5 ms·

I would give the centralised app approach some credit - there is some good science around why being able to react to reports of symptoms (without a test) could

by g_p 6y ago

I would give the centralised app approach some credit - there is some good science around why being able to react to reports of symptoms (without a test) could actually have significant positive benefit. Some of the feedback seems to be frustrating (for those building a system like this) in that it came down to more human factors like people not wanting to receive this kind of news via a message on their phone, and it scaring them. I think the constant delaying to the app is a real problem, but it does appear to have become a target of pot-shots from all sides of the political spectrum. Despite this, some of the innovation that went into the app seemed to be quite impressive, and I think it's a shame we won't get to see the outcomes of a "well-thought-out" centralised app compared to the decentralised ones. My concern with the decentralised apps is that they are reliant on testing, testing means latency, and given the incubation period of covid, it seems people will be at their most infectious, spreading it to the next generation of recipients, at the time they are notified they may have been exposed. At least in my view, getting notifications out ASAP is most important given the pre-symptomatic spreading, and the centralised approach seems to both aid that, and help get people able to stop isolating if it turns out they weren't exposed to Covid (i.e. they and others exposed to same person don't have symptoms in 5 days, thus suggesting a false alarm). There was more to the centralised app than purely "centralised vs decentralised", but there's clearly other issues in the approach to handling covid.

archi42 6y ago
The drawback of a centralized, government controlled /TRACKING/ app is the MASSIVE AMOUNT trust it requires not to be abused. Neither now nor in the future. Purely scientifically it's quite useful in the current situation, much more than the decentralized approach we're using here in Germany; I think that goes without saying. But creating such a precedence for mass surveillance in our democracies is extremely troublesome, and -m-i-g-h-t- will cause a lot of harm in the long run. Also, only speaking for myself here: The morning the German App was released, I installed it without hesitation or any trace of doubt. It's now running on my [only] phone, which I have 24/7 with me. So within its limits, the App is rather effective. If it was centralized,... I probably would have hesitated a lot, maybe even skipped it or installed it on my old phone (with the GPS disabled via root), and only turn on that phone on demand. What I want to say: Acceptance/wide-spread use is rather important. Of course the gov can [try to] mandate the app to be used (does the UK do that? idk), but then they're opening another can of worms because they're discriminating against poorer people/demographics who might have older phones with poor battery, limited memory/RAM/CPU, or no smartphones at all (e.g. cheap dumbphones). Full disclosure: I'm sometimes checking with BeaconScope if the people around me are generally using the app. It's not as many as one would like, but it's slowly ramping up.
- g_p 6y ago
  I am inclined to agree, but I think we need to be careful not to paint the "decentralised" approaches as perfect. Neither solution is perfect, as both make different trade-offs. I share your privacy concerns and whether it's a "bad idea" or not. The UK has no plan to make the app "mandatory", and they are well aware of the demographic issues that would cause, especially with large areas of elderly populations. That's why there's such a focus on the traditional approach to contact tracing. RE decentralised vs centralised, the trade-off isn't so simple though in my view - the decentralised app requires the creation of a list of the "infected", which is synced to everyone. That means those who get infected suffer a fairly large "loss" of privacy compared to those not infected. The centralised approach "averages" the two by not broadcasting an infected list. It isn't hugely difficult to use time-based correlation with a calendar or diary to work out if a given person was infected etc, if you have access to the list and database (which we should assume in a threat model people have). The question is if this is a design goal or not. In addition to the app is traditional "public health authority" contact tracing. That in itself is very privacy-invasive though, and I think people are ignoring it in favour of talking about the app - collecting names and contact info of everyone someone was in contact with, storing this into an IT system, then contacting them etc. Data retention concerns etc and privacy risks here seem significant, yet there has been more focus on the apps than on this traditional approach.
  - jnxx 6y ago
    > - the decentralised app requires the creation of a list of the "infected", which is synced to everyone I don't think it works that way. Here the requirements on privacy which became the accepted base for the German app: https://www.ccc.de/en/updates/2020/contact-tracing-requirements https://www.ccc.de/en/updates/2020/contact-tracing-requireme...
    - g_p 6y ago
      Interesting - every version I've looked at to date still creates a form of "infected list". You could try bloom filters but at risk of many false positives, at a time you really don't want false positives. Looking at the Apple + Google spec though, this is happening - see https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-CryptographySpecificationv1.2.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu... I can't really see a way to avoid creating an "infected tokens" list, if you want a decentralised approach where the uninfected are not interacting with the protocol on an ongoing basis as well. The UK approach (centralised) was different though, as it was based on the infected person telling the server "who" (based on the tokens) it saw, and they take the steps to notify those users by decrypting the tokens etc, and working out who needs notified. In the decentralised apps, your phone squawks a changing "identifier", everyone stores the squawks they hear, and periodically checks their list of squawks heard to see if any are flagged on the infected list.
jonplackett 6y ago
I think arguing for the centralised option is a bit like arguing for breaking encryption. Sure, it would be lovely if you could give the police / anti-terror / anti-paedophile agencies access with a warrant and leave everyone else alone. The government will insist this is all they want. Except YOU CAN’T DO THAT! It’s not technically possible, however nice it might be. I think centralised apps were the same story. It would be great if you could do it (leaving privacy aside) but... it seems as though you can’t. Or they can’t.

