5 ms·

Vietnam's contact tracing app broadcasting a fixed ID

107 points by cryptbe 6y ago

dkdk8283 6y ago
Contract tracing is a disaster. I’ve secured a forensic RF shielding bag for my phone. I refuse to participate
- jariel 6y ago
  That's fine, then stay at home. You're a liability to the rest of us. It's fair if you don't want to use it, but then you cannot go anywhere near any other person, because you're putting everyone at risk.
  - throwaway122378 6y ago
    That’s a little extreme- if someone doesn’t want to be tracked they must stay at home and shamed? There are other alternatives.
    - jariel 6y ago
      So what are the alternatives exactly? Because we have the whole world on lockdown waiting for someone to tell us. Unfortunately, without a vaccine or cure - there are only 2 approaches that work: 1) Eradication - like Taiwan. They have a tiny number of cases in full quarantine. Nobody comes on or off the island without being checked. So they are in total isolation. But we can't do this. 2) Contact tracing - like Korea. They keep the virus under wraps by aggressively isolating cases, using social policy centered around contact tracing. Of course, they have masks, widespread testing, but a very asserted focus on contact management. FYI we have to get it down to low-levels before this policy can be implemented. But it works. Regular 'social distancing' does not do enough. Right now - we are coming out of our 'lockdowns' but the virus will likely just bounce back - why would it not? Other than the fact weather does play a role and it's getting warmer, there's no reason for the COVID growth to come back to where it was. So either you stay away from other people - or - at least you consent to inform them if somehow you were near them, which requires contact tracing obviously with the addition of good operational capabilities there, it's not 'just an app'.
      - throwaway122378 6y ago
        The longer the country is shut down the more lives we’ll lose to poverty related deaths. Total covid deaths are still below last seasons Flu death total and that’s Counting all the probable covid deaths that are included in this years count. That was with the population operating under pre covid lifestyle. We can get back now and take caution. Shelter those above 65 and anyone with an underlying condition. (Of course anyone should stay home if they feel the need) Everyone else back to life with social distancing and preventative measures in place (masks, no concerts etc) Build immunity and slowly bring the rest of society back. Sources: Go research. Look at the data we are way over doing it. Anything I post will be taken with a grain of salt anyway.
        ToFundorNot 6y ago
        I did. We're two days away from matching the top end estimates for 2019 flu deaths[1] And that's with an estimated ~1/30th of the infections. Based off the most liberal estimates of deaths directly related to the financial crisis, we're many multiples higher (est: 10,000+)[2] and a couple of day from being par with both direct, and indirect deaths related to stress and financial strife (assuming all the cancer patience died, which they did not) [3]. We're moving towards what you're suggesting, now that most countries have a serious testing infrastructure in place. Randomized testing, plus regular testing of the medial professionals tied with social distancing is what our near future hold. Most things open up to a limited extent, and we'll move from there. [1] https://www.hopkinsmedicine.org/health/conditions-and-diseases/coronavirus/coronavirus-disease-2019-vs-the-flu https://www.hopkinsmedicine.org/health/conditions-and-diseas... [2] https://www.bbc.com/news/health-27796628 https://www.bbc.com/news/health-27796628 [3] https://www.hsph.harvard.edu/news/press-releases/economic-downturn-excess-cancer-deaths-atun/ https://www.hsph.harvard.edu/news/press-releases/economic-do...
        dannyw 6y ago
        Actually, not exactly. The antibody tests, everywhere from NYC to California to Germany to Italy, is showing that unreported infections may be 80x as high as reported infections. In fact, entire homeless shelters have been tested with about a third being infected, and zero showing symptoms. What this means is that COVID19 is significantly less dangerous than we originally thought. 1 in 5 NYCers have antibodies; and this was sampled a week ago. Given how fast COVID spreads, it could be 1 in 4 now. This means that if we flatten the curve enough, we could possibly see ~3x the deaths (to reach a 80% infected rate) and reach herd immunity. Now, no one likes thinking about this, but is another 32K deaths worth fully re-opening NYC and getting rid of social distancing? I think it is arguable to say yes, just as it is arguable to say no. We absolutely cannot be in lockdown till a vaccine is found, we cannot stay at home for 18 months or we will witness decades of economic devastation for 7.5 billion people on the planet (given how connected the world is); not to mention all the mental health harm; as well as physical health harm (deferral of non-essential but still highly important surgeries like hip replacements; less preventative check ups from people going to doctors; etc). There are trade-offs to be made: we have cars despite the fact that they kill. We allow cigarettes despite the fact that they kill. We allow alcohol despite the fact that they kill. For anyone who this message resonates to, please join us on /r/LockdownSkepticism. We're about using logic and data discuss what the best course of action is for society as a whole.
  - Avamander 6y ago
    By going out you're already putting people at risk, tracker or no tracker attached. You and people like you, thinking this is a perfect solution, are actually a bigger liability to public health.
    - jariel 6y ago
      "By going out you're already putting people at risk, tracker or no tracker attached" This is completely false because, with contact tracing, we can probabilistically determine who has likely to have had contact and therefore be infected, which is a proven technique for the suppression of COVID. Korea has implemented this solution, it works, and their economy is open. By venturing outside without contact-tracing - we know the results: Italy, Spain etc.. Just the opposite ... it's the 'privacy fanatics' who are having difficulty grasping a situation that hits at their preconceived sensitivities. 'Just go outside' will kill is quickly. 'Shelter in place' will kill us slowly. 'Contact tracing policy - (followup, quarantine for those affected) means we can go about our business roughly as normal with only the slight inconvenience of having an 'app' on our phones and possibly wearing masks. I'm sorry but it's the anti-contact tracing people that are the tip of the anti-science community right now. Anti contact tracing people are the new 'anti-vaxxers'.
