7 ms·

Finally it would put to rest all the fake news about big brother surveillance and privacy noise that was around this app.

moh_maya 6y ago
No, what would have put all the legitimate concerns to rest would have been: a) transparency into who the developers are, and what the terms of engagement are b) even if they didn't / couldn't open source the code from the get go, a clear date and target of when they would do so c) even before the app was launched, a single one page document of the architecture, the regulations governing data retention, etc (all were released post facto, after the "fake news" and "privacy noise"). Concerns about the govt collecting massive, potentially identifiable data on an individual level for an application that they originally mandated everyone had to use to travel, is not "fake news". Perhaps one may feel such concern was unwarranted (and I disagree there), but how is that "fake news"? We may have differences of opinion on the level of trust one can have on govts, but I'm sure we can agree that transparency and visibility into such critical decisions is reasonable to demand and expect.
- kosmischemusik 6y ago
  You're spot on. I've seen a lot of folks talk about how the government rushed into putting out the app without having an open consultation with technologists. Rather, a closed-door discussion with a vague set of "industry players". Nonetheless, this is the first step the government has taken. Let's hope continued pressure will result in audits and better protocols in the future.
- pm90 6y ago
  > Concerns about the govt collecting massive, potentially identifiable data on an individual level for an application that they originally mandated everyone had to use to travel, is not "fake news". Perhaps one may feel such concern was unwarranted (and I disagree there), but how is that "fake news"? I'm not the OP but from what I've heard there's a mix of genuine concerns and conspiracy theories about this (as often happens), and its quite hard for a layperson to understand what to believe. I read the OP as saying "finally, we get to see what's really happening and can thus determine if the concerns for data privacy are legitimate and put the conspiracy theories to rest"
- sbmthakur 6y ago
  Like every other thing, even this was politicized in India. There are people terming the app as a "surveillance app" without a proper technical analysis[0]. 0. https://www.nationalheraldindia.com/india/aarogya-setu-is-a-surveillance-app-will-not-help-those-who-are-most-vulnerable-to-covid-19 https://www.nationalheraldindia.com/india/aarogya-setu-is-a-...
  - moh_maya 6y ago
    How does one do proper "technical analysis" without access to the code, or knowing the architecture? None of those were available when the app was released. Was the shrill noise over the top? IMO, perhaps; but that does not detract from the fact that the application was just announced, with mandatory use if you had to travel (now diluted to encouraged), without any transparency.. National herald is not an unbiased source; it's clearly anti-current incumbent govt, but the argument that people were criticizing without "technical analysis" when no data was provided nor were they (initially) open to even sharing the code for scrutiny, makes me wonder how one could have assumed the app did what it said on the tin, except by blindly trusting the govt. Which, personally, I'm not a fan of. There is a reason the US federal govt is constrained by the 1st amendment, and not private corps. Govts are unique entities in our societies, with a monopoly on multiple forms of power, and their oversight should be held to a higher standard (again, IMO)
    - sbmthakur 6y ago
      Well, people have decompiled the Android app. I believe if someone wants to term the app as a complete sham then they should at least do that. Note that I am not against criticism of the app. Privacy concerns are full valid and I also want the app to be open sourced in its entirety.
      - moh_maya 6y ago
        Fair point; I think we both probably agree that there was a lot of needless hysteria. However, the ability to decompile / reverse engineer the app itself was explicitly disallowed in the app ToS [1]: “...You agree that you will not tamper with, reverse-engineer or otherwise use the App for any purpose for which it was not intended including, but not limited to, accessing information about registered users stored in the App, identifying or attempting to identify other registered users or gaining or attempting to gain access to the cloud database of the Service.” exposing the software engineer / group that did it & published the analysis to significant harassment & risk. One could argue that this was for data protection, but it reeks of security through obscurity, especially the way the clause is worded (including but not restricted to). Whatever the intentions, the initial roll-out was a disaster from the transparency / info-sec PoV IMO. [1] https://sflc.in/our-concerns-aarogya-setu-app https://sflc.in/our-concerns-aarogya-setu-app edit: added link to the Software Freedom Law Center India site with details on the clause prohibiting reverse engineering
kosmischemusik 6y ago
While the source code will be open-sourced, the fact that data is being stored in a centralized server is still worrisome. There was no fake news. The topic was debated, discussed, in the public domain.
shrutipathak 6y ago
How would just open sourcing the code imply that surveillance is fake news?
vijaybritto 6y ago
How would it put to rest when multiple govt agencies continuously leak private information? The data is still stored in the app. Only the source has been published now. It can be vetted for security but not the server code
- pm90 6y ago
  I have only heard rumors, is there a good source that summarizes what these concerns are?
- sbmthakur 6y ago
  > The data is still stored in the app. What's the issue with the data being stored in the app?
  - vijaybritto 6y ago
    sorry I meant a centralized server. Storing it in device is not a problem. But when they have already published private details (Aadhar) of millions of people without any sort of care, its really worrying
    - sbmthakur 6y ago
      Published as in? Is the data available on some site?
      - moh_maya 6y ago
        apparently on the darkweb, etc [1], among other leaks [2,3]. To be fair, the issue doesn't appear to be with the aadhaar database itself but the many agencies that use / store the data but do not protect it properly. Poor to non-existent data handling practices, limited understanding of privacy risks at the end user level.. Aadhaar has been transformational; but I hope we don't go down the path of the US SSN: one of the simplest vectors for massive identity theft in the US. I don't think we will, but it does appear that there are significant teething issues that could be better addressed if the powers that be were more willing to acknowledge shortcomings instead of saying the data is protected by 13 feet walls. [4] [1] https://www.moneylife.in/article/aadhaar-data-breach-largest-in-the-world-says-wefs-global-risk-report-and-avast/56384.html https://www.moneylife.in/article/aadhaar-data-breach-largest... [2] https://www.thehindu.com/sci-tech/technology/major-aadhaar-data-leak-plugged-french-security-researcher/article26584981.ece https://www.thehindu.com/sci-tech/technology/major-aadhaar-d... [3] https://techcrunch.com/2019/01/31/aadhaar-data-leak/ https://techcrunch.com/2019/01/31/aadhaar-data-leak/ [4] https://www.news18.com/news/india/aadhaar-data-protected-by-13-feet-high-5-feet-thick-walls-attorney-general-to-sc-1696269.html https://www.news18.com/news/india/aadhaar-data-protected-by-...
monkeynotes 6y ago
I really despise how the term "fake news" can now liberally be applied to any dialog that challenges the status quo. There are legitimate conversations that should happen around broad surveillance, shutting that down because some actors derail the topic with wild unsubstantiated claims is just wrong. With such a huge signal/noise ratio for information these days it seems we are rapidly heading toward people not thinking for themselves and deferring to 'approved' sources of information. All the 'fake news' will be taken down, this will include dissent obviously. I worry for the future. People accept contact tracing and don't see how this is exactly what the Chinese govt. have been doing for a number of years, something we used to reject as authoritarian and against western ideals. It's astonishing what we have lost in such a small period of time. Any policy made today will almost certainly be carried indefinitely forward, the the "new normal". Another term that horrifies and depresses me.
- bitxbitxbitcoin 6y ago
  The current (mis)use of the term "fake news" has really been normalized by Trump - I don't know that its meaning will ever be recovered.
  - monkeynotes 6y ago
    Trump is a symptom, not the cause. He was elected after all.
Zecar 6y ago
The privacy angle is a total distraction. The intent of these "exposure notification" apps is to tell you that you have been exposed. Six degrees from Kevin Bacon means everyone gets a notification, everyone lives in fear. Fear is the most powerful tool for control.

