Leave Home Safe: The Good, the Bad, the Ugly

The talk looks at LeaveHomeSafe, a covid-19 contact tracing app that Hong Kong required for entry to many public venues from late 2021. The audit was commissioned by a Hong Kong democracy advocacy group, funded by an internet freedom grant, and carried out in spring 2022. Without source code, backend access or valid vaccination QR codes, the testers relied on decompilation, reverse engineering and runtime analysis, which limited coverage but still surfaced several serious problems.

The strengths included secure secret storage in the Android keystore and iOS keychain, cleartext HTTP disabled, restricted Google API keys, and a design that used Firebase device registration to balance exposure alerts with privacy. The weaknesses ranged from screenshots that exposed sensitive screens and task hijacking on older Android versions, to vaccination images left on SD cards and an authentication toggle that could be switched off without any check. The most severe issue was a certificate hostname check that skipped validation for the health system's domain, letting an attacker intercept login credentials and one-time passwords without any warning.

After disclosure, the government called the report inaccurate, yet later quietly patched some issues and removed the authentication feature instead of fixing it. The talk argues that a report with reproducible proof should be checked by an independent third party rather than dismissed by official statements. Practical takeaways include relying on platform defaults, storing secrets in hardware-backed stores, and reviewing TLS validation code carefully before release.