by g_p 6y ago

archi42 6y ago

The drawback of a centralized, government controlled /TRACKING/ app is the MASSIVE AMOUNT trust it requires not to be abused. Neither now nor in the future. Purely scientifically it's quite useful in the current situation, much more than the decentralized approach we're using here in Germany; I think that goes without saying. But creating such a precedence for mass surveillance in our democracies is extremely troublesome, and -m-i-g-h-t- will cause a lot of harm in the long run. Also, only speaking for myself here: The morning the German App was released, I installed it without hesitation or any trace of doubt. It's now running on my [only] phone, which I have 24/7 with me. So within its limits, the App is rather effective. If it was centralized,... I probably would have hesitated a lot, maybe even skipped it or installed it on my old phone (with the GPS disabled via root), and only turn on that phone on demand. What I want to say: Acceptance/wide-spread use is rather important. Of course the gov can [try to] mandate the app to be used (does the UK do that? idk), but then they're opening another can of worms because they're discriminating against poorer people/demographics who might have older phones with poor battery, limited memory/RAM/CPU, or no smartphones at all (e.g. cheap dumbphones). Full disclosure: I'm sometimes checking with BeaconScope if the people around me are generally using the app. It's not as many as one would like, but it's slowly ramping up.

g_p 6y ago
I am inclined to agree, but I think we need to be careful not to paint the "decentralised" approaches as perfect. Neither solution is perfect, as both make different trade-offs. I share your privacy concerns and whether it's a "bad idea" or not. The UK has no plan to make the app "mandatory", and they are well aware of the demographic issues that would cause, especially with large areas of elderly populations. That's why there's such a focus on the traditional approach to contact tracing. RE decentralised vs centralised, the trade-off isn't so simple though in my view - the decentralised app requires the creation of a list of the "infected", which is synced to everyone. That means those who get infected suffer a fairly large "loss" of privacy compared to those not infected. The centralised approach "averages" the two by not broadcasting an infected list. It isn't hugely difficult to use time-based correlation with a calendar or diary to work out if a given person was infected etc, if you have access to the list and database (which we should assume in a threat model people have). The question is if this is a design goal or not. In addition to the app is traditional "public health authority" contact tracing. That in itself is very privacy-invasive though, and I think people are ignoring it in favour of talking about the app - collecting names and contact info of everyone someone was in contact with, storing this into an IT system, then contacting them etc. Data retention concerns etc and privacy risks here seem significant, yet there has been more focus on the apps than on this traditional approach.
- jnxx 6y ago
  > - the decentralised app requires the creation of a list of the "infected", which is synced to everyone I don't think it works that way. Here the requirements on privacy which became the accepted base for the German app: https://www.ccc.de/en/updates/2020/contact-tracing-requirements https://www.ccc.de/en/updates/2020/contact-tracing-requireme...
  - g_p 6y ago
    Interesting - every version I've looked at to date still creates a form of "infected list". You could try bloom filters but at risk of many false positives, at a time you really don't want false positives. Looking at the Apple + Google spec though, this is happening - see https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-CryptographySpecificationv1.2.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu... I can't really see a way to avoid creating an "infected tokens" list, if you want a decentralised approach where the uninfected are not interacting with the protocol on an ongoing basis as well. The UK approach (centralised) was different though, as it was based on the infected person telling the server "who" (based on the tokens) it saw, and they take the steps to notify those users by decrypting the tokens etc, and working out who needs notified. In the decentralised apps, your phone squawks a changing "identifier", everyone stores the squawks they hear, and periodically checks their list of squawks heard to see if any are flagged on the infected list.

jonplackett 6y ago

I think arguing for the centralised option is a bit like arguing for breaking encryption. Sure, it would be lovely if you could give the police / anti-terror / anti-paedophile agencies access with a warrant and leave everyone else alone. The government will insist this is all they want. Except YOU CAN’T DO THAT! It’s not technically possible, however nice it might be. I think centralised apps were the same story. It would be great if you could do it (leaving privacy aside) but... it seems as though you can’t. Or they can’t.