10 ms·

First look at Apple/Google contact tracing framework

208 points by dmvaldman 6y ago

severine 6y ago
https://threadreaderapp.com/thread/1248707315626201088.html https://threadreaderapp.com/thread/1248707315626201088.html
- deleted 6y ago
  [deleted]
Uhhrrr 6y ago
A modest proposal: since almost everyone is going to get this and a much smaller percentage is vulnerable, perhaps we should just use this system to track those who choose to register as vulnerable.
Zenbit_UX 6y ago
No clue who/what a moxie is (presumably some guy) and it makes this threads title seem even more absurd. OP feeling like we all need to know what moxie thinks about this reminds me of this [Chappelle Show skit](https://www.youtube.com/watch?v=Mo-ddYhXAZc https://www.youtube.com/watch?v=Mo-ddYhXAZc) about getting Ja Rule's hot take on current events.
- DyslexicAtheist 6y ago
  the person behind the double-ratchet algorithm used in WhatsApp and the inventor of Signal
  - Zenbit_UX 6y ago
    Ah, that makes sense then. Though I do think "Founder of Signal comments on new Google/Apple contact tracing proposal" would be a far less absurd title than "Moxies take on...", further adding "private" in quotes is a bit cheeky and definitely imparts bias into the discussion. None of us developers here are dumb enough to think an api whose goal is to literally track and trace human beings is 100% private. The question is really, is it private _enough_.
    - dang 6y ago
      We've changed the title now. (Submitted title was "Moxie's take on Apple/Google's “private” contact tracing framework")
    - redis_mlc 6y ago
      Moxie is very well-known in the computer security industry. https://en.wikipedia.org/wiki/Moxie_Marlinspike https://en.wikipedia.org/wiki/Moxie_Marlinspike
mc32 6y ago
Of course Google promises [1]: “ adhering to our stringent privacy protocols and protecting people's privacy. No personally identifiable information, such as an individual's location, contacts or movement, will be made available at any point." [1] https://turnto10.com/news/local/privacy-advocates-raise-concerns-about-googles-mobility-report https://turnto10.com/news/local/privacy-advocates-raise-conc...
est31 6y ago
Note that years ago, Moxie has studied a similar problem of how to let users know if their contacts use Signal or not without uploading the whole address books like e.g. WhatsApp does [0]. It's similar because in both instances you want to "match" users in some fashion using a centralized service while keeping their privacy. He ruled out downloads of megabytes of data (something that the Google/Apple proposal would imply) and couldn't find a good solution beyond trusting Intel's SGX technology, arguably not really a good solution but better than not adopting it at all [1]. You have kind of a computation/download/privacy tradeoff here. You can increase the time interval of the daily keys to weeks. Gives you less stuff to download but the devices have to do more hashes to verify whether they have been in contact with other devices. You can increase the 10 minutes to an hour. That means less privacy and more trackability, but also less computation needed. My guess to why Google/Apple didn't introduce rough location (like US state or county) into the system was to prevent journalists from jumping onto that detail and sensationalizing it into something it isn't (Google/Apple grabbing your data). Both companies operate the most popular maps apps on the planet as well as OS level location services that phone home constantly so they are already in possession of that data. [0]: https://signal.org/blog/contact-discovery/ https://signal.org/blog/contact-discovery/ [1]: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- lilyball 6y ago
  > My guess to why Google/Apple didn't introduce rough location (like US state or county) into the system was to prevent journalists from jumping onto that detail and sensationalizing it into something it isn't (Google/Apple grabbing your data). Both companies operate the most popular maps apps on the planet as well as OS level location services that phone home constantly so they are already in possession of that data. Apple is not in possession of the location of your phone. Their mapping system is designed to keep all queries to the servers anonymous using random rotated identifiers, even going so far as to keep the server from being able to see the full route from start to end (IIRC it's broken up into at least two chunks that are requested separately, though I don't know the details).
  - est31 6y ago
redis_mlc 6y ago
Can somebody address the issue that we have almost no testing ability in the US?
- grandmczeb 6y ago
  We’re testing like 140k per day with over 2.5M tests total. Obviously more would be better but that’s hardly “almost no testing ability.”
  - azinman2 6y ago
    I have friends being turned away from tests because they’re “not severe enough,” yet have the symptoms.
  - hn_throwaway_99 6y ago
    I think it may differ by region. I can say factually that the testing in Texas is absolutely abysmal. Many people who have lots of symptoms are being turned away for testing. On Tuesday our illustrious governor announced with lots of fanfare that Walgreen's would be expanding drive-thru testing using Abbott's 15-minute testing devices. It's now Friday evening and still no word on even where the locations will be for these testing sites. I'm sick of these BS press conferences and press releases, just STFU if you're not actually ready to do anything. There is no way we'll be able to restart our economy without at least a 10X or more increase in testing. For right now the lack of testing isn't that huge of a deal when most people are quarantining at home anyway, but it will become a huge deal when people start going back to work. I'm still kind of amazed I haven't seen any convincing plan about how this eventually ends. Everything will just flare back up again once social distancing ends without tons of robust testing.
    - grandmczeb 6y ago
