UK’s NHS Covid-19 App | Hacker News Reader

UK’s NHS Covid-19 App

github.com

52 pointsmilen23 comments

https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... appears to be looking for Apple devices to wake them back up.

No, that comment is referring to the fact that advertisements change their format when an iOS device is sleeping, and thus devices listening need to filter on a different UUID.

Can someone clearly explain the actual privacy risks of the centralised model (that UK Govt is pursuing) over the decentralised model?

My understanding is that in reporting our unique identifiers (and location data?) to the govt servers, this data could be de-anonymised and misused. But what data is actually being reported and how could it be misused?

Imo the threat here isn't just the government - that's a concern, but if you've been tested positive, the NHS already know you.

The bigger issue is potential leaks or poor access controls resulting in a malicious third party gaining access. With the decentralised approach where Apple/Google control access to their APIs, the threat surface is significantly reduced (e.g. contact tracing apps cannot also use geolocation)

Disclosure: Also a Google employee.

And so the question remains:

>But what data is actually being reported and how could it be misused?

All advertisers already know who I live with, and if I'm obeying social distancing I will only be coming into contact with strangers. Is this data really more sensitive than the stuff we firehouse out every day?

My understanding is that the centralised model means the government will very quickly get a huge database of who meets whom, how often, and for how long. Even if you don't couple this with location data, it's still a privacy nightmare. If you test positive for COVID19 the government would use this information to send out alerts to people you've recently been in contact with.

With the de-centralised model, your device tracks who you've seen recently and when. The government would announce the IDs of devices owned by people that had tested positive and your device would tell you if you had encountered any of the positive devices.

The centralised approach makes it much easier for the government to track compliance (e.g. we know 500 people should have come forward for testing, but only 200 did) - but again, complete privacy disaster.

Having perused their Github, I noted the database for x-rays and scans.

<TinFoilHat>This is being run in 'partnership' with a relative non-entity, who in turn have links to a private American medical company.

Not sure I'm happy with private NHS medical records being slurped up in this way - unless consent is expressly given - which, based on their website that 'anonymizes' uploaded imagery, I guess we'll never know for sure.</TinFoilHat>

Good to see the code for both the iOS and Android clients being posted, as this should prove if these clients can ultimately be trusted.

I think I would feel much better about this if it was accompanied by a legally binding declaration that the only entity that will ever have access to these data will be NHS, explicitly excluding any other government intelligence agency.

This is not a stab against the people who developed it, in fact I know some of the people involved in the development of the application and they have the highest ethical standards.

The problem is that in the post-Snowden era, no matter the good intentions behind such projects it is naive to not ask for as many safeguards as we possibly can.

Well...at least they’re open sourcing this which is better than letting some company develop the app entirely and keep the code under lock and key.

ACCESS_FINE_LOCATION is an immediate red flag. Yikes.. that's gonna be a no from me.

https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a16...

Did you read the notes in the link next to that item?

"In order to use Bluetooth features in your application, you must declare the Bluetooth permission BLUETOOTH. You need this permission to perform any Bluetooth communication, such as requesting a connection, accepting a connection, and transferring data.

You must also declare the ACCESS_FINE_LOCATION permission, given that LE beacons are often associated with location. Without this permission, scans won't return any results."

Sure, but the Google/Apple contact tracing APIs do not need this.

do these exist yet?

My understanding is those are still in development and haven't yet been pushed to the world.

The API interfaces were published, but you're correct implementation is yet to ship.

https://blog.google/documents/55/Android_Contact_Tracing_API...

FWIW, as the comment in the source hints at, it's needed for Bluetooth low energy scanning: https://developer.android.com/guide/topics/connectivity/blue...

It looks like they are using beacons that are the same for 1 day. I think the google/apple version uses beacons that last until the bluetooth MAC address changes which I think is 15 minutes on iOS. So you can setup bluetooth devices around the city to track people's movements who are using this app.

Firebase, seriously???

And Microsoft Appcenter Analytics: https://reports.exodus-privacy.eu.org/en/reports/uk.nhs.nhsx...

Which they're using to track a couple of events, i.e. when the app fails to register with the API: https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste...

(Though that analytics platform itself does do device fingerprinting, inasmuch as detecting phone model, OS version etc -- I assume no individually identifying stuff like IMEIs, but who knows what a bad actor can do with sufficient entropy?)

They use firebase for push notifications. GCM (Google Cloud Messaging) has been moved to firebase, and it can now also do Apple notifications I think so it makes sense to just stick to one.

Except you don't need to import Firebase Analytics to use the messaging. And, same as the Facebook SDK situation earlier today, Firebase SDKs will do stuff when the app loads whether you reference them or not.

According to the repo [1] they're using: apply plugin: 'com.google.firebase.crashlytics' com.google.firebase:firebase-messaging

[1] https://github.com/nhsx/COVID-19-app-Android-BETA/search?p=1...

I assume crashlytics is for crash dumps only, could firebase-messaging pull in firebase-analytics?

Why are y'all aggressively judging the codebase when you don't even know how firebase analytics works on Android? Damn

Reply on news.ycombinator.com