Unfortunately, I agree with this view of the report. The report does do a mid-depth technical dive and raises the sort of things a security analyst would certai

Unfortunately, I agree with this view of the report. The report does do a mid-depth technical dive and raises the sort of things a security analyst would certainly look to verify, and I will use it as a base for other app analysis - but it conflates hypothetical risks with vulnerabilities. I am dealing with these precise technical issues around de-identification and encryption in a professional context right now. The paper uses nested and linked parenthetical observations and comments without resolving them to evidence, and it reads like a rant. The issue of not being able to rebuild a working app from the provided source code is indeed cause for suspicion, but it needs deeper analysis. The criticism that somehow key derivation is not encryption reads like the author was reaching out of their depth. A security analysis needs to be more than just an uncharitable read of an architecture that shows it has exposure to scandal or discredit. These apps are going to have issues around data access, custody and control and a lot of others, but the analysis of them needs to be stronger.