4 ms·

This system goes to quite some lengths to preserve privacy. If you are going to attack it, you need to actually address what it does and explain why you don't

This system goes to quite some lengths to preserve privacy. If you are going to attack it, you need to actually address what it does and explain why you don't think that is sufficient.

joekrill 7y ago
_This_ particular version of the system does, yes. But the next iteration may slightly weaken the privacy for some "legitimate" reason. And the next version slightly more. Then just a bit more. All for seemingly legitimate reasons. That's the slippery slope.
- shadowgovt 7y ago
  That's not a very impressive slippery slope if we've just concluded that the first step of it is horizontal. If this system goes to some lengths to preserve privacy, slippery slope argument doesn't really apply.
  - taborj 7y ago
    That's a false sense of security. Change often starts with a lateral move, but one closer to the slope being acceptable.
    - shadowgovt 7y ago
      Great. Then we should keep an eye out for the actual thing that's down the slope. Forgoing useful technologies because a slope exists is like refusing to mine coal because the uranium nearby could some day be used to build atomic bombs.
      - drivingmenuts 7y ago
        Neither of your example minerals are particularly healthy for humans, nor can they be made so without extreme efforts.
        shadowgovt 7y ago
        But we can agree there's a world of difference. There isn't a massive international storage and handling agreement for coal and its waste products, and no country has ever been preemptively bombed over mining too much coal.
- DagAgren 7y ago
  Why not just ask telecom companies for all their data? Quicker, stealthier and much easier. There is not NEED to use this scheme in such a convoluted way. There are far better ways to spy, and the way to protect against it is through politics and laws.
  - shadowgovt 7y ago
    Exactly. People worrying about what their smartphones could be leaking via a convoluted point-to-point aggregation process while every telephone conversation and email is routed through dozens of third-party machines with unaccountable auditing going on.
FartyMcFarter 7y ago
The authors of DP-3T have already explained the privacy holes in their scheme. It's in the trade-offs section of the paper; eavesdroppers, savvy hackers and governments can identify and track infected users (to varying extents) without much trouble. A tech-savvy person could drive by your house and find out your IDs for that day. If you reveal them later on (as you would if infected), that person would know you're infected. In small towns a single person could in practice publish a database of all infected households. A government can install Bluetooth receivers throughout a city and find out where an infected user passed by.
- Aeolun 7y ago
  Installing bluetooth receivers throughout a city is only feasible if you plan to use it for way more than just coronapatient tracking.
  - mikece 7y ago
    It will compliment CCTV quite nicely... and since the former can do biometric identification then cross referencing that ID# 04d07402e5a502fb7ae0a7847853f1ac5d2a280729901a29738fb3b017135934 is really Bob Smith who lives at 1234 Main Street will be easy enough.
    - rfoo 7y ago
      I recommend actually reading the specification before imagine how to abuse it. There is no fixed, per-user ID being broadcast. Or if you don't want to, a tl;dr is: 1. Your phone broadcasts a message via BLE every X milliseconds with a "random" ID. The ID is only predictable with a secret key which never leaves user device before "voluntarily revealing" (I agree this can be shaddy). The "random" ID is rotated every Y minutes. 2. The secret key will be rotated daily. The user device only reveals last 14 keys if user voluntarily do so. 3. Note that every BLE advertisement already contains a hardware address and your phone does this regularly. Guess how they mitigate this privacy issue? Rotating the hardware address every Y minutes. So no additional entropy being leaked here, unless you have the user's secret key.
  - 7y ago
mikece 7y ago
"OMG! We know ID 04d07402e5a502fb7ae0a7847853f1ac5d2a280729901a29738fb3b017135934 is infected and not quarantining but we have no idea who they are! If only this system weren't built for security we could save the elderly! Won't someone please think of grandma?" You really think that won't be the predicate for abandoning security and anonymity?
- rfoo 7y ago
  But wait, with this system the infected ones have to voluntarily reveal their ID, otherwise nobody knows what their ID are. So how is "We know ID .... is infected but we have no idea who they are" possible? edit: and no, the observable "ID" is not fixed, so you can't link two unknown IDs.

