Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple and Google partner on Covid-19 contact tracing technology

apple.com

Post reply on HN
Print view View original

41–50 of 484 posts

Re: Apple and Google partner on Covid-19 contact tracing technology

#41

Post by microtonal »

blhack wrote: post #12

The interest in "privacy" around contact tracing seems like a ship that sailed a long time ago to me. Verizon etc all already have this data, and it isn't "private", and so does uber, lyft, and every other overly-aggressive-permission-askning-app that anybody has ever installed. Privacy is really important: but we lost it all a long long time ago. Maybe saying "well now we can do a good job of contact tracing" is at…

I would think that for contact tracing, you need more than Uber/Lyft/Verizon-level GPS/WiFi triangulation/cell tower triangulation accuracy inside cities. With contact tracing, a proximity of 1 or 20 meters probably makes a large difference. Hence these apps will also have to use Bluetooth Low Energy continuously.

https://www.imec-int.com/en/articles/imec-sets-new-benchmark...

Re: Apple and Google partner on Covid-19 contact tracing technology

#42

Post by joosters »

blhack wrote: post #12

The interest in "privacy" around contact tracing seems like a ship that sailed a long time ago to me. Verizon etc all already have this data, and it isn't "private", and so does uber, lyft, and every other overly-aggressive-permission-askning-app that anybody has ever installed. Privacy is really important: but we lost it all a long long time ago. Maybe saying "well now we can do a good job of contact tracing" is at…

That's too defeatist: these contact tracing tools will be gathering data that isn't available any other way - otherwise, they'd just be going straight to Verizon etc for what they need.

Presumably the bluetooth recording will give much better fidelity/precision about who is close to who, in all conditions (in buildings, in the subway, etc), where simple phone triangulation or GPS won't be accurate enough.

That's far more data than the phone companies have on us right now, so it is a good thing that people are considering the privacy issues. Just saying "we've already lost" only makes things worse.

Re: Apple and Google partner on Covid-19 contact tracing technology

#43

Post by JoshTriplett »

ceejayoz wrote: post #21
JoshTriplett wrote: post #13

Earlier quoted context omitted.

> But... this may be a time that the privacy concerns are worth loosening a bit for the good of this. But that comes with the caveat that I hope this is disabled when this is all done, and preferably the code removed completely. Any right you're willing to give up now, you've demonstrated a willingness to give up. You won't get it back. Either it'll remain lost forever, or it'll be used as evidence for a future propo…

I don't understand this absolutist mindset. It doesn't have to work this way. We can have, say, the draft - an absolutely whopping restriction on civil liberties - during WWII but get rid of it when it's no longer needed.

We haven't gotten rid of it, it still exists. It just isn't being used right now. Getting rid of it would be to abolish it entirely, and instead require people to voluntarily consent in the future. (And if you can't get people to agree to it, perhaps that should tell you something.) "needed" isn't even a factor here.

An involuntary mechanism for contact or location tracing that's accessible to governmental authorities without the consent of the user is a civil rights violation, whether it's being actively used at the moment or not.

Re: Apple and Google partner on Covid-19 contact tracing technology

#44

Post by FartyMcFarter »

justusthane wrote: post #4

Pretty good illustration of how private and secure contact tracing can work here: https://ncase.me/contact-tracing/ Not sure whether that's what this implementation would look like.

I'm not a security expert. However, this part looks worrying:

> alice can also hide messages from times she wants to keep private

If there's a need for this, doesn't that imply that the scheme does not actually keep Alice's privacy in all situations?

Furthermore:

> the random messages give the hospital NO INFO on where Alice was

This seems to assume that the hospital (or anyone with access to the data, such as governments) didn't capture the broadcast messages together with their location. With enough Bluetooth receptors in busy areas, a government could easily find out where Alice had been by looking up each of her messages in their list of message/location pairs?

Experts can probably come up with nastier and/or easier exploits...

Re: Apple and Google partner on Covid-19 contact tracing technology

#45

Post by driverdan »

blhack wrote: post #12

The interest in "privacy" around contact tracing seems like a ship that sailed a long time ago to me. Verizon etc all already have this data, and it isn't "private", and so does uber, lyft, and every other overly-aggressive-permission-askning-app that anybody has ever installed. Privacy is really important: but we lost it all a long long time ago. Maybe saying "well now we can do a good job of contact tracing" is at…

I downvoted you because this is false. This is enhanced individual tracing and will only get worse over time. We should fight tooth and nail against all new anti-privacy schemes like this.

Re: Apple and Google partner on Covid-19 contact tracing technology

#48

Post by owenwil »

pkaye wrote: post #40

Is this the approach that South Korea and Singapore used?

Sort of, but not really: both of their apps were unable to track in the background due to privacy restrictions. This partnership enables that at the OS level, and will remove the need to download an additional app

Re: Apple and Google partner on Covid-19 contact tracing technology

#50

Post by acqq »

The relevant privacy details:

https://covid19-static.cdn-apple.com/applications/covid19/cu...

"Privacy Considerations

• The key schedule is fixed and defined by operating system components, preventing applications from including static or predictable information that could be used for tracking.

• A user’s Rolling Proximity Identifiers cannot be correlated without having the Daily Tracing Key. This reduces the risk of privacy loss from advertising them.

• A server operator implementing this protocol does not learn who users have been in proximity with or users’ location unless it also has the unlikely capability to scan advertisements from users who recently reported Diagnosis Keys.

• Without the release of the Daily Tracing Keys, it is not computationally feasible for an attacker to find a collision on a Rolling Proximity Identifier. This prevents a wide-range of replay and impersonation attacks.

• When reporting Diagnosis Keys, the correlation of Rolling Proximity Identifiers by others is limited to 24h periods due to the use of Daily Tracing Keys. The server must not retain metadata from clients uploading Diagnosis Keys after including them into the aggregated list of Diagnosis Keys per day."

It doesn't look bad, at least, at the first sight.

A detail: I hope the "day begin" for the "Daily Tracing Key" is the same for all users? I.e. not a local day but e.g. GMT+0 day or something.

Post reply on HN