Stay up to date on all things crypto and blockchain
Token Daily is a place to discover trending news and products in crypto and blockchain.
Source: aclu.org ·
The latest in the fight for our civil liberties.
zooko - @zooko
3 months ago
RT @Snowden: Apple and Google intend to push pandemic trackers into most of the world's smartphones. In response, @ACLU just published a whitepaper listing bottom-line principles phone-based contact-tracing systems must follow to comply with basic rights. Summary: https://t.co/ZZ4KuaKUIb
823
1141
Andrew Miller - @socrates1024
3 months ago
RT @Snowden: Apple and Google intend to push pandemic trackers into most of the world's smartphones. In response, @ACLU just published a whitepaper listing bottom-line principles phone-based contact-tracing systems must follow to comply with basic rights. Summary: https://t.co/ZZ4KuaKUIb
810
1122
peterman86
3 months ago
The solution is simple. DO. NOT. ACCEPT. It's always sold as a convenience, or a "security" measure, especially after a global event.
1
thz3218
3 months ago
Whatever ..at this point I'm just trying out different colors for my faraday bag.
2
Tom5053
3 months ago
It's an app literally designed to track you. No shit it's a privacy risk. No robust controls and safety and consent features will stop if from tracking you.
2
oxyuh
3 months ago
Robust controls on safety in a contact tracking fucking app? As soon as we’re forced to use them, we’re in Orwell’’s 1984
1
rohitandley
3 months ago
This virus is big setback in terms of data collection by the companies and other entities.
2
trai_dep
3 months ago
And, you're banned for homophobic comments. Rule #5.
Thanks for the reports, everyone!
1
ComatoseSixty
3 months ago
The ACLU and various state specific counterparts fight for the rights of all Americans in court, even if they are confused about the 2nd Amendment. They've sued schools for holding prayers and sued other schools for preventing students from conducting prayers, as the Constitution demands.
2
crypticstencil
3 months ago
You have the right to free speech. Although I don’t agree with how you express yourself in response to this article, I will defend your right to say it.
1
Mr-Yellow
3 months ago
It does not matter one iota how robust the controls or consent is.
They make your device broadcast short-lived, short-range IDs.
These IDs add resolution to existing surveillance systems.
The apps don't have to track you, you're broadcasting signal. The existing honeypot location networks around major cities will simply have this bluetooth ID added to the list of things they record.
7
_TheConsumer_
3 months ago
The fact that the We’re ceding any type of access to our health data to a google/Apple is frightening.
It’s enough reason to get rid of a cellphone.
11
Mr-Yellow
3 months ago
In Australia the federal government is making noises about tying the relaxation of movement restrictions to app participation metrics. Some noise about 40% of people will need to run it before they'll be allowed to sun-bake alone in the park.
Then wrapping that in some nonsense about the minister deleting some data-store when it's "over". People will go on broadcasting IDs for years without thinking about it.
12
_TheConsumer_
3 months ago
It is incredible that any government is leveraging this virus to totally control our lives and privacy.
I’m on my way to a pager and dumb phone. I’ve had enough.
13
Supes_man
3 months ago
ACLU
Well a broken clock can still be right twice a day. Good on them this time.
0
JesseJames8046
3 months ago
How much you wanna bet that Google or (especially) Apple will update iOS to the next version and put an app on the user's phone that can't be gotten rid of, then like software updates give a pop-up message bugging you to use the app? (sigh)
10
ravend13
3 months ago
No doubt. I expect it will be opt-in by default as well. I'm on the fence about whether opting out will be an option.
As a privacy advocate, I think opting out should be possible.
As someone who got stabbed in the lung 6 months ago and really doesn't want to find out first hand how much more vulnerable to COVID that makes me, I think they should silently install it on everyone's phones and provide no way to turn it off...
2
DarthTechious
3 months ago
I’d probably expect Apple to integrate this into the Health app, which (so far) can’t be deleted. Hopefully the system is opt-in.
5
JesseJames8046
3 months ago
Of course it cannot be deleted.
There was a show called Breaking Bad on TV, among its many episodes it had 2 that were named "Half Measure" and "Full Measure". The stories behind those episodes detail how much one should put care into detail and action.
I'll apply those same principles here;
Half Measure; Giving users the ability to do something such as check their symptoms for a disease/illness, and making it optional.
Full Measure: Giving users the ability to do something such as check their symptoms with an app they put on your phone. The app comes mandatory with a system update and as far as Apple goes, if you don't update they badger you to do it with pop ups. Once then app is on your phone, it cannot be taken off.
2
ContentPolicy101101
3 months ago
In short, the Apple and Google tool might be collecting far more personal information than is warranted by the crisis, with no plan to stop it at the conclusion of the pandemic, proposals have been coercive and scary, people might escape tracking by turning off location entirely, leave their phone at home or register a second dummy one.
