Live data from Hacker News

Dissection of COVIDSafe (Android): Australian government's contact tracing app

docs.google.com

191–200 of 271 posts

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#191

I'm wondering how the application protects against people running malicious clients works? If the point of this app is to broadcast identifiable information into the public domain, what is stopping others from snooping this information and creating their own tracing DB?

Legally it's probably disallowed by https://www.legislation.gov.au/Details/F2020L00480 section 6(1)

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#192
post #151

Earlier quoted context omitted.

The Australian governments track record is bad and we should be critical of that. But I have yet to see important problems with this particular app identified. Lets stick with the facts here rather than 'it must be bad'. People have decompiled the kotlin code and so far I haven't seen anyone report anything bad. Am I missing something?

That’s a massive understatement. More accurate words describing the government’s track record would be “screwup, coverup, deceit, malicious”. At every single point in the past where they have had the chance to deal with technology they have done one or more of the following: 1. Screwed up, and then tried to cover it up. 2. Outright lied. 3. Created malicious laws that mandate violating privacy and makes it illegal to…

My feeling is that they are getting it right this time, as science and medicine is still trumping politics in Australia's COVID response. (Though that's beginning to change.)

Getting it right this time means the Government doesn't have any excuses going forward.

Overall Australia is genuinely doing a great job in relation to COVID, mainly because the Government had the good sense to put the experts center stage and give them real authority. Most Australians have spotted this break with the past and have unified to contain COVID. Going forward, maybe the nation can keep sanity in government and avoid the political parties again taking over the asylum?

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#193
post #11
post #6

It was interesting to hear a lead story on the nightly news talking about data privacy issues related to where the data was stored, saying that the data would be stored on “American company Amazon’s Servers”. No mention of Australian regions or GovCloud etc.

The ABC is reporting that the server must store data in Australia and the data cannot be transferred overseas.

https://www.legislation.gov.au/Details/F2020L00480

7(3) If COVID app data is uploaded from a mobile telecommunications device to the National COVIDSafe Data Store, a person must not:

(a) retain the data on a database outside Australia; or (b) disclose the data to a person outside Australia.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#194

Earlier quoted context omitted.

I'm not sure what you are saying adds to this discussion. In fact I think it mis-directs a useful debate. All the things you are complaining about are true literally anywhere else in the developed world right now. In fact, Australia probably has more cause for them then most because self-iso and aggressive contact tracing have done so much to keep us safe so that we can be free sooner rather than later .

Sometimes zoom-out perspective, "right now the whole western world [your point] is like a dystopian Gibson novel" is deeply meaningful.

Yes, but that can be considered assumed knowledge. The specialities of people here lend themselves well to discussing the gritty details of how dystopian surveillance systems are implemented. Which is a far more interesting discussion once you have exhausted your broader perspectives. I worry that the parent comment has a strong emotive hook which will distract from a more useful conversation that hasn't be had yet.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#195
My biggest worry (apart from the fact that any Australian law enforcement agency or intelligence service could serve the department that released the app with a notice under the TOLA Act (AA bill) to add a backdoor, and they would be compelled to do it and then deny its existence), is that it probably just won't be extremely effective, but people will see it as a magic bullet out of lockdown.

There is a lot of pressure from the right wing and business lobbies to re-open everything, but the only reason that we have had such low numbers is because we locked down early and hard.

People are saying "Install the app so we can go back to normal quicker" already - this is dangerous. With commercial grade hardware and software not designed for this, we can't assume the app will be reliable all (or even most) of the time. The period of time somebody is infectious seems to be quite long. So using the app as an excuse to ease lockdown will not work and would probably just result in unrestrained community transmission. Especially as we are coming into winter, we really don't want a second wave!

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#196
post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Why is time needed to "clean up the code"? Why not just develop the code on GitHub, in the open, with full transparency?

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#197

Earlier quoted context omitted.

It's OpenTrace [0]. OpenTrace is GPLv3, and is based on a published specification that's not too difficult understand. The fact that it is dervived from OpenTrace and they haven't published the source is the whole basis of this story. To answer your direct questions: - randomize Bluetooth addresses: I expect not, as that would screw any existing bluetooth connections, like headsets. - does it use a separate randomise…

It would be obvious if they tried to get precise location (GPS) as that requires a discrete permission. However, precision location is a red herring -- it isn't needed for intelligence purposes. They are much much more interested in the social graph. From that they can likely back track to calculate approximate location (using cell positioning information and other sources). Last I looked the OpenTrace was exchanging…

I just realised that using bluetooth directly requires location permission on Android. Which makes sense since you can geolocate using the signal strength of known location beacons.

https://developer.android.com/guide/topics/connectivity/blue...

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#198
post #196
post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Why is time needed to "clean up the code"? Why not just develop the code on GitHub, in the open, with full transparency?

It could be obfuscation and/or developing a compiler to add "extra features". For security reasons.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#199
post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

reap: ass access bill sow: scepticism

I think that should be reversed: they "sowed" the Assistance and Access Bill, and then "reap" (harvest, get) the scepticism?

But yes. Combined with the census, the "robodebt" project, etc, etc, there's not a lot of trust in government-run IT in Australia ...

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#200
post #192

Earlier quoted context omitted.

That’s a massive understatement. More accurate words describing the government’s track record would be “screwup, coverup, deceit, malicious”. At every single point in the past where they have had the chance to deal with technology they have done one or more of the following: 1. Screwed up, and then tried to cover it up. 2. Outright lied. 3. Created malicious laws that mandate violating privacy and makes it illegal to…

My feeling is that they are getting it right this time, as science and medicine is still trumping politics in Australia's COVID response. (Though that's beginning to change.) Getting it right this time means the Government doesn't have any excuses going forward. Overall Australia is genuinely doing a great job in relation to COVID, mainly because the Government had the good sense to put the experts center stage and g…

I agree that the government’s handling of covid-19 has mostly been surprisingly competent in a pleasant way.

It has certainly changed my opinion of them. I used to think that they were out of touch and incompetent, but now I think they can be competent and highly effective when they care, I just don’t think they care about privacy one bit.

Post reply on HN