7 ms·

TracePrivately – open-source sample app using Apple's contact tracing framework

81 points by prawn 7y ago

lasdfas 7y ago
This is great. My only worry is that people shouldn't be allowed to self diagnose Covid-19. It will lead to trolls and cause tons of people self isolating unnecessarily, then eventually not using it once they realize the abuse. Maybe have the sever validate the diagnosis or have the person required to enter a code signed by the server's private key.
- conroy 7y ago
  My understanding is that to mark yourself as Covid+, you’ll need a code from a health care provider. I agree that allowing self diagnosis would ruin the entire system.
  - emptybits 7y ago
    A quick scan of the linked project suggests no such healthcare provider code is required. The source[1] suggests the flow is literally: "I Have COVID-19" -> "Are You Sure?" -> "Click OK", and that's that. Anyways, I take this project to be a proof of concept. One would hope that governments will have healthcare professionals replacing the self-diagnosis step. * hope * [1] https://github.com/CrunchyBagel/TracePrivately/blob/master/TracePrivately/Localizable.strings https://github.com/CrunchyBagel/TracePrivately/blob/master/T...
    - odensc 7y ago
      > A quick scan of the linked project suggests no such healthcare provider code is required. That's why this is a sample app and not the actual application that public health authorities will be using. See below: "A representative from Apple and Google's joint contact-tracing project said that their system similarly envisions that patients can't declare themselves infected without the help of a health care professional, who would likely confirm with a QR code." [1] [1]: https://www.wired.com/story/apple-google-contact-tracing-strengths-weaknesses/ https://www.wired.com/story/apple-google-contact-tracing-str...
    - yegle 7y ago
      If the Rolling Proximity Key is not recorded by other users (e.g. the abuser haven't put their device in a high human traffic location and intentionally broadcast your RPK), attacker uploading Diagnosis Keys will not cause any effect. If the abuser took the effort to place a device and broadcast RPK for a while, then upload the Diagnosis Keys, I'm hoping Apple or Google have a way to validate the requests is from a legit device and thus abuser would have to have a lot of devices to game the system.
    - Reelin 7y ago
      Sure, you can report any arbitrary key as positive. I can even do it right here on HN; my positive key that I just made up is "0d d8 cb 25 8a 88 aa df 6a 33 17 5f 59 ad fd bf"! ... now what? Someone has to aggregate that key (along with all the other flagged ones) somewhere, and then end users have to voluntarily choose to download the keys from that source and check for themselves if they came into contact with it. So you would have to get someone to accept your self reported positive key, and then convince a bunch of end users to trust that (apparently untrustworthy) data source. I expect that most databases will require some sort of authentication from a healthcare provider or known laboratory before they will accept a key from an end user.
    - prawn 7y ago
      Yes, just a concept. Developer tweeted about issues with government’s plan and then spent part of a day building a concept to show how it should be done, then fleshed it out to share code publicly.
- catchmeifyoucan 7y ago
  Or possibly they could take a picture of their diagnosis sheet?
exprez135 7y ago
One note: the README lists one of the objectives as to "Remain open source for independent verification", but the project is licensed under the MIT license. Since it's being designed to be a turn-key solution for governments to use, wouldn't this allow them to distribute closed-source and (potentially maliciously) modified versions?
- londons_explore 7y ago
  But license it GPL, and governments won't use it at all...
  - JoshTriplett 7y ago
    A few private companies are allergic to GPL; there's no particular reason governments would be.
    - vageli 7y ago
      > A few private companies are allergic to GPL; there's no particular reason governments would be. Many large, public (as in publicly-traded) companies also have an aversion to GPL. Most enterprises that have a technology review board or legal review of software dependencies (aka any regulated industry) have a dislike for GPL in customer-facing services.
      - JoshTriplett 7y ago
        "private companies" as opposed to "government-run", not as opposed to "publicly traded". And no, "most" enterprises aren't averse to GPL code for usage. They certainly will have policies about making their own software depend on it, but that's different from simply using it, which was the original topic here.
        vageli 7y ago
        Gotcha, seems like we just have different definitions of private and using.
devit 7y ago
I don't quite understand why Apple and Google are releasing an API instead of a single system application. This is going to create a gigantic mess as governments with limited software development competence slowly release incompatible and partially broken applications, while Apple and Google could just deploy a single solution via a system update. Also, it's much easier to make it mandatory if it's a system app (and obviously it needs to be mandatory to be useful).
- jedieaston 7y ago
  The governments each want their own app so data isn't shared with other governments, so either Apple sends out 100+ versions of an iOS update, or, they expose an API and let the governments ingest it into an app that they control, which adds privacy for the user by making it opt-in.
  - devit 7y ago
    But no data is shared with the government, so there isn't any data that gets shared with "other governments". All that is shared is a randomly generated key that can only be used by other smartphones to determine if any of the ids that they have collected come from the key.
    - bjtitus 7y ago
      > But no data is shared with the government > All that is shared is a randomly generated key thinking face I agree, though, it seems dumb to have governments anywhere near this.
    - pmiller2 7y ago
      That sounds like a massive privacy violation to me.
      - yegle 7y ago
        The only time your keys are uploaded, is when you are infected. The assumption is that if you are infectious certain privacy needs to forgo to protect others. In fact this is over simplification. The only key that will be uploaded is partial of the daily tracing key (called Diagnosis Key in the specification). Most importantly, there's no location or timestamp involved or needed. Once this Diagnosis Key is uploaded, every client (anyone who wants to know if they are potentially infected) will periodically download the batch and see if your phone has seen any of the Rolling Proximity Identifiers, and when.
nomanlagharipq 7y ago
are ok with this mod ? please visit http://ntechappspk.blogspot.com/2020/04/boo-video-status-maker-apk-mod-all.html http://ntechappspk.blogspot.com/2020/04/boo-video-status-mak...
ytdouchebags 7y ago
You guys are pieces of shit for participating in any aspect of this contact tracing thing. They are doing RSSI logging with timestamp data that can be used for precise localization of each observed BLE stack - opt in or not - and with zero requirements for a cryptographic PRNG for rolling identifiers which will result in the ability to unroll everything back to the original source. This is a garbage project that will do nothing but create a massive surveillance network that needs no connectivity to the MTSO. Not surprising from the YT homo programmer crowd. Bet you have a Dallas Mavericks mask on while you push Swift.
diebeforei485 7y ago
I actually turned off auto update on my iPhone and Apple Watch. I'm going to wait for people on here, and other security experts, to analyze the binaries to see what the new stuff really does prior to installing it. Apple has screwed up software updates before (eg. AirPods Pro[1]). 1. https://medium.com/macoclock/we-need-to-talk-about-airpods-pro-4bbd2533e031 https://medium.com/macoclock/we-need-to-talk-about-airpods-p...

