15 ms·
Leakage paths for the Apple / Google Bluetooth tracing system
- saagarjha 7y agoAside: you look like you might be the author, so I thought I'd mention that the link for "one-way hash" seems to be empty.
- awinter-py 7y agoeek fixed thanks
- sowbug 7y agoDTKs are derived rather than random so that the device doesn't have to store its own keys or identifiers, saving both space and flash wear. It can start with the initial seed and re-derive all the rest as needed.
- awinter-py 7y agowhy does the device need to know its own key history?
- drrotmos 7y agoBecause the idea is that when you test positive, you upload DTKs for all days you could have been contagious, so that includes historical keys.
- awinter-py 7y agoohhhh makes sense. I'll update the post
- gruez 7y agoWhy not randomly generate a key for each day and store the keys for the last n days? 16 byte keys for 60 days is less than a kilobyte.
- tehlike 7y agoYou phone already stores lots of data every 10minutes, I am not sure if flash wear is a problem. Same with storage space. A guid is 16 bytes per key * 6 keys per hour 24 hours per day 365 days makes less than a megabyte. Even accounting for additional data stored where guid is the key it feels not a big concern. I imagine data stored like: Key: guid Contacts made: <timestamp, guid>[]
- gorgoiler 7y agoBecause you want to use the same protocol for 89¢ devices?
- judge2020 7y agodidn't see any info on how the "download list of infected people's keys" would work in the documents, but it seems like k-anonymity[0][1] would be a good choice for saving data on peoples' phones and mitigating the potential DOS threat. Another way the DOS attack could be prevented is perhaps requiring you to get a QR code from a government or testing facility before you can report your keys as being infected. 0: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with... 1: https://developers.google.com/safe-browsing/v4#update-api-v4 https://developers.google.com/safe-browsing/v4#update-api-v4
- donarb 7y agoThis technology is meant to be used by local health agencies like city or county. If you have the app provided by the county and you are tested positive by them, they would then ask you if you would like to share that information with others. So the chance of DOS is nil since you actually have to test positive to broadcast the keys.
- snovv_crash 7y agoSince they generate the keys anyways, why not just make a new one every 30 seconds? This would address the main concern IMO.
- kccqzy 7y agoClock drift I guess. Perhaps it's possible for the clock on two different devices to differ by more than 30 seconds.
- riedel 7y agoAlthough I think tge aproach is correct. I think the DTK period is far too long. 1 day may reveal to much information regarding movement patterns if someone has enough distributed trackers at critical spots. Also if everyone uses it I see a slight chance of bruteforcing in often visited spaces (didn't do the math). Adding more hierarchicies would allow people to share information more finegranuarly. Putting RPIs into a bloom filter and releasing them might be another idea. Critical contact would mean multiple bloom filter matches anyways .
- tinus_hn 7y agoI guess you are not aware what contact tracing is. If you get a disease like this most governments have the right to ask you where you have been and who you have seen and the need for society to be protected from your disease is seen as to trump your privacy rights. This is just another mechanical way to get the same information, except privacy gets much more protection here.
- tsimionescu 7y agoI imagine the concern is the system being highjacked by advertisers or other bad faith actors.
- tinus_hn 7y agoThis is one of the few issues that is indeed real. I’m not sure if tracking only infected people would be worth the effort and the risk of bad publicity though.
- softwarejosh 7y agocrazy to think where this tech is going after the epidemic
- PeterStuer 7y agoTrust me, you are getting chipped, it's just a matter of when. Your government and healthcare system might have been neglected, but surveillance capitalism has a plan.
- pedrocx486 7y ago>when When I die, that's when.
- ddalex 7y agoChipping is smoke and mirrors. You are already very much biometrically identifiable at large scale.
- PeterStuer 7y agoI agree with that, but still think it will happen sooner rather than later. Just like banks are making it harder and harder to use cash, and yes, you can shop without a 'loyalty card' if you are willing to pay the markup (aka forgo the reduction). https://www.npr.org/2018/10/22/658808705/thousands-of-swedes-are-inserting-microchips-under-their-skin?t=1586620231970 https://www.npr.org/2018/10/22/658808705/thousands-of-swedes...
- user_50123890 7y agoWhy does it have to be anonymous? The coronavirus is not HIV, there is no social stigma in knowing someone was infected. The biggest problem is exactly the fact that since it spreads so easily, it's impossible to reach all who have to been exposed
- hartator 7y agoWhen people actively avoid each other even for good reasons, no sure how we can argue there is no social stigma.
- andromeduck 7y agoPeople have been best for having been associated with outbreak regions in China India and the US. People have been attacked for looking different like Muslims in India or Black's/Whites in China, Asian in Europe/Americas.
- matz1 7y agoBeing different has always cause issue but we should not fix by hiding it but we should fix it by other way be it changing perception or find sameness among the difference, etc.
