4 ms·

No, it specifically does not. You cannot use this system to determine if two people have been in contact. It doesn’t have the capability. All you can tell is

by jmull 7y ago

No, it specifically does not. You cannot use this system to determine if two people have been in contact. It doesn’t have the capability. All you can tell is if one person who explicitly participates in the system has had contact with one or more of any of the other people who explicitly participate in the system who indicates they are infected, but not which people.

BorisTheBrave 7y ago
Is that right? My understanding is that given someone else's daily key, it can tell you whether you were in contact with that specific key. So anonymity relies on not knowing who had that key. But the (as yet unspecified) authority collecting "infected" keys will certainly know who submitted what, so you are relying on their secrecy.
- jmull 7y ago
  In this system, the collecting authority doesn’t know who submitted diagnosis keys. If you assume a malicious app installed on both party’s phones, then you might be able to do it... but then again, if you have that you don’t really need this system to track contacts. (I think on one side, you’d have to collect the daily keys and associate them when a person’s identity. Then, when you want to check a contact, you would then need to trigger an “infection” because otherwise the keys don’t leave the device. This requires user interaction, BTW, so there would be some kind of special social engineering effort to get someone to report themself as infected or else you the phone needs to be unlocked in the possession of a malicious party — or you have to hope to get “lucky” in that the person actually gets infected within 14 days of the timeframe of interest. For the other party, you’d have to feed only the specific ids of the known people you want to check against to the matching API — it only tells you if there’s a match, not which match, so unless you’re checking only one, you’d have to use a process of elimination to work it down to a specific person. I wonder if that API might be throttled, though, or otherwise limited to make that less effective. With the requirement to have malicious, cooperating apps on both sides you don’t need the Apple/Google system and you could get more useful info, like location, and with less user interaction.)
- surajrmal 7y ago
  A list of which anonymous keys came into contact with other anonymous keys is never uploaded and is never centralized. You phone only tracks which keys it has seem and polls the server to see if one of those keys has been uploaded to signal itself as infected. The only way for this system to break privacy is if the app started uploading all keys it came in contact with, and also identified who the uploader is.

by jmull 7y ago

BorisTheBrave 7y ago

Is that right? My understanding is that given someone else's daily key, it can tell you whether you were in contact with that specific key. So anonymity relies on not knowing who had that key. But the (as yet unspecified) authority collecting "infected" keys will certainly know who submitted what, so you are relying on their secrecy.

jmull 7y ago
In this system, the collecting authority doesn’t know who submitted diagnosis keys. If you assume a malicious app installed on both party’s phones, then you might be able to do it... but then again, if you have that you don’t really need this system to track contacts. (I think on one side, you’d have to collect the daily keys and associate them when a person’s identity. Then, when you want to check a contact, you would then need to trigger an “infection” because otherwise the keys don’t leave the device. This requires user interaction, BTW, so there would be some kind of special social engineering effort to get someone to report themself as infected or else you the phone needs to be unlocked in the possession of a malicious party — or you have to hope to get “lucky” in that the person actually gets infected within 14 days of the timeframe of interest. For the other party, you’d have to feed only the specific ids of the known people you want to check against to the matching API — it only tells you if there’s a match, not which match, so unless you’re checking only one, you’d have to use a process of elimination to work it down to a specific person. I wonder if that API might be throttled, though, or otherwise limited to make that less effective. With the requirement to have malicious, cooperating apps on both sides you don’t need the Apple/Google system and you could get more useful info, like location, and with less user interaction.)
surajrmal 7y ago
A list of which anonymous keys came into contact with other anonymous keys is never uploaded and is never centralized. You phone only tracks which keys it has seem and polls the server to see if one of those keys has been uploaded to signal itself as infected. The only way for this system to break privacy is if the app started uploading all keys it came in contact with, and also identified who the uploader is.