81 points by prawn 7y ago

This is great. My only worry is that people shouldn't be allowed to self diagnose Covid-19. It will lead to trolls and cause tons of people self isolating unnecessarily, then eventually not using it once they realize the abuse. Maybe have the sever validate the diagnosis or have the person required to enter a code signed by the server's private key.

conroy 7y ago
My understanding is that to mark yourself as Covid+, you’ll need a code from a health care provider. I agree that allowing self diagnosis would ruin the entire system.
- emptybits 7y ago
  A quick scan of the linked project suggests no such healthcare provider code is required. The source[1] suggests the flow is literally: "I Have COVID-19" -> "Are You Sure?" -> "Click OK", and that's that. Anyways, I take this project to be a proof of concept. One would hope that governments will have healthcare professionals replacing the self-diagnosis step. * hope * [1] https://github.com/CrunchyBagel/TracePrivately/blob/master/TracePrivately/Localizable.strings https://github.com/CrunchyBagel/TracePrivately/blob/master/T...
  - odensc 7y ago
    > A quick scan of the linked project suggests no such healthcare provider code is required. That's why this is a sample app and not the actual application that public health authorities will be using. See below: "A representative from Apple and Google's joint contact-tracing project said that their system similarly envisions that patients can't declare themselves infected without the help of a health care professional, who would likely confirm with a QR code." [1] [1]: https://www.wired.com/story/apple-google-contact-tracing-strengths-weaknesses/ https://www.wired.com/story/apple-google-contact-tracing-str...
  - yegle 7y ago
    If the Rolling Proximity Key is not recorded by other users (e.g. the abuser haven't put their device in a high human traffic location and intentionally broadcast your RPK), attacker uploading Diagnosis Keys will not cause any effect. If the abuser took the effort to place a device and broadcast RPK for a while, then upload the Diagnosis Keys, I'm hoping Apple or Google have a way to validate the requests is from a legit device and thus abuser would have to have a lot of devices to game the system.
  - Reelin 7y ago
    Sure, you can report any arbitrary key as positive. I can even do it right here on HN; my positive key that I just made up is "0d d8 cb 25 8a 88 aa df 6a 33 17 5f 59 ad fd bf"! ... now what? Someone has to aggregate that key (along with all the other flagged ones) somewhere, and then end users have to voluntarily choose to download the keys from that source and check for themselves if they came into contact with it. So you would have to get someone to accept your self reported positive key, and then convince a bunch of end users to trust that (apparently untrustworthy) data source. I expect that most databases will require some sort of authentication from a healthcare provider or known laboratory before they will accept a key from an end user.
  - prawn 7y ago
    Yes, just a concept. Developer tweeted about issues with government’s plan and then spent part of a day building a concept to show how it should be done, then fleshed it out to share code publicly.
catchmeifyoucan 7y ago
Or possibly they could take a picture of their diagnosis sheet?

