Apple and Google Strengthen Privacy of COVID-19 Exposure Notification System, Targeting Next Week for Beta Release

[rjohnstone]

If it's going to be baked in at the OS level, how will you really know if it's in use or not.
If you disable bluetooth, is it really disabled, or just not available for normal BT devices?
If you run an Android device not made by Google, your chances of getting the update any time soon are slim to none depending on the age of your device.

 

[itsmilo]

Which government? Most government efforts so far in this area have been completely devoid of privacy protections (e.g.: Singapore, France, UK) and require you to leave the app open and running on your phone because they cannot leverage BLE while the app is not active (for privacy reasons). This seems to be the quick path to implementation and privacy with no battery issues.

in Germany. They are fighting over how to make sure to make an App that is also data privacy conform

 

[code-m]

Which government? Most government efforts so far in this area have been completely devoid of privacy protections (e.g.: Singapore, France, UK) and require you to leave the app open and running on your phone because they cannot leverage BLE while the app is not active (for privacy reasons). This seems to be the quick path to implementation and privacy with no battery issues.

What if you don’t keep the app open and turn-off Bluetooth, are you forced isolated or thrown in prison or fined. Hmm...how is life in an authoritarian regime.
[automerge]1587750930[/automerge]

in Germany. They are fighting over how to make sure to make an App that is also data privacy conform

What if you lend your phone to a friend who borrows it to make a phone call due to a dead battery on their own phone, then goes to an area for privacy and walks past someone infected. Does that inform the owner of the phone they must isolate or go to get tested while the friend who may be infect is unaware. Does the app notify you when in a close group setting that one of your group members is infected. This is going to create paranoia for the sake of oppression. But what do I know, why not ask the police to weld your house door for 14 days to report to us how “free” you are.
[automerge]1587751048[/automerge]

If it's going to be baked in at the OS level, how will you really know if it's in use or not.
If you disable bluetooth, is it really disabled, or just not available for normal BT devices?
If you run an Android device not made by Google, your chances of getting the update any time soon are slim to none depending on the age of your device.

If it is baked into iOS, the version prior will be the last I will be on. Plus I will start looking at jailbreaking to disable this app and the baked in feature.
[automerge]1587751326[/automerge]

Would not be surprised with a watch app that understands your handshake with someone else’s and that close proximity of the two Watches.

Plus new Apple AR/VR headset will start placing bio-hazard icons or emojis on people waking-by. Literally it can be a “killer app/feature” because you will kill yourself with all the undue anxiety and end up spending money on pharma and doctor visits.

 

[orthorim]

I'd rather this than 100% lockdown. Bring it on!

Its not either OR

USA is dumping every single death into the covid category now so the numbers climb but this BS will end soon hopefully...

European countries with severe restrictions are already recovering

More interestingly, European countries without any restrictions are also recovering - ie everything is just fine in Sweden, who did not participate in the media generated and government perpetuated lies about estimated death rates meant to scare everyone ********.
Restaurants were open the entire time, no mask order, nobody was locked up at home, people were told to wash their hands and be a little bit careful... no run on the hospitals happened, no ICUs were overwhelmed, basically nothing happened, everyone's just fine. Just like many virologists had predicted.


The virus is definitely novel but it's not particularly dangerous. More dangerous is the fear, and obviously the economic devastation. Fear lowers the immune response - this is a fact.

In any case, people are waking up to the scamdemic or plandemic, whichever you wanna see it. Turns out there's many interest groups which want to have people locked in their homes, politicians first and foremost, becasue on the one hand they can play little dictator and finally tell everyone what to do and no todo, while simultaneously looking like the rescuer of the nation! Wow - double bonus!

And then all those who say, um, hello, virologists have found more problems with the official story than can be named here, they are considered un-patriotic. And shamed for their lack of compassion. No, it's not lack of compassion, it's lack of stupidity.

 

[827538]

Why is this being pushed so heavily now? It's closing the barn door after the horse has already bolted.

I'm not some conspiracy theorist or whack job that thinks the government is out to get me but the insistence and drive of governments and corporations to push this sort of tracking is making me very uneasy. Just like how the Patriot Act was rammed through after 9/11, one crisis seems to result in massive and long running invasions into privacy and civil liberties.

This crisis is a problem, it needs dealt with, but the measures of completely shutting down the world economy coupled with complete invasions into our privacy are steps too far.

