4 ms·

> In summary, our observations are as follows. > Some servers are hosted by Amazon, as part of a CDN service. FUD - This report is all about Fear, Uncertainty

> In summary, our observations are as follows. > Some servers are hosted by Amazon, as part of a CDN service. FUD - This report is all about Fear, Uncertainty and Doubt and is every bit as dangerous as lying. I find it difficult to believe that, even among the HackerNews crowd, this point registers near as important as having an easy to use, efficient way to do contact tracing for Covid-19. Why does every attempt to make the world a better place have to be ripped apart and thrown in the dumpster fire?

motohagiography 6y ago
Unfortunately, I agree with this view of the report. The report does do a mid-depth technical dive and raises the sort of things a security analyst would certainly look to verify, and I will use it as a base for other app analysis - but it conflates hypothetical risks with vulnerabilities. I am dealing with these precise technical issues around de-identification and encryption in a professional context right now. The paper uses nested and linked parenthetical observations and comments without resolving them to evidence, and it reads like a rant. The issue of not being able to rebuild a working app from the provided source code is indeed cause for suspicion, but it needs deeper analysis. The criticism that somehow key derivation is not encryption reads like the author was reaching out of their depth. A security analysis needs to be more than just an uncharitable read of an architecture that shows it has exposure to scandal or discredit. These apps are going to have issues around data access, custody and control and a lot of others, but the analysis of them needs to be stronger.
- jeffrallen 6y ago
  I agree generally with you, but Prof Vaudenay is not "out of his depth". His publication record would show that he knows the difference between key derivation and encryption. The people who don't are those trying to write the overly simplified summaries to calm people's nerves, in particular in the case of Vaudenay is taking about, the Confederation government, who should know better.

motohagiography 6y ago

Unfortunately, I agree with this view of the report. The report does do a mid-depth technical dive and raises the sort of things a security analyst would certainly look to verify, and I will use it as a base for other app analysis - but it conflates hypothetical risks with vulnerabilities. I am dealing with these precise technical issues around de-identification and encryption in a professional context right now. The paper uses nested and linked parenthetical observations and comments without resolving them to evidence, and it reads like a rant. The issue of not being able to rebuild a working app from the provided source code is indeed cause for suspicion, but it needs deeper analysis. The criticism that somehow key derivation is not encryption reads like the author was reaching out of their depth. A security analysis needs to be more than just an uncharitable read of an architecture that shows it has exposure to scandal or discredit. These apps are going to have issues around data access, custody and control and a lot of others, but the analysis of them needs to be stronger.

jeffrallen 6y ago
I agree generally with you, but Prof Vaudenay is not "out of his depth". His publication record would show that he knows the difference between key derivation and encryption. The people who don't are those trying to write the overly simplified summaries to calm people's nerves, in particular in the case of Vaudenay is taking about, the Confederation government, who should know better.