8 ms·

Summary: Germany is moving away from a centralized approach (PEPP-PT = Pan-European Privacy-Preserving Proximity Tracing) to a decentralized one (like DP-3T = D

by svat 7y ago

Summary: Germany is moving away from a centralized approach (PEPP-PT = Pan-European Privacy-Preserving Proximity Tracing) to a decentralized one (like DP-3T = Decentralised Privacy-Preserving Proximity Tracing). A nice comic version of DP-3T, by Nicky Case, is available here: https://ncase.me/contact-tracing/ https://ncase.me/contact-tracing/ (But is the Apple-Google protocol identical to DP-3T, or does the headline mention “Apple-Google approach” just for simplicity? I heard there are some minor differences…)

cm2187 7y ago
I found that Steve Gibson’s description was both more technical and still very simple to follow, for those interested: https://m.youtube.com/watch?v=Z3DZ3St3QRw https://m.youtube.com/watch?v=Z3DZ3St3QRw Starts at about 1:19.
- MaxBarraclough 7y ago
  Better link: https://youtu.be/Z3DZ3St3QRw?t=4748 https://youtu.be/Z3DZ3St3QRw?t=4748 Edit Gibson is a good explainer, but it's just a video of the two podcasters. It could be much clearer with visual aids.
0xBeefFed 7y ago
There are some differences. DP-3T proposes two different systems, one with linkable tokens and the other without linkable tokens. The first system is similar to Apple-Google in the sense that your tokens for a day are derived from a key which is uploaded to a central distribution server when you test positive. In the second system the tokens are not linkable and they propose the use of a Cuckoo Filter to reduce the space complexity. A Cuckoo Filter is a probabilistic data structure that can tell you if an item is not or might be in a set. As a result there are some false positives. DP-3T also explains how records are uploaded to a central server and the interactions with health-care providers. Apple-Google omit this part and focus on proximity data collection. Edit: Formatting + I wrote a survey paper on a few of the distributed protocols and how they defend against linkage attacks (de-anonymization): https://github.com/robertTheHub/ContactTracingSurvey/blob/master/ContactTracing.pdf https://github.com/robertTheHub/ContactTracingSurvey/blob/ma...
- matthewdgreen 7y ago
  It seems unlikely that anyone will deploy a version of DP-3T that differs significantly from the approach built into Android and iOS, due to the need for apps to obtain special permissions to run in the background. So the alternative variants that go under that brand are probably a dead letter.
  - Reelin 7y ago
    Can an app not simply ask the user for, and subsequently be granted, the necessary permissions? At least on Android I had understood it to work that way in theory, although in practice perhaps it doesn't always behave ideally (https://support.google.com/pixelphone/thread/6068458?hl=en https://support.google.com/pixelphone/thread/6068458?hl=en). Edit: I see now that it's specifically iOS that doesn't provide for granting the required permissions. I find such lack of control over a device that one supposedly owns highly concerning at best.
    - cheerlessbog 7y ago
      Guess: many people would tap OK without thinking about it (they don’t understand or care what background means) then would be unhappy that their battery drains..
      - Reelin 7y ago
        It seems to me that restricting freedoms to combat ignorance is unlikely to have a desirable outcome. To your specific example, I suspect that bluntly warning that granting the permission has the potential to lead to significant loss of battery life would get even the most technically illiterate user's attention. More generally, how are background streaming services supposed to work on the iPhone? Does Apple have to individually approve every app that wishes to do so (ex Spotify, Pandora, ...)?
        fhars 7y ago
        No, they would just click anything that makes that dialog that stands between them and their goal of installing the app go away without reading the text and then be unhappy that their battery drains. Any design that relies on a confirmation dialog is fundamentally broken. Even technically competent users will read most confirmation dialogs as „Let me do what I want [Abort] [OK]“ no matter what you actually write there. In many situations we may not have better solutions, but that doesn‘t change the fact that this is terrible.
SlowRobotAhead 7y ago
That's a good comic for an overview, but with a lot of assumptions. Like that Alice can limit what she reports, that 30 seconds or 5 minutes or any amount of time is a "contact" this is entirely undefined as far as I know, that Alice could be compelled to release this data (4th and 5th amendment cases possible), that there will likely be no open source alternatives to the centralized AppleGoogle plan where both will want to build into the OS, doesn't say that just because the "public data" was X that there isn't also meta data Y that a mfg could add and supplement (like GPS data) and just the whole idea of opt-out might be questionable now and impossible later. It's a good idea to show how it could be privacy "OK" , but doesn't even hint on a reality that this might not be a road we want to go down - paved best intentions and all that.
- azernik 7y ago
  1. Alice limiting what she reports is a function of her phone software; this is trivially doable by just not broadcasting beacons, or after-the-fact by not reporting your beacons (or reporting false beacons) for certain times. 2. The number of minutes is a threshold decided by epidemiologists, programmed into people's phone, as a public-policy heuristic. It doesn't need to be perfect, just to catch a lot of the actual contacts in its filter while avoiding too many false positives - even quarantining 50 or 60% of contacts can reduce spread by a lot! 3. You could be compelled to release data, but all you would get is a list of beacons; you'd then have to also subpoena/steal everyone else's records of whose beacons they saw (this data stays on local devices!) and correlate encounters with actual locations. This is HARD - like, nation-state actor hard. Like, nation-state intelligence agency hard, probably beyond the reach of your average criminal-justice apparatus. 4. DP3T already has open-source implementations (e.g. https://github.com/DP-3T/dp3t-app-android https://github.com/DP-3T/dp3t-app-android). 5. If your threat model is "my phone/OS manufacturer will publish code that doesn't follow the protocol", then you're screwed anyway. (And in fact, Apple and Google aren't following this protocol, they're coming out with their own joint system that they claim is DP3T-inspired.)
  - SlowRobotAhead 7y ago
    1. You clearly didn’t reference the panel where Alice is choosing to upload data with exempting sections from it. 3. Yea, that’s great and all. The point is that you may compelled to upload your contacts - NOT your beacons. You are collecting people you met. You likely do understand some of the ways contract testing could be abused. Think about police trying to prove contact with someone they do have beacons for. 5. So why bother with passcodes, or any security at all anywhere for any new or existing feature? This is a slight evolution on “I have nothing to hide”.
takeda 7y ago
Too bad that (at least on Android an app that needs to use Bluetooth also needs GPS permission. So there's still will be a concern about privacy. I don't understand why these two permissions needs to be together.
- tsbinz 7y ago
  If you don't trust the app to not localize/track you, you also don't want to give it BT permissions. BT on its own is enough to localize/track you pretty well in cities, which was one of the reasons people didn't like the idea of a centralized database of BT contacts ...
- grey-area 7y ago
  Probably because bluetooth alone could give away your location with beacons.
  - andybak 7y ago
    Could you not have a separate permission based on bluetooth profile? Not all bluetooth devices are location privacy threats to the same degree.
1ko 7y ago
Is there already a working app that people can install and use?
- qzervaas 7y ago
  I’m building one here, using a mock implementation of Apple’s framework based on their documentation: https://github.com/CrunchyBagel/TracePrivately/ https://github.com/CrunchyBagel/TracePrivately/
sllabres 7y ago
Can someone explain who invents this abbreviations? The PP-PT and P-3T parts are are exactly the same except completely differently shorted. In P-3T the "3" is in reference to the "P", not the "T", so i would think it should be either DPP-PT or maybe D3PT. Then the hyphen in the first abbreviation are at exactly different positions when spelled out: PEPP-PT vs Pan-European Privacy-Preserving Proximity Tracing.