      - Avamander 6y ago
        > suppression of COVID. Exactly suppression, not prevention. If you're immunocompromised, old or in a risk group, which most americans are, you're s* out of luck, even with the app, you can't really go outside. People thinking contact tracing is the silver bullet are just delusional or outright dangerous. Especially if those people also think contact tracing can't be done privacy-friendly.
        jariel 6y ago
        "People thinking contact tracing is the silver bullet are just delusional or outright dangerous." Your ad-hominems are inappropriate, especially since you are misreading the point and inventing your own interpretation. Nobody is indicating that 'contact tracing' is a 'silver bullet' and nobody is indicating that 'people won't' die - obviously, dangers exist. However, here are the results of the 'contact tracing' policy here: [1] are extremely effective. There are less than 250 deaths in South Korea a population of 24 Million - and they do not have 'shelter in place' orders. This is very clear scientific evidence of an outstandingly effective solution against COVID, by far the best approach for those nations that cannot hope to eradicate it / keep it out like Taiwan. America has 10's of thousands dead and an economy that is hurling towards death with millions unemployed, trillions in bailouts, the worst existential calamity since WW2, and everyone is locked in their homes. The Koreans have very effectively dealt with the problem, kept harm way down their economy is mostly functional. Privacy is obviously a concern but it's nowhere near the threshold for contemplating existential collapse. Given the choice between 'stay at home' and 'contact tracing' - over 99% of people would choose 'contact tracing'. [1] https://www.worldometers.info/coronavirus/country/south-korea/ https://www.worldometers.info/coronavirus/country/south-kore...
  - dang 6y ago
    It's not ok to cross into personal attack in HN comments, so please don't. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
serf 6y ago
deleted in the interest of a fellow hacker.
- cryptbe 6y ago
  I wrote the article. I agreed. It's a bad joke. I have no intention causing harm to this system.
  - serf 6y ago
    >I have no intention causing harm to this system. I took that intent from the article, but 'professionals' aren't always as kind in their reading of things like that. Interesting article.
    - cryptbe 6y ago
      Thanks. I have no strong evidence, but it seems that Force 47 is actively monitoring my blog [1]. I've never got so many personal attacks and smear comments like I did since I published my findings. I bet one of them will cite your comment as an evidence of my "immaturity". [1] https://en.wikipedia.org/wiki/Public_opinion_brigades https://en.wikipedia.org/wiki/Public_opinion_brigades
      - serf 6y ago
        >I bet one of them will cite your comment as an evidence of my "immaturity". I have no clue whether or not your hunch is valid, but in the interest of good will I edited the comment; too late for a delete from me. Good luck, I hope your voice gets heard.
        cryptbe 6y ago
        Thanks, appreciate it! Check out this comment: https://news.ycombinator.com/item?id=22991028 https://news.ycombinator.com/item?id=22991028.
cryptbe 6y ago
Author here. One interesting aspect that I've learned is the tactics, techniques, and procedures (TTPs) of public opinion brigades, aka Force 47. They tried hard to discrete me. My initial report had an error, that is I didn't know that Bluetooth on Android needs ACCESS_FINE_LOCATION permission. A person pointed this out in a comment -- he posted and rewrote it three times. I said thank you and thought that's that, but then he and a bunch of new people commented that since I made that basic mistake I'm immature and inexperienced, therefore the rest of my findings have no merit. Someone then posted a super long comment, raising a lot of questions about my credibility and intention. The interesting thing is they claimed that they're a student, haven't installed the app, have no intention to do so, but care a lot about privacy. Essentially they want to show that they're merely an underdog bystander standing up against my wrongdoings. I thought this is a very subtle psychological trick, aiming to amplify their attacks. Other attacks are more direct. For example, a person pointed out that since I don't have many followers on Twitter, I'm not a good engineer. They said I didn't really contribute anything to my public research, but I just took credit from my coauthors. That I am only cleaning toilet at Google, there's nothing proud about that. After I posted a rebuttal to the developers' rebuttal, a guy [2] dropped this one-line comment: >cái vụ này bắt đầu thấy nhảm rồi. Lập luận của anh Thái cũng không còn chặt chẽ như trước nữa. Which translates to "This is getting nonsense. Thai's argument is not as strict as before". The title of the guy's blog [3] is, I kid you not, "There's always only one truth: Communist Party of Vietnam. [1] https://en.wikipedia.org/wiki/Public_opinion_brigades https://en.wikipedia.org/wiki/Public_opinion_brigades [2] https://www.blogger.com/profile/17567201928186857755 https://www.blogger.com/profile/17567201928186857755 [3] http://phichnuocnong.blogspot.com/ http://phichnuocnong.blogspot.com/
- makomk 6y ago
  If I remember rightly, requiring ACCESS_FINE_LOCATION for certain uses of Bluetooth on Android is a relatively new thing and the two used to be completely independent of each other, so it's not even that surprising a mistake to make.
- twomoretime 6y ago
  Sounds like you're up against some real communists. Westerners don't understand the psychology.
moneysake 6y ago
Very interesting
meotimdihia 6y ago
Vietnamese here, no one in Vietnam cares about this app. Hence the creator also doesn't care about app security.
- cryptbe 6y ago
  In less than a week, 77K people have installed the app, according to the official tally published by the developer. The growth rate is 2x-3x every day, faster than COVID-19.
lihop 6y ago
The app is open source now: https://github.com/BluezoneGlobal/bluezone-app https://github.com/BluezoneGlobal/bluezone-app. The id generation code is in this library: https://github.com/BluezoneGlobal/react-native-bluetooth-scan https://github.com/BluezoneGlobal/react-native-bluetooth-sca...