      This may be a bit of an optimistic take, but there's at least some evidence the IFR is ~0.37%. Given the current number of deaths in NYC, that would imply at least ~20% of the city population has already been infected, likely more given the lag between infection and death. If that's true, the best strategy will probably be to keep vulnerable groups isolated and loosen some restrictions until herd immunity is reached. How long that would be depends on the hospitalization rate since ideally we'd have hospitals just barely at max capacity, but I don't think its implausible by the end of the summer we'd reach ~75% infected at which point all restrictions could be lifted.
hn_throwaway_99 6y ago
Regardless of the technical issues with this, I think the "prank" issue Moxie brings up is much more serious. We've already seen the phenomenon of "Zoom bombing", I can imagine "tracer bombing" would be a much more serious issue. The only way I could see this working is that if when you enter a positive result you have to enter some sort of secret key from the testing authority, but that's totally not tenable given a lot (most?) testing these days is from private providers.
- krcz 6y ago
  Don't these providers need to be registered somewhere? It should be easy to reach them and provide with either code generator software or even printed one-time codes for database addition.
  - Reelin 6y ago
    Why use a centralized model? Allow users to subscribe to a data source so that any entity can push their own dataset. This is also important because it keeps the framework usable under a variety of adverse and unusual circumstances. An aid organization operating in a disaster zone or impoverished area could make use of such a framework without needing permission from a higher authority or even reliable internet access to the outside world.
    - lasdfas 6y ago
      Because it can abused. The easier you make it upload, it also allows bad actors to upload invalid data to cause people to go into quarantine unnecessarily. It only works well if you can trust the data, so I think it should error on the side of validating the data instead of openness.
      - Reelin 6y ago
        In an open model, the extent to which abuse is possible would be determined entirely by the authentication requirements (or lack thereof) imposed by the entity operating the server the user selected. That being said, another commenter linked to a set of specifications (https://news.ycombinator.com/item?id=22836871 https://news.ycombinator.com/item?id=22836871) which seem to indicate that (at least on iOS) the data source is determined entirely by an app that the user chooses to run on top of the framework.
daenz 6y ago
An important question here is: will this framework go away once the pandemic is over? Something tells me it won't.
- yellow_lead 6y ago
  I'm sure we'll be told how "it really made a difference" regardless of if it did, and how "we'll need it for the next one."
- VectorLock 6y ago
  It should go away when you uninstall the app.
- krcz 6y ago
  Why wouldn't it? Phones used to be trackable based on WiFi MAC address, now it is randomized. General drive is towards avoiding tracking, I don't see any reason why would it change.
- Reelin 6y ago
  Having a standardized framework is a good thing provided it meets certain minimal security and privacy needs. The idea is to enable end users to proactively collect useful data without making the potential for government abuse any worse than it already is. So long as all data remains on the physical device at all times and any access or export is _always_ actively initiated by the user, I don't see how it makes the current situation any worse. An abusive government can already subpoena or otherwise monitor all the network providers.
  - dingaling 6y ago
    > An abusive government can already subpoena or otherwise monitor all the network providers. The advantage that this tracking proposal provides is that it unfurls contact tracing from one node. Until now, authorities have had to work from a large dataset ( all phones on a mast at a particular time ) inwards; now they can start with one node of interest and expand outwards. Combined with some other 'temporary' pandemic measures, such as the legal requirement to carry your phone at all times, this provides a huge benefit to any authority.
femto113 6y ago
The system doesn't need to ship every key to every phone, much more compact structures like Bloom filters could be used instead. If we assume about 1000 positives per day and each positive uploading 14 days of keys at 4 keys per hour that's a bit over 1 million keys per day. A Bloom filter with a false positive rate of 1/1000 could store that in about a megabyte. Phone downloads the filter each day and checks its observed keys, and only needs to download the actual keys if there's a potential match.
- VectorLock 6y ago
  Nothing prevents the user from pushing the checking to some trusted service as well, if they so choose. If they trust the service then they'd upload their seen keys to a checking service, rather than downloading the whole set of diagnosis keys. The important part is the decision is in their hands.
  - femto113 6y ago
    Bloom filters could work that direction as well: phone produces a filter of observed keys and uploads it to the service, service checks all positive keys to see if they're in the filter. I think the main point of doing the checking on the phone is that way you're the only one who knows if you've been exposed.
- krcz 6y ago
  You need just one key per day, 15-minutes ids can be generated based on this. Bloom filter might be still useful though.
- est31 6y ago
  The main issue of bloom filters is this: > only needs to download the actual keys if there's a potential match. One of the design constraints of the service was that it should not know your (suspected) infection status unless you give consent that it should be shared. > Matches must stay local to the device and not be revealed to the Diagnosis Server. https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ContactTracing-CryptographySpecification.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu... The better the bloom filter is, the more likely it is that you have actually been in contact with a key if the bloom filter is positive. Furthermore, the bloom filter has to deal with a lot more keys. In fact, in your example of 1000 positives per day uploading 14 days of keys you only need to upload 14 keys as they only rotate once per day. At 16 bytes per key (as the link above specifies), you'd have to download 14 * 1000 * 16 = 224kb, much less than the bloom filter needs. And this scheme can tell you with 100% certainty whether there has been a match or not, so at least in your example it's much better than bloom filters. The scalability issues that exist only manifest themselves at larger numbers than 1000 infections per day, say upper tens to lower hundreds of thousands where it starts becoming a problem. So yes, rough location as moxie suggests is the best method to improve the scheme. Instead of checking the IDs of people thousands or hundreds of km away from you, you could just check the IDs of people in your US state or county. But it has to be smart enough to recognize movement, as in, you need to upload/download all areas you've been in and people living at the borders automatically stand out because they download two or three areas.
