Massachusetts health notifications app installed without users’ knowledge • Hacker News Board

Re: Massachusetts health notifications app installed without users’ knowledge

#141

Post by dstaley » Sat, Jun 19, 2021, 9:54 AM UTC

I think it's far more interesting to think about what went wrong so that the MassNotify app actually displays as installed on these devices. All of the Android COVID exposure apps for US states are simply the Google Play Services COVID Exposure Notifications code with an icon, splash screen, and possibly some text. The idea is that you enable the setting by installing the app, but in this case it seems that rolling out the setting itself has caused the app to appear as installed. I wonder if there was a misconfiguration on the part of the MassNotify developer, which caused this. The push to devices enabling the setting is likely automatic on Google's end, so I doubt a human did a check to ensure the MassNotify app behaved as expected.

At the end of the day, there likely wasn't actually anything more than a package ID installed on user devices. It didn't opt anyone into exposure notifications, and it most likely didn't include any executable code.

Re: Massachusetts health notifications app installed without users’ knowledge

#142

Post by andyjohnson0 » Sat, Jun 19, 2021, 9:55 AM UTC

Animats wrote: post #22

gostsamo wrote: post #4

Here is an official page for the same app. Interesting what is the whole story. https://www.mass.gov/info-details/enable-massnotify-on-your-...

Why do this at this late date? A year ago it would have been useful. Now, 59% of Massachusetts's population has been fully vaccinated. About 70% have at least one shot. A bit more pushing and they'll hit 80%, which seems to be about where the epidemic dies out for lack of new carriers.

> Why do this at this late date? A year ago it would have been useful.

Because it took time to develop, and now they just shipped it?

Maybe if the US had had a functional federal government prior to January then a national exposure notification app might have been developed, rather than relying on the states to do their own thing. Or not. But it's too late now.

I'm not a USAian so I don't know what the take-up of a federal government app would have been. Probably insufficient given what seems to be the ambient level of distrust and misinformation.

I've been running the UK/English NHS tracing app since the start of the second wave here, and I have no complaints. I'm happy with its approach to privacy, and that I've never had an alert from it despite living in a region with high covid incidence has been reassuring.

Re: Massachusetts health notifications app installed without users’ knowledge

#143

Post by corin_ » Sat, Jun 19, 2021, 9:57 AM UTC

ganzuul wrote: post #45

delusional wrote: post #34

Earlier quoted context omitted.

Are you sure about that? Previously they required the location permission to scan for nearby bluetooth devices (because of the obvious implications). Recenly they've split that into it's own separate permission. It that what you're thinking of?

Yes, that is it. I did notice it's not the case anymore, but do you know if they admitted error with the change, or gave any kind of motivation? I think that in this context, this previous issue is relevant.

Were you just guessing their motivation before, when you wrote "Claimed their users were too ill-informed to know the difference."?

Re: Massachusetts health notifications app installed without users’ knowledge

#144

Post by avian » Sat, Jun 19, 2021, 9:57 AM UTC

yunohn wrote: post #118

ElViajero wrote: post #56

It is obvious that we need better legislation to deal with all the new possibilities that technologies have opened. The installation of this app, even done with good intent, open a lot of questions on what should be possible or not to be done by government and corporations. When you get a device with pre-installed, uninstallable, or auto-installed apps. What are the rules? > "By enabling this service, you can be quic…

> instead of the silent install the government could have spend money in advertisement campaigns This absolutely does not work. Here, the NL gov tried this and almost nobody installed the app, despite it using the privacy-safe google/apple API.

I'm not from NL, but I am someone that did not install the COVID tracing app that our government provided (for voluntary installation).

My reason was that I was not convinced by the PR that it is actually privacy safe. Just repeating "it uses a safe API, trust us/Google/Apple" was not enough for me.

The subcontractor that made the app did dump some source code on GitHub saying "see, we have nothing to hide". However it was very obviously not the same code as the app published on the Play store (for start, it had a different version number), it had a cleared out commit log, etc. Questions about that went unanswered as far as I know.

I try my best to prevent COVID spread, wear a mask, got vaccinated as soon as possible, etc. I think it's more likely that the thing with the app was just developers not wanting to bother too much with things they were not paid for than anything nefarious going on. However it raised enough red flags for me that I was not comfortable installing the app on my phone.

Re: Massachusetts health notifications app installed without users’ knowledge

#145

Post by studentrob » Sat, Jun 19, 2021, 10:01 AM UTC

TomOwens wrote: post #140

Most of the comments on that app as well as here are probably wrong. I'd suspect that everyone who had the app "installed without their permission" opted into the Android COVID-19 Exposure Notification program. This was deployed by Google as part of an update to Google Play Services. When you go to your phone's settings with this update, there's an option to enable COVID-19 Exposure Notifications. When you turn it on…

When you opt-in, does it notify you of all the permissions the app will require?

- view network connections

- pair with Bluetooth devices

- full network access

- run at startup

- prevent device from sleeping

Re: Massachusetts health notifications app installed without users’ knowledge

#146

Post by sohei » Sat, Jun 19, 2021, 10:03 AM UTC

GavinMcG wrote: post #137

sohei wrote: post #130

Earlier quoted context omitted.