moh_maya 6y ago

No, what would have put all the legitimate concerns to rest would have been: a) transparency into who the developers are, and what the terms of engagement are b) even if they didn't / couldn't open source the code from the get go, a clear date and target of when they would do so c) even before the app was launched, a single one page document of the architecture, the regulations governing data retention, etc (all were released post facto, after the "fake news" and "privacy noise"). Concerns about the govt collecting massive, potentially identifiable data on an individual level for an application that they originally mandated everyone had to use to travel, is not "fake news". Perhaps one may feel such concern was unwarranted (and I disagree there), but how is that "fake news"? We may have differences of opinion on the level of trust one can have on govts, but I'm sure we can agree that transparency and visibility into such critical decisions is reasonable to demand and expect.

kosmischemusik 6y ago
You're spot on. I've seen a lot of folks talk about how the government rushed into putting out the app without having an open consultation with technologists. Rather, a closed-door discussion with a vague set of "industry players". Nonetheless, this is the first step the government has taken. Let's hope continued pressure will result in audits and better protocols in the future.
pm90 6y ago
> Concerns about the govt collecting massive, potentially identifiable data on an individual level for an application that they originally mandated everyone had to use to travel, is not "fake news". Perhaps one may feel such concern was unwarranted (and I disagree there), but how is that "fake news"? I'm not the OP but from what I've heard there's a mix of genuine concerns and conspiracy theories about this (as often happens), and its quite hard for a layperson to understand what to believe. I read the OP as saying "finally, we get to see what's really happening and can thus determine if the concerns for data privacy are legitimate and put the conspiracy theories to rest"
sbmthakur 6y ago
Like every other thing, even this was politicized in India. There are people terming the app as a "surveillance app" without a proper technical analysis[0]. 0. https://www.nationalheraldindia.com/india/aarogya-setu-is-a-surveillance-app-will-not-help-those-who-are-most-vulnerable-to-covid-19 https://www.nationalheraldindia.com/india/aarogya-setu-is-a-...
- moh_maya 6y ago
  How does one do proper "technical analysis" without access to the code, or knowing the architecture? None of those were available when the app was released. Was the shrill noise over the top? IMO, perhaps; but that does not detract from the fact that the application was just announced, with mandatory use if you had to travel (now diluted to encouraged), without any transparency.. National herald is not an unbiased source; it's clearly anti-current incumbent govt, but the argument that people were criticizing without "technical analysis" when no data was provided nor were they (initially) open to even sharing the code for scrutiny, makes me wonder how one could have assumed the app did what it said on the tin, except by blindly trusting the govt. Which, personally, I'm not a fan of. There is a reason the US federal govt is constrained by the 1st amendment, and not private corps. Govts are unique entities in our societies, with a monopoly on multiple forms of power, and their oversight should be held to a higher standard (again, IMO)
  - sbmthakur 6y ago
    Well, people have decompiled the Android app. I believe if someone wants to term the app as a complete sham then they should at least do that. Note that I am not against criticism of the app. Privacy concerns are full valid and I also want the app to be open sourced in its entirety.
    - moh_maya 6y ago
      Fair point; I think we both probably agree that there was a lot of needless hysteria. However, the ability to decompile / reverse engineer the app itself was explicitly disallowed in the app ToS [1]: “...You agree that you will not tamper with, reverse-engineer or otherwise use the App for any purpose for which it was not intended including, but not limited to, accessing information about registered users stored in the App, identifying or attempting to identify other registered users or gaining or attempting to gain access to the cloud database of the Service.” exposing the software engineer / group that did it & published the analysis to significant harassment & risk. One could argue that this was for data protection, but it reeks of security through obscurity, especially the way the clause is worded (including but not restricted to). Whatever the intentions, the initial roll-out was a disaster from the transparency / info-sec PoV IMO. [1] https://sflc.in/our-concerns-aarogya-setu-app https://sflc.in/our-concerns-aarogya-setu-app edit: added link to the Software Freedom Law Center India site with details on the clause prohibiting reverse engineering

