Thread by @XorNinja

I reversed the Vietnam's contact tracing app, and found that it can silently upload all contact history to a centralized server, despite claiming that it only stores data on the client.

Somebody then said I was wrong and challenged me to provide evidences.

Well, challenge accepted and achieved! github.com/thaidn/bluezone

I now know much more than I ever wanted to about React Native and how to merge split APKs =)

I'm now told that I don't understand how contact tracing works.

When I said in decentralized contact tracing systems, the server will publish a list of infected IDs, from which clients will download and do matching locally, dude said it never works that way.

Dude boasted that he's building a contact tracing system for the US government, and asked if I ever developed any similar system.

Help me folks, give me some credit!

@SchmiegSophie @thinkpanzer @ChadBrubaker5 @motiyung @FredericJacobs

github.com/BluezoneGlobal…

Think I'll read some Kafka to sleep tonight.

Bluezone dude just now went on a national paper claiming that even if their servers got hacked nobody could get access to any contact history data.

As if my PoC has ceased to exist.