8 ms·

UK’s NHS Covid-19 App

52 points by milen 6y ago

Sephiroth87 6y ago
Firebase, seriously???
- proactivesvcs 6y ago
  And Microsoft Appcenter Analytics: https://reports.exodus-privacy.eu.org/en/reports/uk.nhs.nhsx.colocate/latest/ https://reports.exodus-privacy.eu.org/en/reports/uk.nhs.nhsx...
  - erinaceousjones 6y ago
    Which they're using to track a couple of events, i.e. when the app fails to register with the API: https://github.com/nhsx/COVID-19-app-Android-BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/analytics/AnalyticEvent.kt https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... (Though that analytics platform itself does do device fingerprinting, inasmuch as detecting phone model, OS version etc -- I assume no individually identifying stuff like IMEIs, but who knows what a bad actor can do with sufficient entropy?)
- geoah 6y ago
  They use firebase for push notifications. GCM (Google Cloud Messaging) has been moved to firebase, and it can now also do Apple notifications I think so it makes sense to just stick to one.
  - Sephiroth87 6y ago
    Except you don't need to import Firebase Analytics to use the messaging. And, same as the Facebook SDK situation earlier today, Firebase SDKs will do stuff when the app loads whether you reference them or not.
    - erinaceousjones 6y ago
      According to the repo [1] they're using: apply plugin: 'com.google.firebase.crashlytics' com.google.firebase:firebase-messaging [1] https://github.com/nhsx/COVID-19-app-Android-BETA/search?p=1&q=firebase&unscoped_q=firebase https://github.com/nhsx/COVID-19-app-Android-BETA/search?p=1... I assume crashlytics is for crash dumps only, could firebase-messaging pull in firebase-analytics?
      - angrais 6y ago
        Why are y'all aggressively judging the codebase when you don't even know how firebase analytics works on Android? Damn
splatzone 6y ago
Can someone clearly explain the actual privacy risks of the centralised model (that UK Govt is pursuing) over the decentralised model? My understanding is that in reporting our unique identifiers (and location data?) to the govt servers, this data could be de-anonymised and misused. But what data is actually being reported and how could it be misused?
- cameronbrown 6y ago
  Imo the threat here isn't just the government - that's a concern, but if you've been tested positive, the NHS already know you. The bigger issue is potential leaks or poor access controls resulting in a malicious third party gaining access. With the decentralised approach where Apple/Google control access to their APIs, the threat surface is significantly reduced (e.g. contact tracing apps cannot also use geolocation) Disclosure: Also a Google employee.
  - rozab 6y ago
    And so the question remains: >But what data is actually being reported and how could it be misused? All advertisers already know who I live with, and if I'm obeying social distancing I will only be coming into contact with strangers. Is this data really more sensitive than the stuff we firehouse out every day?
- k1t 6y ago
  My understanding is that the centralised model means the government will very quickly get a huge database of who meets whom, how often, and for how long. Even if you don't couple this with location data, it's still a privacy nightmare. If you test positive for COVID19 the government would use this information to send out alerts to people you've recently been in contact with. With the de-centralised model, your device tracks who you've seen recently and when. The government would announce the IDs of devices owned by people that had tested positive and your device would tell you if you had encountered any of the positive devices. The centralised approach makes it much easier for the government to track compliance (e.g. we know 500 people should have come forward for testing, but only 200 did) - but again, complete privacy disaster.
wtracz 6y ago
https://github.com/nhsx/COVID-19-app-Android-BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/ble/Scanner.kt https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... appears to be looking for Apple devices to wake them back up.
- jeffrallen 6y ago
  No, that comment is referring to the fact that advertisements change their format when an iOS device is sleeping, and thus devices listening need to filter on a different UUID.
cameronbrown 6y ago
ACCESS_FINE_LOCATION is an immediate red flag. Yikes.. that's gonna be a no from me. https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a167f8dba422fd9001b64f9c4fd82275abb1c8/app/src/main/AndroidManifest.xml https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a16...
- danielmg 6y ago
  Did you read the notes in the link next to that item? "In order to use Bluetooth features in your application, you must declare the Bluetooth permission BLUETOOTH. You need this permission to perform any Bluetooth communication, such as requesting a connection, accepting a connection, and transferring data. You must also declare the ACCESS_FINE_LOCATION permission, given that LE beacons are often associated with location. Without this permission, scans won't return any results."
  - cameronbrown 6y ago
    Sure, but the Google/Apple contact tracing APIs do not need this.
    - senectus1 6y ago
      do these exist yet? My understanding is those are still in development and haven't yet been pushed to the world.
      - cameronbrown 6y ago
        The API interfaces were published, but you're correct implementation is yet to ship. https://blog.google/documents/55/Android_Contact_Tracing_API.pdf https://blog.google/documents/55/Android_Contact_Tracing_API...
- rpns 6y ago
  FWIW, as the comment in the source hints at, it's needed for Bluetooth low energy scanning: https://developer.android.com/guide/topics/connectivity/bluetooth-le#permissions https://developer.android.com/guide/topics/connectivity/blue...
sakisv 6y ago
I think I would feel much better about this if it was accompanied by a legally binding declaration that the only entity that will ever have access to these data will be NHS, explicitly excluding any other government intelligence agency. This is not a stab against the people who developed it, in fact I know some of the people involved in the development of the application and they have the highest ethical standards. The problem is that in the post-Snowden era, no matter the good intentions behind such projects it is naive to not ask for as many safeguards as we possibly can.
abhisuri97 6y ago
Well...at least they’re open sourcing this which is better than letting some company develop the app entirely and keep the code under lock and key.
bitlevel 6y ago
Having perused their Github, I noted the database for x-rays and scans. <TinFoilHat>This is being run in 'partnership' with a relative non-entity, who in turn have links to a private American medical company. Not sure I'm happy with private NHS medical records being slurped up in this way - unless consent is expressly given - which, based on their website that 'anonymizes' uploaded imagery, I guess we'll never know for sure.</TinFoilHat> Good to see the code for both the iOS and Android clients being posted, as this should prove if these clients can ultimately be trusted.
benmmurphy 6y ago
It looks like they are using beacons that are the same for 1 day. I think the google/apple version uses beacons that last until the bluetooth MAC address changes which I think is 15 minutes on iOS. So you can setup bluetooth devices around the city to track people's movements who are using this app.

