Schneier on Security

Clive Robinson • September 13, 2021 11:07 AM

@ ALL,

“Such an expectation fails to take into account that isolation—and sometimes even seeking care when ill—is much harder for some populations than others.”

What many do not realise is that “middle class” under 40 year olds are in an awkward position.

Either they live in their parents homes making an undesirable “multi-generational” home. Or they move into accommodation where they live on their own.

The result in London is that small 1930’s “family homes” that are as little ad 900Sqft are being converted into either “Houses in multiple occupation” with small bedrooms and tiny shared bathrooms and kitchens (think 6ftx6ft) and two extra bedrooms in the roof). Or are being converted into between two and four flats.

The assumption being they are “sleep only” homes and that the people will live outside of them either at work or in social spaces.

So there is not the space for issolation, let alone shelter at home if you are a vulnerable person.

But with as many as 12 individual housing units well within BlueTooth range, phone based apps are not going to function at all well, and false positives will be high.

A “cods-up” in the UK system created a “ping-storm” where people were getting told to issolate over and over again. The result many in effect turnd the apps off or ignored the warnings so the system quickly became usless.

The question then becomes what is the “threshold” where people loose confidence in the system so start to ignore it entirely?

Because if the system can not be designed to stay well below that threashold, then the system will become worse than usless.

Because it will act as a tipping point. Once a person ignores the app they will start to disregard other health warnings such as washing hands, wearing masks, giving people distance, and ventilating etc.

Clive Robinson • September 13, 2021 11:19 PM

@ SpaceLifeForm, David,

found that it’s using 512-bit keys =)

There is a distinct possibility the authorities figured, the equivalent of, “if you have sufficient hardware and knowledge” you are probably a very rare outlier. So you would be near enough a “compleate nerd”, so have no “real life” in which to get infected in the first place… (remember SARS-2 is like nearly all pathogens a “social disease”).

The reality is yes you could forge a pass, that’s been true for as long as mankind has been writing things down. However security “costs” in terms of resources and capabilities.

A sensible person draws a line where some fraud is still possible but the cost to the fraudster is way higher than the gain.

The pass is actually an “administative device” designed to “discorage”, in the same way “Most locks are made to keep honest people honest”. That is it raises enough of a barrier to keep the number of people moving around to a sensible minimum.

I suspect the pass system is sufficiently weak that there are other much less resource intensive ways to get around them (like a bribe etc).

After all do we know if the QR codes even have a unique serial number that ties back to a validation database? I suspect not, other than for “book-keeping” rather than “security”.

Why? Because I rather suspect the system has been designed to work entirely “Off-line”. Thus checking can be done by the equivalent of an app running off of a low power Smart Device not even runing a Microsoft OS.

The reality is they want a “quick go / no-go” system that works very much like a digital thermometer does “point and click at arms length or further” and gives a near instant answer.

Clive Robinson • September 14, 2021 12:16 PM

@ Adrian,

I always like to remind people in these discussions that these apps do not track contacts between people but contacts between smartphones.

Not even “contacts” bluetooth can work from one office building to another office building on the other side of a four lane street…