Security Bits Logo no alpha channel

Security Bits — 19 April 2020

Feedback & Followups

Deep Dive — Apple & Google’s Privacy-Protecting COVID-19 Contact Tracing API

Apple and Google have partnered to develop on an API for tracking close personal contacts in an attempt to fight the COVID-19 pandemic. Unlike other solutions rolled out by some more authoritarian governments, this is a de-centralised solution designed from the ground up to prevent it’s use for tracking.

The solution makes use low energy bluetooth rather than GPS for recording close physical contacts, and it uses a combination of public-key crypto and one-way hashing functions to generate anonymous ephemeral tokens that each participating phone broadcasts. As users move around their phone records the ephemeral tokens for all phones it comes close to, and keeps a lot for a few weeks. If a participating user gets tested positive, they can choose to instruct their phone to tell a server that they have tested positive, and upload all their ephemeral keys. Participating devices will periodically check to see if any of the known-infected keys are in their cache, and if they are, alert the user that they have potentially been exposed.

The key point is that the tokens change regularly, so the same phone does not have the same token for long. This means you can’t use the tokens to track people. Also, the tokens cycle in sync with the randomisation of Bluetooth MAC addresses, so the tokens can’t be used to un-do the tracking protection provided by MAC address randomisation.

Apple and Google insist their API will always be opt-in, and that there will need to be some kind of validation of diagnoses to avoid trolling. There will not be a single global server all phones check for positive tokens, instead, separate countries or regions will run their own servers, and the operators of those servers will put in the appropriate safeguards to validate positive diagnoses.

Initially this will be available as an API developers can incorporate into 3rd-party apps, but Apple and Google plan to add the functionality into iOS and Android in the coming months.


❗ Action Alerts

Worthy Warnings

Notable News

Palate Cleansers


When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by Bart.

Emoji Meaning
🎧 A link to audio content, probably a podcast.
A call to action.
flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
📊 A link to graphical content, probably a chart, graph, or diagram.
🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
💵 A link to an article behind a paywall.
📌 A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.

1 thought on “Security Bits — 19 April 2020

  1. Sarah - November 24, 2020

    Keep in mind privacy considerations when using Zoom:

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to top