This system goes to quite some lengths to preserve privacy. If you are going to attack it, you need to actually address what it does and explain why you don't think that is sufficient.

joekrill 7y ago

_This_ particular version of the system does, yes. But the next iteration may slightly weaken the privacy for some "legitimate" reason. And the next version slightly more. Then just a bit more. All for seemingly legitimate reasons. That's the slippery slope.

shadowgovt 7y ago
That's not a very impressive slippery slope if we've just concluded that the first step of it is horizontal. If this system goes to some lengths to preserve privacy, slippery slope argument doesn't really apply.
- taborj 7y ago
  That's a false sense of security. Change often starts with a lateral move, but one closer to the slope being acceptable.
  - shadowgovt 7y ago
    Great. Then we should keep an eye out for the actual thing that's down the slope. Forgoing useful technologies because a slope exists is like refusing to mine coal because the uranium nearby could some day be used to build atomic bombs.
    - drivingmenuts 7y ago
      Neither of your example minerals are particularly healthy for humans, nor can they be made so without extreme efforts.
      - shadowgovt 7y ago
        But we can agree there's a world of difference. There isn't a massive international storage and handling agreement for coal and its waste products, and no country has ever been preemptively bombed over mining too much coal.
DagAgren 7y ago
Why not just ask telecom companies for all their data? Quicker, stealthier and much easier. There is not NEED to use this scheme in such a convoluted way. There are far better ways to spy, and the way to protect against it is through politics and laws.
- shadowgovt 7y ago
  Exactly. People worrying about what their smartphones could be leaking via a convoluted point-to-point aggregation process while every telephone conversation and email is routed through dozens of third-party machines with unaccountable auditing going on.

FartyMcFarter 7y ago

The authors of DP-3T have already explained the privacy holes in their scheme. It's in the trade-offs section of the paper; eavesdroppers, savvy hackers and governments can identify and track infected users (to varying extents) without much trouble. A tech-savvy person could drive by your house and find out your IDs for that day. If you reveal them later on (as you would if infected), that person would know you're infected. In small towns a single person could in practice publish a database of all infected households. A government can install Bluetooth receivers throughout a city and find out where an infected user passed by.

Aeolun 7y ago
Installing bluetooth receivers throughout a city is only feasible if you plan to use it for way more than just coronapatient tracking.
- mikece 7y ago
  It will compliment CCTV quite nicely... and since the former can do biometric identification then cross referencing that ID# 04d07402e5a502fb7ae0a7847853f1ac5d2a280729901a29738fb3b017135934 is really Bob Smith who lives at 1234 Main Street will be easy enough.
  - rfoo 7y ago
    I recommend actually reading the specification before imagine how to abuse it. There is no fixed, per-user ID being broadcast. Or if you don't want to, a tl;dr is: 1. Your phone broadcasts a message via BLE every X milliseconds with a "random" ID. The ID is only predictable with a secret key which never leaves user device before "voluntarily revealing" (I agree this can be shaddy). The "random" ID is rotated every Y minutes. 2. The secret key will be rotated daily. The user device only reveals last 14 keys if user voluntarily do so. 3. Note that every BLE advertisement already contains a hardware address and your phone does this regularly. Guess how they mitigate this privacy issue? Rotating the hardware address every Y minutes. So no additional entropy being leaked here, unless you have the user's secret key.
- 7y ago

mikece 7y ago

"OMG! We know ID 04d07402e5a502fb7ae0a7847853f1ac5d2a280729901a29738fb3b017135934 is infected and not quarantining but we have no idea who they are! If only this system weren't built for security we could save the elderly! Won't someone please think of grandma?" You really think that won't be the predicate for abandoning security and anonymity?

rfoo 7y ago
But wait, with this system the infected ones have to voluntarily reveal their ID, otherwise nobody knows what their ID are. So how is "We know ID .... is infected but we have no idea who they are" possible? edit: and no, the observable "ID" is not fixed, so you can't link two unknown IDs.