- awinter-py 7y agoeven if covid status isn't sensitive, location & interpersonal associate data is sensitive
- MisterTea 7y agoMaybe you work in an American office with me, a mentally unstable individual. You were the first person to get sick in the office, everyone knows it. Now I'm sick and my family is sick. Maybe I take a severe financial hit or someone is my family gets really sick, perhaps even dies. Now I'm VERY upset with you. Maybe I follow you to your car after work... maybe I follow you home. Maybe to the store. Either way, there's a gun in my waistband and I stopped giving a fuck. You sure you want me knowing you were patient zero?
- tastroder 7y ago> Given all those unknowns, I shouldn’t express an opinion on ‘do we need this’ and so I won’t. A blog post is a form of expression / opinion, isn't it? The technique is limited in time, after the pandemic I'm hoping usage will drop to zero. Coming from the two major OS vendors, we now have a point where we can get it to be shut off after the threat is contained. The proposal by Google / Apple does not touch upon the serverside other than recommending restrictions on usage of the data that is gathered and shared. > Find out if someone specific is sick Many countries already have mandatory reporting paths for infectious diseases, if you operate an office building it is likely that you will find out if somebody using that building has to quarantine themselves for a few weeks already. You will want to know if someone specific that you have been in contact with is sick. This reads like you are pointing out the main reason for why we do contact tracing in the first place as a negative leakage path. > I won’t know who they are, but I can at least grab aggregate information about where coronavirus getters travel. You do not know who they are, you can track an infected persons movement (assuming 100% coverage) at most over a single day. Existing tracking using Bluetooth and other signals a typical smartphone puts out already allows you to do more. The problem in this scenario is a lack of customer protection rights, not one of the proposal being bad. > Increased hit rate of stationary / marketing beacons Again, that's a policy issue more than a technical one and pretty US centric. As you correctly point out it also isn't new. The data they gather now will likely be less useful than what they can get with the broken MAC randomization stuff phones put out before. > Leakage of information when someone isn’t sick The alternative to the first bullet point is running around infected. The second point seems unrelated to the method of contact tracing. With existing manual contact tracing, the health authority could also tell you that you're infected and get your DNA. > Fraud resistance Most civilized countries have central reporting for positive test results, making the fraud resistance argument moot. This supplements existing, manual, contact tracing. The proposal itself has nothing to do with that part of the workflow, it merely helps app developers to take care of a crucial and previously hard part of the stack and suggests a well designed crypto scheme to ensure privacy in the scope of the exchanged data itself. The only realistic scenario in here seems like that of existing stationary marketing beacons, which I'd propose to look at in terms of realism and the tradeoff between the status quo of manual contact tracing (which is inefficient, labor intensive, and error prone). In the realism aspect, marketing firms are hardly on the edge of technology. How likely is it for a major player to upgrade their systems with this tracking capability in the timeframe of the pandemic? What insight do they gather on those infected? If you're infected you would have to realistically share a few days worth of keys.
- PeterStuer 7y agoGamification: In countries with a working social security system, getting into proximity of a known infected person can be rather easily achieved. In countries without a working social security system, staying 'clear' is easily achieved by turning of your BT or phone or even just lining your pocket with tin foil.
- dogma1138 7y agoSouth Korea and Israel both have working social security systems, universal health care, mandatory national IDs no devolution of administrative or legislative powers to local authorities, a single police force and both are relatively small countries geographically with a relatively dense population and both had to use mobile data to do contact tracing effectively.
- PeterStuer 7y agoNo, both used it, they didn't 'have to'. There is strong doubt in both cases as to whether the app had any effect at all.
- awinter-py 7y agoIf you have links about the efficacy of the tracing programs, please post -- I'm trying to educate myself about this
- narrator 7y agoGood thing I have a removable battery on my phone.
- DagAgren 7y agoWhat, so you can more effectively spread a dangerous infectious disease?
- narrator 7y agoDo you see where this is going? The end game is treating every individual in the world as a convict and potential murderer that requires 24/7 mandatory surveillance and an injected digital ID that they can't remove. Heck, we should add an immobilization capsule so we can just knock out anyone with remotely electronically released drugs who isn't obeying quarantine.
- DagAgren 7y agoAre you really expecting any sane person to take you seriously when you say shit like that.
- narrator 7y agoYes. Bill Gate's ID 2020 program is a underskin implant that holds a vaccine record that he is proposing that all will have to get to do just about anything in the future. You probably think this is a good thing and will love getting scanned everywhere and getting your regular lightly tested compulsory vaccines. It's basically parolee ankle bracelets for everyone. None other than the Attorney General recently commented on this and said it's a "slippery slope."[1] Slippery slope privacy arguments used to be totally normal on Hacker News. Now everyone's demanding their rights and privacy be taken away! [1] https://www.dailywire.com/news/ag-barr-on-bill-gates-wanting-digital-vaccine-certificates-im-very-concerned-about-slippery-slope https://www.dailywire.com/news/ag-barr-on-bill-gates-wanting...
- 7y ago
- the_mitsuhiko 7y agoI recommend everybody to look at the whitepaper which discusses this type of protocol extensively: https://github.com/DP-3T/documents/blob/master/DP3T%20White%20Paper.pdf https://github.com/DP-3T/documents/blob/master/DP3T%20White%... A lot of the arguments against this were rehashed the last few weeks over and over. As an passive participant to such discussions I can't express how tiring it is to see new people drop into these conversations without reading up on what already has been discussed beforehand.
