The LucaApp is intended to provide contact tracking in private environments, but also for restaurants, museums and other businesses. The data collected with this app should be used by the health authorities if necessary to better track the spread of the coronavirus. Time to start a self-experiment. I had no idea how this would get out of hand.
It all started with a simple idea: test the LucaApp. Simply create a private event and ask friends to book into it. What is supposed to happen? No private data is shared and the app runs on a large server farm. So I shared the Luca App QR code for my Corona party on Twitter. And people booked in: ten, twenty, thirty. The first number in the app shows how many people are currently booked into the event, the second number shows how many people were booked in total. But then the number of those currently present rose above the number of those who were booked in overall. This shouldn't be possible, but it is a known software bug. You can increase the event counter with a manipulated QR code without actually registering. You can also automate this directly from the command line of a computer.
This does not pose a problem. All real users of the app would be reachable in the event of an infection. Only the manipulated QR codes would not be accessible.
The number of people present quickly rose to over 100.000, then 200.000 and finally to around 614.000 people or 614.000 QR codes and 210 real people.
Development of participant numbers. Source: AmXa_ict
Shortly afterwards, Smudo contacted me and answered a few questions about the app, security and anonymity, then the event was over. Nobody could log in anymore. But one problem remained: the app on my phone was stuck at 411.468, no longer updated itself and wouldn't let me finish the event.
So everything is like before: When the fun police end the party, the host is left with the broken things.
Update
After the app operator deleted the event, users reported problems: They kept being returned to the Event that no longer exists is booked.
Update 2:
On twitter says Patrick Henning, one of the creators of the Luca app: “Due to obvious misuse, the meeting was ended by the system.”
Opposite the New Germany However, it says: “(…) whether the Luca developers carried out the deletion. In discussions with the PR agency, this possibility was denied. Lenze simply reached the maximum number for a private event (…)”
3 comments