The Swiss once again showed a measured, sensible approach. Keep the vulnerable and sick isolated, introduce wide scale testing but not shut everything down. I'll say it again, we are so comfortable and soft in our modern lives that we have been completely unable to gauge risk correctly.

 

[BuffaloTF]

Its not either OR

USA is dumping every single death into the covid category now so the numbers climb but this BS will end soon hopefully...

Yeah... no.

They aren't.

There's a category called "presumed" deaths. Presumed. Potential. That's an entirely separate number from confirmed. And it's done by the CDC's own guidance on it, who reports only the confirmed cases and tracks the presumed because not counting those exacerbates the fact we're severely undercounting the total number.

 

[Analog Kid]

They've done a solid job of addressing the privacy concerns here -- way more than most (all?) governments have thought to do.

I appreciate Apple pushing back on government privacy over-reach. In fact I find it funny when congress simultaneously demands that Apple and Google prove the privacy of new features and then also demands they put backdoors into phone encryption. Apple seems to be the champion of providing privacy while still giving us technology that improves our lives.

I know lots of conspiracy theorists on this forum will keep wearing their tin foil hats to keep the aliens and Big Brother from intercepting their thoughts and there is no way they are going to opt in for this. But viewing this transparent architecture makes it pretty clear that the only person who is going to know who you have been near is you.

Heck, anybody who uses GPS navigation on their phone is giving some app access to their location for an extended period and there is not much uproar over that. And people take that privacy risk for the convenience of not using paper maps. This is way way way more secure from a privacy perspective than GPS nav.

My only concern here is how Google is going to deploy this to older low-end Android phones. Can they push an update like this through Google Play Services?

Yes, they’re making a respectable effort at privacy here, and I‘m happy to see this getting as much thought as it is. That said, though, the last revision was touted for protecting privacy, and now we hear that they’ve only now decided to move to random keys— and it’s still not clear how uncorrelated that is to user information. I’m not sure that it’s possible to truly make this private. If each key is being used for 5 minutes before updating, and a government puts listeners on every street corner, then it’s pretty straight forward to track an individual’s movements and identify them. It would be nice if every interaction was a one time code so there was less correlation in the information.

That’s the big difference between this and GPS— GPS is listen only, so nobody knows you’re using it. The app that is providing the UI for that GPS has the potential to forward that information (and there’s been a lot of uproar over that, actually). Still we have fine grained control over location services and can ensure an app only has that information when we want it to. This system is a beacon that emits everywhere you go without your intervention and without turning off.

I’m a bit bothered by the “save us, big tech!” mentality that’s developed— these are businesses and its not really their role to provide public health services. I also don’t know if there’s another solution rather than tracing everyone everywhere, but I’d hope people are looking for one because it’s really easy to just decide that we have to throw privacy out the window without thinking about it more deeply.

If it turns out that tracking individuals is the only safe way forward, then I’d much prefer this be a dedicated key fob that I can throw away when the crisis is over, rather than building this kind of tracking functionality into the OS of all my devices.

 

[raybob]

The keyword is “harder” not impossible!!

 

[code-m]

Its not either OR

USA is dumping every single death into the covid category now so the numbers climb but this BS will end soon hopefully...

European countries with severe restrictions are already recovering

More interestingly, European countries without any restrictions are also recovering - ie everything is just fine in Sweden, who did not participate in the media generated and government perpetuated lies about estimated death rates meant to scare everyone ********.
Restaurants were open the entire time, no mask order, nobody was locked up at home, people were told to wash their hands and be a little bit careful... no run on the hospitals happened, no ICUs were overwhelmed, basically nothing happened, everyone's just fine. Just like many virologists had predicted.


The virus is definitely novel but it's not particularly dangerous. More dangerous is the fear, and obviously the economic devastation. Fear lowers the immune response - this is a fact.

In any case, people are waking up to the scamdemic or plandemic, whichever you wanna see it. Turns out there's many interest groups which want to have people locked in their homes, politicians first and foremost, becasue on the one hand they can play little dictator and finally tell everyone what to do and no todo, while simultaneously looking like the rescuer of the nation! Wow - double bonus!

And then all those who say, um, hello, virologists have found more problems with the official story than can be named here, they are considered un-patriotic. And shamed for their lack of compassion. No, it's not lack of compassion, it's lack of stupidity.