by svat 7y ago

cm2187 7y ago

I found that Steve Gibson’s description was both more technical and still very simple to follow, for those interested: https://m.youtube.com/watch?v=Z3DZ3St3QRw https://m.youtube.com/watch?v=Z3DZ3St3QRw Starts at about 1:19.

MaxBarraclough 7y ago
Better link: https://youtu.be/Z3DZ3St3QRw?t=4748 https://youtu.be/Z3DZ3St3QRw?t=4748 Edit Gibson is a good explainer, but it's just a video of the two podcasters. It could be much clearer with visual aids.

0xBeefFed 7y ago

There are some differences. DP-3T proposes two different systems, one with linkable tokens and the other without linkable tokens. The first system is similar to Apple-Google in the sense that your tokens for a day are derived from a key which is uploaded to a central distribution server when you test positive. In the second system the tokens are not linkable and they propose the use of a Cuckoo Filter to reduce the space complexity. A Cuckoo Filter is a probabilistic data structure that can tell you if an item is not or might be in a set. As a result there are some false positives. DP-3T also explains how records are uploaded to a central server and the interactions with health-care providers. Apple-Google omit this part and focus on proximity data collection. Edit: Formatting + I wrote a survey paper on a few of the distributed protocols and how they defend against linkage attacks (de-anonymization): https://github.com/robertTheHub/ContactTracingSurvey/blob/master/ContactTracing.pdf https://github.com/robertTheHub/ContactTracingSurvey/blob/ma...

