Profile picture
, 5 tweets, 3 min read
My Authors
Read all threads
I reversed the Vietnam's contact tracing app, and found that it can silently upload all contact history to a centralized server, despite claiming that it only stores data on the client.

Somebody then said I was wrong and challenged me to provide evidences.
Well, challenge accepted and achieved! github.com/thaidn/bluezone

I now know much more than I ever wanted to about React Native and how to merge split APKs =)
I'm now told that I don't understand how contact tracing works.

When I said in decentralized contact tracing systems, the server will publish a list of infected IDs, from which clients will download and do matching locally, dude said it never works that way.
Dude boasted that he's building a contact tracing system for the US government, and asked if I ever developed any similar system.

Help me folks, give me some credit!

@SchmiegSophie @thinkpanzer @ChadBrubaker5 @motiyung @FredericJacobs

github.com/BluezoneGlobal…
Think I'll read some Kafka to sleep tonight.

Bluezone dude just now went on a national paper claiming that even if their servers got hacked nobody could get access to any contact history data.

As if my PoC has ceased to exist.
Missing some Tweet in this thread? You can try to force a refresh.

Keep Current with thaidn

Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @XorNinja see all

Profile picture
thaidn
@XorNinja
How this works (from memory)

Problem:
-Client has a single pair of (username, password) that it wants to check if it was leaked.
-Server has a huge database of leaked (username, password).
Security/privacy requirements:
- Server cannot learn the client's password
- Server cannot distinguish between the client's username and k-1 others, i.e., k-anonymity
To check a single password:
1. Client computes a k-bit hash of username, denote U
2. Client computes P = r * H(password), where r is a random scalar, and H(password) hashes the password to a point on NIST P-256
3. Client sends (U, P)
Read 8 tweets
Profile picture
thaidn
@XorNinja
Kepler: so, you see, orbit of a planet is elliptical. To find where the Earth is, we need a method to calculate the arc length of the ellipse
Fermat: I have discovered such a marvelous method which this tweet is too narrow to contain
Newton: This is a fluent problem, and, as usual, it can be solved with an infinite series expansion
Leibniz: Pardon monsieur, what's a fluent? Arc length is an integral problem, and to calculate ∫f(x)dx first you need to find a closed form function such that F'(x) = f(x)
(100 years had passed. The search for Leibniz's closed-form solution for the elliptic integral, that is ∫f(x, g(x))dx where f is a rational function and g is a polynomial of degree 3 or 4, had been fruitless)
Read 13 tweets

Embed code for your website

×
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!