6 ms·

Read up on how the contact tracing apps work. They do not upload your data to the cloud. Phones broadcast a rolling random identifier, other phones collect rece

Read up on how the contact tracing apps work. They do not upload your data to the cloud. Phones broadcast a rolling random identifier, other phones collect received identifiers, and only on confirmed infection does the person's phone upload its last two weeks of broadcast IDs to the cloud, where other phones can grab them and cross-check. Having someone's phone number allows you (via the phone company) to trace their location at any time, forever. That is much worse.

thinkingemote 5y ago
I think the low adoption is because it's hard to explain. No one on my street, none of the most vulnerable people would understand your paragraph. No wonder it's not being adopted by those who should be adopting it, but just being used by vigilant young tech savvy and already covid safe people. So not only are only a small number of people using it, these people are least likely to make a difference using it.
- marcan_42 5y ago
  Edit: Surely we can come up with a more approachable explanation for less technical folks, though? Here's an attempt: "Contact tracing respects your privacy and does not send your location to the cloud. Instead, your phone makes up a new random name every 15 minutes and broadcasts it to nearby phones. It remembers the last two weeks of names it used, as well as the last two weeks of names it heard from other phones. When someone catches COVID-19, they register it in the app. Their phone then uploads the last two weeks' worth of names it used to the cloud, where other phones can download the data. The names aren't connected to their identity, all they represent is someone who caught COVID-19. If your phone finds a match between a name it has recently heard and the online database, it sends you a notification. After 2 weeks the data is erased, so you are only notified if you were near an infected person in the past 2 weeks. Since the random names change every 15 minutes, nobody can track you or know that you are the same person as last time they saw your phone. The data is only stored locally, so after it is deleted two weeks later, there is no way to go back and recover it." How's that? (Edited because without the intro sentence it sounded like I was trying to imply the parent didn't get it; that wasn't my intent.
  - thinkingemote 5y ago
    Ahh apologies. It's not the wording of your paragraph, I understood both very well, they are well written. It's a more fundamental understanding of stuff that's hard by those who are most at risk. The old, the vulnerable etc. It's the old digital divide idea. My neighbor doesn't have any internet connected devices, for example. But she would benefit much more from the app than 40 of her mask wearing, young, self isolating, working from home fellow city inhabitants.
    - marcan_42 5y ago
      I didn't want to imply you didn't understand it; I was trying to come up with a more accessible explanation that might help others do so and help drive adoption. You're right that it's not easy to explain, but surely we can come up with something that gets the idea across? :)
  - bonoboTP 5y ago
    Still too complicated. I saw a comic version once, working through an actual example with some example IDs and it used phrases like "sends to the hospital" or "asks the hospital" etc. instead of downloading from the cloud. Very non-technical people are not familiar with the basic concepts involved. "Makes up a new random name and broadcasts it to nearby phones" is something they'd struggle with if they never heard or thought about random number generators, don't understand Bluetooth etc. Also don't underestimate learned helplessness. Many will stop reading if it looks technical because they "can't understand that sort of thing. " Many such people never ever read such lengthy step by step technical documentation. It seems to them as a quantum physics experimental setup description sounds to the average programmer.
    - kortex 5y ago
      > Also don't underestimate learned helplessness. Learned helplessness is so real. My partner works at a help desk, and I constantly hear stories of older folks just mentally shutting down as soon as she has them open the start menu or a settings menu. I even see it in myself, a super curious neophile software/hardware hacker. Sometimes I'll come across some particularly arcane API docs and it's like my brain just goes "tl;dr" to the whole thing and tries to immediately find a way to avoid interfacing with it. That mental switch of "ah this is overwhelming, eyes glaze over" is all too easy to trip, even if you push through it and it really is not that bad after the fact.
- zo1 5y ago
  Well what do we expect? We've been shoving privacy down peoples throats for years. You can't now expect them to be rational and trust us with: "don't worry we know privacy is bad, but THIS privacy breach is okay. Again trust us this is because of covid, we're the good guys."
  - mixmastamyk 5y ago
    Perhaps “lack of privacy” is what you mean?
watwut 5y ago
Just because protocol is theoretically safe does not imply it is safe in actual practice or that it is not possible to exploit it.
- bonoboTP 5y ago
  Right. They can change things with the next silent update anyway. In Germany they also started requiring turning on the GPS while using it. Initially it wasn't necessary and only Bluetooth was needed. Who knows what they modify all the time. I have no spare capacity to follow these developments and when they decide to stop caring about privacy and go rogue in the name of harm prevention.
  - Quanttek 5y ago
    The apps used around Europe, including Germany's Corona-Warn-App, do NOT use GPS. It only asks for location permissions since it utilizes the exposure notification API that indirectly tracks your "location" relative to other users (i.e. the ID exchange)
    - trulyme 5y ago
      I fail to see the difference. You say it doesn't use GPS, but then continue to say that it uses location data (and thus, I assume, GPS). So which is it? Or are you saying that the app doesn't receive the user location data, only Google does?
      - Quanttek 5y ago
        Neither the App nor Google use location data. However, Google still prompts your for these permissions because, in their mind, the swapping of rotating IDs presents an indirect way of tracking somebody's location (although that data is solely stays on the device and is never transferred, unless a positive person decides to upload the list of IDs there were in contact with)
        5y ago
sokoloff 5y ago
> only on confirmed infection does the person's phone upload its last two weeks of broadcast IDs to the cloud Alternatively phrased: “only upon government request does the person’s phone upload…” with the implied promise that such request will only come as a result of a CV-19+ test result.