matthewdgreen 7y ago
It seems unlikely that anyone will deploy a version of DP-3T that differs significantly from the approach built into Android and iOS, due to the need for apps to obtain special permissions to run in the background. So the alternative variants that go under that brand are probably a dead letter.
- Reelin 7y ago
  Can an app not simply ask the user for, and subsequently be granted, the necessary permissions? At least on Android I had understood it to work that way in theory, although in practice perhaps it doesn't always behave ideally (https://support.google.com/pixelphone/thread/6068458?hl=en https://support.google.com/pixelphone/thread/6068458?hl=en). Edit: I see now that it's specifically iOS that doesn't provide for granting the required permissions. I find such lack of control over a device that one supposedly owns highly concerning at best.
  - cheerlessbog 7y ago
    Guess: many people would tap OK without thinking about it (they don’t understand or care what background means) then would be unhappy that their battery drains..
    - Reelin 7y ago
      It seems to me that restricting freedoms to combat ignorance is unlikely to have a desirable outcome. To your specific example, I suspect that bluntly warning that granting the permission has the potential to lead to significant loss of battery life would get even the most technically illiterate user's attention. More generally, how are background streaming services supposed to work on the iPhone? Does Apple have to individually approve every app that wishes to do so (ex Spotify, Pandora, ...)?
      - fhars 7y ago
        No, they would just click anything that makes that dialog that stands between them and their goal of installing the app go away without reading the text and then be unhappy that their battery drains. Any design that relies on a confirmation dialog is fundamentally broken. Even technically competent users will read most confirmation dialogs as „Let me do what I want [Abort] [OK]“ no matter what you actually write there. In many situations we may not have better solutions, but that doesn‘t change the fact that this is terrible.

SlowRobotAhead 7y ago

That's a good comic for an overview, but with a lot of assumptions. Like that Alice can limit what she reports, that 30 seconds or 5 minutes or any amount of time is a "contact" this is entirely undefined as far as I know, that Alice could be compelled to release this data (4th and 5th amendment cases possible), that there will likely be no open source alternatives to the centralized AppleGoogle plan where both will want to build into the OS, doesn't say that just because the "public data" was X that there isn't also meta data Y that a mfg could add and supplement (like GPS data) and just the whole idea of opt-out might be questionable now and impossible later. It's a good idea to show how it could be privacy "OK" , but doesn't even hint on a reality that this might not be a road we want to go down - paved best intentions and all that.

azernik 7y ago
1. Alice limiting what she reports is a function of her phone software; this is trivially doable by just not broadcasting beacons, or after-the-fact by not reporting your beacons (or reporting false beacons) for certain times. 2. The number of minutes is a threshold decided by epidemiologists, programmed into people's phone, as a public-policy heuristic. It doesn't need to be perfect, just to catch a lot of the actual contacts in its filter while avoiding too many false positives - even quarantining 50 or 60% of contacts can reduce spread by a lot! 3. You could be compelled to release data, but all you would get is a list of beacons; you'd then have to also subpoena/steal everyone else's records of whose beacons they saw (this data stays on local devices!) and correlate encounters with actual locations. This is HARD - like, nation-state actor hard. Like, nation-state intelligence agency hard, probably beyond the reach of your average criminal-justice apparatus. 4. DP3T already has open-source implementations (e.g. https://github.com/DP-3T/dp3t-app-android https://github.com/DP-3T/dp3t-app-android). 5. If your threat model is "my phone/OS manufacturer will publish code that doesn't follow the protocol", then you're screwed anyway. (And in fact, Apple and Google aren't following this protocol, they're coming out with their own joint system that they claim is DP3T-inspired.)
- SlowRobotAhead 7y ago
  1. You clearly didn’t reference the panel where Alice is choosing to upload data with exempting sections from it. 3. Yea, that’s great and all. The point is that you may compelled to upload your contacts - NOT your beacons. You are collecting people you met. You likely do understand some of the ways contract testing could be abused. Think about police trying to prove contact with someone they do have beacons for. 5. So why bother with passcodes, or any security at all anywhere for any new or existing feature? This is a slight evolution on “I have nothing to hide”.

takeda 7y ago

Too bad that (at least on Android an app that needs to use Bluetooth also needs GPS permission. So there's still will be a concern about privacy. I don't understand why these two permissions needs to be together.

tsbinz 7y ago
If you don't trust the app to not localize/track you, you also don't want to give it BT permissions. BT on its own is enough to localize/track you pretty well in cities, which was one of the reasons people didn't like the idea of a centralized database of BT contacts ...
grey-area 7y ago
Probably because bluetooth alone could give away your location with beacons.
- andybak 7y ago
  Could you not have a separate permission based on bluetooth profile? Not all bluetooth devices are location privacy threats to the same degree.

1ko 7y ago

Is there already a working app that people can install and use?

qzervaas 7y ago
I’m building one here, using a mock implementation of Apple’s framework based on their documentation: https://github.com/CrunchyBagel/TracePrivately/ https://github.com/CrunchyBagel/TracePrivately/

sllabres 7y ago

Can someone explain who invents this abbreviations? The PP-PT and P-3T parts are are exactly the same except completely differently shorted. In P-3T the "3" is in reference to the "P", not the "T", so i would think it should be either DPP-PT or maybe D3PT. Then the hyphen in the first abbreviation are at exactly different positions when spelled out: PEPP-PT vs Pan-European Privacy-Preserving Proximity Tracing.