Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

First look at Apple/Google contact tracing framework

twitter.com

Post reply on HN
Print view View original

71–80 of 113 posts

Re: First look at Apple/Google contact tracing framework

#71

Post by laggyluke »

antpls wrote: post #66
adamweld wrote: post #65

Earlier quoted context omitted.

1) and 2) - the fact that Google and Apple have what is essentially a monopoly on smartphone software is exactly what makes this a good approach. it's the easiest way to reach a high percentage of the population. 3) false positive are a hell of a lot better than having no way to trace back contacts while someone was asymptomatic but contagious. 4) it helps stop others from becoming infected and possibly dying. how is…

> 4) it helps stop others from becoming infected and possibly dying. how is that not a good thing? The virus will always be here, we cannot hide forever, we must find a way to cure it or reduce its biological effect. Once covid19 goes away (if ever), and a new virus appears, NO ONE will have that app turned on, and by then, the new virus will have spread just like covid19. I have a very simple solution to win time :…

> Once covid19 goes away (if ever), and a new virus appears, NO ONE will have that app turned on, and by then, the new virus will have spread just like covid19.

Devil's advocate: so why not just keep the app running forever in the background?

If there's no virus to report - that's fine.

But the moment a new outbreak starts, the data is already there, you just have to report that you're sick.

Re: First look at Apple/Google contact tracing framework

#72

Post by krisoft »

tastroder wrote: post #70
krisoft wrote: post #68

Earlier quoted context omitted.

> in Germany, like many other European countries, this becomes a non-issue. What do you mean by that? The protocol, as published, doesn’t have a role for the central authority. Even if the German state knows that mrSick tested positive and mrPrankster did not, how would the diagnosis server reject the keys published by mrPrankster? They are by design resistant to de-anonymization. In fact the German state can’t even…

My main point is that the protocol as published is completely unrelated to the prank scenario, that's simply out of scope. The protocol does not prescribe who is able to report certain Diagnostic Keys that have tested positive. In a centralised deployment, that is likely under the current German reporting chain for infectious diseases, mrPrankster has no capability to falsely report a positive test result. You have a…

> “simply out of scope” (of the protocol)

But it is in-scope for the framework, would you say not? If we want to evaluate the privacy aspects its important to understand the whole system.

First you said it’s a complete non-issue, and now you say actually we need to tweak things here and there in a serious fashion. That’s fine.

> “The protocol does not prescribe who is able to report certain Diagnostic Keys that have tested positive.”

It heavily implies though that it is a decision by the user. It says the keys never leave the phone, it also says that the keys with the users consent gets uploaded. Maybe what they actually meant is that the keys get uploaded alongside a signed cert of the local health authorities. Or that when you get tested the health authorities extract something from your phone and they themselves report using that. But it very much sounds like this is also a very important part of the protocol then.

Re: First look at Apple/Google contact tracing framework

#73

Post by Slartie »

ehsankia wrote: post #46
zeckalpha wrote: post #34

> Published keys are 16 bytes, one for each day. If moderate numbers of smartphone users are infected in any given week, that's 100s of MBs for all phones to DL. Seems like a usecase for bloom filters or k-anonymity.

This calculation doesn't make sense to me. Since the start of the pandemic, there's been 1.6m confirmed cases so far worldwide. Even if every single one of those were to send 16 bytes identifier, that would still only be 27MB, no? Where are they getting 100s of MBs per week? I know it's exponential growth and the number of cases will grow, but their calculation still seems off to me. EDIT: I guess each person has 14…

His argument is self-defeating. If you have rapid exponential growth and would have to publish hundreds of megabytes of keys per day, this approach of contact tracing is useless and you must instead get the entire population under lockdown. If everybody is sheltering at home, nobody needs notifications of possible contacts, because everybody is doing what would be the response to such a notification already.

This approach, just like the manual approach of tracking potential contacts via paper and phone, is only of use in a scenario with a very limited number of transmissions and an R (reproduction rate) of around or below 1. Its purpose is not to reach such a situation, but to aid in keeping that situation in effect without severe measures. But severe lockdowns must first suppress the infection counts to such levels before any contact tracing may work at all.

Re: First look at Apple/Google contact tracing framework

#74

Post by tastroder »

krisoft wrote: post #72
tastroder wrote: post #70

Earlier quoted context omitted.

My main point is that the protocol as published is completely unrelated to the prank scenario, that's simply out of scope. The protocol does not prescribe who is able to report certain Diagnostic Keys that have tested positive. In a centralised deployment, that is likely under the current German reporting chain for infectious diseases, mrPrankster has no capability to falsely report a positive test result. You have a…

> “simply out of scope” (of the protocol) But it is in-scope for the framework, would you say not? If we want to evaluate the privacy aspects its important to understand the whole system. First you said it’s a complete non-issue, and now you say actually we need to tweak things here and there in a serious fashion. That’s fine. > “The protocol does not prescribe who is able to report certain Diagnostic Keys that have…

I don't feel like I'm contradicting myself there. Yes, the scenario of pranks would be in scope for the overall system or framework, sure. Pointing it out as a leakage / flaw of the proposal by Apple and Google is counterproductive though in my mind since a) it can be easily tackled in those other parts of the framework and b) we don't even have a specific single framework to talk about on that particular matter so it makes little sense to spread FUD about it.

> But it very much sounds like this is also a very important part of the protocol then.

