Please use a secure PRNG for adding noise to the applications list

[jvoisin]

Hello,

in the getReports method, the code is using the following snippet:

            // Add some random packages to avoid tracking
            Random rand = new Random(Thread.currentThread().getId());
            int alea = rand.nextInt(120) % 10 + 11;
            for(int i = 0 ; i < alea; i++) {
                int val = rand.nextInt(handles.size());
                packages.add(handles.get(val));
            }

This could lead, at some degrees, a rogue server to be able to do educated guess about what applications are installed or not. It would be cool to use SecureRandom instead.

This is a super-minor issue, feel free to close it with an E_DONTCARE :)

[U039b]

Hi @jvoisin
Even if we use a PNRG, 2 full sync of the list of installed applications will allow any rogue server to remove the noise.

[jvoisin]

Sure, but I think that some users will install exodus, run it, glance at the results, be horrified, remove some of their applications and then remove exodus because it fulfilled its purpose.

For this usecase, using a better PRNG will slightly improve privacy.

[pnu-s]

Fixed by #90