[vijai]

The app has gone open-source for android. To me it surprisingly looks like a clean code for a govt app.

[bblost]

I have a couple of questions on this app:

• Can anyone without a laboratory test mark themselves as covid positive on this app?
• If a lab test confirms covid positive, does the app get automatically updated?

[roy_libran]

Originally Posted by bblost

Can anyone without a laboratory test mark themselves as covid positive on this app?

Yes!

Originally Posted by bblost

If a lab test confirms covid positive, does the app get automatically updated?

No!

This is part of the reason why Contact Tracing inherently is a weak control.

[AZT]

Slightly off topic but came across this today
Google sees resurgence in state-backed hacking, phishing related to COVID-19

(Reuters) - Security experts at Alphabet Inc’s Google sent 1,755 warnings in April to users whose accounts were targets of government-backed attackers, following a resurgence in hacking and phishing attempts related to the coronavirus outbreak.
Google said on Wednesday its Threat Analysis Group saw new activity from “hack-for-hire” firms, many based in India, that have been creating Gmail accounts spoofing the World Health Organization (WHO).

These accounts largely targeted business leaders in financial services, consulting and healthcare corporations in numerous countries including the United States, Slovenia, Canada, India, Bahrain, Cyprus and UK, the company said in a blog post. (bit.ly/2M2k9UA)

Read More: https://in.reuters.com/article/us-he...-idINKBN2340CH

[v1p3r]

Tangentially - https://www.vpnmentor.com/blog/report-csc-bhim-leak/ BHIM records leaked.

[Sutripta]

Interesting article.

How does one find out for Android/ Play Store apps, the source code published is what is used to generate the code?

Sutripta

[roy_libran]

Originally Posted by Sutripta

Interesting article.

How does one find out for Android/ Play Store apps, the source code published is what is used to generate the code?

Sutripta

It is evident now that while a Repo has been published on GitHub, it is not the one on which Development is happening. It might be a true copy or worse!

APK's can be decompiled but that would never give the exact same source code as the actual source components. The usual reasons to decompile are usually to PenTest or extract logic or find hardcoded configs, but not to establish veracity. Moreover, if certain pre-compiled C/C++ libs have been included those wouldn't decompile in the same way. So a DIFF operation is futile; the only way out would be a laborious and very time consuming manual comparison.

I think right now the entire community is waiting for the Server and other components to be published, so that a complete functional replica can be deployed and tested. Over the last few days the NIC have been cleaning up and tidying up the codebase of this wrapper App which is about what this is!

[theMandarin]

Originally Posted by Sutripta

Interesting article.

How does one find out for Android/ Play Store apps, the source code published is what is used to generate the code?

Sutripta

Originally Posted by roy_libran

It is evident now that while a Repo has been published on GitHub, it is not the one on which Development is happening. It might be a true copy or worse!

...

I think right now the entire community is waiting for the Server and other components to be published, so that a complete functional replica can be deployed and tested. Over the last few days the NIC have been cleaning up and tidying up the codebase of this wrapper App which is about what this is!

This is a very logical question and something quite difficult to answer & it seems some developers who have been tracking the code repository share these concerns:

• Did Indian govt really put Covid-19 tracing Aarogya Setu code on Github?

With everything opening up now, the data gathered via the app is likely to be less reliable; If a person positive on the App, travels between states and in the process triggers an alert for everyone he comes close to along the way, validating the genuineness of the alert becomes much more difficult due to the large number of people who need to be evaluated especially when many of them may not be tested.

It's like checking the boxes in a To-Do list.

[Sutripta]

Originally Posted by roy_libran

APK's can be decompiled but that would never give the exact same source code as the actual source components.

Not necessary to decompile. The goal is not reverse engineering. You supposedly have the source code in hand.

Originally Posted by theMandarin

This is a very logical question and something quite difficult to answer

I'm not conversant with the Android system, but if intentions are honorable, proving a 1 to 1 correspondence between the source code and the finished executable is no big deal. A thing to note is that all libraries used should also be open source. And specify the toolchain used in detail.

I'm talking of just the app, not server side, or sunset clauses, or ...

Sutripta

[whitewing]

Originally Posted by v1p3r

Tangentially - https://www.vpnmentor.com/blog/report-csc-bhim-leak/ BHIM records leaked.

Oh My! That is a massive breach. Not a squeak on that in our news channels! And a one month resolution time to fix such a basic issue should really warrant a serious look into the current SOPs for data security.

[Sutripta]

Originally Posted by whitewing

Not a squeak on that in our news channels!

Give it time. When they'll come out guns blazing saying it's fake news to tarnish us etc etc. PIB might even do a fact check debunking it.
But fact also remains that people exaggerate claims.

Sutripta

[bluevolt]

Two of my acquaintances have reported that their aarogya setup app status has been changed from 'Safe' to 'Low Risk of Infection' and 'Moderate Risk of Infection' since the last 4-5 days.

Does the status will change back to 'Safe' after a certain number of days or will it remain like this only? They might need to travel through a flight in next 8-10 days are skeptical if they may face problem due to the status?

[RK79]

I have installed the app in my phone. 30 Covid positive cases are admitted at the hospital I work but the app shows only 3 positive cases in proximity. So you can imagine its accuracy.

[nagr22]

Originally Posted by bluevolt

Does the status will change back to 'Safe' after a certain number of days or will it remain like this only? They might need to travel through a flight in next 8-10 days are skeptical if they may face problem due to the status?

Yes it does change to safe after certain period if the person is not tested positive. One of my relative works in transportation sector and he was devastated when his status showed high risk. His company asked him to home quarantine and luckily he didn't turn positive and the status returned to safe after a week.

In your relatives case, I humbly request them not to travel for the benefit of other passengers.

Originally Posted by RK79

I have installed the app in my phone. 30 Covid positive cases are admitted at the hospital I work but the app shows only 3 positive cases in proximity. So you can imagine its accuracy.

The accuracy of the app is as good as willingness of people to install it and upload their status if they test positive. It is fully voluntary for anyone to install it and even after testing positive, it is upto the patient to decide whether to upload his status or not. Thanks to the sudden surge in privacy conscious people.

[saisree]

Couldn’t find an apt thread. Fate, Irony whatever we want to call