Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple and Google partner on Covid-19 contact tracing technology

apple.com

Post reply on HN
Print view View original

431–440 of 484 posts

Re: Apple and Google partner on Covid-19 contact tracing technology

#431

Post by ac29 »

lwf wrote: post #413
jschwartzi wrote: post #207

Earlier quoted context omitted.

Bluetooth 5.1 devices can do both distance and direction, so if you have a bunch of beacons you can determine your location to sub-meter accuracy.

Realistically, what does sub-metre accuracy help with "evil" (catch-all for all non-disease-related) surveillance that, say, a 5-10m is insufficient for?

"Evil" is a bit loaded, but what that level of accuracy does is let you say "this person was in front of the shelves for products X, Y and Z" as opposed to "this person was probably in the store".

Re: Apple and Google partner on Covid-19 contact tracing technology

#432

Post by mkagenius »

est31 wrote: post #388
mkagenius wrote: post #183

Earlier quoted context omitted.

Seems like a scenario where bloom filter[1] could be useful. 1. https://en.wikipedia.org/wiki/Bloom_filter

Bloom filters aren't good for privacy because if there is a hit, you have to upload the id to check it. Which tells the service a) which ID you encountered and b) if it's an ID that was confirmed to be affected, whether you are affected by corona or not, something the system was designed to prevent.

> if there is a hit, you have to upload the id to check it.

Why would you upload it if you know (almost for sure) there was a hit? We can all live with small false positives I think.

Re: Apple and Google partner on Covid-19 contact tracing technology

#433

Post by ericlavigne »

prophesi wrote: post #405
The_Double wrote: post #240

There is surprisingly little discussion about the actual spec here. It looks really good to me! - Advertisements change every 15 minutes, are not trackable unless keys are shared. - The only central bit is a repository of "infected" daily keys. - No knowledge about contacts is shared with a central authority. Nothing is shared unless you are infected and decide to share your keys, which are only valid for one day. I…

Could someone smarter than me ELI5 how devices are able to "re-derive the sequence of Rolling Proximity Identifiers" of the infected? I know that the RPI is derived from the daily key + TimeIntervalNumber. But these devices should only be receiving the daily keys + the current day. Everything else about the spec is pretty easy to follow and gets my a-okay.

Think of the daily key as the seed to a random number generator. If two people pass the same seed into the same random number generator, they can generate the same list of 500 random numbers. This provides a compact way for someone to say: "I just learned that I was infected. These are the 500 identifiers I broadcast on that day. If you recognize one of them, then you might also be infected."

https://tcn-coalition.org/

Re: Apple and Google partner on Covid-19 contact tracing technology

#434

Post by usaar333 »

arcticbull wrote: post #384
usaar333 wrote: post #367

Earlier quoted context omitted.

My numbers generally comes from https://www.thelancet.com/journals/laninf/article/PIIS1473-3... . That paper would give about 3% for a 70 year old. But remember that cruise passengers are healthy enough to be on cruises. 1.5% death rate seems about reasonable when you correct for that (again, this is where you might see that 2x difference). Iceland has a considerable number of unresovled cases. Whether you use 7 deat…

This is all case data, not population studies. The Gangelt study is different because they tested the entire population and not just people walking into hospitals. They found the CFR in Germany (2%) was roughly 10X higher than the actual mortality rate in town. The CFR is always going to suffer from adverse selection bias at this stage because they're only including people sick enough to walk into a hospital, and not…

Does the town have any nursing homes? Those are accounting for a large percent of deaths in the United States. (Around 20% in California). If a small town has already shipped its least healthy population away, its IFR will look lower.

Re: Apple and Google partner on Covid-19 contact tracing technology

#435

Post by dwaite »

kian wrote: post #49

It says this is opt-in - is this just the sending of covid information, or is it the entire contact-tracing key-exchange enterprise?

The idea is that nobody ever shares who they were close to. Think of it as walking around in a mask, then if you were sick you opt in to being on a list so everyone knows they may have been exposed if they saw someone in "a pink fox mask."

Your identity is pseudorandomly generated and cycles every 15 minutes, so you won't be identifiable/trackable - until you choose to share you were sick, and release the inputs to the KDF publicly. A third party app determines who can share they were sick, but the OS appears to require user consent before your information can be shared.

Even then, the people who did see you haven't shared any information.

The biggest vector of privacy abuse IMHO is that once you have opted in to letting an app check whether you had contact with an affected person, the app is responsible for behavior - informing you, helping you schedule testing, or potentially more abusive behavior like informing you and the state of a mandatory quarantine.

Re: Apple and Google partner on Covid-19 contact tracing technology

#436

Post by sneak »

sitkack wrote: post #416
fauigerzigerk wrote: post #100

Promising opt-in is a bit disingenuous. These tech giants are creating a technological capability. Whether or not it is opt-in, opt-out or mandatory is then decided by governments, now and in the future. This is of course nothing new. But it's worth noting considering how high the tolerance for extremely intrusive government action currently is and how extremely weak any resistance is bound to be. I'm not saying I'm…

Both Apple and Google have the exact location for all users for all time. Both can tell you right now, who you have been in contact with and how many folks they in turn have been in contact with. They aren't building anything new, in fact, this is much less than they already have.

> Both Apple and Google have the exact location for all users for all time.

This is a false statement. With location services off, the providers only get coarse location via tower strengths and also via IP geolocation (everything phones home and leaks your IP constantly). It’s not exact, not by a long stretch.

Re: Apple and Google partner on Covid-19 contact tracing technology

#437

Post by sneak »

dmak wrote: post #412
BiteCode_dev wrote: post #152

Earlier quoted context omitted.

No, it was already terrible before. But it was labelled as terrible. I was for the secret service. Now it's going to be culturally accepted, and in the hand regular administrators. This is on order or magnitude worse, for something that was awful.

In a pandemic, I think it’s fair to value public safety over privacy. What comes after the pandemic is a separate concern and discussion.

Public safety is not a human right, while privacy is.

If we abandon our commitments to human rights in times of crisis, how important are they to us, really?

Re: Apple and Google partner on Covid-19 contact tracing technology

#439

Post by kncvetko »

As far as I understand the actual risk assessment is done by the Contact Tracing Framework.

I wonder why this design decision was made. The risk assessment will change and the apps done by health organization have the expertise on that subject and shall do the assessment and not the CT framework. It will require an update of the OS to get latest findings published.

Privacy and other technical decisions are sound and legit.

Has somebody some background information on the reasoning driving that design decision?

Re: Apple and Google partner on Covid-19 contact tracing technology

#440

Post by jka »

ericlavigne wrote: post #430
jka wrote: post #276

Earlier quoted context omitted.

In widely distributed and important spec like this it may be useful to look for what is conspicuously absent or unstated, rather than simply reading the precise positive language. To my mind this phrase under 'Privacy Considerations' in the Cryptography Specification stands out: "A server operator implementing this protocol does not learn who users have been in proximity with or users’ location unless it also has the…

The approach outlined by Apple and Google is very similar to, and likely based on, the TCN protocol developed by a coalition of open source projects. If you'd like to discuss possible vulnerabilities and propose further improvements, there's an active community already doing that who would be happy to have one more contributor. :-) https://tcn-coalition.org/

Thank you, I'll take a look into TCN and the protocol.

Do you know whether TCN have worked with and/or compared notes with OpenTrace[1]?

[1] - https://github.com/OpenTrace-Community

Post reply on HN