3 ms·

I've read Permanent Record by Edward Snowden. It doesn't get more detailed than that. There is nothing in the book that indicates that Google's implementation o

I've read Permanent Record by Edward Snowden. It doesn't get more detailed than that. There is nothing in the book that indicates that Google's implementation of the contact tracing spec would deviate from the spec either through incompetence or malice. You're making vague, unsubstantiated claims about how this could be compromised. Even if there is a bug that allows such apps to collect location info, that has nothing to do with Snowden leaks. If a government is keen on collecting such information, they would simply not use Google/Apple's APIs and instead roll their own using bluetooth and location services. This was pointed out in the article. Now could you explain to us why you're promoting a conspiracy theory that the government will lean on Apple and Google to introduce malicious bugs into their APIs when they don't need the APIs at all?

Legogris 7y ago
I'm not arguing for the existence of any specific deliberate conspiracy. So please don't misrepresent what I'm saying as conspiracy theory. Still, there are multiple plausible ways in which these apps and systems can be compromised by malicious actors (from any nationality). The risks are significantly larger than they need to, to a large degree due to lack of transparency and verifiability, and significant trust elements. These risks are not inherent in the design of the contact-tracing system or the specific companies themselves, but they are inherent in the way smartphone apps are typically developed and distributed to end-users on mainstream platforms today. Then on top of that, past and ongoing incidents obliterates my personal confidence that large U.S. tech companies will live up to their promises.
rstuart4133 7y ago
> There is nothing in the book that indicates that Google's implementation of the contact tracing spec would deviate from the spec either through incompetence or malice. I agree I'd trust Google over the government and many others. But the OP you are replying to called for releasing the source code, and reproducible builds. If you do that, you don't have to trust somebodies word or the laws of the land, you have the laws of mathematics in your court. Surely you are not saying what is a clearly inferior solution is one we should be using.

Legogris 7y ago

I'm not arguing for the existence of any specific deliberate conspiracy. So please don't misrepresent what I'm saying as conspiracy theory. Still, there are multiple plausible ways in which these apps and systems can be compromised by malicious actors (from any nationality). The risks are significantly larger than they need to, to a large degree due to lack of transparency and verifiability, and significant trust elements. These risks are not inherent in the design of the contact-tracing system or the specific companies themselves, but they are inherent in the way smartphone apps are typically developed and distributed to end-users on mainstream platforms today. Then on top of that, past and ongoing incidents obliterates my personal confidence that large U.S. tech companies will live up to their promises.

rstuart4133 7y ago

> There is nothing in the book that indicates that Google's implementation of the contact tracing spec would deviate from the spec either through incompetence or malice. I agree I'd trust Google over the government and many others. But the OP you are replying to called for releasing the source code, and reproducible builds. If you do that, you don't have to trust somebodies word or the laws of the land, you have the laws of mathematics in your court. Surely you are not saying what is a clearly inferior solution is one we should be using.