- jka 7y agoCould you help address this lack of awareness by searching for and upvoting that project in HN post submissions and/or submitting it if not found?
- hartator 7y agoWhich part guarantee it won’t be repurposed later to track if you have been in contact with a terrorist or not? I understand this is already possible with current tech. However not sure why we should empress to make it things even easier. Specially if the only thing that protects you if the absence of mandatory uploads of your daily hashed list. It seems super easy to switch that on.
- IAmEveryone 7y agoIt’s totally useless for tracking “contacts with terrorists”, especially compared to phone records or chat metadata. Location data is far more valuable for a surveillance state, and it is already recorded in several places, including servers that are easier to get to (legally) than your phone.
- hartator 7y agoIt might be useless or it might not. And it’s not like the NSA has not been collecting in the past “useless” data for the sake of it.
- johnbellone 7y ago
- TechBro8615 7y agoAnyone who thinks this will “go away” eventually is naive. We don’t even have a definition for what the end of the pandemic looks like, nevermind an exit strategy for social distancing or these draconian tracking measures. It’s optional until it’s not, and it’s anonymous until it’s not. I don’t like this one bit.
- iso1210 7y agoThe problem is that the public are fully on the side of the Stassi -- clammouring for police to arrest people in their front gardens, confiscating inappropriate food etc. This is how liberty dies, with thunderous aplause
- pbhjpbhj 7y agoWhere are you in the World, in my locality (South-West UK) your description doesn't appear to fit. Wanting lockdown to be enforced strongly doesn't mean one is for totalitarianism. Strong inhibition of movement is necessary.
- dogma1138 7y agoConsidering that I’ve only heard these stories in the UK I’m guessing the GP is in the UK as well. And I agree the media and the public are mocking the police that does this and are quite outraged. Social distancing is to stop large gatherings not to put people in isolation. I have no problems with using technology to do contact tracing as long as there are sufficient controls around it, it’s extremely difficult to do contact tracing without it especially since people not only forget but outright lie.
- iso1210 7y agoThe UK government has proved it can't be trusted with that technology, neither can google. I'm disappointed that apple have bought into this panic. And yes, in the UK the local busybodies are complaining about people walking down the road in fancy dress, and families out together for a walk
- alkonaut 7y agoLots of comments on these topics seem to revolve around fear that democratic governments have an interest in making tracking permanent and mandatory. From the more nuanced “I don’t trust that they don’t abuse the data” to the downright dystopian paranoia “you will be chipped”. I don’t get it. We should worry about privacy issues of course, but isn’t this nearly as good as it could be and still be effective? Which democratic government could mandate the use of this type of tracking forever yet not be able to impose it against people’s will? The privacy fears feel somewhat rational but the fear that governments act with some interest that is separate from the voters’ interests seems irrational to me. Maybe I’m used to governments that people trust and that are simply doing what voters want, rather than having an agenda.
- dingaling 7y ago> Which democratic government could mandate the use of this type of tracking forever yet not be able to impose it against people’s will? First they'd have to coerce two US-based companies to implement the technology. For example, imagine UK.gov ( pop 60 million ) telling Apple ( 250 million annual iPhone sales ) to do so. Secondly they'd have to coerce their population into using the feature. Without a clear public benefit I suspect there would be workarounds and hacks within days to dilute its effectiveness. However, implement it under global public health reasons and coercion is much easier. Protect the NHS, keep your tracking app active! Don't turn your phone off when out exercising! Keep your phone with you at all times... for the public good. > Maybe I’m used to governments that people trust and that are simply doing what voters want Any such governments come to mind?
- alkonaut 7y ago> Without a clear public benefit I suspect there would be workarounds and hacks within days to dilute its effectiveness. Exaxtly. Governments can easily do this, because they already have the bigger tool at their disposal: lockdowns. People in prisons choose to wear an electronic tracker to spend the last year of a sentence at home. Their freedom was already taken, and the monitoring is a way to get some of it back. No one turns that down out of fear the government won’t remove the tracking thing around their ankle. “No thanks I don’t trust them to take it off after a year so I’m staying in the cell”, said no one ever. If you don’t trust them to take it off after a year why would you trust them to unlock your cell door? Of course the public will choose to use this tech if the alternative is less freedom. So yes people will voluntarily use this because of peer pressure and because the alternative is worse. At least they will do so in countries with high trust in goverment, the public healthcare system and a strong sense of community in crisis (this is where I would have thought the UK would be the obvious example!). “For the public good” is very persuasive to me - while “for your own good” might work better in other places. > Any such governments come to mind? Most Western European governments I would have thought? I (Scandinavian) always considered the government to be “me”, not “them”.
- shireboy 7y agoArmchair prognosticator here, but is there not a zero-knowledge proof way of doing this? A way so that neither side (or intermediate) can learn the identity of the other?