44
_TheConsumer_
3 months ago
When I heard of the Google/Apple proposal I bought a one way pager. I am currently looking at dumb phones with removal batteries. I will set aside time through the day to answer calls and texts. All other times - the phone has no battery. Page me or wait until my next “online” time.
Enough is enough. This was the straw that broke the camel’s back.
25
_TheConsumer_
3 months ago
I did some homework on them. One way pagers are probably the best bet privacy wise. Exceptionally difficult to track - but still reliable methods of communication.
2
KrakatiteKryptonite
3 months ago
Anyone knows where I can find some info about them? I need to use in middle-eastern europe, but cannot find much information.
1
_TheConsumer_
3 months ago
No. I just think that modern conveniences are coming at a very heavy cost of privacy. I can’t stop Google or Apple from collecting my data. But, I can stop providing it to them.
15
dogsresidue
3 months ago
some phone manufacturers (Samsung, Huawei) don't allow you to unlock the bootloader. I solve this problem by buying phones that I know let me. OnePlus phones are a great value and have amazing LineageOS support, years and years past their EoLs. to this day you can buy any OnePlus phone besides X and run the latest version of Android on LineageOS
2
MysteriousPumpkin2
3 months ago
Depends on the phone ofc, but lineageos has a lot of support, which you can choose to supplement with MicroG. Copperhead OS also exists for a smaller set of devices.
2
_TheConsumer_
3 months ago
Yeah. But I’ve come to the conclusion that I want a phone without bells and whistles. Just a dumb phone that I can yank the battery out of.
Want me? Beep me. I’ll call you back on my designated time.
18
dogsresidue
3 months ago
makes sense. LineageOS is nice and minimalist but it's not a dumb phone lol
1
antilex
3 months ago
Pinephone.
Purism phone.
Both just Linux on a phone ( no android )
You get basically a web browser and messaging.
1
dogsresidue
3 months ago
that's what you get with LineageOS too expect on Lineage it's not an unfinished unstable experience intended for developers rather than end users.
1
DarkArchives
3 months ago
For two devices to communicate over a network they need to exchange MAC address numbers so they know where to send the information. Once you’ve exchanged MAC address numbers you have exchanged personally identifiable information. Google and Apple are trying to mislead people they can encrypt this data, but those encryption methods were already demonstrated to not work.
5
ocelost
3 months ago
The counter to this problem, of course, would be a verifiable guarantee that the system doesn't actually use the MAC addresses (or any other data that it shouldn't). Let's scrutinize the proposed protocols for possible exploits, require that the code be open source, and only install builds that were built by us our by a privacy-focused third party.
That last part probably means *not* building the tracing functionality into the OS.
3
DarkArchives
3 months ago
That’s the thing every networking protocol requires the two machines exchange MAC numbers.
It’s like asking some to send you an email without giving you an email address.
Cryptographers working at The Naval Academy proved this provided no protection years ago
https://arxiv.org/abs/1703.02874v1
5
ocelost
3 months ago
My point is that the software doesn't have to use the MAC for anything beyond the network exchange. It doesn't have to keep it. It doesn't have to include it when generating a tracing ID. It doesn't have to share it with anyone or anything. It could just throw it away.
The study you linked is about protection from malicious external actors. It doesn't apply to my comment, because the steps I listed are specifically to ensure that the software would *not* be a malicious actor.
Now, if you were to argue that just leaving bluetooth enabled while walking around is a risk that the devices around you could exploit, then yes, you would have a point. But that's not a flaw in the tracing app you run on your phone; it's a danger from bluetooth itself. It is already present in your phone, regardless of whether you install a tracing app.
Of course, the same is true for wifi, nfc, and cellular phone service. Just carrying a charged cell phone around with you already exposes you to the same kind of tracking risk. The best way to protect yourself from it is to avoid carrying a cell phone.
To be clear, though, I agree that adding more involuntary and/or exploitable trackers to our daily lives is a terrible idea. We should be reducing them, not enabling more of them.
1
DarkArchives
3 months ago
If you are walking by someone you have no idea if they are malicious or not
People could put a Bluetooth beacon capturing MAC address and match it up to security footage
1
0xdead0x
3 months ago
Oh buddy. You don’t understand any of this as well as you wanna believe you do.
I’ve read the spec. It’s exceptionally privacy friendly. The handshakes it describes are completed without the MAC address using instance-generated identifiers derived from a unique key stored on the device that you can reset just by turning the feature off and back on. No legitimately identifiable information gets exchanged.
