Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissection of COVIDSafe (Android): Australian government's contact tracing app

docs.google.com

Post reply on HN
Print view View original

201–210 of 271 posts

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#201

Post by tgsovlerkhgsel »

rstuart4133 wrote: post #157
tgsovlerkhgsel wrote: post #132

Does this randomize the Bluetooth address too? I saw the README (from the dissection) mention a function that hides the name "so the other side only gets the address", which would defeat the entire purpose of rotating identifiers. If it does randomize the Bluetooth address, does it use a separate identifier, and if so, does it rotate both at the same time? Otherwise, you can use an identifier that changes at time 1 t…

It's OpenTrace [0]. OpenTrace is GPLv3, and is based on a published specification that's not too difficult understand. The fact that it is dervived from OpenTrace and they haven't published the source is the whole basis of this story. To answer your direct questions: - randomize Bluetooth addresses: I expect not, as that would screw any existing bluetooth connections, like headsets. - does it use a separate randomise…

The Apple/Google protocol does randomize:

> The advertiser address type shall be Random Non-resolvable.

> The advertiser address, RollingProximityIdentifier, and Associated Encrypted Metadata shall be changed synchronously so that they cannot be linked.

(page 5, https://covid19-static.cdn-apple.com/applications/covid19/cu...)

I assume you can use your "regular" Bluetooth address for any communication with paired devices (which is then just as trackable as it would be otherwise), while still using this at the same time for the BTLE announcements.

However, I suspect these APIs may not be available to non-OS applications.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#202

Post by sfpibx »

danieltillett wrote: post #137
mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Mike my concern as a scientist about this app is it may not help much at this point. If it is only picking up people you spent more than 15 minutes talking to it is going to miss a lot transmission events. Do we have the contact tracing people to actually make use of this data? Even if we did I can’t see how we are going to avoid the need to interview each positive case to find all the people they came into contact w…

Non scientist here but I’ve been harping on about the same thing. Someone can cough this virus into my face in a matter of seconds. It would appear this 15 min contact duration minimum is perhaps based on outdated data and knowledge of transmissibility.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#203

Post by sfpibx »

metta2uall wrote: post #62
mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

IMHO, the fact that they app is unobfuscated and can thus be easily decompiled is even better than released source code since one can't be sure that the released source code truly matches the actual build in the app store (unless they also go to the effort of having 'reproducible builds' - which would be quite impressive). Also it's good to keep in perspective that the 'government' can already track people to a great…

The mobile app could be just the tip of a very big iceberg. We need the server side code.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#204

Post by cmroanirgo »

femto wrote: post #192
chillfox wrote: post #178

Earlier quoted context omitted.

That’s a massive understatement. More accurate words describing the government’s track record would be “screwup, coverup, deceit, malicious”. At every single point in the past where they have had the chance to deal with technology they have done one or more of the following: 1. Screwed up, and then tried to cover it up. 2. Outright lied. 3. Created malicious laws that mandate violating privacy and makes it illegal to…

My feeling is that they are getting it right this time, as science and medicine is still trumping politics in Australia's COVID response. (Though that's beginning to change.) Getting it right this time means the Government doesn't have any excuses going forward. Overall Australia is genuinely doing a great job in relation to COVID, mainly because the Government had the good sense to put the experts center stage and g…

Requiring a phone number may be in breach of existing legislation, particularly that which resulted from the No vote to the Australia Card in the 80's. Those anti-id laws were ratified in 2005/2006.

https://www.aph.gov.au/About_Parliament/Parliamentary_Depart...

This tech can and should be using crypto random hashes rather than phone numbers. The authorities don't need to call anyone, let the app and the fully anonymous central db do it's job to notify others that they need to get tested.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#205

Post by femto »

chillfox wrote: post #200
femto wrote: post #192

Earlier quoted context omitted.

My feeling is that they are getting it right this time, as science and medicine is still trumping politics in Australia's COVID response. (Though that's beginning to change.) Getting it right this time means the Government doesn't have any excuses going forward. Overall Australia is genuinely doing a great job in relation to COVID, mainly because the Government had the good sense to put the experts center stage and g…

I agree that the government’s handling of covid-19 has mostly been surprisingly competent in a pleasant way. It has certainly changed my opinion of them. I used to think that they were out of touch and incompetent, but now I think they can be competent and highly effective when they care, I just don’t think they care about privacy one bit.