Hit the proverbial nail on the head, good to see logical thinking and minded people on MR forum relating to this virus.
[automerge]1587753823[/automerge]

Yes, they’re making a respectable effort at privacy here, and I‘m happy to see this getting as much thought as it is. That said, though, the last revision was touted for protecting privacy, and now we hear that they’ve only now decided to move to random keys— and it’s still not clear how uncorrelated that is to user information. I’m not sure that it’s possible to truly make this private. If each key is being used for 5 minutes before updating, and a government puts listeners on every street corner, then it’s pretty straight forward to track an individual’s movements and identify them. It would be nice if every interaction was a one time code so there was less correlation in the information.

That’s the big difference between this and GPS— GPS is listen only, so nobody knows you’re using it. The app that is providing the UI for that GPS has the potential to forward that information (and there’s been a lot of uproar over that, actually). Still we have fine grained control over location services and can ensure an app only has that information when we want it to. This system is a beacon that emits everywhere you go without your intervention and without turning off.

I’m a bit bothered by the “save us, big tech!” mentality that’s developed— these are businesses and its not really their role to provide public health services. I also don’t know if there’s another solution rather than tracing everyone everywhere, but I’d hope people are looking for one because it’s really easy to just decide that we have to throw privacy out the window without thinking about it more deeply.

If it turns out that tracking individuals is the only safe way forward, then I’d much prefer this be a dedicated key fob that I can throw away when the crisis is over, rather than building this kind of tracking functionality into the OS of all my devices.

Someone who understands the inherent risks. Are they going to delete this app and database once we have s vaccine or are they going to use it and/or expand upon it without consent and knowledge in the excuse of something else.

We fight for our freedom, only to easily give it away because of fear. Yep contradiction and a shameful dishonour to the people who gave their lives fighting for it.
[automerge]1587754130[/automerge]

The keyword is “harder” not impossible!!

Hacker community is going to have a field day with this as it is ripe for abuse.

Nostalgia to the Hacker movie where they get back at the FBI agent.

 

[TechieGeek]

You guys realize that your location is already being tracked by cell carriers, right? Does nobody remember this article? https://www.vice.com/en_us/article/...ollars-located-phone-microbilt-zumigo-tmobile

Everyone here is arguing about "loss of freedom" and "loss of privacy".... this particular exposure notification system is built to be incredibly private. You're not losing any freedom from this.

If you care about privacy, there are MUCH bigger fish to fry.

The arguments here are akin to arguing and bickering about whether or not the Caps Lock light is contributing to MacBook battery drain and whether people should have the freedom to use Caps Lock without the green light staying on, and in the meantime the laptop is encoding videos but everyone is too focused on the **** Caps Lock light.

 

[iGobbleoff]

The Librem and Pine phones can’t come soon enough. There is no way anything related to Google is going to be private.

 

[TechieGeek]

The Librem and Pine phones can’t come soon enough. There is no way anything related to Google is going to be private.

Have you lost your marbles? The tech companies are not your enemies. Do you remember when ISPs lost their **** when Chrome began supporting encrypted DNS? Google wasn't changing everyone's DNS server, only supporting encrypted connections if people's existing DNS supported them.

The ISPs cried, "but now we won't get to track people!"

Google addresses 'misconceptions' about Chrome's encrypted DNS push

Last month, Google announced a plan to encrypt DNS — or DNS over HTTPS (DoH) — in Chrome. After criticism about Chrome encrypted DNS...

9to5google.com

Read my link up above about the similar tracking habits of cellular carriers.

Apple and Google are not "out to get you". You should be 100x more worried about the companies that provide your internet and cellular service.

 

[code-m]

You guys realize that your location is already being tracked by cell carriers, right? Does nobody remember this article? https://www.vice.com/en_us/article/...ollars-located-phone-microbilt-zumigo-tmobile

Everyone here is arguing about "loss of freedom" and "loss of privacy".... this particular exposure notification system is built to be incredibly private. You're not losing any freedom from this.

If you care about privacy, there are MUCH bigger fish to fry.

The arguments here are akin to arguing and bickering about whether or not the Caps Lock light is contributing to MacBook battery drain and whether people should have the freedom to use Caps Lock without the green light staying on, and in the meantime the laptop is encoding videos but everyone is too focused on the **** Caps Lock light.

