Live data from Hacker News

First look at Apple/Google contact tracing framework

twitter.com

11–20 of 113 posts

Re: First look at Apple/Google contact tracing framework

#13

Earlier quoted context omitted.

the person behind the double-ratchet algorithm used in WhatsApp and the inventor of Signal

Ah, that makes sense then. Though I do think "Founder of Signal comments on new Google/Apple contact tracing proposal" would be a far less absurd title than "Moxies take on...", further adding "private" in quotes is a bit cheeky and definitely imparts bias into the discussion. None of us developers here are dumb enough to think an api whose goal is to literally track and trace human beings is 100% private. The questi…

Moxie is very well-known in the computer security industry.

https://en.wikipedia.org/wiki/Moxie_Marlinspike

Re: First look at Apple/Google contact tracing framework

#14
post #9

Note that years ago, Moxie has studied a similar problem of how to let users know if their contacts use Signal or not without uploading the whole address books like e.g. WhatsApp does [0]. It's similar because in both instances you want to "match" users in some fashion using a centralized service while keeping their privacy. He ruled out downloads of megabytes of data (something that the Google/Apple proposal would i…

> My guess to why Google/Apple didn't introduce rough location (like US state or county) into the system was to prevent journalists from jumping onto that detail and sensationalizing it into something it isn't (Google/Apple grabbing your data). Both companies operate the most popular maps apps on the planet as well as OS level location services that phone home constantly so they are already in possession of that data.

Apple is not in possession of the location of your phone. Their mapping system is designed to keep all queries to the servers anonymous using random rotated identifiers, even going so far as to keep the server from being able to see the full route from start to end (IIRC it's broken up into at least two chunks that are requested separately, though I don't know the details).

Re: First look at Apple/Google contact tracing framework

#15

Can somebody address the issue that we have almost no testing ability in the US?

We’re testing like 140k per day with over 2.5M tests total. Obviously more would be better but that’s hardly “almost no testing ability.”

I have friends being turned away from tests because they’re “not severe enough,” yet have the symptoms.

Re: First look at Apple/Google contact tracing framework

#17

Can somebody address the issue that we have almost no testing ability in the US?

We’re testing like 140k per day with over 2.5M tests total. Obviously more would be better but that’s hardly “almost no testing ability.”

I think it may differ by region. I can say factually that the testing in Texas is absolutely abysmal. Many people who have lots of symptoms are being turned away for testing.

On Tuesday our illustrious governor announced with lots of fanfare that Walgreen's would be expanding drive-thru testing using Abbott's 15-minute testing devices. It's now Friday evening and still no word on even where the locations will be for these testing sites. I'm sick of these BS press conferences and press releases, just STFU if you're not actually ready to do anything.

There is no way we'll be able to restart our economy without at least a 10X or more increase in testing. For right now the lack of testing isn't that huge of a deal when most people are quarantining at home anyway, but it will become a huge deal when people start going back to work. I'm still kind of amazed I haven't seen any convincing plan about how this eventually ends. Everything will just flare back up again once social distancing ends without tons of robust testing.

Re: First look at Apple/Google contact tracing framework

#18
post #9

Note that years ago, Moxie has studied a similar problem of how to let users know if their contacts use Signal or not without uploading the whole address books like e.g. WhatsApp does [0]. It's similar because in both instances you want to "match" users in some fashion using a centralized service while keeping their privacy. He ruled out downloads of megabytes of data (something that the Google/Apple proposal would i…

> My guess to why Google/Apple didn't introduce rough location (like US state or county) into the system was to prevent journalists from jumping onto that detail and sensationalizing it into something it isn't (Google/Apple grabbing your data). Both companies operate the most popular maps apps on the planet as well as OS level location services that phone home constantly so they are already in possession of that data…

Do you mean this?

> To protect user privacy, this data is associated with an identifier that rotates at the conclusion of a trip, not with the user’s Apple ID or any other account information. Rotating the ID at the conclusion of the trip makes it harder for Apple to piece together a history of any user’s activity over time.

https://www.apple.com/privacy/docs/Location_Services_White_P...

I think it's a nice gesture, however I wouldn't say that Apple isn't in possession of that data. The phone already uses other Apple services that are linked to your Apple ID and those services tell your IP address to Apple. Even if Apple can't track you via the rotating ID (not sure how it's made, maybe they actually can't), your IP address will reveal you, at least as long as you are using ipv6 which Apple has been heavily pushing in the past years.

They might not have the data refined, but even the whitepaper says it only makes piecing together the location history harder, not impossible.

Re: First look at Apple/Google contact tracing framework

#19

Can somebody address the issue that we have almost no testing ability in the US?

We’re testing like 140k per day with over 2.5M tests total. Obviously more would be better but that’s hardly “almost no testing ability.”

By these numbers, we have tested less than 1% of the population of the United Statues.

That is barely a drop in the bucket.

Re: First look at Apple/Google contact tracing framework

#20
Regardless of the technical issues with this, I think the "prank" issue Moxie brings up is much more serious. We've already seen the phenomenon of "Zoom bombing", I can imagine "tracer bombing" would be a much more serious issue. The only way I could see this working is that if when you enter a positive result you have to enter some sort of secret key from the testing authority, but that's totally not tenable given a lot (most?) testing these days is from private providers.
Post reply on HN