Discover and read the best of Twitter Threads about #TraceTogether
Most recents (3)
Ok, seems like as good a time as any to take another look at where the data used by #TraceTogether is stored, and what are the implications of the police having access to it. 1/
First, let's talk about identities. There are 3 kinds of identities in TT. First is your actual PII: your NRIC number, contact number, etc. Second, a unique ID that is generated per user, the ttID. Third, temporary IDs that are broadcasted to other users, TempIDs. 2/
The server holds a mapping between the permanent ttID, and your PII. So with access to the server, it can determine who (in "real life") a ttID is. The phone holds your ttID, and it also appears in comms between client and server (including Firebase). 3/
[#Infographie.S] #StopCoVid : une application pour tracker le #SARSCoV2 bit.ly/2xWvUIJ + bit.ly/2xUZLkM #LaMethSci 
E Thomé > le principe d'une application de traçage est de détecter la présence de personnes autour de nous, et a posteriori, si l'une est infectée, de déterminer avec qui elle a été en contact #LaMethSci
.@bayartb > çela peut-il être au moins partiellement efficace ? Peut-être. Mais le fait que ce soit potentiellement efficace n'est pas, pour moi, une raison efficace. Le problème pour moi n'est pas technique mais philosophique #LaMethSci
Okay, so I've been taking a look at #TraceTogether over the weekend, to see what I could find. This is still very preliminary, but since there's a lot of chatter about it, I decided to write something up on whatever I have so far.
First, a disclaimer: I've not had a lot of time to look at it (weekend time is spent with the kids), and I have limited experience looking at Android apps, especially modern ones.
I also only did a static analysis as that's what I'm better at, and I didn't want to spend a day setting up a phone for dynamic analysis.
