3 ms·

The drawback of a centralized, government controlled /TRACKING/ app is the MASSIVE AMOUNT trust it requires not to be abused. Neither now nor in the future. Pur

The drawback of a centralized, government controlled /TRACKING/ app is the MASSIVE AMOUNT trust it requires not to be abused. Neither now nor in the future. Purely scientifically it's quite useful in the current situation, much more than the decentralized approach we're using here in Germany; I think that goes without saying. But creating such a precedence for mass surveillance in our democracies is extremely troublesome, and -m-i-g-h-t- will cause a lot of harm in the long run. Also, only speaking for myself here: The morning the German App was released, I installed it without hesitation or any trace of doubt. It's now running on my [only] phone, which I have 24/7 with me. So within its limits, the App is rather effective. If it was centralized,... I probably would have hesitated a lot, maybe even skipped it or installed it on my old phone (with the GPS disabled via root), and only turn on that phone on demand. What I want to say: Acceptance/wide-spread use is rather important. Of course the gov can [try to] mandate the app to be used (does the UK do that? idk), but then they're opening another can of worms because they're discriminating against poorer people/demographics who might have older phones with poor battery, limited memory/RAM/CPU, or no smartphones at all (e.g. cheap dumbphones). Full disclosure: I'm sometimes checking with BeaconScope if the people around me are generally using the app. It's not as many as one would like, but it's slowly ramping up.

g_p 6y ago
I am inclined to agree, but I think we need to be careful not to paint the "decentralised" approaches as perfect. Neither solution is perfect, as both make different trade-offs. I share your privacy concerns and whether it's a "bad idea" or not. The UK has no plan to make the app "mandatory", and they are well aware of the demographic issues that would cause, especially with large areas of elderly populations. That's why there's such a focus on the traditional approach to contact tracing. RE decentralised vs centralised, the trade-off isn't so simple though in my view - the decentralised app requires the creation of a list of the "infected", which is synced to everyone. That means those who get infected suffer a fairly large "loss" of privacy compared to those not infected. The centralised approach "averages" the two by not broadcasting an infected list. It isn't hugely difficult to use time-based correlation with a calendar or diary to work out if a given person was infected etc, if you have access to the list and database (which we should assume in a threat model people have). The question is if this is a design goal or not. In addition to the app is traditional "public health authority" contact tracing. That in itself is very privacy-invasive though, and I think people are ignoring it in favour of talking about the app - collecting names and contact info of everyone someone was in contact with, storing this into an IT system, then contacting them etc. Data retention concerns etc and privacy risks here seem significant, yet there has been more focus on the apps than on this traditional approach.
- jnxx 6y ago
  > - the decentralised app requires the creation of a list of the "infected", which is synced to everyone I don't think it works that way. Here the requirements on privacy which became the accepted base for the German app: https://www.ccc.de/en/updates/2020/contact-tracing-requirements https://www.ccc.de/en/updates/2020/contact-tracing-requireme...
  - g_p 6y ago
    Interesting - every version I've looked at to date still creates a form of "infected list". You could try bloom filters but at risk of many false positives, at a time you really don't want false positives. Looking at the Apple + Google spec though, this is happening - see https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-CryptographySpecificationv1.2.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu... I can't really see a way to avoid creating an "infected tokens" list, if you want a decentralised approach where the uninfected are not interacting with the protocol on an ongoing basis as well. The UK approach (centralised) was different though, as it was based on the infected person telling the server "who" (based on the tokens) it saw, and they take the steps to notify those users by decrypting the tokens etc, and working out who needs notified. In the decentralised apps, your phone squawks a changing "identifier", everyone stores the squawks they hear, and periodically checks their list of squawks heard to see if any are flagged on the infected list.
Mvandenbergh 6y ago
Take into account that the NHSX approach is most accurately described as partially centralised. A real centralised approach is what the Chinese and the Koreans have where phones are constantly recording and transmitting location data. The NHSX and Google/Apple approaches both restrict what data they record, they just made different judgements about what privacy tradeoffs were reasonable in order to deliver contact tracing and alerting. So it's not the case that privacy was never considered by NHSX, just that they wanted to do things that you cannot do without some degree of centralisation. Most importantly they warn you when a contact develops symptoms and then warn you again if they test positive. That would help get at least some people reducing their contacts earlier. Apparently despite some very clever design on their Bluetooth system they never got it to work well enough.

g_p 6y ago

I am inclined to agree, but I think we need to be careful not to paint the "decentralised" approaches as perfect. Neither solution is perfect, as both make different trade-offs. I share your privacy concerns and whether it's a "bad idea" or not. The UK has no plan to make the app "mandatory", and they are well aware of the demographic issues that would cause, especially with large areas of elderly populations. That's why there's such a focus on the traditional approach to contact tracing. RE decentralised vs centralised, the trade-off isn't so simple though in my view - the decentralised app requires the creation of a list of the "infected", which is synced to everyone. That means those who get infected suffer a fairly large "loss" of privacy compared to those not infected. The centralised approach "averages" the two by not broadcasting an infected list. It isn't hugely difficult to use time-based correlation with a calendar or diary to work out if a given person was infected etc, if you have access to the list and database (which we should assume in a threat model people have). The question is if this is a design goal or not. In addition to the app is traditional "public health authority" contact tracing. That in itself is very privacy-invasive though, and I think people are ignoring it in favour of talking about the app - collecting names and contact info of everyone someone was in contact with, storing this into an IT system, then contacting them etc. Data retention concerns etc and privacy risks here seem significant, yet there has been more focus on the apps than on this traditional approach.

jnxx 6y ago
> - the decentralised app requires the creation of a list of the "infected", which is synced to everyone I don't think it works that way. Here the requirements on privacy which became the accepted base for the German app: https://www.ccc.de/en/updates/2020/contact-tracing-requirements https://www.ccc.de/en/updates/2020/contact-tracing-requireme...
- g_p 6y ago
  Interesting - every version I've looked at to date still creates a form of "infected list". You could try bloom filters but at risk of many false positives, at a time you really don't want false positives. Looking at the Apple + Google spec though, this is happening - see https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-CryptographySpecificationv1.2.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu... I can't really see a way to avoid creating an "infected tokens" list, if you want a decentralised approach where the uninfected are not interacting with the protocol on an ongoing basis as well. The UK approach (centralised) was different though, as it was based on the infected person telling the server "who" (based on the tokens) it saw, and they take the steps to notify those users by decrypting the tokens etc, and working out who needs notified. In the decentralised apps, your phone squawks a changing "identifier", everyone stores the squawks they hear, and periodically checks their list of squawks heard to see if any are flagged on the infected list.

Mvandenbergh 6y ago

Take into account that the NHSX approach is most accurately described as partially centralised. A real centralised approach is what the Chinese and the Koreans have where phones are constantly recording and transmitting location data. The NHSX and Google/Apple approaches both restrict what data they record, they just made different judgements about what privacy tradeoffs were reasonable in order to deliver contact tracing and alerting. So it's not the case that privacy was never considered by NHSX, just that they wanted to do things that you cannot do without some degree of centralisation. Most importantly they warn you when a contact develops symptoms and then warn you again if they test positive. That would help get at least some people reducing their contacts earlier. Apparently despite some very clever design on their Bluetooth system they never got it to work well enough.