52 points by milen 6y ago

Sephiroth87 6y ago

Firebase, seriously???

proactivesvcs 6y ago
And Microsoft Appcenter Analytics: https://reports.exodus-privacy.eu.org/en/reports/uk.nhs.nhsx.colocate/latest/ https://reports.exodus-privacy.eu.org/en/reports/uk.nhs.nhsx...
- erinaceousjones 6y ago
  Which they're using to track a couple of events, i.e. when the app fails to register with the API: https://github.com/nhsx/COVID-19-app-Android-BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/analytics/AnalyticEvent.kt https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... (Though that analytics platform itself does do device fingerprinting, inasmuch as detecting phone model, OS version etc -- I assume no individually identifying stuff like IMEIs, but who knows what a bad actor can do with sufficient entropy?)
geoah 6y ago
They use firebase for push notifications. GCM (Google Cloud Messaging) has been moved to firebase, and it can now also do Apple notifications I think so it makes sense to just stick to one.
- Sephiroth87 6y ago
  Except you don't need to import Firebase Analytics to use the messaging. And, same as the Facebook SDK situation earlier today, Firebase SDKs will do stuff when the app loads whether you reference them or not.
  - erinaceousjones 6y ago
    According to the repo [1] they're using: apply plugin: 'com.google.firebase.crashlytics' com.google.firebase:firebase-messaging [1] https://github.com/nhsx/COVID-19-app-Android-BETA/search?p=1&q=firebase&unscoped_q=firebase https://github.com/nhsx/COVID-19-app-Android-BETA/search?p=1... I assume crashlytics is for crash dumps only, could firebase-messaging pull in firebase-analytics?
    - angrais 6y ago
      Why are y'all aggressively judging the codebase when you don't even know how firebase analytics works on Android? Damn

splatzone 6y ago

Can someone clearly explain the actual privacy risks of the centralised model (that UK Govt is pursuing) over the decentralised model? My understanding is that in reporting our unique identifiers (and location data?) to the govt servers, this data could be de-anonymised and misused. But what data is actually being reported and how could it be misused?

