6 ms·

The technical explanation[1] provided by the NCSC is a lot more interesting than the casual write-up on El Reg, IMHO. As a strong advocate of privacy and limiti

The technical explanation[1] provided by the NCSC is a lot more interesting than the casual write-up on El Reg, IMHO. As a strong advocate of privacy and limiting government surveillance, I was somewhat reassured reading those details. In particular, that paper identifies several specific threats to the operation of the system, some of which have not been widely discussed in the media and a few of which raise potential concerns about decentralised systems as proposed or recently adopted elsewhere. TL;DR: Yes, there are some rational privacy concerns about the NHS app being centralised in nature. However, the people designing this system aren't morons and there is no perfect solution that is invulnerable to all conceivable attacks and abuses. [1] https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1.pdf https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1....

sigwinch28 7y ago
Although there are no perfect solutions, there are systems which willingly connect to and distribute contact data to government servers, and there are systems which do not.
- Silhouette 7y ago
  As the paper notes, there are also systems that are vulnerable to various kinds of abuse by malicious actors and there are systems that are not. The price of using an unauthenticated, distributed system instead is likely to be greater vulnerability to some of those forms of attack and/or a dependency on verifiable test results that causes possibly very damaging delays in sending out notifications.
  - zimpenfish 7y ago
    > there are also systems that are vulnerable to various kinds of abuse by malicious actors Some people consider GCHQ themselves to be malicious actors when it comes to the privacy of the UK public.
    - Silhouette 7y ago
      I'm sure they do. Under some conditions, I might even be one of them. However, the drawback if data from a centralised system for coronavirus tracing is abused by central authorities contrary to their explicit public statements is obvious and not particularly interesting or enlightening, so I suggest we all stick to discussing the substance of the article rather than conspiracy theories. If the government wanted to track people centrally via their mobile phones, it's not as if there aren't more reliable ways they could do it anyway.
  - sigwinch28 7y ago
    So are you saying that the Venn diagram of centralised government controlled systems and systems not vulnerable to malicious users is a single circle? I don’t think so, and the NHSX described system also seems vulnerable to a degree.
    - Silhouette 7y ago
      Of course not. I just think the threat if the government straight-up lie and then abuse the contact graph is obvious and not particularly interesting as a conspiracy theory. I also think that in this particular case, it's not really that much of a threat, for the simple reason that more effective means are already trivially available for the government to track people using their mobile phones if it wants to.
      - sigwinch28 7y ago
        The problem is they're not straight-up lying: they're admitting to MPs that this data will be used for "research", people will have no right to delete their own data, and that Peter Thiel's Palantir is involved and basically giving away the services for free. Whataboutmanship isn't an excuse either, to me. Just because the government is capable of hacking our phones, getting our phone records, and sending men in black cars to watch our houses doesn't mean we should also invite them in via an app we choose to install. Edit: I agree with you: I don't think this is a conspiracy and I don't think a centralised contact tracing app is a security concern if its used just for that. However, I do not trust the British government at all, especially given their beyond-satire record. Don't give the state an inch: they'll take a mile.
dingaling 7y ago
> However, the people designing this system aren't morons I don't think anyone insulted them as such. Bur smart people can sti make unwise decisions under the pressures of time, politics and conflicting requirements.
- TheSpiceIsLife 7y ago
  Smart people implementing intentionally nefarious systems.
FartyMcFarter 7y ago
> However, the people designing this system aren't morons That is exactly the problem. I fully trust the designers and implementers of this system to know how to exploit the data for "unintended" purposes at any point.
szc 7y ago
There is a separate Hacker News thread on an "article" that points to this PDF -- https://news.ycombinator.com/item?id=23074447 https://news.ycombinator.com/item?id=23074447 The summary, from my perspective is that this approach is terrible. It builds a social graph. If you get sick, and a LOT of people are going to get Covid-19, then you reveal your social graph. There are "technical" parts of the description that do not make sense -- why is your "phone model number" important, Covid-19 doesn't care. Why is that data being collected? If you read closely, an "installation ID" is created and ends up being recorded. This is a unique tracking identifier. When you get sick, you reveal this ID and put a name to it -- along with a "fuzzy" geographic location. Now that I've looked at the PDF, some of the crypto includes the "Country Code". Which is "recoverable" on the server side. The trite explanation for that is "and the country code allows for multiple countries to interact". Why is "Country Code" in the crypto and not in the questions you ask the patient? [edit: to remove bad linking] I do not believe this is a good design. Caveat, it is far, far easier to criticize than it is to create a good design.
- Silhouette 7y ago
  Where in the technical document does it say anything about a "phone model number"? It explicitly describes what data is to be sent at the different stages, and I see no mention of anything like that. Where does it say anything about associating a name with the installation ID? The risk of potentially commingling the graph built from notifications with other data sets is explicitly acknowledged and discussed, and is obviously the big drawback of a centralised notification system like this. Precautions to be taken to prevent abuse are also discussed. It seems to me that most of your objections here, and in your comment on the other thread, are attacking straw men and ignoring the technical details and logical arguments presented in the document.
  - Robin_Message 7y ago
    https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contact-tracing-app#section_4 https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contac... is the closest link I can provide. In the section subtitled Here comes the crypto, second paragraph, it says "it records the model of your phone (for example ‘Apple iPhone 10,2’)." So, you're wrong about these arguments being straw men. However, the reason for doing this is reasonable enough: you need to model what the bluetooth signal strength measured by each phone actually means in terms of physical distance; and that means knowing the phone model. The real argument is not technical; it is that the UK government has proven itself repeatedly incapable of avoiding mission creep in these kind of laws and systems. My go to example "Half of councils use anti-terror laws to spy on 'bin crimes'" – https://www.telegraph.co.uk/news/uknews/3333366/Half-of-councils-use-anti-terror-laws-to-spy-on-bin-crimes.html https://www.telegraph.co.uk/news/uknews/3333366/Half-of-coun...

sigwinch28 7y ago

Although there are no perfect solutions, there are systems which willingly connect to and distribute contact data to government servers, and there are systems which do not.

