3 ms·

It says this is opt-in - is this just the sending of covid information, or is it the entire contact-tracing key-exchange enterprise?

by kian 7y ago

acqq 7y ago
If I understand correctly, it's up to every infected person to manually click "upload" (edit: here was "who I was close to", but it's not correct, see note 1 here) once he gets diagnosed, i.e. completely voluntary. That is so that once one is diagnosed others can check if they were close to that one (and when?). And even these lists aren't supposed to be any typical metadata but something that stays local and the third parties can't reconstruct. The idea is, again if I understood, that those who remain negative never have to upload anything that gives any traceable information about them. See my other post here with other relevant quotes from the specification. ---- Edit: 1) Actually what is uploaded is: "the Daily Tracing Keys for days where the user could have been affected" "Upon a positive test of a user for COVID-19, their Diagnosis Keys and associated DayNumbers are uploaded to the Diagnosis Server. A Diagnosis Server is a server that aggregates the Diagnosis Keys from the users who tested positive and distributes them to all the user clients who are using contact tracing." The matching is done locally on every device: "In order to identify any exposures, each client frequently fetches the list of Diagnosis Keys. Since Diagnosis Keys are sets of Daily Tracing Keys with their associated Day Numbers, each of the clients are able to re-derive the sequence of Rolling Proximity Identifiers that were advertised over Bluetooth from the users who tested positive. In order to do so, they use each of the Diagnosis Keys with the function defined to derive the Rolling Proximity Identifier. For each of the derived identifiers, they match it against the sequence they have found through Bluetooth scanning."
- tinus_hn 7y ago
  You can’t upload who you were close to because you only have a set of pieces of data that can’t be traced back to people without their key. Only if infected, you upload your key to the server which distributes it to the others who can then tell if they’ve been close to you.
  - acqq 7y ago
    > Only if infected, you upload your key to the server You are more right than I was initially, thanks! Actually, to be even more precise: only if infected, you upload the set of your own derived keys, and apparently only for the days you could have transmitted the virus to other people. From the documentation: "Upon a user testing positive, the Daily Tracing Keys for days where the user could have been affected are derived on the device from the Tracing Key. We refer to that subset of keys as the Diagnosis Keys. If a user remains healthy and never tests positive, these Daily Tracing Keys never leave the device."
- throwaway2429 7y ago
  As I read it, the specification doesn't enforce whether upload is voluntary. local custom and laws can be implemented to vary degrees of freedom on this aspect.
dwaite 7y ago
The idea is that nobody ever shares who they were close to. Think of it as walking around in a mask, then if you were sick you opt in to being on a list so everyone knows they may have been exposed if they saw someone in "a pink fox mask." Your identity is pseudorandomly generated and cycles every 15 minutes, so you won't be identifiable/trackable - until you choose to share you were sick, and release the inputs to the KDF publicly. A third party app determines who can share they were sick, but the OS appears to require user consent before your information can be shared. Even then, the people who did see you haven't shared any information. The biggest vector of privacy abuse IMHO is that once you have opted in to letting an app check whether you had contact with an affected person, the app is responsible for behavior - informing you, helping you schedule testing, or potentially more abusive behavior like informing you and the state of a mandatory quarantine.

It says this is opt-in - is this just the sending of covid information, or is it the entire contact-tracing key-exchange enterprise?

by kian 7y ago

It says this is opt-in - is this just the sending of covid information, or is it the entire contact-tracing key-exchange enterprise?

acqq 7y ago

If I understand correctly, it's up to every infected person to manually click "upload" (edit: here was "who I was close to", but it's not correct, see note 1 here) once he gets diagnosed, i.e. completely voluntary. That is so that once one is diagnosed others can check if they were close to that one (and when?). And even these lists aren't supposed to be any typical metadata but something that stays local and the third parties can't reconstruct. The idea is, again if I understood, that those who remain negative never have to upload anything that gives any traceable information about them. See my other post here with other relevant quotes from the specification. ---- Edit: 1) Actually what is uploaded is: "the Daily Tracing Keys for days where the user could have been affected" "Upon a positive test of a user for COVID-19, their Diagnosis Keys and associated DayNumbers are uploaded to the Diagnosis Server. A Diagnosis Server is a server that aggregates the Diagnosis Keys from the users who tested positive and distributes them to all the user clients who are using contact tracing." The matching is done locally on every device: "In order to identify any exposures, each client frequently fetches the list of Diagnosis Keys. Since Diagnosis Keys are sets of Daily Tracing Keys with their associated Day Numbers, each of the clients are able to re-derive the sequence of Rolling Proximity Identifiers that were advertised over Bluetooth from the users who tested positive. In order to do so, they use each of the Diagnosis Keys with the function defined to derive the Rolling Proximity Identifier. For each of the derived identifiers, they match it against the sequence they have found through Bluetooth scanning."

tinus_hn 7y ago
You can’t upload who you were close to because you only have a set of pieces of data that can’t be traced back to people without their key. Only if infected, you upload your key to the server which distributes it to the others who can then tell if they’ve been close to you.
- acqq 7y ago
  > Only if infected, you upload your key to the server You are more right than I was initially, thanks! Actually, to be even more precise: only if infected, you upload the set of your own derived keys, and apparently only for the days you could have transmitted the virus to other people. From the documentation: "Upon a user testing positive, the Daily Tracing Keys for days where the user could have been affected are derived on the device from the Tracing Key. We refer to that subset of keys as the Diagnosis Keys. If a user remains healthy and never tests positive, these Daily Tracing Keys never leave the device."
throwaway2429 7y ago
As I read it, the specification doesn't enforce whether upload is voluntary. local custom and laws can be implemented to vary degrees of freedom on this aspect.

dwaite 7y ago

The idea is that nobody ever shares who they were close to. Think of it as walking around in a mask, then if you were sick you opt in to being on a list so everyone knows they may have been exposed if they saw someone in "a pink fox mask." Your identity is pseudorandomly generated and cycles every 15 minutes, so you won't be identifiable/trackable - until you choose to share you were sick, and release the inputs to the KDF publicly. A third party app determines who can share they were sick, but the OS appears to require user consent before your information can be shared. Even then, the people who did see you haven't shared any information. The biggest vector of privacy abuse IMHO is that once you have opted in to letting an app check whether you had contact with an affected person, the app is responsible for behavior - informing you, helping you schedule testing, or potentially more abusive behavior like informing you and the state of a mandatory quarantine.