Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissection of COVIDSafe (Android): Australian government's contact tracing app

docs.google.com

Post reply on HN
Print view View original

181–190 of 271 posts

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#181

Post by hilbert42 »

Daishiman wrote: post #100
discordance wrote: post #45

Earlier quoted context omitted.

I would love to trust them more, but the Australian government does not have a good track record with regards to privacy. Two such recent examples: - Australian's browser history is being provided to law enforcement even though that practice was excluded from the original intent and law [0] - Australia passed laws in 2018 which enable law enforcement to compel tech companies into inserting backdoors into their softwa…

The Australian government is not a single monolothic institution. It's a set of hundreds of thousands of people with different agendas and intentions. You cannot assign singular agency to the entire government; rather we have to go case-by-case to understand the implications of programs like these.

"The Australian government is not a single monolothic institution. It's a set of hundreds of thousands of people with different agendas and intentions."

Correct! Once we had two camps, you either voted for one or the other. That's all gone now, Identity Politics unfortunately killed the simple life off years ago.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#182

Post by ggm »

lukevdp wrote: post #37

In the Privacy Impact assessment that was released here https://www.health.gov.au/sites/default/files/documents/2020... The government is planning to release the source code “subject to consultation with the Australian Signals Directorate’s Australian Cyber Security Centre.” Take that for what you will. I suspect some people will take this to mean they won’t be releasing the source, however at this point I think it’s…

On national radio this morning they implied a belief in security-by-obscurity regarding things. I can't even. (I suspect the journalists mangled what the ASD said)

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#183

Post by angry_octet »

rstuart4133 wrote: post #152
tastroder wrote: post #2

It's interesting to see these tracing app discussions crop up all over the world at the moment. In Germany it quite literally took dozens of public interest groups, two weeks of media attention, EU guidance and an open letter by hundreds of scientists to make the government switch from central data collection to an acceptable decentralised approach. The amount of misinformation put out by lobby groups in the process…

> is that similar in Australia or is this app primarily driven by the government itself? I'm an Australian - and from my perspective the answer is "no". They are doing the best job they can. In this case, the mandarins running the place (we have a West Minister system) look to be very unfamiliar with open sources development practices, and the positive impacts it has software reliability, productivity and the trust y…

I would have to disagree that this is not driven by the government. This approach -- which has significant privacy defects -- is very much driven by a desire to have centralised control. It is quite possible them to think that they are the best people to have this data, and that they will manage it best, despite evidence to the contrary.

You have to understand that none of the senior officials have any desire but to please the politicans, and they are all extremely risk averse. They have a long history of covering up mistakes, breaches of the ministerial code of conduct and their own maladministration, so citizen privacy isn't even on their list of concerns.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#184

Post by hilbert42 »

roenxi wrote: post #156
Daishiman wrote: post #100

Earlier quoted context omitted.

The Australian government is not a single monolothic institution. It's a set of hundreds of thousands of people with different agendas and intentions. You cannot assign singular agency to the entire government; rather we have to go case-by-case to understand the implications of programs like these.

That is a little like saying the human body isn't a single organism because, say, the digestive tract operates with its own agency and intention outside of conscious control. It isn't correct; the politicians in the government have a very high level of agency around what ends up being fed into the institutions and what agendas and intentions are allowed to rise to power. This isn't the step that gets us to a dystopia…

"I'd rather we went in the exact opposite direction of this app and put legal barriers in place to them even asking. COVID-19 is horrible, but it will pass. This tracking strategy will not.".

Absolutely damn correct brother! 10/10.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#185

Post by justatdotin »

mcannon wrote: post #42
bad_user wrote: post #40

Earlier quoted context omitted.

You can easily deny location data to games and people that are concerned about these apps will not share their location lightly. I have no app on my iPhone with the ability to use my location in the background, not even Waze or Google Maps. Also I don't care about deletion policies. That data should not be collected in the first place. I don't know about any specifics, but if the data isn't anonymized somehow, on the…

Did you know that on iOS it doesn’t even ask for location, and on Android that’s required for Bluetooth? The source code will show you what is done with that (as others who have decompiled it already have shown it doesn’t use the location anywhere). You can choose to get the virus - but that’s a pretty silly choice IMHO. And if you do, please stay home and don’t give it to anyone else.

how does running the app stop you from getting the virus?

