall 7y ago

You could do an idea pull request.

nexuist 7y ago
Good idea. Just did!

sunemai 7y ago

The "buy in" issue is why I consider using Denmark (which is where I live) as an initial test area before internationalization: Danes are generally well educated, and they have a high trust in public authorities compared to many other countries. The use of open source software is also widespread in Denmark. So an app/server solution developed with 100% transparency on GitHub could easily be pushed to everybody by public authorities - under the critical assumption that we can both make it work technically, and make it completely anonymous. Just for reference, the same "scale problem" is also the challenge with ordinary vaccines, as I understand it: They don't really need to give 100% protection to each individual. The critical point is that if a large enough percentage of the population has the vaccine, the R_0 parameter of the given disease will drop below 1, and the exponential spreading turns into an exponential decline.