You do realize that cell phone carriers have to track your phone to monitor congestion in a given cell tower area to temporary limit data speed and priority of services. If you use this data, along with wifi data, contact tracing, etc the level of accuracy is incredible.

Today it is to track virus exposure tomorrow a three letter alphabet agencies will request this data for suspected terrorists to see if they were in contact with other virus carriers so those people can be “informed”. It’s a method to circumvent and abuse.

 

[mrothroc]

Yes, they’re making a respectable effort at privacy here, and I‘m happy to see this getting as much thought as it is. That said, though, the last revision was touted for protecting privacy, and now we hear that they’ve only now decided to move to random keys— and it’s still not clear how uncorrelated that is to user information.

The article said that the original key generation mechanism was based off of some seed. While this can be secure, there have been cases where this type of approach was compromised because of either a flaw in the generation algorithm or some mechanism for discovering the seed. This is often how engineers start with a problem like this, so it's not surprising they tried this first, then someone pointed out the flaw, then they went to a higher entropy algorithm.

This is a commonly accepted, well understood, and trusted approach to this problem.

I’m not sure that it’s possible to truly make this private. If each key is being used for 5 minutes before updating, and a government puts listeners on every street corner, then it’s pretty straight forward to track an individual’s movements and identify them. It would be nice if every interaction was a one time code so there was less correlation in the information.

Actually, if the keys are truly random, and they rotate every five minutes, then there isn't any way to know that key A seen at point A is from the same person as key B at point B. In low-density environments, you may be able to use dead reckoning on a key observed over some period of time to predict where that person will be next, but this isn't particularly reliable.

Regardless, people seem to forget that the governments don't need to do this. They already have the ability to track the location of every phone via cell tower triangulation. They've been doing this for a long time now. In the US, they regularly issue blanket warrants for this data. If you carry a mobile phone, you've already opted in to this.

 

[gnasher729]

No thanks, this is like opening Pandora’s Box. Once it gets accepted it will not be able to be reigned in, just look at the track record of governments that push for this type of power and control.

Ok, if you prefer staying at home for the next years, that's up to you.

You may have noticed that Apple told the British NHS that their own attempts at getting this data would be rejected, and the same with the French. USA is apparently not bothered.
[automerge]1587755753[/automerge]

They say this will not be mandatory. But that will prove to be false. Employers in various essential industries will start to make it a requirement of employment. From there others that employ people that deal with the public. You WILL be using it or some derivative of it in the future or you will be an outcast. No need for the government to mandate it, they can claim you are free to not use it or whatever it morphs to in the future.

If my company's offices open again, do you think they want anyone in there who has been close to COVID-19? Do you think I would want anyone sitting besides me who has been close to COVID-19? So yes, you are right. You won't have much choice.

 

[RemedyRabbit]

If you’ve used the internet and a smartphone everyday for the past 10 years and NOW you’re suddenly super concerned about being tracked then I’ve got nothing for you.

 

[code-m]

Ok, if you prefer staying at home for the next years, that's up to you.

Ask yourself who imposed this “stay at home” recommendation and order. Look at Sweden, their did not succumb to these extreme measures. Now compare the infected, recovered, death and new cases with countries who did have this order. Unlike some I do not give into fear of some virus propagated and reminded constantly by the government, public health and media. Imagine if these three entities have this much attention to any other issue. The goal is to keep the public living in fear as to not question any decision made without choice.

You may have noticed that Apple told the British NHS that their own attempts at getting this data would be rejected, and the same with the French. USA is apparently not bothered.
[automerge]1587755753[/automerge]

That is how it starts then slowly concessions are made and it slowly but surely is chipped away with pressure and influence, look at history. Humans seek control over others and things, sure we are about to change this now. Wake me up from your utopia dream world.

If my company's offices open again, do you think they want anyone in there who has been close to COVID-19? Do you think I would want anyone sitting besides me who has been close to COVID-19? So yes, you are right. You won't have much choice.

How many employers are going to let employees go if they are inadvertently come into contact and have to quarantine for 14 days. At that point you might as well work remotely.
[automerge]1587756784[/automerge]

If you’ve used the internet and a smartphone everyday for the past 10 years and NOW you’re suddenly super concerned about being tracked then I’ve got nothing for you.