krcz 6y ago
> So first obvious caveat is that this is "private" (or at least not worse than BTLE), until the moment you test positive. > At that point all of your BTLE mac addrs over the previous period become linkable. Linkable over the period of 14 days. Or even linkable during one day - each day means new key, so linking between these might be attempted only on basis on behavioral correlations. What to do with such data? Microanalysis of customer behaviors? It won't be possible to use such data for future customer profiling, as it won't be possible to match the history with identifiers after the infection. This data is practically worthless.
- dbbk 6y ago
  Yes that's the point...?
zeckalpha 6y ago
> Published keys are 16 bytes, one for each day. If moderate numbers of smartphone users are infected in any given week, that's 100s of MBs for all phones to DL. Seems like a usecase for bloom filters or k-anonymity.
- social_quotient 6y ago
  Can you expand on that a bit more? Is the set running and updated locally or centralized? If local, does it solve the size issue? Thanks!
- ehsankia 6y ago
  This calculation doesn't make sense to me. Since the start of the pandemic, there's been 1.6m confirmed cases so far worldwide. Even if every single one of those were to send 16 bytes identifier, that would still only be 27MB, no? Where are they getting 100s of MBs per week? I know it's exponential growth and the number of cases will grow, but their calculation still seems off to me. EDIT: I guess each person has 14 keys, so that makes it an order of magnitude bigger.
  - Slartie 6y ago
    His argument is self-defeating. If you have rapid exponential growth and would have to publish hundreds of megabytes of keys per day, this approach of contact tracing is useless and you must instead get the entire population under lockdown. If everybody is sheltering at home, nobody needs notifications of possible contacts, because everybody is doing what would be the response to such a notification already. This approach, just like the manual approach of tracking potential contacts via paper and phone, is only of use in a scenario with a very limited number of transmissions and an R (reproduction rate) of around or below 1. Its purpose is not to reach such a situation, but to aid in keeping that situation in effect without severe measures. But severe lockdowns must first suppress the infection counts to such levels before any contact tracing may work at all.
- sneak 6y ago
  16 byte keys for a quarter million people are only 4mb per day. We aren’t seeing remotely close to a quarter million infections per day. The data sizes are reasonable, even if you multiply it times n days for the backward tracing. I think his post is a little bit more fearmongering than is necessary.
themark 6y ago
Seems like a lot of processing. I wonder how much battery performance will be affected.
Reelin 6y ago
Is there an official document somewhere? Also, how does it compare to DP-3T? (https://github.com/DP-3T/documents https://github.com/DP-3T/documents) (https://ncase.me/contact-tracing/ https://ncase.me/contact-tracing/) Edit: Apple's preliminary specification was linked in another HN comment. (https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ContactTracing-CryptographySpecification.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu...)
- tastroder 6y ago
  More technical links in here: https://news.ycombinator.com/item?id=22836871 https://news.ycombinator.com/item?id=22836871
deleted 6y ago
[deleted]
howmayiannoyyou 6y ago
Finally a decent use-case for blockchain and nobody is paying attention. Seems to make a lot more sense to reconcile location and proximity from a shared user-controlled anonymous ledger.
- tastroder 6y ago
  There's plenty of Blockchain based proposals for the backend of this, none of which takes off because it's another one of these imaginary use cases that can just leverage existing centralisation without wasting time on solving problems the introduction of a decentralised Blockchain architecture brings with it.
olliej 6y ago
Let's just answer these * Use stationary beacons to track someone’s travel path Doesn't work because there's no externally visible correlation between reported identifiers until after the user chooses to report there test result. * Increased hit rate of stationary / marketing beacons Doesn't work because they depend on coherence in the beacons, and the identifiers roll every 10 or so minutes. Presumably you'd ensure that any rolling of the bluetooth MAC also rolls the reported identifier. * Leakage of information when someone isn’t sick The requests for data simply tell you someone is using an app - which you can already tell if they're using app. The system can encourage someone to get tested, if your app wants to tell people to get tested, then FairPlay to that app (though good luck in the US). - Fraud resistance Not a privacy/tracking concern, though I'm sure devs will have to do something to limit spam/dos
- FartyMcFarter 6y ago
  > Doesn't work because there's no externally visible correlation between reported identifiers until after the user chooses to report there test result. So you're saying it works after the user reports their test result.
  - olliej 6y ago
