Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissection of COVIDSafe (Android): Australian government's contact tracing app

docs.google.com

Post reply on HN
Print view View original

241–250 of 271 posts

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#241

Post by phaynes »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

+1 mcannon. -1 Silly misinformation below. The country is also in the midst of a health induced financial crisis. I advise on both cyber and health. The tracking App is essential to helping the health workers and getting people back to work. It is benign as you can make such a thing.

Let's get behind it. Beers over video are just not the same as those in the pub.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#242

Post by AussieCit »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Before telling non technical people Yes the app is safe wouldn't it be prudent and ethical to rather say probably but wait until the legislation is passed and the source code is out?

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#243

Post by jamesjansson »

pca184 wrote: post #95
salan781 wrote: post #80

Earlier quoted context omitted.

Even if the government has the best intentions in this instance, it doesn’t matter. They have already created a set of laws that clearly dictate that this app and this data can be used how ever intelligence communities desire. They have burned all goodwill and trust with the public. It doesn’t matter what they say today unless they repeal AABill etc. Otherwise they’re just saying empty words.

Interpreting legislation without any common law / precedence is difficult. However as a general rule, if there are two laws that are conflicting (such as previous anti-privacy laws vs the proposed safeguards) the most recent enacted law applies, especially if it is specific. So while I’m by no means a fan of the erosion of privacy that this government has done previously, the proposed safeguards would be effective an…

Is "latest rules" truly what happens? Or if the law explicitly allows X and also explicitly disallows X, then a person would not be convicted, rendering in this case the latest safeguards in effective?

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#244

Post by thisrod »

I think this discussion is putting the cart before the horse. If there is no alternative to this app, what protections should it have? That's the second question to ask. The first one, which hardly anyone is asking, is whether the thing is necessary to start with.

There is one very strong reason to suspect Australians don't need this: the app has only been here 3 days, but the novel coronavirus has been around for 3 months, and it has never looked like getting out of control. Turns out that telephones and old-school contact tracing still work, and they work even better with some help from DNA manipulating virus detection robots. Who would have thunk it?

Plus, at this point, each app user has a 1 in a million chance of being exposed to the virus. Talk about number needed to treat!

Australia should focus on prisons, aged care facilities and concentration camps, where the risks are still meaningful. And we should rack our brains to imagine other ways that the virus could rapidly spread beyond our capacity to contain it. If things keep going right, we won't need this app. If something goes wrong, it will be an unexpected thing that the app can't fix.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#245

Post by RicFre »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Thanks for allaying some of the privacy concerns around the place Mike.....

But to be honest, I will wait for the Apple/Google contact tracing app to be released (because it will be soooo open and better and with a generic name can be used beyond the current pandemic).

It will not only tell me I've just sat next to someone with Covid19 on my train ride to work, but that they also updated their status to single this morning with a broken heart emoji. They've also been up all night watching relationship expert advice videos and about to start their 10 hour shift (since they socialize online under different pseudonyms, their employer is none the wiser) as an open heart surgeon... And if i’m inclined and would like to take up a limited special offer, I can get a 50% rebate on my 21yo gold plated private health fund if I can convince the Covid19 case to co-isolate immediately in the seat in front of me with the other Covid19 case. A full rebate if I can convince both of them to get off at the next station!!

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#246

Post by dghcrypto »

fuckthehumanity wrote: post #226
dghcrypto wrote: post #219

Earlier quoted context omitted.

It's easy to fix the app so that it does not need the phone number and to have the app notify the user of the need to get a test instead of having a contact tracer having to double handle the information and ring the user. I believe the fact the app is doing this more about its heritage than any design here, however as an "Australian innovation" we could fix this and avoid the prospect of vulnerable people being rung…

This is an extremely good point. The potential for misuse through ignorance and misinformation is high. How many "ATO" phone calls have we all received? This service could be genuinely anonymous, although of course under existing laws the government may already have created a back door, and as long as we're using authenticated app stores, nothing is truly untraceable. Having said that, this might very well help us in…

On the ATO calls, too many! It's interesting to note a news article about someone spoofing messages to phones claiming they are due to the app already. I actually think the idea of the app isn't a bad one (well at least once the blue tooth issues are properly fixed), but mixing the phone number and the app as a communication channel is already showing how it can cause problems.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#247

Post by iddqd »

addandsubtract wrote: post #133
tastroder wrote: post #2

It's interesting to see these tracing app discussions crop up all over the world at the moment. In Germany it quite literally took dozens of public interest groups, two weeks of media attention, EU guidance and an open letter by hundreds of scientists to make the government switch from central data collection to an acceptable decentralised approach. The amount of misinformation put out by lobby groups in the process…

Do you have a source for the change of course? The CCC published an open letter[0] 2 days ago and I doubt anything changed over the weekend. [0] https://www.ccc.de/en/updates/2020/corona-tracing-app-offene...

Germany flips to Apple-Google approach on smartphone contact tracing: https://www.reuters.com/article/us-health-coronavirus-europe...

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#248

Post by sjwright »

doubleunplussed wrote: post #235
lern_too_spel wrote: post #116

Earlier quoted context omitted.

I'm not aware of any Linux distros with 100% reproducible builds, though Debian is actively working on it and getting closer.

The distros can be sure without full reproducibility, since they built it. The users are still required to trust the distros built what they said they would though.

The end user isn't the distro though.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#249

Post by ifthenorelse »

sfpibx wrote: post #203
metta2uall wrote: post #62

Earlier quoted context omitted.

IMHO, the fact that they app is unobfuscated and can thus be easily decompiled is even better than released source code since one can't be sure that the released source code truly matches the actual build in the app store (unless they also go to the effort of having 'reproducible builds' - which would be quite impressive). Also it's good to keep in perspective that the 'government' can already track people to a great…

The mobile app could be just the tip of a very big iceberg. We need the server side code.

Yes, and presumably the scores of bureaucrats / administrators / call centre operators in all States and Territories accessing the database will read / write to the server via a separate application. So we need the code for those users.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#250

Post by rstuart4133 »

tgsovlerkhgsel wrote: post #201
rstuart4133 wrote: post #157

Earlier quoted context omitted.

It's OpenTrace [0]. OpenTrace is GPLv3, and is based on a published specification that's not too difficult understand. The fact that it is dervived from OpenTrace and they haven't published the source is the whole basis of this story. To answer your direct questions: - randomize Bluetooth addresses: I expect not, as that would screw any existing bluetooth connections, like headsets. - does it use a separate randomise…

The Apple/Google protocol does randomize: > The advertiser address type shall be Random Non-resolvable. > The advertiser address, RollingProximityIdentifier, and Associated Encrypted Metadata shall be changed synchronously so that they cannot be linked. (page 5, https://covid19-static.cdn-apple.com/applications/covid19/cu... ) I assume you can use your "regular" Bluetooth address for any communication with paired dev…

You made me look, and my times have changed.

> I assume you can use your "regular" Bluetooth address for any communication with paired devices

It turns out even that's not true. It's normal to use a different mac each time you connect to the same paired device: https://www.lairdconnect.com/support/faqs/why-does-ble-mac-a...

I don't know whether it multiple mac's in flight at the same time, but given the the effort they've put into it, it's entirely possible.

Post reply on HN