Good riddance. It’s a totalitarian privacy nightmare that never functioned as advertised.
Similar systems were widely deployed in Singapore, on the premise it would only be used to fight COVID. Then to no one’s surprise, law enforcement started it using for criminal investigations.
Once they’re built, governments cannot resist abusing such systems.
You probably have no idea how it, nor that system from Singapore work, right?
The Google system allegedly shares hashes of a ID-number salted with a rotating timestamp over BLE. But it’s also a closed-source binary. Can you or anyone else actually inspect its implementation? Can you really guarantee it doesn’t have even the smallest design flaws?
This technology is exceptionally dangerous. There is very little difference between these two scenarios:
- A doctor has identified a COVID patient. Let’s notify everyone who’s spent time with them recently.
- Secret police have identified a “dissident”. Let’s round up all their close associates.
It’s voluntary (for now). It’s allegedly secure (for now). But did anyone actually benefit from this complicated system? All I see are downsides.
Security researches have taken apart the binaries, listened to network requests and everything else you need to do to verify that nothing nefarious was going on. The system itself is set up so no tracing is possible if nobody reads your hashes.