Just because you are unsure of how to cover your digital activities, don’t assume others don’t and have not.

 

[AppleTO]

Apple and Google are targeting next week for the release of the seed version of iOS and Android operating system updates, which will support these APIs to enable testing by public health authority developers. The software update will support iOS devices released in the last four years, dating back to the iPhone 6s and iPhone 6s Plus.

So it will be available on all Apple devices that run iOS 13, and probably about 10% (or less) of android devices. Huh.

 

[iGobbleoff]

Have you lost your marbles? The tech companies are not your enemies. Do you remember when ISPs lost their **** when Chrome began supporting encrypted DNS? Google wasn't changing everyone's DNS server, only supporting encrypted connections if people's existing DNS supported them.

The ISPs cried, "but now we won't get to track people!"

Google addresses 'misconceptions' about Chrome's encrypted DNS push

Last month, Google announced a plan to encrypt DNS — or DNS over HTTPS (DoH) — in Chrome. After criticism about Chrome encrypted DNS...

9to5google.com

Read my link up above about the similar tracking habits of cellular carriers.

Apple and Google are not "out to get you". You should be 100x more worried about the companies that provide your internet and cellular service.

There is ZERO need for us to be tracked by anyone. Whatever the BS they tell you about it being anonymous is BS. A random number generated on your phone for some database somewhere is linked to the various hardware IDs and then your App Store / Play Store account and then your CC etc etc.

What do they need it for? There isn’t one. No need to be tracked. If I want to store a history of whatever then I should be able to decide when that happens, and if I agree to it then it should stay on the phone, and only on the phone.

Using COVID-19 as an excuse to implement some sort of tracking isn’t setting a good precedent. What’s next? Have a good think about it. If you’re happy to be tracked in the name of “security” then go for it, but I’m not going to be part of it.

 

[TechieGeek]

There is ZERO need for us to be tracked by anyone.

Using COVID-19 as an excuse to implement some sort of tracking isn’t setting a good precedent.

I don't know why you quoted me, I was saying there's bigger fish to fry (ISP tracking, cellular carrier tracking), that the exposure notification system is nothing compared to the tracking that ISPs and carriers are running.

However -- are you making a case that there's no need for "contact tracing" in general? Are you claiming that healthcare professionals are just lying?

If I've been near someone diagnosed with COVID-19, I want to know, because I may be infected and may be contagious even if I don't have symptoms. If I'm notified, I can be far more careful not to get near any immunocompromised friends, near my parents, etc.

 

[Analog Kid]

The article said that the original key generation mechanism was based off of some seed. While this can be secure, there have been cases where this type of approach was compromised because of either a flaw in the generation algorithm or some mechanism for discovering the seed. This is often how engineers start with a problem like this, so it's not surprising they tried this first, then someone pointed out the flaw, then they went to a higher entropy algorithm.

This is a commonly accepted, well understood, and trusted approach to this problem.

Actually, if the keys are truly random, and they rotate every five minutes, then there isn't any way to know that key A seen at point A is from the same person as key B at point B. In low-density environments, you may be able to use dead reckoning on a key observed over some period of time to predict where that person will be next, but this isn't particularly reliable.

Regardless, people seem to forget that the governments don't need to do this. They already have the ability to track the location of every phone via cell tower triangulation. They've been doing this for a long time now. In the US, they regularly issue blanket warrants for this data. If you carry a mobile phone, you've already opted in to this.

I don’t disagree with your basic premises here— the system isn’t bad, there’s other ways to be tracked, etc. I do think that data with overlapping observations and a 5min correlation time is more trackable than uncorrelated data points, just as a matter of mathematics, but we don’t need to design that system here.

My points are these:

• Questioning the methodology is not the same as denying the importance. Don’t assume there’s only one way to solve a problem, or that all good things must come with sacrifice. Zero sum mentality, or “we have to do something and this is something” approaches lead to worse outcomes than looking for optimal solutions.
• Don’t assume it’s private because the companies are saying it’s private. We’ve already seen one instance (the key generation) where challenging that assumption has improved the solution.
• Don’t assume every crisis is best solved with reduced privacy protections.
• Just because governments have other ways of tracking people doesn’t make it a good idea to provide more.