cameronbrown 6y ago
Imo the threat here isn't just the government - that's a concern, but if you've been tested positive, the NHS already know you. The bigger issue is potential leaks or poor access controls resulting in a malicious third party gaining access. With the decentralised approach where Apple/Google control access to their APIs, the threat surface is significantly reduced (e.g. contact tracing apps cannot also use geolocation) Disclosure: Also a Google employee.
- rozab 6y ago
  And so the question remains: >But what data is actually being reported and how could it be misused? All advertisers already know who I live with, and if I'm obeying social distancing I will only be coming into contact with strangers. Is this data really more sensitive than the stuff we firehouse out every day?
k1t 6y ago
My understanding is that the centralised model means the government will very quickly get a huge database of who meets whom, how often, and for how long. Even if you don't couple this with location data, it's still a privacy nightmare. If you test positive for COVID19 the government would use this information to send out alerts to people you've recently been in contact with. With the de-centralised model, your device tracks who you've seen recently and when. The government would announce the IDs of devices owned by people that had tested positive and your device would tell you if you had encountered any of the positive devices. The centralised approach makes it much easier for the government to track compliance (e.g. we know 500 people should have come forward for testing, but only 200 did) - but again, complete privacy disaster.

wtracz 6y ago

https://github.com/nhsx/COVID-19-app-Android-BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/ble/Scanner.kt https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... appears to be looking for Apple devices to wake them back up.

jeffrallen 6y ago
No, that comment is referring to the fact that advertisements change their format when an iOS device is sleeping, and thus devices listening need to filter on a different UUID.

cameronbrown 6y ago

ACCESS_FINE_LOCATION is an immediate red flag. Yikes.. that's gonna be a no from me. https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a167f8dba422fd9001b64f9c4fd82275abb1c8/app/src/main/AndroidManifest.xml https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a16...

danielmg 6y ago
Did you read the notes in the link next to that item? "In order to use Bluetooth features in your application, you must declare the Bluetooth permission BLUETOOTH. You need this permission to perform any Bluetooth communication, such as requesting a connection, accepting a connection, and transferring data. You must also declare the ACCESS_FINE_LOCATION permission, given that LE beacons are often associated with location. Without this permission, scans won't return any results."
- cameronbrown 6y ago
  Sure, but the Google/Apple contact tracing APIs do not need this.
  - senectus1 6y ago
    do these exist yet? My understanding is those are still in development and haven't yet been pushed to the world.
    - cameronbrown 6y ago
      The API interfaces were published, but you're correct implementation is yet to ship. https://blog.google/documents/55/Android_Contact_Tracing_API.pdf https://blog.google/documents/55/Android_Contact_Tracing_API...
rpns 6y ago
FWIW, as the comment in the source hints at, it's needed for Bluetooth low energy scanning: https://developer.android.com/guide/topics/connectivity/bluetooth-le#permissions https://developer.android.com/guide/topics/connectivity/blue...

sakisv 6y ago

I think I would feel much better about this if it was accompanied by a legally binding declaration that the only entity that will ever have access to these data will be NHS, explicitly excluding any other government intelligence agency. This is not a stab against the people who developed it, in fact I know some of the people involved in the development of the application and they have the highest ethical standards. The problem is that in the post-Snowden era, no matter the good intentions behind such projects it is naive to not ask for as many safeguards as we possibly can.

abhisuri97 6y ago

Well...at least they’re open sourcing this which is better than letting some company develop the app entirely and keep the code under lock and key.

bitlevel 6y ago

Having perused their Github, I noted the database for x-rays and scans. <TinFoilHat>This is being run in 'partnership' with a relative non-entity, who in turn have links to a private American medical company. Not sure I'm happy with private NHS medical records being slurped up in this way - unless consent is expressly given - which, based on their website that 'anonymizes' uploaded imagery, I guess we'll never know for sure.</TinFoilHat> Good to see the code for both the iOS and Android clients being posted, as this should prove if these clients can ultimately be trusted.

benmmurphy 6y ago

It looks like they are using beacons that are the same for 1 day. I think the google/apple version uses beacons that last until the bluetooth MAC address changes which I think is 15 minutes on iOS. So you can setup bluetooth devices around the city to track people's movements who are using this app.