Hacker News Reader

Comment by halixand | Hacker News Reader

Moxie Marlinspike has an interesting analysis on this: https://twitter.com/moxie/status/1248707315626201088

He objects to two things:

1. Doing it globally would require download of too much data, thus (contra promise of the spec) location data will have to enter. However, from what I can tell, that could be very coarse data, on the level of country and/or time zone (thus, not even necessitating access to GPS location data). I don’t see it as a major problem.

2. The “prank” danger: someone just pressing “I’m infected” for fun. One could introduce a tiered system where “I’m infected” requires some sort of authentication from a hospital/lab (a QR code on positive test results for example). There would also need to be a tier for “I have symptoms”, and yes, that could be abused/“pranked”.

Would be interesting to see a deeper analysis on both points. I don’t think they’re deal breakers.

I don't think there is any suggestion of using any kind of granular location data, be it GPS or cellular network location. Doing it per region could certainly work, and only reveal maybe 4 bits of information about location. I imagine for Europe and some parts of the world, per country could be too granular due to localised travel (at least as things ease back), but at region level you would be revealing more from your (even cellular) IP address than actually passing on a rough region of interest.

His argument No. 1 is self-defeating. If you have rapid exponential growth and would have to publish hundreds of megabytes of keys per day (and phones only need to download the delta to the previous day), this approach of contact tracing is useless and you must instead get the entire population under lockdown. If everybody is sheltering at home, nobody needs notifications of possible contacts, because everybody is doing what would be the response to such a notification already. So you can simply disable the app in a certain country or don't accept submissions to the diagnosis server during that time.

This approach, just like the manual approach of tracking potential contacts via paper and phone, is only of use in a scenario with a very limited number of transmissions and an R (reproduction rate) of around or below 1. Its purpose is not to reach such a situation, but to aid in keeping that situation in effect without severe measures. But severe lockdowns must first suppress the infection counts to such levels before any contact tracing may work at all.

I think the point with this is when the curve starts to flatten, we can _safely_ reopen the economy. Contract tracing and rapid response can end this.

> The “prank” danger: someone just pressing “I’m infected” for fun.

How about you can only check the "I'm infected" box if your phone is near the phone of a health worker?

Another idea is that you get a code in the mail from the hospital which you have to enter in the app.

In the UK, most supermarkets have an hour where only health workers can enter (quite right, give them priority). But this makes it trivial to get close enough to health-worker to execute your prank, just join that queue.

Published keys are 16 bytes, one for each day. If moderate numbers of smartphone users are infected in any given week, that's 100s of MBs for all phones to DL.

That seems untenable.

It's a lot, but untenable? If 300 million report as infected, that's 4.8 GB, coincidently the size of a DVD. So 2 hours of Netflix, 1 hour at 4k. Very easy to cache this data close to the edge, too.

> Published keys are 16 bytes, one for each day. If moderate numbers of smartphone users are infected in any given week, that's 100s of MBs for all phones to DL.

> That seems untenable.*

> It's a lot, but untenable? If 300 million report as infected, that's 4.8 GB, coincidently the size of a DVD. So 2 hours of Netflix, 1 hour at 4k. Very easy to cache this data close to the edge, too.

Just doing the math here, assuming a perfectly efficient wire protocol was used, each infected person would amount to (16 x 14 = 224 bytes) of data to be transmitted.

Assuming we see 150k new cases per day, worldwide (worldometers is reporting 100k new cases per day as the peak, and let's factor in 50% margin), this would be 33.6 MB of data per day.

Since you only need to transmit that day's data rather than the full database, a very basic sync protocol could be used here - the phone simply stores the sequence number of the last identifier handled, and it can be given subsequent data. This could even be done with a static (and thus cacheable) server if cases are chunked sequentially into 1MB chunks, and addressed by filename based on the last case ID.

For clarity here, case ID would be simply be the sequential number that a given tracing ID has in the server-side record, so you only need to fetch data you haven't already checked against.

300 million each day would be the whole world population on less than a month. At current numbers ( 13000 per day ) that’s a few megabytes without compression.

Yes. That's my point. Even if you chose a ludicrously high value -- in this case approximately the entire population of the US --, you still get an amount of data that's manageable as evidenced by the fact that various companies manage it every day.

Reply on news.ycombinator.com