21
Velokoraptus
3 months ago
It's only a matter of time till someone will find the way to exploit this, no matter how secure it is. NSA and China government definitely won't do that, because they are respecting everybody's PRIVACY, and everybody can calm down now 😊
1
DarkArchives
3 months ago
A MAC address, which stands for Machine Access Control gives every device using a NIC, Network Interface Control, an ability to send and receive traffic using the IEEE 802 protocol and is used for both Ethernet and Bluetooth. It was invented back at Xerox in the early days of computer networking
Here are some resources to help you learn more
https://www.globalknowledge.com/us-en/resources/resource-library/articles/does-a-mac-address-mean-apple-invented-it/
https://techterms.com/definition/macaddress
https://www.sciencedirect.com/topics/computer-science/hardware-address
0
HadACigar
3 months ago
Got a link to the spec? Do we know if this will be app based, or native to the phone OS?
2
0xdead0x
3 months ago
I’m gonna have to dig it back up but yes, the spec is public!
It looks like it’s going to be integrated into the OS, but obviously Google and Apple will handle that a little bit differently between them. I expect that Apple will make an app for interacting with the system but the actual implementation will be a daemon owned by launchd, but Google’s approach is going to be more of a wildcard.
2
Woody27327
3 months ago
Is the key the phones exchange used as a spoofed MAC then? That's better than I'd expected.
Just a thought I'd had the other day - if I leave this feature turned on and walk past someone with an Android phone with location turned on and set to 'high accuracy', their phone will be scanning for WiFi and Bluetooth devices nearby as well as GPS ([link](https://images.techhive.com/images/article/2015/10/location-mode-100621707-large.png)). So will a passer by see my random/spoofed MAC and cache it as part of their own location tracking? Depending on their settings, would that info leave their device or be sent to Google?
2
0xdead0x
3 months ago
Good question! The answer is no, Google can’t use Android phones to scrape location data from this system. What essentially happens during this handshake is that both devices generate a one-time key based on their identifier (such that it can’t be reversed - similar process to a provably secure hashing algorithm) and use that in lieu of a MAC address. So even if Google did take this one-time key and store the location it was seen at, the next time the phone performs a handshake, it will use a totally different one-time key that Google can’t relate to the first one or to you. Super cool stuff.
7
Woody27327
3 months ago
Ah that's neat! The dumbed down description I saw on BBC and Googles blog just said it was a key that was changed every day. Can you recommend any resources that give a more technical overview?
I guess the only other possible weakness would be if in 10 or 20 years time the encryption/hashing methods (I'm guessing public key + OTP here?) used today are either found to be flawed or easily brute forced and you could possibly gather more information from the public data set of infected keys?... But that's not exactly a pressing concern and there's only so much you could really expect them to be able to do about that.
2
fuster_cluq
3 months ago
Robust controls in safety and consent? Does that even exist in the modern tech world?
89
crypticstencil
3 months ago
The original post was removed for just cause. This link will take you to the direct source. Let’s continue the conversation!
13
JamesGibsonESQ
3 months ago
Fear mongering. Apple and alphabet already tell me when you guys are slowing traffic in my area.. I'm sure if they actually DO make a warning system that it'll have anonimized the data. It's your fault if you use android or ios on your phone. Those 2 have made it crystal clear you are only a product for them... Caveat Emptor.
2
gorpie97
3 months ago
>It's your fault if you use android or ios on your phone.
What other options are there? And how many media outlets report on this stuff?
Also, quite a few people think it's no big deal if they're being spied on because they're not doing anything wrong.
2
JamesGibsonESQ
3 months ago
Here's a good list to start with, and a great example of why Right to Repair is being fought in hearings rn (samapple hates that they're around and doesn't want you rooting)...
https://en.m.wikipedia.org/wiki/Comparison_of_mobile_operating_systems
2
gorpie97
3 months ago
Thanks.
But my point is how many people even know there are other options?
Not many could install them of course, but they could take them places - as long as "right to repair" is allowed. Effing corporations.
1
JamesGibsonESQ
3 months ago
Though I'm with you, this is also the public's fault... When we watched Charlie and the Chocolate Factory, we all knew those greedy kids were doomed, but here we are in 2010-2020, and we as a society gobbled up those apples and sammies... We had Nokia and Rim, but they didn't have snapchat or play angry birds... It's our own damn fault in a way, like North America just wants a Wall-E future..
1
gorpie97
3 months ago
Myeah. But they do make it so entertaining - like soma, I guess.
Options need to be provided. And MARKETED. I would be happy to pay Facebook a *reasonable* monthly fee if it meant my data wouldn't be sold. (I don't use FB anymore, but for example.) It should be like virus protection.
1
Trending this week..
Newsletter
Upcoming Q&As
Post a Job
Teams Hiring Now
-
TokenSoft is the volume leader in compliant token sales.
-
The open protocol for tokenized debt.
-
A secure online platform for buying, selling, and storing digital currencies.
-
A second layer, off-chain scaling proposal for bitcoin.
-
Ensuring the blockchain is inexpensive and accessible to everyone.
-
An open protocol for decentralized exchange on the ethereum blockchain.
- See all