107 points by cryptbe 6y ago

dkdk8283 6y ago

Contract tracing is a disaster. I’ve secured a forensic RF shielding bag for my phone. I refuse to participate

jariel 6y ago
That's fine, then stay at home. You're a liability to the rest of us. It's fair if you don't want to use it, but then you cannot go anywhere near any other person, because you're putting everyone at risk.
- throwaway122378 6y ago
  That’s a little extreme- if someone doesn’t want to be tracked they must stay at home and shamed? There are other alternatives.
  - jariel 6y ago
    So what are the alternatives exactly? Because we have the whole world on lockdown waiting for someone to tell us. Unfortunately, without a vaccine or cure - there are only 2 approaches that work: 1) Eradication - like Taiwan. They have a tiny number of cases in full quarantine. Nobody comes on or off the island without being checked. So they are in total isolation. But we can't do this. 2) Contact tracing - like Korea. They keep the virus under wraps by aggressively isolating cases, using social policy centered around contact tracing. Of course, they have masks, widespread testing, but a very asserted focus on contact management. FYI we have to get it down to low-levels before this policy can be implemented. But it works. Regular 'social distancing' does not do enough. Right now - we are coming out of our 'lockdowns' but the virus will likely just bounce back - why would it not? Other than the fact weather does play a role and it's getting warmer, there's no reason for the COVID growth to come back to where it was. So either you stay away from other people - or - at least you consent to inform them if somehow you were near them, which requires contact tracing obviously with the addition of good operational capabilities there, it's not 'just an app'.
    - throwaway122378 6y ago
      The longer the country is shut down the more lives we’ll lose to poverty related deaths. Total covid deaths are still below last seasons Flu death total and that’s Counting all the probable covid deaths that are included in this years count. That was with the population operating under pre covid lifestyle. We can get back now and take caution. Shelter those above 65 and anyone with an underlying condition. (Of course anyone should stay home if they feel the need) Everyone else back to life with social distancing and preventative measures in place (masks, no concerts etc) Build immunity and slowly bring the rest of society back. Sources: Go research. Look at the data we are way over doing it. Anything I post will be taken with a grain of salt anyway.
      - ToFundorNot 6y ago
        I did. We're two days away from matching the top end estimates for 2019 flu deaths[1] And that's with an estimated ~1/30th of the infections. Based off the most liberal estimates of deaths directly related to the financial crisis, we're many multiples higher (est: 10,000+)[2] and a couple of day from being par with both direct, and indirect deaths related to stress and financial strife (assuming all the cancer patience died, which they did not) [3]. We're moving towards what you're suggesting, now that most countries have a serious testing infrastructure in place. Randomized testing, plus regular testing of the medial professionals tied with social distancing is what our near future hold. Most things open up to a limited extent, and we'll move from there. [1] https://www.hopkinsmedicine.org/health/conditions-and-diseases/coronavirus/coronavirus-disease-2019-vs-the-flu https://www.hopkinsmedicine.org/health/conditions-and-diseas... [2] https://www.bbc.com/news/health-27796628 https://www.bbc.com/news/health-27796628 [3] https://www.hsph.harvard.edu/news/press-releases/economic-downturn-excess-cancer-deaths-atun/ https://www.hsph.harvard.edu/news/press-releases/economic-do...
        dannyw 6y ago