That might be arguing semantics honestly, the protocol as published suggests restrictions that are beneficial to the end user's privacy, sure. It otherwise does not dictate any particular government, country, or region where the keys are supposed go in case of a positive test results or how they should be verified / handled. That in my mind would again fall into the category of the overall framework that we do not have. What we have is a manual system that is ineffective and hard to scale. What this adds is a privacy aware method to tackle a tiny part of a digital supplement to this manual system.

That's why I'm so insistent on the in scope / out of scope, sorry if that comes across harsh but I don't feel it's particularly productive to construct hypothetical overall threat models based on this very limited technical proposal. Scenarios such as malicious distributions of tests are much better looked at in the context of a full framework proposal. I can come up with dozens of threat models that include unrelated things, that doesn't mean it's particularly responsible to share those imho. We're the technical audience that can grasp this, pointing out potential shortcomings is fine but they should be grounded in reality.

Re: First look at Apple/Google contact tracing framework

#75

Post by tinus_hn »

antpls wrote: post #60

Again, this solution _cannot_ work and it is a _threat_ to a permanent loss of privacy. This is like the government and the adtech companies sleeping in the same bed, without any other power opposition in the balance. 1) The "solution" is created by a monopoly of 2 american private corporations. 2) It can only work reliably if everyone wear an (Apple or Android) phone at all time, and consent to give data 3) You are…

So what are you doing here posting, why have you not solved all the problems already? Get to work!

Re: First look at Apple/Google contact tracing framework

#76

Post by tinus_hn »

est31 wrote: post #9

Note that years ago, Moxie has studied a similar problem of how to let users know if their contacts use Signal or not without uploading the whole address books like e.g. WhatsApp does [0]. It's similar because in both instances you want to "match" users in some fashion using a centralized service while keeping their privacy. He ruled out downloads of megabytes of data (something that the Google/Apple proposal would i…

The proposed system requires download of 16 bytes per infected user per day. Unless this really gets out of hand that’s not in the megabytes range.

Re: First look at Apple/Google contact tracing framework

#77

Post by fabian2k »

hn_throwaway_99 wrote: post #20

Regardless of the technical issues with this, I think the "prank" issue Moxie brings up is much more serious. We've already seen the phenomenon of "Zoom bombing", I can imagine "tracer bombing" would be a much more serious issue. The only way I could see this working is that if when you enter a positive result you have to enter some sort of secret key from the testing authority, but that's totally not tenable given a…

The media reports about the german version of this include getting a one-time code from the health authorities that you have to enter into the app to mark yourself as infected.

As far as I understand, the proposal from Google and Apple is about the underlying framework, but you can set up additional controls a level above in the app and the server infrastructure. So it's likely by design that it doesn't address the issue as the solutions to ensuring only verified cases can trigger alerts must be specific to the local circumstances.

Re: First look at Apple/Google contact tracing framework

#78

Post by fabian2k »

antpls wrote: post #60

Again, this solution _cannot_ work and it is a _threat_ to a permanent loss of privacy. This is like the government and the adtech companies sleeping in the same bed, without any other power opposition in the balance. 1) The "solution" is created by a monopoly of 2 american private corporations. 2) It can only work reliably if everyone wear an (Apple or Android) phone at all time, and consent to give data 3) You are…

From looking at the specification, I don't see any serious loss of privacy there, if this is implemented as stated.

2) You don't need 100%, you only need enough to drop the R0 below 1. You'll likely need a majority of people using this, which is hard enough, but you don't need everyone using it.

3) The apps are not supposed to include every single registered contact, only contacts that are over a bit longer timeframe. A typical value I've heard is 15 minutes close contact, that is considered a high risk contact when contact tracing.

Re: First look at Apple/Google contact tracing framework

#79

Post by jhoechtl »

antpls wrote: post #60

Again, this solution _cannot_ work and it is a _threat_ to a permanent loss of privacy. This is like the government and the adtech companies sleeping in the same bed, without any other power opposition in the balance. 1) The "solution" is created by a monopoly of 2 american private corporations. 2) It can only work reliably if everyone wear an (Apple or Android) phone at all time, and consent to give data 3) You are…

I am so terribly frightened by that move I am seriously considering getting rid of Android. Of what I have heard it's going to be backed into the OS and not installed as an app I could de-install / block, right?

What truly open Smart phone OSes are available besides Android and iOS?

Re: First look at Apple/Google contact tracing framework

#80

Post by IanCal »

tastroder wrote: post #62
daenz wrote: post #16

An important question here is: will this framework go away once the pandemic is over? Something tells me it won't.

To ease on the fear mongering front here: This proposal relies on an app implementing these protocols, you're free to uninstall the app after the pandemic - or not install it in the first place. It is furthermore trivial to check if your device sends out these BTLE packets. It's not a "can we put the genie back in the bottle" scenario if the genie is wearing a bright warning vest announcing its presence everywhere. Y…

I'm not sure I'd count this as fearmongering. I think I know which way the tradeoffs work in my mind but there's not an unreasonable set of paths that lead to this being more permanent.

Given the broad powers passed recently in the UK they could make having this app a legal requirement to go in any shop if they wanted, and whether apps can be uninstalled reasonably is down to whoever controls the OS.

Would it not make sense to require everyone who is able to to install and use this? Or require Google and apple to force install it?

Post reply on HN