Hacker News Reader

Comment by Quanttek | Hacker News Reader

Technical details: https://www.pepp-pt.org/content

The app basically uses Bluetooth Low Energy for the proximity measurements: The app generates temporary IDs, so if two smartphones with the app come close, they exchange their IDs and save the IDs of their respective partner locally and encrypted. If a person is tested positivive for the novel coronavirus, the doctor can ask the person to upload their list of contacts to the Pepp-PT server. The app can then compare its list with the list on the server and notify the user if they had contact with person who has COVID-19.

Source for the summary (before I found the site at the top): https://www.spiegel.de/netzwelt/apps/corona-warn-app-fuer-eu...

View on HN

"The app can then compare its list with the list on the server". So the comparison takes place on each individual's phone ? To do this without leaking privacy, each phone will need to receive all the ids on the server i.e. all ids collected by the phones of people with positive diagnosis. This could require a lot of data to be distributed to a lot of phones.

If the comparison takes place on the server, it will save a lot of bandwidth. But then there will need to be a Tor like network to hide the IPs of the phones doing the requests.

bloom filters to the rescue (:

Suppose Alice is permanently at home with only one caregiver. The system should never tell Alice that she has been in contact with a virus carrier because that will imply that the caregiver tested positive.

Instead, the system should rather tell Alice she may have been exposed to the virus and should get tested. Bloom filters can provide that uncertainty.

The list on the server could be classified by region and time period (certainly this reduces privacy, but would still prevent tracking individual movements with precission).

This way the phone would need to download just the lists for those regions and periods of the places it has been through.

Basically what the TraceTogether app in Singapore has already been doing in the past 2 weeks. Not rocket science, but a simple and clever approach still.

I don't know why Singapore GovTech hasn't yet released the source even after they said they intend to do so...

A little late of a reply, but afaik, TraceTogether tracks phone numbers, so it doesn't provide as much anonymity.

Is the app open-source?

Only if you're a partner, so - no.

It will be open-sourced soon: https://twitter.com/gannimo/status/1245630618462867457

Reply on news.ycombinator.com