Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts health notifications app installed without users’ knowledge

play.google.com

Post reply on HN
Print view View original

201–210 of 407 posts

Re: Massachusetts health notifications app installed without users’ knowledge

#201

Post by Quanttek »

bonoboTP wrote: post #154
watwut wrote: post #104

Earlier quoted context omitted.

Just because protocol is theoretically safe does not imply it is safe in actual practice or that it is not possible to exploit it.

Right. They can change things with the next silent update anyway. In Germany they also started requiring turning on the GPS while using it. Initially it wasn't necessary and only Bluetooth was needed. Who knows what they modify all the time. I have no spare capacity to follow these developments and when they decide to stop caring about privacy and go rogue in the name of harm prevention.

The apps used around Europe, including Germany's Corona-Warn-App, do NOT use GPS. It only asks for location permissions since it utilizes the exposure notification API that indirectly tracks your "location" relative to other users (i.e. the ID exchange)

Re: Massachusetts health notifications app installed without users’ knowledge

#202

Post by glycine »

Barrin92 wrote: post #167
arpstick wrote: post #90

a government installing a software without notice or consent onto their population's devices is not something a healthy functioning democracy does, it's what a psychotic paranoid despot does. if the Mass Gov truly wants to minimize harm this is the opposite of what needs to be done. all this will do is drive conspiracy theories and deepen a very legitimate mistrust in the institutions that plague the USA (which helpe…

>"if the Mass Gov truly wants to minimize harm this is the opposite of what needs to be done." where is the actual evidence for this? Both Taiwan and South Korea deployed massive, digital tracking efforts to respond to covid often at the cell-provider/ infrastructure level so the entire population was covered whether they wanted to or not. Nothing about this was despotic or paranoid, it was simply the correct, swift,…

in Taiwan, system base on everyone send one message to government when they into one shop or work site, and then if some infected one pass same site, government will send message to warn you. it don't need install anything and it is optional (although shop will refuse offer service...)

Re: Massachusetts health notifications app installed without users’ knowledge

#203

Post by kburman »

baybal2 wrote: post #89

FYI: Google can remotely install/delete/alter any app on your phone without your notice if you have GAPPS installed, and they removed the option to disable it back in 2.* days. This is very rampant in India. Operators keep pushing crapware like Linkedin app, clash of kings, etc for money from app vendors.

> This is very rampant in India. Operators keep pushing crapware like Linkedin app, clash of kings, etc for money from app vendors.

Are you using Mi phone?

Re: Massachusetts health notifications app installed without users’ knowledge

#204

Post by sanid »

sc11 wrote: post #24
88840-8855 wrote: post #10

Earlier quoted context omitted.

Except, the Corona Warn App is the biggest crap that I have ever seen. Yes, the code is open and free and super transparent; morally superior. But what about the effectiveness of this app? Even the German officials do not mention this app since many many many months. The app was criticised from all sides due to lack of effectiveness. Even the freedom-loving large news outlets published their opinions that they would…

The app was recently evaluated for effectiveness.[1] 110-230k people were tested positive as a result of a warning and therefore isolated. They found that it had about the same effect as the tracing efforts by all public health authorities combined. [1] article in German about it https://www.heise.de/news/RKI-Schaetzung-Warn-App-hat-mehr-a...

These numbers don't seem to reflect the whole picture based on the data provided by the local institutions which show a rather small effectiveness.

See here (german): https://netzpolitik.org/2021/robert-koch-institut-widersprue...

Re: Massachusetts health notifications app installed without users’ knowledge

#205

Post by tylercubell »

TomOwens wrote: post #140

Most of the comments on that app as well as here are probably wrong. I'd suspect that everyone who had the app "installed without their permission" opted into the Android COVID-19 Exposure Notification program. This was deployed by Google as part of an update to Google Play Services. When you go to your phone's settings with this update, there's an option to enable COVID-19 Exposure Notifications. When you turn it on…

I have no memory of opting in, I checked under Settings -> Google and "COVID-19 Exposure Notifications" was set to "Off", and the MassNotify app was still installed on my phone. It has no icon and the only way to find it is going to Settings -> