Analysis of SwissCovid app
lasec.epfl.ch
Analysis of SwissCovid app
1–10 of 33 posts
Re: Analysis of SwissCovid app
#2misleading title. Please use source titles in submissions.
Re: Analysis of SwissCovid app
#3Setting apart the technical parts, this is IMHO preoccupying:
> NCSC states that "Users can always turn off tracing if they are in what they consider to be a sensitive environment".
Data (location and/or contacts) is either sensitive data or is it not (according to local Laws), the concept of "less sensitive data that I can risk being not protected" as opposed to "more sensitive data that - to be safe - I must exclude from collection by turning off the app" is "crazy".
Example:
1) going to work and back: app on
2) at work: app on
3) at home: app on
4) going out to - say - procure something illegal or meet lover (cheating on wife), sensitive environment: app off
In this case absence of data may be data as well.
Re: Analysis of SwissCovid app
#4"Although the source code of the app is available, we cannot compile it, run it, and make it work without signing an agreement with Apple or Google. We do not find it compatible with the notion of open source." <-- Isnt this the case with every app?
Re: Analysis of SwissCovid app
#5>A big part of the contact tracing protocol (which was originally the DP3T protocol) is implemented by Apple-Google in a part of the system called GAEN. This part has no available source code although the law requires disclosure of the source code of all components of the system.
By the same logic, this would seem to require all of iOS and Android to be open source. Where does the "App" end and the underlying OS and libraries begin in this requirement?
Re: Analysis of SwissCovid app
#6"Although the source code of the app is available, we cannot compile it, run it, and make it work without signing an agreement with Apple or Google. We do not find it compatible with the notion of open source." <-- Isnt this the case with every app?
Yes, it's a ridiculous absolutist argument.
Re: Analysis of SwissCovid app
#7"Although the source code of the app is available, we cannot compile it, run it, and make it work without signing an agreement with Apple or Google. We do not find it compatible with the notion of open source." <-- Isnt this the case with every app?
I think the point here is that on iOS, compiling/running/making it work requires an entitlement (i.e. permission) that is granted only to those who are signatories to Apple's agreement on getting access to the Covid API.
See the yellow "important" box on https://developer.apple.com/documentation/exposurenotificati... for some more info. Not sure how this works on Android but I assume there is a similar permissions gate to prevent other apps accessing this feature.
Re: Analysis of SwissCovid app
#8>A big part of the contact tracing protocol (which was originally the DP3T protocol) is implemented by Apple-Google in a part of the system called GAEN. This part has no available source code although the law requires disclosure of the source code of all components of the system. By the same logic, this would seem to require all of iOS and Android to be open source. Where does the "App" end and the underlying OS and…
They argue that GAEN is part of the Play Services on Android. And that the app was designed to work at first with DP3T protocol which (I'm not sure) requires only access to bluetooth on the device. But DP3T was replaced with GAEN.
(This just my understanding from the web page and wikipedia, I'm not familiar with all of this :) )
To justify such exclusion, SwissCovid promoters argue that GAEN is part of the operating system of the phone, or sometimes part of the Bluetooth communication interface of the phone, and that it is not common to require to disclose the source code of such parts. We deny that GAEN is any such part of the phone, at least on Android phones. GAEN is part of the Google Play Services which are independent of the operating system and of the communication interfaces. We could actually run a pre-standard version of SwissCovid on an Android phone which had no Google Play Services. However, this phone had the Android operating system and could use Bluetooth. Furthermore, most of the former DP3T protocol which was implemented in this pre-standard version disappeared in the current version of the app since an equivalent protocol is now in GAEN. We conclude that there is no founded technical justification for excluding GAEN from the components of the system.
Re: Analysis of SwissCovid app
#9"Although the source code of the app is available, we cannot compile it, run it, and make it work without signing an agreement with Apple or Google. We do not find it compatible with the notion of open source." <-- Isnt this the case with every app?
If you read the report itself, they elaborate in section A.3 that the app does run but crashes due to something related to notifications.
I'm speculating but I suspect the agreement they're referring to is the agreement for Google's proprietary Play Services API. I believe it's possible to compile Android itself and regular non-Google-Play Android apps without agreeing to anything but the terms of the open-source licenses.
Re: Analysis of SwissCovid app
#10"Although the source code of the app is available, we cannot compile it, run it, and make it work without signing an agreement with Apple or Google. We do not find it compatible with the notion of open source." <-- Isnt this the case with every app?
I wonder what alternative they would propose? If you want people to be able to use your app, you have to support the most popular app platforms, and if that means signing and agreement with Apple and/or Google, you have to do that. Anything else is "ivory tower" thinking.