281–290 of 484 posts
An interesting Twitter thread on why the stand-alone contact tracing apps that many others are building won't work, and why integrated platform solutions like this are necessary: https://twitter.com/zainy/status/1248482486524379137 (but of course, necessary does not mean sufficient)
I've spent the last 3 weeks with my team building exactly this - contact tracing apps for both android and ios that use bluetooth tech[1]. This will probably require us to redo the app completely to fit into their API plans, but I'm glad they are, in a way, acknowledging our idea. The troubling thing is, bluetooth-based contact tracing is in no way easy. Different android phones handle background bluetooth scanning /…
Do you think that GPS coordinates will be exposable with the API so that there can be public tracing maps online? Obviously a big privacy issue where the actual bluetooth ID and the person's identity have to be fully anonymized but if GPS coordinates of contact points can be exposed publicly, there can be good public tracing maps that can show where contact events are happening and in what numbers so that people can…
Pretty good illustration of how private and secure contact tracing can work here: https://ncase.me/contact-tracing/ Not sure whether that's what this implementation would look like.
The problem with doing any sort of effective contact tracing requires special APIs for iOS and Android because newer versions of both OS disallow background communication and location gathering
Earlier quoted context omitted.
The Daily Tracing Key cannot be "easily fingerprinted" since it does not leave the device (see page 5). Your LE threat model seems like grasping at straws, the majority of users already have location services enabled anyway, people breaking the law would have to change exactly nothing from the common practice of not bringing your phone when committing crimes.
I miss-spoke. I meant to say the rolling proximity identifier could be tracked and fingerprinted. Furthermore, it's not the same as a phone's location implicating you in a crime. It's a persistent log of your in-person social network that can be reverse engineered every time you get arrested or go through customs at the airport.
Earlier quoted context omitted.
3 million is way too high. Old infections aren't interesting for this; users only need to download newly reported infections since yesterday. Limiting to broad geographic regions would also help reduce scope and not be especially privacy invasive.
> Old infections aren't interesting for this Yes, healed patients who don't produce viruses any more aren't important, but anyone still infectious is still a danger. Even if you are supposed, often even legally required, to stay at home while being infected, there is no guarantee you aren't. I'd bet that most of these people also take their phones with them, after all far more serious criminals like actual murderers…
Seems doable, especially considering that you’d want to have fully blown lockdown during the exponential growth, and only then switch over to this contact tracing phase once the initial wave has abated.
I know it is about APIs - but no mention of any Free or at least Open Source Software example implementations makes me worry. I was expecting that people would organize around git repos - but no, just one of the many COVID tracing initiatives published their code. It is https://github.com/tripleblindmarket/covid-safe-paths by the way.
Other than that many, in fact most of those I know to be active, tracing efforts are pretty open, the one you linked is definitely not the only one that currently publishes their source or plans to do so in the near future. There's even been others in this thread.
Earlier quoted context omitted.
Do you think that GPS coordinates will be exposable with the API so that there can be public tracing maps online? Obviously a big privacy issue where the actual bluetooth ID and the person's identity have to be fully anonymized but if GPS coordinates of contact points can be exposed publicly, there can be good public tracing maps that can show where contact events are happening and in what numbers so that people can…
I dont see any mention of it in the current context of bluetooth device proximity tracing. It is possible, however, that apps that will build up on this API will also fetch location history separately from already established mechanisms on each OS. As a matter of fact I see this as a very likely scenario as this is precisely what South Korea has already done.[1] [1] - https://www.youtube.com/watch?v=BE-cA4UK07c
Earlier quoted context omitted.
> It means that contacts with infected persons can't be linked across days, and it means that I can't build an app that alerts me that someone who was previously infected just walked by. Edit: This actually turns out to be correct, but your conclusion: > It means that contacts with infected persons can't be linked across days, and it means that I can't build an app that alerts me that someone who was previously infec…
I see: SK_(t) = H(SK_(t-1)), where SK_(t) is the secret key for day t. This seems to align with the statement that knowing the key for one day (i.e. once it is uploaded following diagnosis) allows one to derive all future keys. Is there another section I am missing? Edit: clarified that daily keys are shared post-diagnosis, to trace prior contact.
I know it is about APIs - but no mention of any Free or at least Open Source Software example implementations makes me worry. I was expecting that people would organize around git repos - but no, just one of the many COVID tracing initiatives published their code. It is https://github.com/tripleblindmarket/covid-safe-paths by the way.
This is my summary of how I interpreted it works:
- A [Tracing Key] is stored locally in every device.
- A [Rolling Key] gets regenerated every day based on the [Tracing Key]
- A [Proximity Identifier] gets regenerated every 15 minutes and broadcasted to other bluetooth devices.
- The Contact Tracing Bluetooth Specification does not require the user’s location; any use of location is completely optional to the schema.
- Other devices save the [Proximity Identifier] locally.
- History is stored for a couple of weeks
Some questions about how I interpreted the rest:
- The device wakes up once a day and downloads the list of identifiers that have been known/reported to have COVID. It compares on device that you are on that list. Q: Wouldn't this list be insanely long? More so if it doesn't have any concept of location?
- If you have COVID-19, you can report to the servers that you were found to have it. Your rolling identifiers gets uploaded to the "cloud server". Q: Which "cloud server"? Whose cloud server?
Any clarifications are strongly welcomed :)
- If diagnosed with COVID-19, users consent to sharing Diagnosis Keys with the server.