JWjwalton·May 17, 2021
They're transmitting things like "This device showed a 'You have been exposed to COVID' alert". You can see the full list of events they send here:
https://github.com/cds-snc/covid-alert-app/blob/97bb16034140...
But the fact that they could be tracking which citizens have and have not been shown a "You have been exposed to Covid" alert, and there's no way to opt-out, is a little scary.
> What are you able to infer about the contents exactly?
Most days, you are not exposed to covid and you don't interact with the app. So most days, the app transmits a "background-check" event to the server. This means the contents of the message will be the exact same length every day.
As a passive listener, then, you can watch for days where the length of the message is abnormal, and then because there's only so many different kinds of messages that th
Read the rest
e app sends and they all have unique lengths, you can infer what metrics events must have been sent to the server based on the delta of the message lengths. You can figure out if a user has been shown a "You have been exposed to COVID" based purely on passive listening to traffic from the device.