thinkingemote 5y ago

I think the low adoption is because it's hard to explain. No one on my street, none of the most vulnerable people would understand your paragraph. No wonder it's not being adopted by those who should be adopting it, but just being used by vigilant young tech savvy and already covid safe people. So not only are only a small number of people using it, these people are least likely to make a difference using it.

marcan_42 5y ago
Edit: Surely we can come up with a more approachable explanation for less technical folks, though? Here's an attempt: "Contact tracing respects your privacy and does not send your location to the cloud. Instead, your phone makes up a new random name every 15 minutes and broadcasts it to nearby phones. It remembers the last two weeks of names it used, as well as the last two weeks of names it heard from other phones. When someone catches COVID-19, they register it in the app. Their phone then uploads the last two weeks' worth of names it used to the cloud, where other phones can download the data. The names aren't connected to their identity, all they represent is someone who caught COVID-19. If your phone finds a match between a name it has recently heard and the online database, it sends you a notification. After 2 weeks the data is erased, so you are only notified if you were near an infected person in the past 2 weeks. Since the random names change every 15 minutes, nobody can track you or know that you are the same person as last time they saw your phone. The data is only stored locally, so after it is deleted two weeks later, there is no way to go back and recover it." How's that? (Edited because without the intro sentence it sounded like I was trying to imply the parent didn't get it; that wasn't my intent.
- thinkingemote 5y ago
  Ahh apologies. It's not the wording of your paragraph, I understood both very well, they are well written. It's a more fundamental understanding of stuff that's hard by those who are most at risk. The old, the vulnerable etc. It's the old digital divide idea. My neighbor doesn't have any internet connected devices, for example. But she would benefit much more from the app than 40 of her mask wearing, young, self isolating, working from home fellow city inhabitants.
  - marcan_42 5y ago
    I didn't want to imply you didn't understand it; I was trying to come up with a more accessible explanation that might help others do so and help drive adoption. You're right that it's not easy to explain, but surely we can come up with something that gets the idea across? :)
- bonoboTP 5y ago
  Still too complicated. I saw a comic version once, working through an actual example with some example IDs and it used phrases like "sends to the hospital" or "asks the hospital" etc. instead of downloading from the cloud. Very non-technical people are not familiar with the basic concepts involved. "Makes up a new random name and broadcasts it to nearby phones" is something they'd struggle with if they never heard or thought about random number generators, don't understand Bluetooth etc. Also don't underestimate learned helplessness. Many will stop reading if it looks technical because they "can't understand that sort of thing. " Many such people never ever read such lengthy step by step technical documentation. It seems to them as a quantum physics experimental setup description sounds to the average programmer.
  - kortex 5y ago
    > Also don't underestimate learned helplessness. Learned helplessness is so real. My partner works at a help desk, and I constantly hear stories of older folks just mentally shutting down as soon as she has them open the start menu or a settings menu. I even see it in myself, a super curious neophile software/hardware hacker. Sometimes I'll come across some particularly arcane API docs and it's like my brain just goes "tl;dr" to the whole thing and tries to immediately find a way to avoid interfacing with it. That mental switch of "ah this is overwhelming, eyes glaze over" is all too easy to trip, even if you push through it and it really is not that bad after the fact.
zo1 5y ago
Well what do we expect? We've been shoving privacy down peoples throats for years. You can't now expect them to be rational and trust us with: "don't worry we know privacy is bad, but THIS privacy breach is okay. Again trust us this is because of covid, we're the good guys."
- mixmastamyk 5y ago
  Perhaps “lack of privacy” is what you mean?

watwut 5y ago

Just because protocol is theoretically safe does not imply it is safe in actual practice or that it is not possible to exploit it.

bonoboTP 5y ago
Right. They can change things with the next silent update anyway. In Germany they also started requiring turning on the GPS while using it. Initially it wasn't necessary and only Bluetooth was needed. Who knows what they modify all the time. I have no spare capacity to follow these developments and when they decide to stop caring about privacy and go rogue in the name of harm prevention.
- Quanttek 5y ago
  The apps used around Europe, including Germany's Corona-Warn-App, do NOT use GPS. It only asks for location permissions since it utilizes the exposure notification API that indirectly tracks your "location" relative to other users (i.e. the ID exchange)
  - trulyme 5y ago
    I fail to see the difference. You say it doesn't use GPS, but then continue to say that it uses location data (and thus, I assume, GPS). So which is it? Or are you saying that the app doesn't receive the user location data, only Google does?
    - Quanttek 5y ago
      Neither the App nor Google use location data. However, Google still prompts your for these permissions because, in their mind, the swapping of rotating IDs presents an indirect way of tracking somebody's location (although that data is solely stays on the device and is never transferred, unless a positive person decides to upload the list of IDs there were in contact with)
      - 5y ago

sokoloff 5y ago

> only on confirmed infection does the person's phone upload its last two weeks of broadcast IDs to the cloud Alternatively phrased: “only upon government request does the person’s phone upload…” with the implied promise that such request will only come as a result of a CV-19+ test result.