kosmischemusik 6y ago

While the source code will be open-sourced, the fact that data is being stored in a centralized server is still worrisome. There was no fake news. The topic was debated, discussed, in the public domain.

shrutipathak 6y ago

How would just open sourcing the code imply that surveillance is fake news?

vijaybritto 6y ago

How would it put to rest when multiple govt agencies continuously leak private information? The data is still stored in the app. Only the source has been published now. It can be vetted for security but not the server code

pm90 6y ago
I have only heard rumors, is there a good source that summarizes what these concerns are?
sbmthakur 6y ago
> The data is still stored in the app. What's the issue with the data being stored in the app?
- vijaybritto 6y ago
  sorry I meant a centralized server. Storing it in device is not a problem. But when they have already published private details (Aadhar) of millions of people without any sort of care, its really worrying
  - sbmthakur 6y ago
    Published as in? Is the data available on some site?
    - moh_maya 6y ago
      apparently on the darkweb, etc [1], among other leaks [2,3]. To be fair, the issue doesn't appear to be with the aadhaar database itself but the many agencies that use / store the data but do not protect it properly. Poor to non-existent data handling practices, limited understanding of privacy risks at the end user level.. Aadhaar has been transformational; but I hope we don't go down the path of the US SSN: one of the simplest vectors for massive identity theft in the US. I don't think we will, but it does appear that there are significant teething issues that could be better addressed if the powers that be were more willing to acknowledge shortcomings instead of saying the data is protected by 13 feet walls. [4] [1] https://www.moneylife.in/article/aadhaar-data-breach-largest-in-the-world-says-wefs-global-risk-report-and-avast/56384.html https://www.moneylife.in/article/aadhaar-data-breach-largest... [2] https://www.thehindu.com/sci-tech/technology/major-aadhaar-data-leak-plugged-french-security-researcher/article26584981.ece https://www.thehindu.com/sci-tech/technology/major-aadhaar-d... [3] https://techcrunch.com/2019/01/31/aadhaar-data-leak/ https://techcrunch.com/2019/01/31/aadhaar-data-leak/ [4] https://www.news18.com/news/india/aadhaar-data-protected-by-13-feet-high-5-feet-thick-walls-attorney-general-to-sc-1696269.html https://www.news18.com/news/india/aadhaar-data-protected-by-...

monkeynotes 6y ago

I really despise how the term "fake news" can now liberally be applied to any dialog that challenges the status quo. There are legitimate conversations that should happen around broad surveillance, shutting that down because some actors derail the topic with wild unsubstantiated claims is just wrong. With such a huge signal/noise ratio for information these days it seems we are rapidly heading toward people not thinking for themselves and deferring to 'approved' sources of information. All the 'fake news' will be taken down, this will include dissent obviously. I worry for the future. People accept contact tracing and don't see how this is exactly what the Chinese govt. have been doing for a number of years, something we used to reject as authoritarian and against western ideals. It's astonishing what we have lost in such a small period of time. Any policy made today will almost certainly be carried indefinitely forward, the the "new normal". Another term that horrifies and depresses me.

bitxbitxbitcoin 6y ago
The current (mis)use of the term "fake news" has really been normalized by Trump - I don't know that its meaning will ever be recovered.
- monkeynotes 6y ago
  Trump is a symptom, not the cause. He was elected after all.

Zecar 6y ago

The privacy angle is a total distraction. The intent of these "exposure notification" apps is to tell you that you have been exposed. Six degrees from Kevin Bacon means everyone gets a notification, everyone lives in fear. Fear is the most powerful tool for control.