Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts health notifications app installed without users’ knowledge

play.google.com

Post reply on HN
Print view View original

111–120 of 407 posts

Re: Massachusetts health notifications app installed without users’ knowledge

#111

Post by fragileone »

okdjnfweonfe wrote: post #99
sohei wrote: post #96

Earlier quoted context omitted.

The factual basis of your assertion is absolutely true, but your attitude is unhelpful and defeatist. There is a chasm between "a state actor throws an 0day at you" and "Google remotely installs an app on your phone". The latter is done at scale. The former is expensive, risky, and used relatively rarely. If you're organizing a protest movement, it's totally reasonable to factor government 0days into your threat mode…

its not exactly a 0day if the ISP is communicating (through an intermediary) to a card the ISP gave you, that's just normal, unexpensive And this is like, literally a state actor installing an app in this case?

In this case it requires the presence of Google Play Services. I'm unsure if there's any evidence that they can install apps without it being present.

Re: Massachusetts health notifications app installed without users’ knowledge

#112

Post by pharrington »

From what I've read (I don't live in Massachusetts), the app is installed via the auto update channel, but it explicitly asks permission to activate.

If you think this is bad, the commercial apps that have been auto-installing for years, without notifying the user, should have you throwing a conniption.

Re: Massachusetts health notifications app installed without users’ knowledge

#113

Post by askmike »

de6u99er wrote: post #105
ElViajero wrote: post #56

It is obvious that we need better legislation to deal with all the new possibilities that technologies have opened. The installation of this app, even done with good intent, open a lot of questions on what should be possible or not to be done by government and corporations. When you get a device with pre-installed, uninstallable, or auto-installed apps. What are the rules? > "By enabling this service, you can be quic…

> It is obvious that we need better legislation to deal with all the new possibilities that technologies have opened. How about applying common sense?

I think covid has shown that when the world is faced with a pandemic, not everyone agrees on what's common sense is in terms of how to respond as a society/government.

Re: Massachusetts health notifications app installed without users’ knowledge

#114

Post by cblconfederate »

viktorcode wrote: post #92
cblconfederate wrote: post #65

Google and apple install tons of software basically without consent (os updates) , so an app being pushed like that is not surprising. It is worrying however that tech people dont seem to realize how great their tools are for totalitarian states , which push apps and spying much worse than this to their subjects. We really need to talk about users owning their devices and their software rather than leasing them. Ther…

You are explicitly allowing to install updates in phone's settings. It is made painfully clear. The question here is about what mechanism Google used to install an app, can it be disabled, and what other kind of apps Google is capable of installing silently on the devices?

The mechanism is google's so that point is moot. There should be a physical switch for updates just like some cameras have physical covers

Re: Massachusetts health notifications app installed without users’ knowledge

#115

Post by MiddleEndian »

baybal2 wrote: post #89

FYI: Google can remotely install/delete/alter any app on your phone without your notice if you have GAPPS installed, and they removed the option to disable it back in 2.* days. This is very rampant in India. Operators keep pushing crapware like Linkedin app, clash of kings, etc for money from app vendors.

It honestly baffles me that there are Android enthusiasts. My phone runs Android but it's not a good operating system.

Re: Massachusetts health notifications app installed without users’ knowledge

#116

Post by dalbasal »

I think some of he "consent" norms we are building up are a double edged sword.

Ooh, its good to reinforce the idea that users need freedom.

OTOH, "consent" isn't really an informed consent. It's pages of TCs, UI antipatterns and take-it-or-leave-it choices. In practice, I don't think consent is genuinely increasing user sovereignty. It's more about disclosure than consent, currently. Human centIpad stuff.

Re: Massachusetts health notifications app installed without users’ knowledge

#117

Post by ahofmann »

pizza wrote: post #94
ahofmann wrote: post #59

Earlier quoted context omitted.

Ok, but my point was that on Android and iOS it is possible to install apps without touching your phone. This qualifies as remote code execution. You need your credentials for doing this, but google and Apple apparently don't need them.

Yes, but RCE is typically shorthand for “RCE by someone other than the owner of the device”

When I buy a phone, I'd like to think that I am the owner. I haven't rented it from the vendor or something.

Re: Massachusetts health notifications app installed without users’ knowledge

#118

Post by yunohn »

ElViajero wrote: post #56

It is obvious that we need better legislation to deal with all the new possibilities that technologies have opened. The installation of this app, even done with good intent, open a lot of questions on what should be possible or not to be done by government and corporations. When you get a device with pre-installed, uninstallable, or auto-installed apps. What are the rules? > "By enabling this service, you can be quic…

> instead of the silent install the government could have spend money in advertisement campaigns

This absolutely does not work. Here, the NL gov tried this and almost nobody installed the app, despite it using the privacy-safe google/apple API.

Re: Massachusetts health notifications app installed without users’ knowledge

#119

Post by MiddleEndian »

he0001 wrote: post #54

How is this different from any update program, like windows update or Ubuntu update, installing software/upgrades whenever you get updates?

Windows Update pushes all sorts of junk. At some point, Nadella must have realized, "Shit, Windows users put up with years of adware on their computers in the 90s and 00s. We're leaving money on the table by not taking advantage of this!"

Ex: In 2019, Microsoft added a shortcut Win+Ctrl+Alt+Shift that when pressed, brings up an advertisement to buy MS Office, which I have no use for, and you need to edit the registry to disable the shortcut. I already gave MS thousands of dollars for the laptop, you'd think they could leave me alone if they want me to buy another one.

Although at least with Windows, you can remove most of the damage yourself, which is more than can be said for Android. Quite honestly why does the Computer Fraud and Abuse Act exist if manufacturers remain free to abuse your machines at will?

Re: Massachusetts health notifications app installed without users’ knowledge

#120

Post by kuschku »

malka wrote: post #70
kuschku wrote: post #6

The app is just a fork of the German Corona-Warn-App [1][2]. From what I can tell only the UI was modified, the codebase seems to be still the same. Honestly, pushing the app to users isn’t anything to worry about – and in fact something I’d have loved to see other countries do as well. ________ [1] https://www.coronawarn.app/en/ [2] https://github.com/corona-warn-app

>and in fact something I’d have loved to see other countries do as well. Why are you wishing harm on people ?

Why are you? Since when is it justified to preinstall apps for tracking and advertising, but not justified to do this to save lives?
Post reply on HN