        Actually, not exactly. The antibody tests, everywhere from NYC to California to Germany to Italy, is showing that unreported infections may be 80x as high as reported infections. In fact, entire homeless shelters have been tested with about a third being infected, and zero showing symptoms. What this means is that COVID19 is significantly less dangerous than we originally thought. 1 in 5 NYCers have antibodies; and this was sampled a week ago. Given how fast COVID spreads, it could be 1 in 4 now. This means that if we flatten the curve enough, we could possibly see ~3x the deaths (to reach a 80% infected rate) and reach herd immunity. Now, no one likes thinking about this, but is another 32K deaths worth fully re-opening NYC and getting rid of social distancing? I think it is arguable to say yes, just as it is arguable to say no. We absolutely cannot be in lockdown till a vaccine is found, we cannot stay at home for 18 months or we will witness decades of economic devastation for 7.5 billion people on the planet (given how connected the world is); not to mention all the mental health harm; as well as physical health harm (deferral of non-essential but still highly important surgeries like hip replacements; less preventative check ups from people going to doctors; etc). There are trade-offs to be made: we have cars despite the fact that they kill. We allow cigarettes despite the fact that they kill. We allow alcohol despite the fact that they kill. For anyone who this message resonates to, please join us on /r/LockdownSkepticism. We're about using logic and data discuss what the best course of action is for society as a whole.
- Avamander 6y ago
  By going out you're already putting people at risk, tracker or no tracker attached. You and people like you, thinking this is a perfect solution, are actually a bigger liability to public health.
  - jariel 6y ago
    "By going out you're already putting people at risk, tracker or no tracker attached" This is completely false because, with contact tracing, we can probabilistically determine who has likely to have had contact and therefore be infected, which is a proven technique for the suppression of COVID. Korea has implemented this solution, it works, and their economy is open. By venturing outside without contact-tracing - we know the results: Italy, Spain etc.. Just the opposite ... it's the 'privacy fanatics' who are having difficulty grasping a situation that hits at their preconceived sensitivities. 'Just go outside' will kill is quickly. 'Shelter in place' will kill us slowly. 'Contact tracing policy - (followup, quarantine for those affected) means we can go about our business roughly as normal with only the slight inconvenience of having an 'app' on our phones and possibly wearing masks. I'm sorry but it's the anti-contact tracing people that are the tip of the anti-science community right now. Anti contact tracing people are the new 'anti-vaxxers'.
    - Avamander 6y ago
      > suppression of COVID. Exactly suppression, not prevention. If you're immunocompromised, old or in a risk group, which most americans are, you're s* out of luck, even with the app, you can't really go outside. People thinking contact tracing is the silver bullet are just delusional or outright dangerous. Especially if those people also think contact tracing can't be done privacy-friendly.
      - jariel 6y ago
        "People thinking contact tracing is the silver bullet are just delusional or outright dangerous." Your ad-hominems are inappropriate, especially since you are misreading the point and inventing your own interpretation. Nobody is indicating that 'contact tracing' is a 'silver bullet' and nobody is indicating that 'people won't' die - obviously, dangers exist. However, here are the results of the 'contact tracing' policy here: [1] are extremely effective. There are less than 250 deaths in South Korea a population of 24 Million - and they do not have 'shelter in place' orders. This is very clear scientific evidence of an outstandingly effective solution against COVID, by far the best approach for those nations that cannot hope to eradicate it / keep it out like Taiwan. America has 10's of thousands dead and an economy that is hurling towards death with millions unemployed, trillions in bailouts, the worst existential calamity since WW2, and everyone is locked in their homes. The Koreans have very effectively dealt with the problem, kept harm way down their economy is mostly functional. Privacy is obviously a concern but it's nowhere near the threshold for contemplating existential collapse. Given the choice between 'stay at home' and 'contact tracing' - over 99% of people would choose 'contact tracing'. [1] https://www.worldometers.info/coronavirus/country/south-korea/ https://www.worldometers.info/coronavirus/country/south-kore...
- dang 6y ago
  It's not ok to cross into personal attack in HN comments, so please don't. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

serf 6y ago

deleted in the interest of a fellow hacker.

cryptbe 6y ago
I wrote the article. I agreed. It's a bad joke. I have no intention causing harm to this system.
- serf 6y ago
  >I have no intention causing harm to this system. I took that intent from the article, but 'professionals' aren't always as kind in their reading of things like that. Interesting article.
  - cryptbe 6y ago
    Thanks. I have no strong evidence, but it seems that Force 47 is actively monitoring my blog [1]. I've never got so many personal attacks and smear comments like I did since I published my findings. I bet one of them will cite your comment as an evidence of my "immaturity". [1] https://en.wikipedia.org/wiki/Public_opinion_brigades https://en.wikipedia.org/wiki/Public_opinion_brigades
    - serf 6y ago
      >I bet one of them will cite your comment as an evidence of my "immaturity". I have no clue whether or not your hunch is valid, but in the interest of good will I edited the comment; too late for a delete from me. Good luck, I hope your voice gets heard.
      - cryptbe 6y ago
        Thanks, appreciate it! Check out this comment: https://news.ycombinator.com/item?id=22991028 https://news.ycombinator.com/item?id=22991028.

cryptbe 6y ago

Author here. One interesting aspect that I've learned is the tactics, techniques, and procedures (TTPs) of public opinion brigades, aka Force 47. They tried hard to discrete me. My initial report had an error, that is I didn't know that Bluetooth on Android needs ACCESS_FINE_LOCATION permission. A person pointed this out in a comment -- he posted and rewrote it three times. I said thank you and thought that's that, but then he and a bunch of new people commented that since I made that basic mistake I'm immature and inexperienced, therefore the rest of my findings have no merit. Someone then posted a super long comment, raising a lot of questions about my credibility and intention. The interesting thing is they claimed that they're a student, haven't installed the app, have no intention to do so, but care a lot about privacy. Essentially they want to show that they're merely an underdog bystander standing up against my wrongdoings. I thought this is a very subtle psychological trick, aiming to amplify their attacks. Other attacks are more direct. For example, a person pointed out that since I don't have many followers on Twitter, I'm not a good engineer. They said I didn't really contribute anything to my public research, but I just took credit from my coauthors. That I am only cleaning toilet at Google, there's nothing proud about that. After I posted a rebuttal to the developers' rebuttal, a guy [2] dropped this one-line comment: >cái vụ này bắt đầu thấy nhảm rồi. Lập luận của anh Thái cũng không còn chặt chẽ như trước nữa. Which translates to "This is getting nonsense. Thai's argument is not as strict as before". The title of the guy's blog [3] is, I kid you not, "There's always only one truth: Communist Party of Vietnam. [1] https://en.wikipedia.org/wiki/Public_opinion_brigades https://en.wikipedia.org/wiki/Public_opinion_brigades [2] https://www.blogger.com/profile/17567201928186857755 https://www.blogger.com/profile/17567201928186857755 [3] http://phichnuocnong.blogspot.com/ http://phichnuocnong.blogspot.com/

makomk 6y ago
If I remember rightly, requiring ACCESS_FINE_LOCATION for certain uses of Bluetooth on Android is a relatively new thing and the two used to be completely independent of each other, so it's not even that surprising a mistake to make.
twomoretime 6y ago
Sounds like you're up against some real communists. Westerners don't understand the psychology.

moneysake 6y ago

Very interesting

meotimdihia 6y ago

Vietnamese here, no one in Vietnam cares about this app. Hence the creator also doesn't care about app security.

cryptbe 6y ago
In less than a week, 77K people have installed the app, according to the official tally published by the developer. The growth rate is 2x-3x every day, faster than COVID-19.

lihop 6y ago

The app is open source now: https://github.com/BluezoneGlobal/bluezone-app https://github.com/BluezoneGlobal/bluezone-app. The id generation code is in this library: https://github.com/BluezoneGlobal/react-native-bluetooth-scan https://github.com/BluezoneGlobal/react-native-bluetooth-sca...