5 ms·

That's a good comic for an overview, but with a lot of assumptions. Like that Alice can limit what she reports, that 30 seconds or 5 minutes or any amount of ti

That's a good comic for an overview, but with a lot of assumptions. Like that Alice can limit what she reports, that 30 seconds or 5 minutes or any amount of time is a "contact" this is entirely undefined as far as I know, that Alice could be compelled to release this data (4th and 5th amendment cases possible), that there will likely be no open source alternatives to the centralized AppleGoogle plan where both will want to build into the OS, doesn't say that just because the "public data" was X that there isn't also meta data Y that a mfg could add and supplement (like GPS data) and just the whole idea of opt-out might be questionable now and impossible later. It's a good idea to show how it could be privacy "OK" , but doesn't even hint on a reality that this might not be a road we want to go down - paved best intentions and all that.

azernik 6y ago
1. Alice limiting what she reports is a function of her phone software; this is trivially doable by just not broadcasting beacons, or after-the-fact by not reporting your beacons (or reporting false beacons) for certain times. 2. The number of minutes is a threshold decided by epidemiologists, programmed into people's phone, as a public-policy heuristic. It doesn't need to be perfect, just to catch a lot of the actual contacts in its filter while avoiding too many false positives - even quarantining 50 or 60% of contacts can reduce spread by a lot! 3. You could be compelled to release data, but all you would get is a list of beacons; you'd then have to also subpoena/steal everyone else's records of whose beacons they saw (this data stays on local devices!) and correlate encounters with actual locations. This is HARD - like, nation-state actor hard. Like, nation-state intelligence agency hard, probably beyond the reach of your average criminal-justice apparatus. 4. DP3T already has open-source implementations (e.g. https://github.com/DP-3T/dp3t-app-android https://github.com/DP-3T/dp3t-app-android). 5. If your threat model is "my phone/OS manufacturer will publish code that doesn't follow the protocol", then you're screwed anyway. (And in fact, Apple and Google aren't following this protocol, they're coming out with their own joint system that they claim is DP3T-inspired.)
- SlowRobotAhead 6y ago
  1. You clearly didn’t reference the panel where Alice is choosing to upload data with exempting sections from it. 3. Yea, that’s great and all. The point is that you may compelled to upload your contacts - NOT your beacons. You are collecting people you met. You likely do understand some of the ways contract testing could be abused. Think about police trying to prove contact with someone they do have beacons for. 5. So why bother with passcodes, or any security at all anywhere for any new or existing feature? This is a slight evolution on “I have nothing to hide”.
  - azernik 6y ago
    1. That's exactly what I was referencing? i.e. I interpreted your saying "with a lot of assumptions. Like that Alice can limit what she reports" as saying "a feature of the protocol, explicitly mentioned in the comic, is an assumption not to be trusted." Whereas that's an option which is already in the preliminary demo apps. 3. Indeed, they can use this to prove that two people who are both under surveillance/investigation were in the same area as each other. That's a risk, but not as severe of a risk as the general fear I've seen around this protocol. 5. That's my point. If you don't trust your implementer to actually implement the security feature, you're screwed anyway. You have to trust someone, and by using a modern phone you are implicitly trusting Apple and Google. Or at least trusting their employees to make a big stink if lines are crossed.
- dTal 6y ago
  > or after-the-fact by not reporting your beacons (or reporting false beacons) for certain times. Not with the "Apple/Google protocol", you can't; your beacons are derived from a key, and only the key is uploaded.
  - azernik 6y ago
    As I noted: > (And in fact, Apple and Google aren't following this protocol, they're coming out with their own joint system that they claim is DP3T-inspired.) Criticisms of DP3T should be separated from criticisms of the Apple/Google system.

azernik 6y ago

1. Alice limiting what she reports is a function of her phone software; this is trivially doable by just not broadcasting beacons, or after-the-fact by not reporting your beacons (or reporting false beacons) for certain times. 2. The number of minutes is a threshold decided by epidemiologists, programmed into people's phone, as a public-policy heuristic. It doesn't need to be perfect, just to catch a lot of the actual contacts in its filter while avoiding too many false positives - even quarantining 50 or 60% of contacts can reduce spread by a lot! 3. You could be compelled to release data, but all you would get is a list of beacons; you'd then have to also subpoena/steal everyone else's records of whose beacons they saw (this data stays on local devices!) and correlate encounters with actual locations. This is HARD - like, nation-state actor hard. Like, nation-state intelligence agency hard, probably beyond the reach of your average criminal-justice apparatus. 4. DP3T already has open-source implementations (e.g. https://github.com/DP-3T/dp3t-app-android https://github.com/DP-3T/dp3t-app-android). 5. If your threat model is "my phone/OS manufacturer will publish code that doesn't follow the protocol", then you're screwed anyway. (And in fact, Apple and Google aren't following this protocol, they're coming out with their own joint system that they claim is DP3T-inspired.)

SlowRobotAhead 6y ago
1. You clearly didn’t reference the panel where Alice is choosing to upload data with exempting sections from it. 3. Yea, that’s great and all. The point is that you may compelled to upload your contacts - NOT your beacons. You are collecting people you met. You likely do understand some of the ways contract testing could be abused. Think about police trying to prove contact with someone they do have beacons for. 5. So why bother with passcodes, or any security at all anywhere for any new or existing feature? This is a slight evolution on “I have nothing to hide”.
- azernik 6y ago
  1. That's exactly what I was referencing? i.e. I interpreted your saying "with a lot of assumptions. Like that Alice can limit what she reports" as saying "a feature of the protocol, explicitly mentioned in the comic, is an assumption not to be trusted." Whereas that's an option which is already in the preliminary demo apps. 3. Indeed, they can use this to prove that two people who are both under surveillance/investigation were in the same area as each other. That's a risk, but not as severe of a risk as the general fear I've seen around this protocol. 5. That's my point. If you don't trust your implementer to actually implement the security feature, you're screwed anyway. You have to trust someone, and by using a modern phone you are implicitly trusting Apple and Google. Or at least trusting their employees to make a big stink if lines are crossed.
dTal 6y ago
> or after-the-fact by not reporting your beacons (or reporting false beacons) for certain times. Not with the "Apple/Google protocol", you can't; your beacons are derived from a key, and only the key is uploaded.
- azernik 6y ago
  As I noted: > (And in fact, Apple and Google aren't following this protocol, they're coming out with their own joint system that they claim is DP3T-inspired.) Criticisms of DP3T should be separated from criticisms of the Apple/Google system.