    I'm not sure what you're saying "works" here. To be very very clear * The only things published by someone when they report a positive test result are the day keys for whatever length of time is reasonable (I assume ~14 days?) * Given those day keys it is possible for your device to generate all the identifiers that the reporter's device would have broadcast. * From that they can go through their database of seen identifiers and see if they find a match. That means your device can determine when you were in proximity to the reporter, so it would in theory be able to know approximately where the contact happened, but you can't determine anything beyond that. The server that collects and serves reported day keys doesn't have the list of identifiers any devices have encountered, so it can't learn anything about the reporters from the day keys they upload. Let's say there's a passive fixed beacon (whatever) in a public space, it can't connect the identifiers to any specific device either, but you could see it being a useful public health tool - "we saw carriers at [some park] at [some times]". It still would not know which specific devices were reporting those keys. Even if that device went through after the day keys were published there's no way to know that its a device that's been seen before. Only the server is able to link published day keys together because it receives them, so presumably knows who published those. The spec explicitly disallows an implementation from doing this, but assumes a malicious server, so it works to ensure that the only information it can get are day keys with no other information.
antpls 6y ago
Again, this solution _cannot_ work and it is a _threat_ to a permanent loss of privacy. This is like the government and the adtech companies sleeping in the same bed, without any other power opposition in the balance. 1) The "solution" is created by a monopoly of 2 american private corporations. 2) It can only work reliably if everyone wear an (Apple or Android) phone at all time, and consent to give data 3) You are not necessarily infected if you cross an infected in the street at 5 meters. This will have too many false positives and give fuzzy information to people 4) It doesn't help people who are infected and _dying_ It just _doesnt make sense_. To me, it looks like electronic voting, but worse. No one can understand how it works, beside experts. Today it is reviewed, but then the app will be forgotten and updated in the background with "new features" for adtech. We are forgetting what we are fighting : a biological virus. All effort should go toward understanding the biological machinery of the virus and the hosts, in order to _cure_ the virus. We should be 3D printing ventilators, analysing DNA sequences, build nanorobots and synthesis new molecules.
- adamweld 6y ago
  1) and 2) - the fact that Google and Apple have what is essentially a monopoly on smartphone software is exactly what makes this a good approach. it's the easiest way to reach a high percentage of the population. 3) false positive are a hell of a lot better than having no way to trace back contacts while someone was asymptomatic but contagious. 4) it helps stop others from becoming infected and possibly dying. how is that not a good thing? > We should be 3D printing ventilators, analysing DNA sequences, build nanorobots and synthesis new molecules. 3D printing ventilators is a horrible idea, and everything else towards a vaccine takes _time_. This is something that can be rolled out today and that will help the situation. You can uninstall the app when this is over.
  - antpls 6y ago
    > 4) it helps stop others from becoming infected and possibly dying. how is that not a good thing? The virus will always be here, we cannot hide forever, we must find a way to cure it or reduce its biological effect. Once covid19 goes away (if ever), and a new virus appears, NO ONE will have that app turned on, and by then, the new virus will have spread just like covid19. I have a very simple solution to win time : total confinement of people of more than 60 years old when a new virus is detected, and wash hands. Also check hemo2life, which is an example of what we could do in terms of medicine
kome 6y ago
that's the new electronic voting: making easy stuff more complicated and dangerous... the problem is not not a technological problem, it's a political problem.
bobowzki 6y ago
Goodbye last shred of privacy. "The road to hell is paved with good intentions" is an expression that comes to mind.
grumple 6y ago
Yikes, this is prep for big brother's guilt by association. I wouldn't want to test positive for anything the state can track (radical ideas? you're now a positive in this system). Opt out.
- DagAgren 6y ago
  Or, it's just what it says. It's a way to implement test and trace, something that is absolutely needed to stop a pandemic like this from killing hundreds of thousands if not millions of people. Everything isn't a slippy slope. Everything isn't about your privacy. Everything isn't a grand conspiracy that only you can see and the sheeple are too dumb to understand. Sometimes, extreme measures are needed.
  - grumple 6y ago
    > Everything isn't a slippy slope. Everything isn't about your privacy. Everything isn't a grand conspiracy that only you can see and the sheeple are too dumb to understand. Crises are often used by despots to seize power. That's not a conspiracy, that's historical fact. In the United States, we've seen it recently - 9/11 was used to degrade our rights across a large number of issues, and we've never gotten them back. Implementing systems to track everyone people come into contact with is absolutely a huge invasion of privacy, and obviously not necessary. > Sometimes, extreme measures are needed. Extreme times do not justify all extreme measures. Every time you lose rights or privacy, assume it's permanent. Our government is not suited for repealing law.
    - DagAgren 6y ago
      Crises are far, far more often NOT used by despots to seize power.
pferde 6y ago
What's it with people making long, split-up twitter threads like this? They're cumbersome and hard to read. Be an adult, write and publish an article on your blog. It feels weird having to criticize Marlinspike about this, but stupid practices are stupid no matter how prestigious the person doing them is.
- searchableguy 6y ago
  Because it gets more visibility on twitter than a blog and is already something many people using Twitter do. You can use threaderapp to get a blog post out of it.

