Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissection of COVIDSafe (Android): Australian government's contact tracing app

docs.google.com

Post reply on HN
Print view View original

261–270 of 271 posts

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#261

Post by hamlsandwich »

pfortuny wrote: post #78
lysp wrote: post #66

Earlier quoted context omitted.

Exactly this. The Aus Gov - especially the current one is massively lacking in trust. Encryption laws, metadata laws. Scope creep on metadata access (ie local councils, horse racing bodies). Lack of transparent reporting when these laws are in use. Raids on journalists. Not to mention their lack of transparency over bushfires, sports grants, angus taylor's family connections with mining / paying $90m? for water to as…

You may be right (probably are, as I am from Spain). But you should not focus on this specific government: the dangers of overstepping are great whatever the color or the chirality or even the deeds of a government.

I know what you're saying, but we _also_ need to focus on this specific government, because they make the situation bad from the get-go, rather than just potentially bad.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#262

Post by mickotron »

cmroanirgo wrote: post #114
Daishiman wrote: post #100

Earlier quoted context omitted.

The Australian government is not a single monolothic institution. It's a set of hundreds of thousands of people with different agendas and intentions. You cannot assign singular agency to the entire government; rather we have to go case-by-case to understand the implications of programs like these.

Yes. But it is the government that creates the law. Parent also forgot to mention mandatory data retention laws. All isps must retain history of internet traffic for ¿2 years. That telephone numbers are used in this app should also be regarded as a breach of the referendum we had about the Australia Card back in the 80's. (It is illegal to tie citizens to a number for the sake of tracking, which is exactly what this…

This only matters if it's mandatory, which voting is in Australia. This app is voluntary. Whether it has passed or not yet, legislation is planned to make it illegal to force anyone to download or use it. So trying it to a phone number is ok if it's totally voluntary. Also because users are not identified by their phone number under normal circumstances, this is also ok. If someone steals or leaks the key used to encrypt/decrypt all TempIds for all users, or can figure out a pattern in the generation of future TempIds for users, they can possibly tie people to their phone number and identify them. However under normal use there is no way to identify someone, well unless they can snoop the broadcast/encounter json messages and get your device ID and toe that to you

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#263

Post by ggm »

aiham wrote: post #254
ggm wrote: post #145

I'd love to know where 15 minutes exposed came from. Feels like a value imputed from a join over battery drain and usefulness. I thought five minutes made more sense. If you are 15 min within 1.5m of a stranger in most Australian states you're probably mildly in beach of social distancing.

15 minutes was part of the definition for a casual contact 2 months ago, a lot earlier than the app and the social distancing rules. https://www.health.gov.au/sites/default/files/documents/2020...

You will notice in that guidance that if you subsequently fall ill as a casual (sub 15 min) contact they will need to talk to you for contacts tracing..

So that implies there is a health risk burden under 15 which needs to incur costs of contact tracing at which time this app cannot help.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#264

Post by mickotron »

bad_user wrote: post #40
mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

You can easily deny location data to games and people that are concerned about these apps will not share their location lightly. I have no app on my iPhone with the ability to use my location in the background, not even Waze or Google Maps. Also I don't care about deletion policies. That data should not be collected in the first place. I don't know about any specifics, but if the data isn't anonymized somehow, on the…

CovidSafe is based off OpenTrace which is GPLv3. The Aus govt have to release the code. They said they would 2 weeks after the launch of the app. I have reviewed the client side source code for OpenTrace. It doesn't store location information. Also, read the BlueTrace whitepaper, it will answer a lot of questions you might have. The data is anonymised. You are identified by a TempId that is changed every 15 mins, that is based on your UserId and some other data (see white paper). If someone were to decrypt this value, it would reveal your UserId, but not your phone number. The attacker would need access to the server side storage to gain this information, as I believe the client side does not store this.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#265

Post by mickotron »

chii wrote: post #233
healsjnr1 wrote: post #139

Earlier quoted context omitted.