Time matters, of course, but so does getting it right. If we deploy something that fails badly and generates bad press, people won’t trust it again no matter how many times we say it saves lives and governments can already track your movements. And we need everyone opting in for this to work— excluding the paranoid leaves massive gaps in the system.

 

[rjohnstone]

More interestingly, European countries without any restrictions are also recovering - ie everything is just fine in Sweden, who did not participate in the media generated and government perpetuated lies about estimated death rates meant to scare everyone ********.
Restaurants were open the entire time, no mask order, nobody was locked up at home, people were told to wash their hands and be a little bit careful... no run on the hospitals happened, no ICUs were overwhelmed, basically nothing happened, everyone's just fine. Just like many virologists had predicted.

I wouldn't be touting Sweden as the model.
They've been on a steady upward climb in cases since the end of March with no decline in sight.
That closed case ratio is horrific. 80% died, 20% recovered.
That number will obviously change as time goes on, hopefully improve.
The screen shot stats are a day or two old. Currently up to 17,567 as of today.

Yeah, their hospitals are not being overrun, but that does not mean they are "doing just fine".

After Rejecting A Coronavirus Lockdown, Sweden Sees Rise In Deaths

Sweden’s daily coronavirus deaths have spiked.

www.forbes.com

 

[ebika]

Sweden is an interesting comparison. By accounts, they let the virus burn more brightly through their population because presumably they are able to handle the load on their healthcare systems, have lower population / population density, more accessible healthcare, and people more willing to share social accountability without being store-ice cream-licking dumbasses. If the US had adequate testing and less fractured healthcare systems, our brute-force approach towards sheltering-in-place probably wouldn't be as necessary or severe. The US has a 5.7% fatality rate, whereas Sweden is sitting at 12.1% (source: https://coronavirus.jhu.edu/data/mortality). They'll achieve herd immunity faster than the US probably primarily because their population is 3% of the US.

I get the frustration for the very uncomfortable measures enacted in the US, and most parts of the world. I'm much less willing to buy into the conspiracy theories about how this was planned. Corrupt people in power have always had power grabs in their playbooks for crises, and we do need to be vigilant. Anonymized contact tracking doesn't really rise to the level of "nefarious" for me, especially compared to other things we've been subjected to over the past few decades.

 

[MacBookGamer]

“No thanks, I’d rather get corona.“ ~Half this forum

Just pretend you’re playing a multiplayer version of Pokémon Go where you have to avoid dangerous Pokemon.

 

[code-m]

Sweden is an interesting comparison. By accounts, they let the virus burn more brightly through their population because presumably they are able to handle the load on their healthcare systems, have lower population / population density, more accessible healthcare, and people more willing to share social accountability without being store-ice cream-licking dumbasses. If the US had adequate testing and less fractured healthcare systems, our brute-force approach towards sheltering-in-place probably wouldn't be as necessary or severe. The US has a 5.7% fatality rate, whereas Sweden is sitting at 12.1%. They'll achieve herd immunity faster than the US probably primarily because their population is 3% of the US.

I get the frustration for the very uncomfortable measures enacted in the US, and most parts of the world. I'm much less willing to buy into the conspiracy theories about how this was planned. Corrupt people in power have always had power grabs in their playbooks for crises, and we do need to be vigilant. Anonymized contact tracking doesn't really rise to the level of "nefarious" for me, especially compared to other things we've been subjected to over the past few decades.

You do realize that most of Sweden’s population is within a few metropolitan areas. This would be like comparing Sweden to the State of New York vice the entire United States. Listen the informed knows how statistics can be skewed to whatever original outcome you want. The question is that when we look at all the countries who had lockdown measures in place compared to the black sheep Sweden regarding infection, recovery, death and new cases we get a different story without the requirement for the economy to be shut down.

The State to State numbers are fluctuating and the infection to death ratio will drop as many are asymptomatic and did not know their were carriers until tested and went about their daily life to some degree to the forced quarantine. Even if asymptomatic and after the 14 day quarantine period these people should be immune, so why has it taken over a month of lock down that official still pushing contagiousness.

As a simple example if we take 100 people, we infect 1/3 with the virus, 1/3 without and the last 1/3 asymptomatic and isolate them for the incubation of this virus for 14-21 days then after that period there should be no virus, no infection, etc. So if this has not worked then by prolonging something that does not work is the definition of madness/insanity.