208 points by dmvaldman 6y ago

severine 6y ago

https://threadreaderapp.com/thread/1248707315626201088.html https://threadreaderapp.com/thread/1248707315626201088.html

deleted 6y ago
[deleted]

Uhhrrr 6y ago

A modest proposal: since almost everyone is going to get this and a much smaller percentage is vulnerable, perhaps we should just use this system to track those who choose to register as vulnerable.

Zenbit_UX 6y ago

No clue who/what a moxie is (presumably some guy) and it makes this threads title seem even more absurd. OP feeling like we all need to know what moxie thinks about this reminds me of this [Chappelle Show skit](https://www.youtube.com/watch?v=Mo-ddYhXAZc https://www.youtube.com/watch?v=Mo-ddYhXAZc) about getting Ja Rule's hot take on current events.

DyslexicAtheist 6y ago
the person behind the double-ratchet algorithm used in WhatsApp and the inventor of Signal
- Zenbit_UX 6y ago
  Ah, that makes sense then. Though I do think "Founder of Signal comments on new Google/Apple contact tracing proposal" would be a far less absurd title than "Moxies take on...", further adding "private" in quotes is a bit cheeky and definitely imparts bias into the discussion. None of us developers here are dumb enough to think an api whose goal is to literally track and trace human beings is 100% private. The question is really, is it private _enough_.
  - dang 6y ago
    We've changed the title now. (Submitted title was "Moxie's take on Apple/Google's “private” contact tracing framework")
  - redis_mlc 6y ago
    Moxie is very well-known in the computer security industry. https://en.wikipedia.org/wiki/Moxie_Marlinspike https://en.wikipedia.org/wiki/Moxie_Marlinspike

mc32 6y ago

Of course Google promises [1]: “ adhering to our stringent privacy protocols and protecting people's privacy. No personally identifiable information, such as an individual's location, contacts or movement, will be made available at any point." [1] https://turnto10.com/news/local/privacy-advocates-raise-concerns-about-googles-mobility-report https://turnto10.com/news/local/privacy-advocates-raise-conc...

est31 6y ago

Note that years ago, Moxie has studied a similar problem of how to let users know if their contacts use Signal or not without uploading the whole address books like e.g. WhatsApp does [0]. It's similar because in both instances you want to "match" users in some fashion using a centralized service while keeping their privacy. He ruled out downloads of megabytes of data (something that the Google/Apple proposal would imply) and couldn't find a good solution beyond trusting Intel's SGX technology, arguably not really a good solution but better than not adopting it at all [1]. You have kind of a computation/download/privacy tradeoff here. You can increase the time interval of the daily keys to weeks. Gives you less stuff to download but the devices have to do more hashes to verify whether they have been in contact with other devices. You can increase the 10 minutes to an hour. That means less privacy and more trackability, but also less computation needed. My guess to why Google/Apple didn't introduce rough location (like US state or county) into the system was to prevent journalists from jumping onto that detail and sensationalizing it into something it isn't (Google/Apple grabbing your data). Both companies operate the most popular maps apps on the planet as well as OS level location services that phone home constantly so they are already in possession of that data. [0]: https://signal.org/blog/contact-discovery/ https://signal.org/blog/contact-discovery/ [1]: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/

lilyball 6y ago
> My guess to why Google/Apple didn't introduce rough location (like US state or county) into the system was to prevent journalists from jumping onto that detail and sensationalizing it into something it isn't (Google/Apple grabbing your data). Both companies operate the most popular maps apps on the planet as well as OS level location services that phone home constantly so they are already in possession of that data. Apple is not in possession of the location of your phone. Their mapping system is designed to keep all queries to the servers anonymous using random rotated identifiers, even going so far as to keep the server from being able to see the full route from start to end (IIRC it's broken up into at least two chunks that are requested separately, though I don't know the details).
- est31 6y ago

redis_mlc 6y ago

Can somebody address the issue that we have almost no testing ability in the US?

grandmczeb 6y ago
We’re testing like 140k per day with over 2.5M tests total. Obviously more would be better but that’s hardly “almost no testing ability.”
- azinman2 6y ago
  I have friends being turned away from tests because they’re “not severe enough,” yet have the symptoms.
- hn_throwaway_99 6y ago
  I think it may differ by region. I can say factually that the testing in Texas is absolutely abysmal. Many people who have lots of symptoms are being turned away for testing. On Tuesday our illustrious governor announced with lots of fanfare that Walgreen's would be expanding drive-thru testing using Abbott's 15-minute testing devices. It's now Friday evening and still no word on even where the locations will be for these testing sites. I'm sick of these BS press conferences and press releases, just STFU if you're not actually ready to do anything. There is no way we'll be able to restart our economy without at least a 10X or more increase in testing. For right now the lack of testing isn't that huge of a deal when most people are quarantining at home anyway, but it will become a huge deal when people start going back to work. I'm still kind of amazed I haven't seen any convincing plan about how this eventually ends. Everything will just flare back up again once social distancing ends without tons of robust testing.
  - grandmczeb 6y ago
    This may be a bit of an optimistic take, but there's at least some evidence the IFR is ~0.37%. Given the current number of deaths in NYC, that would imply at least ~20% of the city population has already been infected, likely more given the lag between infection and death. If that's true, the best strategy will probably be to keep vulnerable groups isolated and loosen some restrictions until herd immunity is reached. How long that would be depends on the hospitalization rate since ideally we'd have hospitals just barely at max capacity, but I don't think its implausible by the end of the summer we'd reach ~75% infected at which point all restrictions could be lifted.

