Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts health notifications app installed without users’ knowledge

play.google.com

Post reply on HN
Print view View original

191–200 of 407 posts

Re: Massachusetts health notifications app installed without users’ knowledge

#191

Post by ben_w »

chrischattin wrote: post #91
ElViajero wrote: post #56

It is obvious that we need better legislation to deal with all the new possibilities that technologies have opened. The installation of this app, even done with good intent, open a lot of questions on what should be possible or not to be done by government and corporations. When you get a device with pre-installed, uninstallable, or auto-installed apps. What are the rules? > "By enabling this service, you can be quic…

If you think legislation is the answer, I’ve got a bridge to sell you. Who do you think writes the legislation and hands it to X representative? How niave... HN crowd has fallen pretty far. Used to be WE build the things that make our lives better and now the top comment is calling for some ethemeral they to come up with legislation? That’s BS. And, antithetical to any builder/havker ethic. We build the world we want…

That was viable when computers were a tiny part of the world, but not when our power to change things became to great to be ignored.

Even back in the day when you could convince a public payphone to work for free by whistling the right way, that kind of interference in a public communications channel was enough for the powers that be to get worried. Now? Now phones are effectively universal, and every government can afford to pay developers to insert obfuscated backdoors in open source code, while the richest could do the same with the hardware from the silicon wafer up to the finished product. And they do, because they want to keep their power.

Just as you go to war with the army you have rather than the army you want, if you seek to improve our security and freedom you have to use the political power structures that exist rather than the ones you want to exist.

Re: Massachusetts health notifications app installed without users’ knowledge

#192

Post by megous »

TomOwens wrote: post #140

Most of the comments on that app as well as here are probably wrong. I'd suspect that everyone who had the app "installed without their permission" opted into the Android COVID-19 Exposure Notification program. This was deployed by Google as part of an update to Google Play Services. When you go to your phone's settings with this update, there's an option to enable COVID-19 Exposure Notifications. When you turn it on…

There's even a standard for mobile operators to control the setting in your modem and update/install apps: https://en.wikipedia.org/wiki/OMA_Device_Management

I reverse engineered what this does in practice on pinephone modem (Quectel EG25G), for example, and there are pre-compiled binaries there for tmobile and vodafone that process their particular OMA DM flavors, download some configuration and code from internet and run it under root on the modem's SoC ARM CPU. (that's still isolated over USB from the main pinephone SoC, but obviously not good) It's also thankfully disabled by default, but if you google for oma dm android, you get reports of this protocol being used still.

Whatever it does on regular Android phone depends on how well it is implemented on android. Regular phones don't have two almost-isolated SoCs like pinephone, so oma dm client would probably run on the main SoC, and all depends on how secure that binary blob is or what it does/allows the operator to do.

Quectel software is a bit of a turd, so I woudln't take from this that operators can run random code they make the device download under root user, using this protocol. Most proprietary software like this is pretty shit, so I wouldn't feel warm and fuzzy safe on random Android device either.

Re: Massachusetts health notifications app installed without users’ knowledge

#193

Post by labawi »

londons_explore wrote: post #190
fwn wrote: post #180

Earlier quoted context omitted.

"full network access" is a hugely important permission. My cynical side believes that the reason for it not being as visible as other permissions is that platforms profit from the ad-driven app model, which itself heavily relies on an apps ability to access the internet. That could also be why stock roms do not allow users to disable full network access on a per app basis. (...like, for example, the camera permission…

It's actually not disableable because there are so many ways to bypass it. For example, just trick a user into clicking a hyperlink to another app like a browser which does have full internet access, and you have successfully exfiltrated any data in the URL.

Seems like a weak excuse.

I mean sure, you could do that, but it would be complicated, conspicuous, tiring for the user and you would still only get one-sided occasional transfer. It could exfiltrate data, albeit suspiciously, but it wouldn't work for ads .. which are the likely motivating factor.

Other motivating factor may be tracking, which google and vendors want to do, but I'm not sure what the stance would be on others tracking their users.

Re: Massachusetts health notifications app installed without users’ knowledge

#194

Post by marosgrego »

mrweasel wrote: post #57
ahofmann wrote: post #50

Earlier quoted context omitted.

Everyone running android play services on their phone has to trust Google, right?

Many might not have a choice. If you need a SmartPhone and can’t afford an iPhone, you’re out of options. Most of the apps people actually need has to be installed via the Play Store. You basically get a (more) privacy focus OS from a luxury brand or you get your OS from an advertising company.

They can run an ungoogled ROM, like LineageOS.