Silhouette 7y ago
As the paper notes, there are also systems that are vulnerable to various kinds of abuse by malicious actors and there are systems that are not. The price of using an unauthenticated, distributed system instead is likely to be greater vulnerability to some of those forms of attack and/or a dependency on verifiable test results that causes possibly very damaging delays in sending out notifications.
- zimpenfish 7y ago
  > there are also systems that are vulnerable to various kinds of abuse by malicious actors Some people consider GCHQ themselves to be malicious actors when it comes to the privacy of the UK public.
  - Silhouette 7y ago
    I'm sure they do. Under some conditions, I might even be one of them. However, the drawback if data from a centralised system for coronavirus tracing is abused by central authorities contrary to their explicit public statements is obvious and not particularly interesting or enlightening, so I suggest we all stick to discussing the substance of the article rather than conspiracy theories. If the government wanted to track people centrally via their mobile phones, it's not as if there aren't more reliable ways they could do it anyway.
- sigwinch28 7y ago
  So are you saying that the Venn diagram of centralised government controlled systems and systems not vulnerable to malicious users is a single circle? I don’t think so, and the NHSX described system also seems vulnerable to a degree.
  - Silhouette 7y ago
    Of course not. I just think the threat if the government straight-up lie and then abuse the contact graph is obvious and not particularly interesting as a conspiracy theory. I also think that in this particular case, it's not really that much of a threat, for the simple reason that more effective means are already trivially available for the government to track people using their mobile phones if it wants to.
    - sigwinch28 7y ago
      The problem is they're not straight-up lying: they're admitting to MPs that this data will be used for "research", people will have no right to delete their own data, and that Peter Thiel's Palantir is involved and basically giving away the services for free. Whataboutmanship isn't an excuse either, to me. Just because the government is capable of hacking our phones, getting our phone records, and sending men in black cars to watch our houses doesn't mean we should also invite them in via an app we choose to install. Edit: I agree with you: I don't think this is a conspiracy and I don't think a centralised contact tracing app is a security concern if its used just for that. However, I do not trust the British government at all, especially given their beyond-satire record. Don't give the state an inch: they'll take a mile.

dingaling 7y ago

> However, the people designing this system aren't morons I don't think anyone insulted them as such. Bur smart people can sti make unwise decisions under the pressures of time, politics and conflicting requirements.

TheSpiceIsLife 7y ago
Smart people implementing intentionally nefarious systems.

FartyMcFarter 7y ago

> However, the people designing this system aren't morons That is exactly the problem. I fully trust the designers and implementers of this system to know how to exploit the data for "unintended" purposes at any point.

szc 7y ago

There is a separate Hacker News thread on an "article" that points to this PDF -- https://news.ycombinator.com/item?id=23074447 https://news.ycombinator.com/item?id=23074447 The summary, from my perspective is that this approach is terrible. It builds a social graph. If you get sick, and a LOT of people are going to get Covid-19, then you reveal your social graph. There are "technical" parts of the description that do not make sense -- why is your "phone model number" important, Covid-19 doesn't care. Why is that data being collected? If you read closely, an "installation ID" is created and ends up being recorded. This is a unique tracking identifier. When you get sick, you reveal this ID and put a name to it -- along with a "fuzzy" geographic location. Now that I've looked at the PDF, some of the crypto includes the "Country Code". Which is "recoverable" on the server side. The trite explanation for that is "and the country code allows for multiple countries to interact". Why is "Country Code" in the crypto and not in the questions you ask the patient? [edit: to remove bad linking] I do not believe this is a good design. Caveat, it is far, far easier to criticize than it is to create a good design.

Silhouette 7y ago
Where in the technical document does it say anything about a "phone model number"? It explicitly describes what data is to be sent at the different stages, and I see no mention of anything like that. Where does it say anything about associating a name with the installation ID? The risk of potentially commingling the graph built from notifications with other data sets is explicitly acknowledged and discussed, and is obviously the big drawback of a centralised notification system like this. Precautions to be taken to prevent abuse are also discussed. It seems to me that most of your objections here, and in your comment on the other thread, are attacking straw men and ignoring the technical details and logical arguments presented in the document.
- Robin_Message 7y ago
  https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contact-tracing-app#section_4 https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contac... is the closest link I can provide. In the section subtitled Here comes the crypto, second paragraph, it says "it records the model of your phone (for example ‘Apple iPhone 10,2’)." So, you're wrong about these arguments being straw men. However, the reason for doing this is reasonable enough: you need to model what the bluetooth signal strength measured by each phone actually means in terms of physical distance; and that means knowing the phone model. The real argument is not technical; it is that the UK government has proven itself repeatedly incapable of avoiding mission creep in these kind of laws and systems. My go to example "Half of councils use anti-terror laws to spy on 'bin crimes'" – https://www.telegraph.co.uk/news/uknews/3333366/Half-of-councils-use-anti-terror-laws-to-spy-on-bin-crimes.html https://www.telegraph.co.uk/news/uknews/3333366/Half-of-coun...