You've really lost me with > You can chose to get the virus That wasn't your original argument and this does nothing to stop individual people getting the virus. And the source code is worth nothing. The legal structure is already there to have the app changed without anyone being notified. If they released an entire buildable set of source that I could use to build and install the app myself, maybe. But that's about…

do you make the same requirement of all software you are using? If not, why would this particular one be differently treated? Location tracking is indeed a dangerous piece of information. But in the short time that the gov't had to face the issue, the best option is to do this tracking to re-enable the economy. Until proven otherwise, it would be wise to not assume there's already malware. I'm not saying there isn't,…

Stop pushing myths. There is no location tracking. You look at the OpenTrace source code or the BlueTrace whitepaper, and see where this is taking place, and let me know. The only way they could location track is if the app data was enriched/correlated with other data, which basically means they can do fuck-all location tracking with this. They only have timestamps, temporary identifiers, mobile device models, transmit power etc. https://github.com/opentrace-community https://bluetrace.io/static/bluetrace_whitepaper-93806365659...

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#266

Post by mickotron »

neximo64 wrote: post #55
mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

How do you realistically use this app if you have to keep it open. You and everyone else are so focussed on convincing everyone that it’s safe, etc and totally ignoring the practical aspects of it. For someone to have the app open for 15 mins within 1.5m all day.. how will that be done, it requires a large conscious commitment. You might as well just ask the person who is in your personal space for 15 consecutive min…

Mate I think you are overcomplicating this something fierce.

It runs in the background. It logs all encounters by either advertising its presence (Peripheral mode) or scanning for devices (Central Mode). They alternate between these states. When two devices encounters it's logged on both sides. That device is blacklisted for a few cycles to avoid constantly logging it.

The 15 minutes 1.5m conditions are applied on the reporting side after it is uploaded.

No conscious effort. Kinda like how your email client pings you when you receive an email. When was the last time you had to consciously think for an email to come into your mailbox?

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#267

Post by mickotron »

danieltillett wrote: post #137
mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Mike my concern as a scientist about this app is it may not help much at this point. If it is only picking up people you spent more than 15 minutes talking to it is going to miss a lot transmission events. Do we have the contact tracing people to actually make use of this data? Even if we did I can’t see how we are going to avoid the need to interview each positive case to find all the people they came into contact w…

The client logs all encounters regardless of time or proximity. It just has to be in range. The 15 minute 1.5m conditions are done on the reporting side when a case is positive and data is uploaded.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#268

Post by mickotron »

bamboozled wrote: post #155

I'm wondering how the application protects against people running malicious clients works? If the point of this app is to broadcast identifiable information into the public domain, what is stopping others from snooping this information and creating their own tracing DB?

Cool go ahead, you're only gonna get my device identifier, phone model, some encrypted temporary ID that identifies me for 15 minutes, which health agency the app is affiliated with (the same as the attacker given we are in range), etc.

Seriously my Facebook app and the underlying Android OS is sucking way more sensitive data than this is broadcasting. And only to the restricted physical range of Bluetooth.

And if you did happen to get my device identifier, TempId etc, you still have to map those to my personal identity. Decrypt my TempId and what do you get, my app UserId. Not even my phone number. Try harder.

My bigger concern is a malicious client that can exploit a weakness in mine by sending a specially crafted json payload and gaining remote code execution.

The data on its own is pretty worthless for location tracking. It needs enrichment or correlation with other data to be used for that purpose.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#269

Post by alfiedotwtf »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

So now it turns out that your company may have been involved in the development of COVIDSafe. Are you actually kidding me? Turn off the HN angry mod mode off? I'm even more pissed now.

https://www.innovationaus.com/atlassian-and-the-covidsafe-te...

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#270

Post by ACow_Adonis »

Fargren wrote: post #256
ACow_Adonis wrote: post #127

Earlier quoted context omitted.

Understand I'm replying not because I think people should necessarily want/try to infect themselves with the virus, but because I'm against spreading misinformation and a misuse of statistics. Australia is approaching 100 deaths and has several thousand confirmed cases through more widespread testing than new York, doing so at a higher and wider rate than New York who's stats/testing and medical regime show signs of…

I appreciate this. I have not had an easy time finding any data that goes deeper than the 0.2% data point, which clearly doesn't give a full picture because it doesn't dive into the effect of comorbidity. Your sibling post links to data that puts the risk for people under 40 without comorbidity at roughly 1/6 of the 0.2, which is a big difference. Do you have any data, or any sources for your comment about the situat…

https://www.health.gov.au/news/health-alerts/novel-coronavir...

It's a live updated page, so I don't know what stats will be displayed each day, but I'm relatively confident they will support my claim unless things change drastically.

You will find an infographic with breakdowns of positive diagnosis (known cases) and deaths. Both are helpfully split by age groups and gender.

Post reply on HN