Vietnam's contact tracing app broadcasting a fixed ID

https://vnhacker.blogspot.com/2020/04/vietnams-contact-tracing-app_26.html

by cryptbe • 6 years ago

107 33 6 years ago

vnhacker.blogspot.com

serf3• 6 years ago

deleted in the interest of a fellow hacker.

cryptbe5• 6 years ago

I wrote the article. I agreed. It's a bad joke. I have no intention causing harm to this system.

serf3• 6 years ago

I have no intention causing harm to this system.

I took that intent from the article, but 'professionals' aren't always as kind in their reading of things like that.

Interesting article.

cryptbe5• 6 years ago

Author here. One interesting aspect that I've learned is the tactics, techniques, and procedures (TTPs) of public opinion brigades, aka Force 47.

They tried hard to discrete me. My initial report had an error, that is I didn't know that Bluetooth on Android needs ACCESS_FINE_LOCATION permission. A person pointed this out in a comment -- he posted and rewrote it three times. I said thank you and thought that's that, but then he and a bunch of new people commented that since I made that basic mistake I'm immature and inexperienced, therefore the rest of my findings have no merit.

Someone then posted a super long comment, raising a lot of questions about my credibility and intention. The interesting thing is they claimed that they're a student, haven't installed the app, have no intention to do so, but care a lot about privacy. Essentially they want to show that they're merely an underdog bystander standing up against my wrongdoings. I thought this is a very subtle psychological trick, aiming to amplify their attacks.

Other attacks are more direct. For example, a person pointed out that since I don't have many followers on Twitter, I'm not a good engineer. They said I didn't really contribute anything to my public research, but I just took credit from my coauthors. That I am only cleaning toilet at Google, there's nothing proud about that.

After I posted a rebuttal to the developers' rebuttal, a guy [2] dropped this one-line comment:

cái vụ này bắt đầu thấy nhảm rồi. Lập luận của anh Thái cũng không còn chặt chẽ như trước nữa.

Which translates to "This is getting nonsense. Thai's argument is not as strict as before".

The title of the guy's blog [3] is, I kid you not, "There's always only one truth: Communist Party of Vietnam.

[1] https://en.wikipedia.org/wiki/Public_opinion_brigades

[2] https://www.blogger.com/profile/17567201928186857755

[3] http://phichnuocnong.blogspot.com/

makomk• 6 years ago

If I remember rightly, requiring ACCESS_FINE_LOCATION for certain uses of Bluetooth on Android is a relatively new thing and the two used to be completely independent of each other, so it's not even that surprising a mistake to make.

twomoretime• 6 years ago

Sounds like you're up against some real communists. Westerners don't understand the psychology.

fa2f• 6 years ago

Hi anh, be calm. Don't get triggered by their comments, it's a trap. Ignore the trolls. Keep your report succinct and professional. Stay safe and strong!

dkdk8283• 6 years ago

Contract tracing is a disaster. I’ve secured a forensic RF shielding bag for my phone. I refuse to participate

jariel5• 6 years ago

That's fine, then stay at home. You're a liability to the rest of us. It's fair if you don't want to use it, but then you cannot go anywhere near any other person, because you're putting everyone at risk.

throwaway1223782• 6 years ago

That’s a little extreme- if someone doesn’t want to be tracked they must stay at home and shamed? There are other alternatives.

Avamander3• 6 years ago

By going out you're already putting people at risk, tracker or no tracker attached. You and people like you, thinking this is a perfect solution, are actually a bigger liability to public health.

dang2• 6 years ago

It's not ok to cross into personal attack in HN comments, so please don't.

https://news.ycombinator.com/newsguidelines.html

moneysake• 6 years ago

Very interesting

meotimdihia• 6 years ago

Vietnamese here, no one in Vietnam cares about this app. Hence the creator also doesn't care about app security.

cryptbe5• 6 years ago

In less than a week, 77K people have installed the app, according to the official tally published by the developer.

The growth rate is 2x-3x every day, faster than COVID-19.

lihop• 6 years ago

The app is open source now: https://github.com/BluezoneGlobal/bluezone-app. The id generation code is in this library: https://github.com/BluezoneGlobal/react-native-bluetooth-sca...

Vietnam's contact tracing app broadcasting a fixed ID

Related Stories