Live data from Hacker News

Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

ccc.de

11–20 of 55 posts

Re: Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

#11
post #9

Entire countries are under house arrest. I don't trust the government but I also want my parents to be able to go to store or hospital without risking their lives. Pretty much everybody is either in at-risk group themselves or has a close relative or friend who is at-risk. Maybe this isn't the dystopia we deserve, but it's the dystopia we need.

From a technical perspective, you don't need to trust the government in these cases - provided that they implement the solutions with built-in privacy.

Re: Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

#12
post #7
post #5

Earlier quoted context omitted.

This is one of the few cases where more privacy might literally save lives, because people will be more inclined to install the app if the privacy is taken more seriously. There was a poll where Germans were asked if they would install a contact tracing app. Some 40% sayed yes outright. Another 40% said "only if privacy concerns are addressed". So you're looking at a potential 40% market penetration without proper pr…

This is one of the few cases where mandatory installation of apps will save lives, as seen in China/SK. For those "40% only if privacy concerns are addressed" there is a gradient of privacy. How many of them will still have concerns no matter what? And how many will not install anything out of laziness/comfort? Meanwhile, Google and Facebook are installed in 90%+ of phones and happily scoop up location data every day…

Where's the proof that installing an app saved any lives at all?

And anyway, our rights are anyway being temporarily but heavily reduced. I don't see why we have to also install this app, especially since having everyone wear a mask and washing one's hands would make the whole point of having contact with an infected person almost irrelevant.

Re: Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

#13
I was listening in to yesterday's WH briefing and suveillance and contact tracing were mentioned multiple times with none of the media reps asking for details. I do know it is a genuine emegency, but I just don't trust goverment that much

Re: Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

#14
post #11
post #9

Entire countries are under house arrest. I don't trust the government but I also want my parents to be able to go to store or hospital without risking their lives. Pretty much everybody is either in at-risk group themselves or has a close relative or friend who is at-risk. Maybe this isn't the dystopia we deserve, but it's the dystopia we need.

From a technical perspective, you don't need to trust the government in these cases - provided that they implement the solutions with built-in privacy.

I don't want to be snarky, so instead let me ask what solutions would you recomnend for it?

Re: Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

#16
post #7
post #5

Earlier quoted context omitted.

This is one of the few cases where more privacy might literally save lives, because people will be more inclined to install the app if the privacy is taken more seriously. There was a poll where Germans were asked if they would install a contact tracing app. Some 40% sayed yes outright. Another 40% said "only if privacy concerns are addressed". So you're looking at a potential 40% market penetration without proper pr…

This is one of the few cases where mandatory installation of apps will save lives, as seen in China/SK. For those "40% only if privacy concerns are addressed" there is a gradient of privacy. How many of them will still have concerns no matter what? And how many will not install anything out of laziness/comfort? Meanwhile, Google and Facebook are installed in 90%+ of phones and happily scoop up location data every day…

And that does not mean it is right; it just means it is status quo. And Germans have a good reason to dislike panopticons as some still remember Stasi.

Mandatory apps installation.. I guess that could be rolled out as most providers can and do have the ability to install stuff on your phone remotely.

That said.. what are the odds average person gets sufficiently annoyed by gvmt mandated apps and installs lineage?

Re: Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

#17
> Even if the transmission of a message is observed in the system (e.g. via communication metadata), it must not be possible to conclude that a person is infected himself or herself or has had contact with infected persons. This must be ensured both with regard to other users and to infrastructure and network operators or attackers who gain insight into these systems.

I don't think this is doable. All protocols that we currently have have the ability to reveal this information in one way or another.

There are two fundamental approaches at the moment: soemthing like DP-3T which uses TCNs (temporary contact numbers) where contacts exchange temporary numbers. On infection you download the list of infected people and compare on your device for matches. This fundamentally reveals who was infected. Then you have centralized approaches where you hand out encrypted IDs which a central authority can decrypt. In the latter case you can just create new device IDs which again lets you easily figure out which of your contacts was infected.

In the latter case you have the theoretical possibility to detect such behavior due to the sheer amount of IDs generated by participants.

Generally the attack vector would be someone putting a beacon to a super market and making pictures of people going in and out and capture their IDs. Then they could figure out later which of the people got infected.

Re: Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

#18
post #7
post #5

Earlier quoted context omitted.

This is one of the few cases where more privacy might literally save lives, because people will be more inclined to install the app if the privacy is taken more seriously. There was a poll where Germans were asked if they would install a contact tracing app. Some 40% sayed yes outright. Another 40% said "only if privacy concerns are addressed". So you're looking at a potential 40% market penetration without proper pr…

This is one of the few cases where mandatory installation of apps will save lives, as seen in China/SK. For those "40% only if privacy concerns are addressed" there is a gradient of privacy. How many of them will still have concerns no matter what? And how many will not install anything out of laziness/comfort? Meanwhile, Google and Facebook are installed in 90%+ of phones and happily scoop up location data every day…

Mandatory how? How will you address people without suitable devices? Not everyone has a (suitable) smartphone.

Making owning and carrying a smartphone with required app mandatory won't fly in any healthy democracy.

Re: Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

#19
post #11

Earlier quoted context omitted.

From a technical perspective, you don't need to trust the government in these cases - provided that they implement the solutions with built-in privacy.

I don't want to be snarky, so instead let me ask what solutions would you recomnend for it?

I just meant that there are technical approaches that don't necessarily involve centralized storage of everyone's movements and contacts, but achieve the same goals.

Singapore (and others, for that matter) has allegedly solved some of these issues in their soon-to-be open source contact tracing app [0].

They basically let every device keep track on itself and it's encounters - until a diagnosis is made.

Can't remember the details from there off the top of my head, but you'd either do a lookup via a central authority, or notify peer-to-peer, depending on what other mechanisms are in play (ephemeral/co-signed IDs, etc.)

[0]: https://www.tracetogether.gov.sg/

Re: Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

#20
post #11

Earlier quoted context omitted.

From a technical perspective, you don't need to trust the government in these cases - provided that they implement the solutions with built-in privacy.

I don't want to be snarky, so instead let me ask what solutions would you recomnend for it?

The German's app will use bluetooth to track whom you're closed to on the device. When you get ill, the device notifies everyone that id 18911-2342-112312 has it and people who came in bluetooth range to you will get a notice to self isolate.
Post reply on HN