Earlier quoted context omitted.
The Canadian version of the app recently added “secure anonymous usage statistics”, which aren’t particularly anonymous (since all we have is their word that they don’t log your IP), and that aren’t particu secure (messages are encrypted with HTTPS but it’s not too difficult to infer the contents of the message based on their length). And, you can’t opt out of them. I still have it on my phone (although at least with…
AFAIK they don't gain access to the BLE contact database on your phone, so what exactly is it that they could be transmitting of concern? What are you able to infer about the contents exactly?
https://github.com/cds-snc/covid-alert-app/blob/97bb16034140...
But the fact that they could be tracking which citizens have and have not been shown a "You have been exposed to Covid" alert, and there's no way to opt-out, is a little scary.
> What are you able to infer about the contents exactly?
Most days, you are not exposed to covid and you don't interact with the app. So most days, the app transmits a "background-check" event to the server. This means the contents of the message will be the exact same length every day.
As a passive listener, then, you can watch for days where the length of the message is abnormal, and then because there's only so many different kinds of messages that the app sends and they all have unique lengths, you can infer what metrics events must have been sent to the server based on the delta of the message lengths. You can figure out if a user has been shown a "You have been exposed to COVID" based purely on passive listening to traffic from the device.