4 ms·

The authors of DP-3T have already explained the privacy holes in their scheme. It's in the trade-offs section of the paper; eavesdroppers, savvy hackers and gov

The authors of DP-3T have already explained the privacy holes in their scheme. It's in the trade-offs section of the paper; eavesdroppers, savvy hackers and governments can identify and track infected users (to varying extents) without much trouble. A tech-savvy person could drive by your house and find out your IDs for that day. If you reveal them later on (as you would if infected), that person would know you're infected. In small towns a single person could in practice publish a database of all infected households. A government can install Bluetooth receivers throughout a city and find out where an infected user passed by.

Aeolun 7y ago
Installing bluetooth receivers throughout a city is only feasible if you plan to use it for way more than just coronapatient tracking.
- mikece 7y ago
  It will compliment CCTV quite nicely... and since the former can do biometric identification then cross referencing that ID# 04d07402e5a502fb7ae0a7847853f1ac5d2a280729901a29738fb3b017135934 is really Bob Smith who lives at 1234 Main Street will be easy enough.
  - rfoo 7y ago
    I recommend actually reading the specification before imagine how to abuse it. There is no fixed, per-user ID being broadcast. Or if you don't want to, a tl;dr is: 1. Your phone broadcasts a message via BLE every X milliseconds with a "random" ID. The ID is only predictable with a secret key which never leaves user device before "voluntarily revealing" (I agree this can be shaddy). The "random" ID is rotated every Y minutes. 2. The secret key will be rotated daily. The user device only reveals last 14 keys if user voluntarily do so. 3. Note that every BLE advertisement already contains a hardware address and your phone does this regularly. Guess how they mitigate this privacy issue? Rotating the hardware address every Y minutes. So no additional entropy being leaked here, unless you have the user's secret key.
- taborj 7y ago
  I think that was the point. This is useful for coronavirus patient tacking, yes, but it's also useful for people tracking in general, and malcontent (whomever defines that) tracking in particular.
  - DagAgren 7y ago
    But it's not. There are far better ways to do that, if that is the path you're going down. This is specifically designed to make that kind of thing much harder.
DagAgren 7y ago
But are any of those at all realistic attack scenarios? A government can do much more with less effort using other means. And it's hard to see the value of making that kind of attack as an individual.

Aeolun 7y ago

Installing bluetooth receivers throughout a city is only feasible if you plan to use it for way more than just coronapatient tracking.

mikece 7y ago
It will compliment CCTV quite nicely... and since the former can do biometric identification then cross referencing that ID# 04d07402e5a502fb7ae0a7847853f1ac5d2a280729901a29738fb3b017135934 is really Bob Smith who lives at 1234 Main Street will be easy enough.
- rfoo 7y ago
  I recommend actually reading the specification before imagine how to abuse it. There is no fixed, per-user ID being broadcast. Or if you don't want to, a tl;dr is: 1. Your phone broadcasts a message via BLE every X milliseconds with a "random" ID. The ID is only predictable with a secret key which never leaves user device before "voluntarily revealing" (I agree this can be shaddy). The "random" ID is rotated every Y minutes. 2. The secret key will be rotated daily. The user device only reveals last 14 keys if user voluntarily do so. 3. Note that every BLE advertisement already contains a hardware address and your phone does this regularly. Guess how they mitigate this privacy issue? Rotating the hardware address every Y minutes. So no additional entropy being leaked here, unless you have the user's secret key.
taborj 7y ago
I think that was the point. This is useful for coronavirus patient tacking, yes, but it's also useful for people tracking in general, and malcontent (whomever defines that) tracking in particular.
- DagAgren 7y ago
  But it's not. There are far better ways to do that, if that is the path you're going down. This is specifically designed to make that kind of thing much harder.

DagAgren 7y ago

But are any of those at all realistic attack scenarios? A government can do much more with less effort using other means. And it's hard to see the value of making that kind of attack as an individual.