Live data from Hacker News

Massachusetts health notifications app installed without users’ knowledge

play.google.com

41–50 of 407 posts

Re: Massachusetts health notifications app installed without users’ knowledge

#42
post #32
post #6

The app is just a fork of the German Corona-Warn-App [1][2]. From what I can tell only the UI was modified, the codebase seems to be still the same. Honestly, pushing the app to users isn’t anything to worry about – and in fact something I’d have loved to see other countries do as well. ________ [1] https://www.coronawarn.app/en/ [2] https://github.com/corona-warn-app

So the German government isn't happy with just fucking everything up locally and is now spreading globally? Did they run out of toxic masks to buy, fake tests to pay for and success statistics to falsify (by removing the leading 20 countries)? There are currently investigations against several members of the government over quite visible corruption while paying themselves with money meant to fight corona and more tha…

Luckily neither Scheuer nor Spahn were involved with the CWA. Check the source code, it’s actually really neat.

Doesn’t help with the rest of the fuckups, obviously. Significantly worse is that now everyone has started switching to the luca app, which actually is a dystopian nightmare as it stores everything on its servers, forever, and sells everything to ad partners.

Re: Massachusetts health notifications app installed without users’ knowledge

#44
post #12

Earlier quoted context omitted.

There’s nothing worrying about that. You get tons of apps installed without consent (including whatever spam your network provider pushes on you). This app can actually save lives without sacrificing any privacy, pushing it to users is something that has no drawbacks. The largest trouble for the German version of the app was that not enough people installed it. Choosing to install it automatically isn’t something nef…

> You get tons of apps installed without consent (including whatever spam your network provider pushes on you). So you are putting this app in the same category as spam, at least that's good. > This app can actually save lives without sacrificing any privacy, pushing it to users is something that has no drawbacks. I have an app that can save your life, trust me. And give me your email so I can send it to you ;)

> I have an app that can save your life, trust me. And give me your email so I can send it to you ;)

Great, send me the source code, I’ll get it released on f-droid and then I’ll install the f-droid version of it, just like I’ve got the f-droid and microG version of the Corona Warn App installed :)

Re: Massachusetts health notifications app installed without users’ knowledge

#45
post #17

Earlier quoted context omitted.

They bundled bluetooth and location permissions not long ago. Claimed their users were too ill-informed to know the difference.

Are you sure about that? Previously they required the location permission to scan for nearby bluetooth devices (because of the obvious implications). Recenly they've split that into it's own separate permission. It that what you're thinking of?

Yes, that is it. I did notice it's not the case anymore, but do you know if they admitted error with the change, or gave any kind of motivation?

I think that in this context, this previous issue is relevant.

Re: Massachusetts health notifications app installed without users’ knowledge

#46
post #35
post #21

Earlier quoted context omitted.

> There’s nothing worrying about that. You get tons of apps installed without consent (including whatever spam your network provider pushes on you). That is different. They are pre-installed and I can list them and disable them. They do not install suddenly by themselves months after buying the device. If they did so, there would be an outrage. > This app can actually save lives without sacrificing any privacy, pushi…

> They do not install suddenly by themselves months after buying the device. If they did so, there would be an outrage. They absolute can do that, and do that. For example, if you switch SIM cards, the phone can (and in some situations will) install whatever crap the ISP chooses. In my case, inserting a SIM card from ALDI’s carrier used to auto-install some weather, news, and similar stuff. Luckily that stopped recen…

> In my case, inserting a SIM card from ALDI’s carrier used to auto-install some weather, news, and similar stuff. Luckily that stopped recently.

Surely there is a prompt. I never had apps silently auto-install in my phone. If that is true, one more reason to go with the custom rom way.

> The only risk is governments not returning the power they got during this pandemic, but that’s more of a worry in 3rd-world-dictatorships.

In my life I've seen a lot of just-for-emergency-temporary-only laws that become permanent once the outrage subsides. In supposedly first world countries

Re: Massachusetts health notifications app installed without users’ knowledge

#47
post #37

I think the real question is what mechanism allows them to push a random app to some phones? google play services is actively listening for remote installation requests? that's essentially a remote-code-execution backdoor to all android phones?

You can install apps from your browser on the PC since years. I think this also works on apple?

Re: Massachusetts health notifications app installed without users’ knowledge

#48
post #37

I think the real question is what mechanism allows them to push a random app to some phones? google play services is actively listening for remote installation requests? that's essentially a remote-code-execution backdoor to all android phones?

There is a handy feature to do so https://android.gadgethacks.com/how-to/remotely-install-apps...

Re: Massachusetts health notifications app installed without users’ knowledge

#49
post #46
post #35

Earlier quoted context omitted.

> They do not install suddenly by themselves months after buying the device. If they did so, there would be an outrage. They absolute can do that, and do that. For example, if you switch SIM cards, the phone can (and in some situations will) install whatever crap the ISP chooses. In my case, inserting a SIM card from ALDI’s carrier used to auto-install some weather, news, and similar stuff. Luckily that stopped recen…

> In my case, inserting a SIM card from ALDI’s carrier used to auto-install some weather, news, and similar stuff. Luckily that stopped recently. Surely there is a prompt. I never had apps silently auto-install in my phone. If that is true, one more reason to go with the custom rom way. > The only risk is governments not returning the power they got during this pandemic, but that’s more of a worry in 3rd-world-dictat…

> Surely there is a prompt. I never had apps silently auto-install in my phone. If that is true, one more reason to go with the custom rom way.

Nope, Google Play Services does this all in the background. The same happens if Google thinks you’ve reinstalled your device (e.g. by wiping the Play Services data) and it starts installing some of Google’s default apps again, without prompts

Re: Massachusetts health notifications app installed without users’ knowledge

#50
post #43
post #36

Just the thought of Google being able to do something like this scares the $&@*#% out of me. How on earth can you trust a company that does something like this?

... you trust Google ?

Everyone running android play services on their phone has to trust Google, right?
Post reply on HN