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#186

Post by hilbert42 »

driverdan wrote: post #126
Daishiman wrote: post #100

Earlier quoted context omitted.

The Australian government is not a single monolothic institution. It's a set of hundreds of thousands of people with different agendas and intentions. You cannot assign singular agency to the entire government; rather we have to go case-by-case to understand the implications of programs like these.

That makes it worse. A well-intentioned, well-meaning government org could create something with proper privacy controls and then another part of the government with worse intentions could get their hands on the data.

"A well-intentioned, well-meaning government org"

Yuh, has there ever been one? If so where and when? (I've been around quite some years now and I've never seen one anywhere.)

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#187

Post by sfpibx »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Deletion is not enough. Destruction is instead required.

They need to release their server side code as the mobile app could be just the tip of a very big iceberg.

They should also provide details of the platform ecosystem and how it’s secured; trust boundaries, IAM, PAM, audit, etc.

Point being that Snowden is right when he warns that the architecture of oppression is being built in the name of COVID-19.

We need a tracing system that can only be used to serve the people, and not some wannabe tyrants.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#188

Post by angry_octet »

tzs wrote: post #84
zelphirkalt wrote: post #32

Earlier quoted context omitted.

For this specific case, it would be a grave mistake to license under anything, which does not contain a copyleft to make sure they release the source code as well and grant the 4 freedoms.

If I'm understanding this right, this app was written by the Australian government. Does the license for any libraries or other outside code they have included even matter? Generally, governments have what is called "sovereign immunity" when it comes to civil lawsuits. They can only be sued if they decide to allow it. Some countries waive their sovereign immunity for specific laws. For example US copyright law waives…

The Australian Govt respects copyright a dictacted by legislation, rather than some general immunity concept. So particular legislation (such as FOI, Archives Act, etc) may dictate that copies are made and kept. In general, the Govt pays fees as would a commercial entity, but many of the use cases could be covered by a legislative requirement or a fair use provision, and it is rather baroque, and the process of legal reform is quite slow.

https://www.alrc.gov.au/publication/copyright-and-the-digita...

https://www.smh.com.au/business/companies/government-alleged...

As to software, I don't believe any part of the Australian Govt has been sued for violation of open source copyright, and it is generally taken quite seriously at agencies like CSIRO. It has always been a big talking point for MSFT and big integrators as a reason not to use open source though.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#189

Post by angry_octet »

rstuart4133 wrote: post #157
tgsovlerkhgsel wrote: post #132

Does this randomize the Bluetooth address too? I saw the README (from the dissection) mention a function that hides the name "so the other side only gets the address", which would defeat the entire purpose of rotating identifiers. If it does randomize the Bluetooth address, does it use a separate identifier, and if so, does it rotate both at the same time? Otherwise, you can use an identifier that changes at time 1 t…

It's OpenTrace [0]. OpenTrace is GPLv3, and is based on a published specification that's not too difficult understand. The fact that it is dervived from OpenTrace and they haven't published the source is the whole basis of this story. To answer your direct questions: - randomize Bluetooth addresses: I expect not, as that would screw any existing bluetooth connections, like headsets. - does it use a separate randomise…

It would be obvious if they tried to get precise location (GPS) as that requires a discrete permission. However, precision location is a red herring -- it isn't needed for intelligence purposes. They are much much more interested in the social graph. From that they can likely back track to calculate approximate location (using cell positioning information and other sources).

Last I looked the OpenTrace was exchanging an encrypted binary blob generated by the government, likely a unique identifier key and timestamp, which could be updated on demand by the server/app owner. Basically there is no anonymity for the user versus the Govt, only somewhat against other users.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#190

Post by jonstribling »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Considered and smart response. Thanks!
Post reply on HN