Earlier quoted context omitted.
You mean 'Own Analysis of SwissCovid'?
Or what it is now (title was edited, before it just mentioned one of the points)
Ahhh, have a nice day.
Analysis of SwissCovid app
21–30 of 33 posts
Re: Analysis of SwissCovid app
#22Earlier quoted context omitted.
I think it’s pretty obvious? You describe the situation as if it has been discovered as a law of physics to which all humans are subject. Change the system... honor open source principles. If ivory tower thinking means, improved state of affairs, then.. ok... ? Call it whatever you want haha.
I'm against the walled gardens of Apple, Google, Amazon etc. too, I'm just saying that if you want to launch an app for which it is especially important that as many people as possible should be able to use it, you have to think pragmatically...
The point is that you shouldn't mislead the population in claiming this app is open source when it actually isn't.
Some consequential parts of the protocol are implemented as a black box.
Re: Analysis of SwissCovid app
#23>A big part of the contact tracing protocol (which was originally the DP3T protocol) is implemented by Apple-Google in a part of the system called GAEN. This part has no available source code although the law requires disclosure of the source code of all components of the system. By the same logic, this would seem to require all of iOS and Android to be open source. Where does the "App" end and the underlying OS and…
The part that has been open sourced is essentially UI. Some of the most consequential parts are in the Bluetooth metadata, and how this leads eventually to an average attenuation over a certain time period.
This has epidemiological consequences, as acknowledged by one of the leaders of the DP-3T team to the BBC: https://www.bbc.com/news/technology-52995881
Apple (and Google?) retain higher quality signals than what they make available to the apps.
It introduces new security issues, because Apple and Google have had to make choices that degrade the qualities of the protocol. See Sections 3.5 and 3.6 in the report. The Swiss Cyber Security Centre expressed negative sentiments towards the fact that Apple and Google didn't implement some of the recommended protocol improvements: https://www.melani.admin.ch/dam/melani/de/dokumente/2020/Rep...
Finally, this Bluetooth layer becomes a covert channel for transmitting information between phones. There is a lot that we can't tell from this outside.
Re: Analysis of SwissCovid app
#24> Users may be traced or identified by surveillance systems of third parties while using SwissCovid.
How does that work? Do they mean the Bluetooth MAC or can the users also be traced/identified by third parties through the Apple/Google API?
Re: Analysis of SwissCovid app
#25"Although the source code of the app is available, we cannot compile it, run it, and make it work without signing an agreement with Apple or Google. We do not find it compatible with the notion of open source." <-- Isnt this the case with every app?
You should be able to compile and run app that is truly open source if you have right tools and skills.
Re: Analysis of SwissCovid app
#26"Although the source code of the app is available, we cannot compile it, run it, and make it work without signing an agreement with Apple or Google. We do not find it compatible with the notion of open source." <-- Isnt this the case with every app?
No, it is not. Most apps on my phone are either compatible with microG (open source), or have their own notification system (such as Telegram).
Re: Analysis of SwissCovid app
#27> In summary, our observations are as follows.
> Some servers are hosted by Amazon, as part of a CDN service.
FUD - This report is all about Fear, Uncertainty and Doubt and is every bit as dangerous as lying.
I find it difficult to believe that, even among the HackerNews crowd, this point registers near as important as having an easy to use, efficient way to do contact tracing for Covid-19.
Why does every attempt to make the world a better place have to be ripped apart and thrown in the dumpster fire?
Re: Analysis of SwissCovid app
#28> In summary, our observations are as follows. > Some servers are hosted by Amazon, as part of a CDN service. FUD - This report is all about Fear, Uncertainty and Doubt and is every bit as dangerous as lying. I find it difficult to believe that, even among the HackerNews crowd, this point registers near as important as having an easy to use, efficient way to do contact tracing for Covid-19. Why does every attempt to…
Unfortunately, I agree with this view of the report. The report does do a mid-depth technical dive and raises the sort of things a security analyst would certainly look to verify, and I will use it as a base for other app analysis - but it conflates hypothetical risks with vulnerabilities. I am dealing with these precise technical issues around de-identification and encryption in a professional context right now. The paper uses nested and linked parenthetical observations and comments without resolving them to evidence, and it reads like a rant. The issue of not being able to rebuild a working app from the provided source code is indeed cause for suspicion, but it needs deeper analysis. The criticism that somehow key derivation is not encryption reads like the author was reaching out of their depth.
A security analysis needs to be more than just an uncharitable read of an architecture that shows it has exposure to scandal or discredit. These apps are going to have issues around data access, custody and control and a lot of others, but the analysis of them needs to be stronger.
Re: Analysis of SwissCovid app
#29Earlier quoted context omitted.
They argue that GAEN is part of the Play Services on Android. And that the app was designed to work at first with DP3T protocol which (I'm not sure) requires only access to bluetooth on the device. But DP3T was replaced with GAEN. (This just my understanding from the web page and wikipedia, I'm not familiar with all of this :) ) To justify such exclusion, SwissCovid promoters argue that GAEN is part of the operating…
Purely speculating, but the reason for GAEN being part of Play Services is probably that otherwise it would require an OS update to be installed, which means ~80% of the Android phones being used "out in the wild" would be incompatible (Ok, maybe a bit less in Switzerland). And (even more speculative), the reason for using GAEN instead of DP3T may be battery usage? So you could build a theoretically pure open source…
You are correct about battery usage. The analysis they published[1] mentions this (in the 2nd paragraph of the introduction) :
"One difficulty of using Bluetooth in phones is that the operating system does not allow apps running in the background to use the Bluetooth advertising system. Hence, to do so,either the app must stay in the foreground, which drains the battery a lot, or the operating system must be changed. Apple and Google allied to provide a standard Bluetooth API which would not drain the battery. Hence, automated contact tracing apps must either be complian twith this API or make the user upset about heavy battery usage."
Singapore's TraceTogether app doesn't use GAEN api and does have this issue [2].
France's StopCovid app uses a different protocol called ROBERT[3], and they asked Apple to allow their app to run in the background[4]. So they also have battery issues.
[1]: https://lasec.epfl.ch/people/vaudenay/swisscovid-ana.pdf
[2]: https://en.wikipedia.org/wiki/TraceTogether#Description
[3]: https://github.com/ROBERT-proximity-tracing/documents
[4]: https://en.wikipedia.org/wiki/Exposure_Notification#Non-adop...
Re: Analysis of SwissCovid app
#30> there is no founded technical justification for excluding GAEN from the components of the system
That can unfortunately be said of quite a few apps, but it's good that they pointed it out here. In any case, if you're running a phone with Google Apps installed, privacy can only be an illusion.