Re: Massachusetts health notifications app installed without users’ knowledge

#195

Post by meragrin_ »

015UUZn8aEvW wrote: post #159
TomOwens wrote: post #140

Most of the comments on that app as well as here are probably wrong. I'd suspect that everyone who had the app "installed without their permission" opted into the Android COVID-19 Exposure Notification program. This was deployed by Google as part of an update to Google Play Services. When you go to your phone's settings with this update, there's an option to enable COVID-19 Exposure Notifications. When you turn it on…

I'm a MA resident and this app was on my (Android) phone...until a few minutes ago when I read about it on Hacker News, found it, and deleted it. I have no memory of ever opting into the program you describe, and it isn't the type of thing I would normally do. It's possible I guess. In any case, the way they did this is creepy. There was no icon for the app; I had to look in Settings/Apps & Notifications to find it.…

Did you get vaccinated? If so, did you supply your email address related to your Google account on the form or enough other information to link the two? Did you read all of the related documentation? I wouldn't be surprised if they slipped somewhere on the form that you were agreeing to it.

Re: Massachusetts health notifications app installed without users’ knowledge

#196

Post by marosgrego »

intellirogue wrote: post #164
Black101 wrote: post #155

Is it possible to remove Google's remote administrator access on Android devices?

It's part of the Play Store. You'd need to install a non-Google build of Android (e.g. LineageOS) which doesn't include Play Store/Services, which also means you can't download apps etc from there.

You can use a 3rd party client like Aurora store to download apps from Google Play. However, it's better to get the from an alternative source like F-Droid if possible.

Re: Massachusetts health notifications app installed without users’ knowledge

#197

Post by shados »

TomOwens wrote: post #140

Most of the comments on that app as well as here are probably wrong. I'd suspect that everyone who had the app "installed without their permission" opted into the Android COVID-19 Exposure Notification program. This was deployed by Google as part of an update to Google Play Services. When you go to your phone's settings with this update, there's an option to enable COVID-19 Exposure Notifications. When you turn it on…

I don't know what kind of proof you want, but I just looked at my phone settings after reading your comment. The exposure notification option is there and it's off. The region selection is grayed out because of it. Yet I got the app (uninstalled it after I saw this on hacker news).

I did get a notification when it got installed but I thought it was just a push similar to amber alerts. I didn't realize it installed something at the time.

Still, exposure notification was never turned on.

Re: Massachusetts health notifications app installed without users’ knowledge

#198

Post by dvfjsdhgfv »

arpstick wrote: post #185
015UUZn8aEvW wrote: post #159

Earlier quoted context omitted.

I'm a MA resident and this app was on my (Android) phone...until a few minutes ago when I read about it on Hacker News, found it, and deleted it. I have no memory of ever opting into the program you describe, and it isn't the type of thing I would normally do. It's possible I guess. In any case, the way they did this is creepy. There was no icon for the app; I had to look in Settings/Apps & Notifications to find it.…

MA resident as well, what worries me more is that someone thought that this method of installation was a good idea and even more worrying is that they were also able to execute on it. It feels rather shady and nefarious the lack of public announcement on it. Shenanigans like this how you get the populace to trust the local government less, which is the last thing this country needs.

It's actually great it's happened. It showed everybody that the government can install whatever they want on your phone without your consent and knowledge. In this case they decided to leave you the option to uninstall but in the future they might not and spy on you at will. Another reminder you are not the owner of your device.

Re: Massachusetts health notifications app installed without users’ knowledge

#199

Post by shados »

meragrin_ wrote: post #195
015UUZn8aEvW wrote: post #159

Earlier quoted context omitted.

I'm a MA resident and this app was on my (Android) phone...until a few minutes ago when I read about it on Hacker News, found it, and deleted it. I have no memory of ever opting into the program you describe, and it isn't the type of thing I would normally do. It's possible I guess. In any case, the way they did this is creepy. There was no icon for the app; I had to look in Settings/Apps & Notifications to find it.…

Did you get vaccinated? If so, did you supply your email address related to your Google account on the form or enough other information to link the two? Did you read all of the related documentation? I wouldn't be surprised if they slipped somewhere on the form that you were agreeing to it.

I did supply my email but it's not a Gmail or Google for Work email address nor a domain tied to those. Exposure notification is clearly off. Still got the app.

Re: Massachusetts health notifications app installed without users’ knowledge

#200

Post by ptero »

TomOwens wrote: post #140

Most of the comments on that app as well as here are probably wrong. I'd suspect that everyone who had the app "installed without their permission" opted into the Android COVID-19 Exposure Notification program. This was deployed by Google as part of an update to Google Play Services. When you go to your phone's settings with this update, there's an option to enable COVID-19 Exposure Notifications. When you turn it on…

I just found this app and removed it. And I definitely did not opt into any kind of covid tracking earlier.

This app seems to use Bluetooth to track potential violations of 6ft personal space and notify people if someone from that list later gets a covid positive test. Whatever the noble goal is I do not want it on my phone, this is creepy!

Post reply on HN