Thread by @juliendubois

I wrote earlier that I would leave alone the French #StopCovid application, but this morning I had more (bad) news, a thread ⬇️
(TL;DR they store you IPs, don't use this app)

On my *very first thread* on the subject, I wrote that centralizing everything in one place was a bad idea, and that they very likely stored the IPs somewhere in the logs, or at least that it was easy to do. So much for "anonymized" data.

https://twitter.com/juliendubois/status/1266022088055414785

In the following days, I did continue to say that it was "likely", but I got an official answer on that ticket I posted to warn them of a bug:
gitlab.inria.fr/stopcovid19/ro…
They were saying that the IP were not logged!

So, when @martin_u interviewed me for "Le Monde" lemonde.fr/pixels/article… I told him that I did not believe that the IP were tracked. It was technically possible, but I didn't want to be paranoid and I was trusting those people didn't mean anything bad.

Even if it is less efficient, it is indeed perfectly possible to configure your API gateway and your logs, not to store any IP information. That's what many cloud providers and software vendors offer.

And thanks to the magic of OSS, there was even a comment on my bug gitlab.inria.fr/stopcovid19/ro… from the very co-author of Kong, @thibaultcha who happens to be French, explaining how to do that with Kong. That was really great!

So imagine my surprise when I saw this ticket from @FLesueur this morning:
gitlab.inria.fr/stopcovid19/ro…
They now claim to store your IP address as if that was something perfectly normal! WTF??????

- The #StopCovid developers don't all seem to agree whether they store the IPs or not.
- The whole system seems broken from the start (my first thread was correct). The ROBERT protocol is good in theory, not in practice.
- I wouldn't use this app if I were you.