hn_throwaway_99 6y ago

Regardless of the technical issues with this, I think the "prank" issue Moxie brings up is much more serious. We've already seen the phenomenon of "Zoom bombing", I can imagine "tracer bombing" would be a much more serious issue. The only way I could see this working is that if when you enter a positive result you have to enter some sort of secret key from the testing authority, but that's totally not tenable given a lot (most?) testing these days is from private providers.

krcz 6y ago
Don't these providers need to be registered somewhere? It should be easy to reach them and provide with either code generator software or even printed one-time codes for database addition.
- Reelin 6y ago
  Why use a centralized model? Allow users to subscribe to a data source so that any entity can push their own dataset. This is also important because it keeps the framework usable under a variety of adverse and unusual circumstances. An aid organization operating in a disaster zone or impoverished area could make use of such a framework without needing permission from a higher authority or even reliable internet access to the outside world.
  - lasdfas 6y ago
    Because it can abused. The easier you make it upload, it also allows bad actors to upload invalid data to cause people to go into quarantine unnecessarily. It only works well if you can trust the data, so I think it should error on the side of validating the data instead of openness.
    - Reelin 6y ago
      In an open model, the extent to which abuse is possible would be determined entirely by the authentication requirements (or lack thereof) imposed by the entity operating the server the user selected. That being said, another commenter linked to a set of specifications (https://news.ycombinator.com/item?id=22836871 https://news.ycombinator.com/item?id=22836871) which seem to indicate that (at least on iOS) the data source is determined entirely by an app that the user chooses to run on top of the framework.

daenz 6y ago

An important question here is: will this framework go away once the pandemic is over? Something tells me it won't.

yellow_lead 6y ago
I'm sure we'll be told how "it really made a difference" regardless of if it did, and how "we'll need it for the next one."
VectorLock 6y ago
It should go away when you uninstall the app.
krcz 6y ago
Why wouldn't it? Phones used to be trackable based on WiFi MAC address, now it is randomized. General drive is towards avoiding tracking, I don't see any reason why would it change.
Reelin 6y ago
Having a standardized framework is a good thing provided it meets certain minimal security and privacy needs. The idea is to enable end users to proactively collect useful data without making the potential for government abuse any worse than it already is. So long as all data remains on the physical device at all times and any access or export is _always_ actively initiated by the user, I don't see how it makes the current situation any worse. An abusive government can already subpoena or otherwise monitor all the network providers.
- dingaling 6y ago
  > An abusive government can already subpoena or otherwise monitor all the network providers. The advantage that this tracking proposal provides is that it unfurls contact tracing from one node. Until now, authorities have had to work from a large dataset ( all phones on a mast at a particular time ) inwards; now they can start with one node of interest and expand outwards. Combined with some other 'temporary' pandemic measures, such as the legal requirement to carry your phone at all times, this provides a huge benefit to any authority.

femto113 6y ago

The system doesn't need to ship every key to every phone, much more compact structures like Bloom filters could be used instead. If we assume about 1000 positives per day and each positive uploading 14 days of keys at 4 keys per hour that's a bit over 1 million keys per day. A Bloom filter with a false positive rate of 1/1000 could store that in about a megabyte. Phone downloads the filter each day and checks its observed keys, and only needs to download the actual keys if there's a potential match.

VectorLock 6y ago
Nothing prevents the user from pushing the checking to some trusted service as well, if they so choose. If they trust the service then they'd upload their seen keys to a checking service, rather than downloading the whole set of diagnosis keys. The important part is the decision is in their hands.
- femto113 6y ago
  Bloom filters could work that direction as well: phone produces a filter of observed keys and uploads it to the service, service checks all positive keys to see if they're in the filter. I think the main point of doing the checking on the phone is that way you're the only one who knows if you've been exposed.
krcz 6y ago
You need just one key per day, 15-minutes ids can be generated based on this. Bloom filter might be still useful though.
est31 6y ago
The main issue of bloom filters is this: > only needs to download the actual keys if there's a potential match. One of the design constraints of the service was that it should not know your (suspected) infection status unless you give consent that it should be shared. > Matches must stay local to the device and not be revealed to the Diagnosis Server. https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ContactTracing-CryptographySpecification.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu... The better the bloom filter is, the more likely it is that you have actually been in contact with a key if the bloom filter is positive. Furthermore, the bloom filter has to deal with a lot more keys. In fact, in your example of 1000 positives per day uploading 14 days of keys you only need to upload 14 keys as they only rotate once per day. At 16 bytes per key (as the link above specifies), you'd have to download 14 * 1000 * 16 = 224kb, much less than the bloom filter needs. And this scheme can tell you with 100% certainty whether there has been a match or not, so at least in your example it's much better than bloom filters. The scalability issues that exist only manifest themselves at larger numbers than 1000 infections per day, say upper tens to lower hundreds of thousands where it starts becoming a problem. So yes, rough location as moxie suggests is the best method to improve the scheme. Instead of checking the IDs of people thousands or hundreds of km away from you, you could just check the IDs of people in your US state or county. But it has to be smart enough to recognize movement, as in, you need to upload/download all areas you've been in and people living at the borders automatically stand out because they download two or three areas.