My hope is that now Australians have seen what is possible there will be no going back to the old ways.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#207

Post by sjy »

shakna wrote: post #154
pca184 wrote: post #95

Earlier quoted context omitted.

Interpreting legislation without any common law / precedence is difficult. However as a general rule, if there are two laws that are conflicting (such as previous anti-privacy laws vs the proposed safeguards) the most recent enacted law applies, especially if it is specific. So while I’m by no means a fan of the erosion of privacy that this government has done previously, the proposed safeguards would be effective an…

> So while I’m by no means a fan of the erosion of privacy that this government has done previously, the proposed safeguards would be effective and not just empty words (at least legally speaking). Currently, they are empty words, legally speaking. The legal text that contains the safeguards is here [0]. It doesn't have most of the safeguards that Hunt announced. They're a pipedream. For example, the minister said th…

That last point is wrong – section 6 of the determination says that “a person must not collect, use or disclose COVID app data“ unless it is for one of the whitelisted purposes in subsection (2). COVID app data includes data that “has been” stored on a phone.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#208

Post by sjy »

lysp wrote: post #56
PudgePacket wrote: post #49

Earlier quoted context omitted.

Aus gov has a terrible track record with information systems. Data leaks & breaches, flaky IT services, mass robo-debt claims of which 600,000 needed to be re-evaluated. Not to mention rushing through privacy destroying laws citing "Islamist terrorism, paedophile networks and organised crime". If you are who I think you are you're probably more knowledgable of the particular 2018 law than me. And now they're "rushing…

Assistance and Access Bill: https://www.zdnet.com/article/whats-actually-in-australias-e... Telecommunications (Interception and Access) Amendment (Data Retention) Bill: https://www.bbc.com/news/world-australia-32061421 Peter Dutton's proposed "give me your password" law: https://www.sydneycriminallawyers.com.au/blog/peter-dutton-p... > Under the proposals, people who are not even suspected of a crime would face a fi…

It’s inaccurate to call it “Peter Dutton’s give me your password law” – it’s been around since 2001 (although the maximum penalty was increased from 2 to 10 years in 2018), and there are equivalent laws in most developed countries. As far as I am aware, only in the US have people actually spent years in prison solely for refusing to disclose a password: https://arstechnica.com/tech-policy/2020/02/man-who-refused-...

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#209

Post by sjy »

neximo64 wrote: post #55
mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

How do you realistically use this app if you have to keep it open. You and everyone else are so focussed on convincing everyone that it’s safe, etc and totally ignoring the practical aspects of it. For someone to have the app open for 15 mins within 1.5m all day.. how will that be done, it requires a large conscious commitment. You might as well just ask the person who is in your personal space for 15 consecutive min…

This is the question I’ve been wondering about, but currently it’s still not clear that you need to do this. I installed the iOS app out of curiosity, and it didn’t tell me I had to leave it foregrounded. However, a few minutes after exiting the app I did receive a notification saying I should reopen it to keep it working – maybe apps can continue scanning in the background for some limited period of time?

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#210

Post by contingencies »

ImaCake wrote: post #194
contingencies wrote: post #124

Earlier quoted context omitted.

Sometimes zoom-out perspective, "right now the whole western world [your point] is like a dystopian Gibson novel" is deeply meaningful.

Yes, but that can be considered assumed knowledge. The specialities of people here lend themselves well to discussing the gritty details of how dystopian surveillance systems are implemented. Which is a far more interesting discussion once you have exhausted your broader perspectives. I worry that the parent comment has a strong emotive hook which will distract from a more useful conversation that hasn't be had yet.

Well, discussing your worries might be best done with a professional. Interest is subjective. Herd mentality is hardly a justification of scope limitation, quite the opposite. We should dig in the places nobody else does, turn over the stones left untouched. Propriety is often just an abject affront to inquiry.
Post reply on HN