exprez135 7y ago

One note: the README lists one of the objectives as to "Remain open source for independent verification", but the project is licensed under the MIT license. Since it's being designed to be a turn-key solution for governments to use, wouldn't this allow them to distribute closed-source and (potentially maliciously) modified versions?

londons_explore 7y ago
But license it GPL, and governments won't use it at all...
- JoshTriplett 7y ago
  A few private companies are allergic to GPL; there's no particular reason governments would be.
  - vageli 7y ago
    > A few private companies are allergic to GPL; there's no particular reason governments would be. Many large, public (as in publicly-traded) companies also have an aversion to GPL. Most enterprises that have a technology review board or legal review of software dependencies (aka any regulated industry) have a dislike for GPL in customer-facing services.
    - JoshTriplett 7y ago
      "private companies" as opposed to "government-run", not as opposed to "publicly traded". And no, "most" enterprises aren't averse to GPL code for usage. They certainly will have policies about making their own software depend on it, but that's different from simply using it, which was the original topic here.
      - vageli 7y ago
        Gotcha, seems like we just have different definitions of private and using.

devit 7y ago

I don't quite understand why Apple and Google are releasing an API instead of a single system application. This is going to create a gigantic mess as governments with limited software development competence slowly release incompatible and partially broken applications, while Apple and Google could just deploy a single solution via a system update. Also, it's much easier to make it mandatory if it's a system app (and obviously it needs to be mandatory to be useful).

jedieaston 7y ago
The governments each want their own app so data isn't shared with other governments, so either Apple sends out 100+ versions of an iOS update, or, they expose an API and let the governments ingest it into an app that they control, which adds privacy for the user by making it opt-in.
- devit 7y ago
  But no data is shared with the government, so there isn't any data that gets shared with "other governments". All that is shared is a randomly generated key that can only be used by other smartphones to determine if any of the ids that they have collected come from the key.
  - bjtitus 7y ago
    > But no data is shared with the government > All that is shared is a randomly generated key thinking face I agree, though, it seems dumb to have governments anywhere near this.
  - pmiller2 7y ago
    That sounds like a massive privacy violation to me.
    - yegle 7y ago
      The only time your keys are uploaded, is when you are infected. The assumption is that if you are infectious certain privacy needs to forgo to protect others. In fact this is over simplification. The only key that will be uploaded is partial of the daily tracing key (called Diagnosis Key in the specification). Most importantly, there's no location or timestamp involved or needed. Once this Diagnosis Key is uploaded, every client (anyone who wants to know if they are potentially infected) will periodically download the batch and see if your phone has seen any of the Rolling Proximity Identifiers, and when.

nomanlagharipq 7y ago

are ok with this mod ? please visit http://ntechappspk.blogspot.com/2020/04/boo-video-status-maker-apk-mod-all.html http://ntechappspk.blogspot.com/2020/04/boo-video-status-mak...

ytdouchebags 7y ago

You guys are pieces of shit for participating in any aspect of this contact tracing thing. They are doing RSSI logging with timestamp data that can be used for precise localization of each observed BLE stack - opt in or not - and with zero requirements for a cryptographic PRNG for rolling identifiers which will result in the ability to unroll everything back to the original source. This is a garbage project that will do nothing but create a massive surveillance network that needs no connectivity to the MTSO. Not surprising from the YT homo programmer crowd. Bet you have a Dallas Mavericks mask on while you push Swift.

diebeforei485 7y ago

I actually turned off auto update on my iPhone and Apple Watch. I'm going to wait for people on here, and other security experts, to analyze the binaries to see what the new stuff really does prior to installing it. Apple has screwed up software updates before (eg. AirPods Pro[1]). 1. https://medium.com/macoclock/we-need-to-talk-about-airpods-pro-4bbd2533e031 https://medium.com/macoclock/we-need-to-talk-about-airpods-p...