krcz 6y ago

> So first obvious caveat is that this is "private" (or at least not worse than BTLE), until the moment you test positive. > At that point all of your BTLE mac addrs over the previous period become linkable. Linkable over the period of 14 days. Or even linkable during one day - each day means new key, so linking between these might be attempted only on basis on behavioral correlations. What to do with such data? Microanalysis of customer behaviors? It won't be possible to use such data for future customer profiling, as it won't be possible to match the history with identifiers after the infection. This data is practically worthless.

dbbk 6y ago
Yes that's the point...?

zeckalpha 6y ago

> Published keys are 16 bytes, one for each day. If moderate numbers of smartphone users are infected in any given week, that's 100s of MBs for all phones to DL. Seems like a usecase for bloom filters or k-anonymity.

social_quotient 6y ago
Can you expand on that a bit more? Is the set running and updated locally or centralized? If local, does it solve the size issue? Thanks!
ehsankia 6y ago
This calculation doesn't make sense to me. Since the start of the pandemic, there's been 1.6m confirmed cases so far worldwide. Even if every single one of those were to send 16 bytes identifier, that would still only be 27MB, no? Where are they getting 100s of MBs per week? I know it's exponential growth and the number of cases will grow, but their calculation still seems off to me. EDIT: I guess each person has 14 keys, so that makes it an order of magnitude bigger.
- Slartie 6y ago
  His argument is self-defeating. If you have rapid exponential growth and would have to publish hundreds of megabytes of keys per day, this approach of contact tracing is useless and you must instead get the entire population under lockdown. If everybody is sheltering at home, nobody needs notifications of possible contacts, because everybody is doing what would be the response to such a notification already. This approach, just like the manual approach of tracking potential contacts via paper and phone, is only of use in a scenario with a very limited number of transmissions and an R (reproduction rate) of around or below 1. Its purpose is not to reach such a situation, but to aid in keeping that situation in effect without severe measures. But severe lockdowns must first suppress the infection counts to such levels before any contact tracing may work at all.
sneak 6y ago
16 byte keys for a quarter million people are only 4mb per day. We aren’t seeing remotely close to a quarter million infections per day. The data sizes are reasonable, even if you multiply it times n days for the backward tracing. I think his post is a little bit more fearmongering than is necessary.

themark 6y ago

Seems like a lot of processing. I wonder how much battery performance will be affected.

Reelin 6y ago

Is there an official document somewhere? Also, how does it compare to DP-3T? (https://github.com/DP-3T/documents https://github.com/DP-3T/documents) (https://ncase.me/contact-tracing/ https://ncase.me/contact-tracing/) Edit: Apple's preliminary specification was linked in another HN comment. (https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ContactTracing-CryptographySpecification.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu...)

tastroder 6y ago
More technical links in here: https://news.ycombinator.com/item?id=22836871 https://news.ycombinator.com/item?id=22836871

deleted 6y ago

[deleted]

howmayiannoyyou 6y ago

Finally a decent use-case for blockchain and nobody is paying attention. Seems to make a lot more sense to reconcile location and proximity from a shared user-controlled anonymous ledger.

tastroder 6y ago
There's plenty of Blockchain based proposals for the backend of this, none of which takes off because it's another one of these imaginary use cases that can just leverage existing centralisation without wasting time on solving problems the introduction of a decentralised Blockchain architecture brings with it.

olliej 6y ago

Let's just answer these * Use stationary beacons to track someone’s travel path Doesn't work because there's no externally visible correlation between reported identifiers until after the user chooses to report there test result. * Increased hit rate of stationary / marketing beacons Doesn't work because they depend on coherence in the beacons, and the identifiers roll every 10 or so minutes. Presumably you'd ensure that any rolling of the bluetooth MAC also rolls the reported identifier. * Leakage of information when someone isn’t sick The requests for data simply tell you someone is using an app - which you can already tell if they're using app. The system can encourage someone to get tested, if your app wants to tell people to get tested, then FairPlay to that app (though good luck in the US). - Fraud resistance Not a privacy/tracking concern, though I'm sure devs will have to do something to limit spam/dos