Another question worth asking is "what is the governing law?" It is almost certainly contract law via Google's ToS. Government phones probably have different ToS, but government employee' personal phones have the same ToS we have. If Google is asserting non-contractual rights, I'd like to know what they are. Edit: I edited this comment because it was rude, and that was not my intent.

[Edit: the comment originally said their question wasn't implying anything] Of course you're implying something. If nothing else, you're implying the one might imply the other, and that the implication is worth attention. The governing law that would protect people is a lot of things, and ToS is the least of it. The Wiretap Act applies, for example.

> ToS is the least of it

I'm afraid I disagree. Google running code on your phone implies it believes you have consented to that. That consent was not given in the app store, so it must have come from the ToS.

Consent is an exception to virtually every protection that exists: Wiretap Act, state wiretapping laws, the CFAA, and state computer trespass laws. Remember, consent is the difference between a home invasion and a dinner party.

So it seems that Google would have to cook up a pretty implausible stopping principle to argue that whatever allows them to do this does not also enable the hypothetical I described above.

Re: Massachusetts health notifications app installed without users’ knowledge

#147

Post by marderfarker2 » Sat, Jun 19, 2021, 10:03 AM UTC

kuschku wrote: post #20

sohei wrote: post #2

Someone should archive a copy for reversing. One comment says it has "permission to utilize all device functions".

It doesn’t. All it can do is request Google Play Services to enable distributed covid exposure notifications, which in turn means the app itself doesn’t even get bluetooth beacon data. Your calculator app has more tracking than this.

You sure about that? You can easily see the permissions granted on the app page.

This app has access to:

Other

view network connections

pair with Bluetooth devices

full network access

run at startup

prevent device from sleeping

Re: Massachusetts health notifications app installed without users’ knowledge

#148

Post by GavinMcG » Sat, Jun 19, 2021, 10:08 AM UTC

sohei wrote: post #146

GavinMcG wrote: post #137

Earlier quoted context omitted.

[Edit: the comment originally said their question wasn't implying anything] Of course you're implying something. If nothing else, you're implying the one might imply the other, and that the implication is worth attention. The governing law that would protect people is a lot of things, and ToS is the least of it. The Wiretap Act applies, for example.

> ToS is the least of it I'm afraid I disagree. Google running code on your phone implies it believes you have consented to that. That consent was not given in the app store, so it must have come from the ToS. Consent is an exception to virtually every protection that exists: Wiretap Act, state wiretapping laws, the CFAA, and state computer trespass laws. Remember, consent is the difference between a home invasion an…

If you've got a stock Android device you've obviously consented to Google running some code, and even updating to add new code after you bought it. On the other hand, apps are restricted based on permissions, and Google bypassing that would belie a consent theory.

You're making out like code is code and there aren't already existing lines and stopping principles, which just isn't true on its face.

Re: Massachusetts health notifications app installed without users’ knowledge

#149

Post by someassholeguy » Sat, Jun 19, 2021, 10:08 AM UTC

TomOwens wrote: post #140

Most of the comments on that app as well as here are probably wrong. I'd suspect that everyone who had the app "installed without their permission" opted into the Android COVID-19 Exposure Notification program. This was deployed by Google as part of an update to Google Play Services. When you go to your phone's settings with this update, there's an option to enable COVID-19 Exposure Notifications. When you turn it on…

This is a great explanation for whats occurring. I'll be interested to see what comes of all of this.

So far what I guess is:

- This is likely a government action via telco and not something done via Google* (*Unless they've opted into a program like the one you stated)

- These phones being affected COULD BE all Carrier Locked phones which have specific terms to allow such behavior.

To me, this is pretty clear cut violation of Google's Device update policy and could be considered Malware or stalkerware (by their definition): https://support.google.com/googleplay/android-developer/answ...

https://support.google.com/googleplay/android-developer/answ...

-----

I think we should all slow down on putting Google for full blame here and focus on Government abuse and overstep of powers.

Re: Massachusetts health notifications app installed without users’ knowledge

#150

Post by bonoboTP » Sat, Jun 19, 2021, 10:09 AM UTC

marcan_42 wrote: post #95

thinkingemote wrote: post #88

Earlier quoted context omitted.

I think the low adoption is because it's hard to explain. No one on my street, none of the most vulnerable people would understand your paragraph. No wonder it's not being adopted by those who should be adopting it, but just being used by vigilant young tech savvy and already covid safe people. So not only are only a small number of people using it, these people are least likely to make a difference using it.

Edit: Surely we can come up with a more approachable explanation for less technical folks, though? Here's an attempt: "Contact tracing respects your privacy and does not send your location to the cloud. Instead, your phone makes up a new random name every 15 minutes and broadcasts it to nearby phones. It remembers the last two weeks of names it used, as well as the last two weeks of names it heard from other phones.…

Still too complicated. I saw a comic version once, working through an actual example with some example IDs and it used phrases like "sends to the hospital" or "asks the hospital" etc. instead of downloading from the cloud.

Very non-technical people are not familiar with the basic concepts involved.

"Makes up a new random name and broadcasts it to nearby phones" is something they'd struggle with if they never heard or thought about random number generators, don't understand Bluetooth etc.

Also don't underestimate learned helplessness. Many will stop reading if it looks technical because they "can't understand that sort of thing. " Many such people never ever read such lengthy step by step technical documentation. It seems to them as a quantum physics experimental setup description sounds to the average programmer.