FartyMcFarter 6y ago
> Doesn't work because there's no externally visible correlation between reported identifiers until after the user chooses to report there test result. So you're saying it works after the user reports their test result.
- olliej 6y ago
  I'm not sure what you're saying "works" here. To be very very clear * The only things published by someone when they report a positive test result are the day keys for whatever length of time is reasonable (I assume ~14 days?) * Given those day keys it is possible for your device to generate all the identifiers that the reporter's device would have broadcast. * From that they can go through their database of seen identifiers and see if they find a match. That means your device can determine when you were in proximity to the reporter, so it would in theory be able to know approximately where the contact happened, but you can't determine anything beyond that. The server that collects and serves reported day keys doesn't have the list of identifiers any devices have encountered, so it can't learn anything about the reporters from the day keys they upload. Let's say there's a passive fixed beacon (whatever) in a public space, it can't connect the identifiers to any specific device either, but you could see it being a useful public health tool - "we saw carriers at [some park] at [some times]". It still would not know which specific devices were reporting those keys. Even if that device went through after the day keys were published there's no way to know that its a device that's been seen before. Only the server is able to link published day keys together because it receives them, so presumably knows who published those. The spec explicitly disallows an implementation from doing this, but assumes a malicious server, so it works to ensure that the only information it can get are day keys with no other information.

antpls 6y ago

Again, this solution _cannot_ work and it is a _threat_ to a permanent loss of privacy. This is like the government and the adtech companies sleeping in the same bed, without any other power opposition in the balance. 1) The "solution" is created by a monopoly of 2 american private corporations. 2) It can only work reliably if everyone wear an (Apple or Android) phone at all time, and consent to give data 3) You are not necessarily infected if you cross an infected in the street at 5 meters. This will have too many false positives and give fuzzy information to people 4) It doesn't help people who are infected and _dying_ It just _doesnt make sense_. To me, it looks like electronic voting, but worse. No one can understand how it works, beside experts. Today it is reviewed, but then the app will be forgotten and updated in the background with "new features" for adtech. We are forgetting what we are fighting : a biological virus. All effort should go toward understanding the biological machinery of the virus and the hosts, in order to _cure_ the virus. We should be 3D printing ventilators, analysing DNA sequences, build nanorobots and synthesis new molecules.

adamweld 6y ago
1) and 2) - the fact that Google and Apple have what is essentially a monopoly on smartphone software is exactly what makes this a good approach. it's the easiest way to reach a high percentage of the population. 3) false positive are a hell of a lot better than having no way to trace back contacts while someone was asymptomatic but contagious. 4) it helps stop others from becoming infected and possibly dying. how is that not a good thing? > We should be 3D printing ventilators, analysing DNA sequences, build nanorobots and synthesis new molecules. 3D printing ventilators is a horrible idea, and everything else towards a vaccine takes _time_. This is something that can be rolled out today and that will help the situation. You can uninstall the app when this is over.
- antpls 6y ago
  > 4) it helps stop others from becoming infected and possibly dying. how is that not a good thing? The virus will always be here, we cannot hide forever, we must find a way to cure it or reduce its biological effect. Once covid19 goes away (if ever), and a new virus appears, NO ONE will have that app turned on, and by then, the new virus will have spread just like covid19. I have a very simple solution to win time : total confinement of people of more than 60 years old when a new virus is detected, and wash hands. Also check hemo2life, which is an example of what we could do in terms of medicine

kome 6y ago

that's the new electronic voting: making easy stuff more complicated and dangerous... the problem is not not a technological problem, it's a political problem.

bobowzki 6y ago

Goodbye last shred of privacy. "The road to hell is paved with good intentions" is an expression that comes to mind.

grumple 6y ago

Yikes, this is prep for big brother's guilt by association. I wouldn't want to test positive for anything the state can track (radical ideas? you're now a positive in this system). Opt out.

DagAgren 6y ago
Or, it's just what it says. It's a way to implement test and trace, something that is absolutely needed to stop a pandemic like this from killing hundreds of thousands if not millions of people. Everything isn't a slippy slope. Everything isn't about your privacy. Everything isn't a grand conspiracy that only you can see and the sheeple are too dumb to understand. Sometimes, extreme measures are needed.
- grumple 6y ago
  > Everything isn't a slippy slope. Everything isn't about your privacy. Everything isn't a grand conspiracy that only you can see and the sheeple are too dumb to understand. Crises are often used by despots to seize power. That's not a conspiracy, that's historical fact. In the United States, we've seen it recently - 9/11 was used to degrade our rights across a large number of issues, and we've never gotten them back. Implementing systems to track everyone people come into contact with is absolutely a huge invasion of privacy, and obviously not necessary. > Sometimes, extreme measures are needed. Extreme times do not justify all extreme measures. Every time you lose rights or privacy, assume it's permanent. Our government is not suited for repealing law.
  - DagAgren 6y ago
    Crises are far, far more often NOT used by despots to seize power.

pferde 6y ago

What's it with people making long, split-up twitter threads like this? They're cumbersome and hard to read. Be an adult, write and publish an article on your blog. It feels weird having to criticize Marlinspike about this, but stupid practices are stupid no matter how prestigious the person doing them is.

searchableguy 6y ago
Because it gets more visibility on twitter than a blog and is already something many people using Twitter do. You can use threaderapp to get a blog post out of it.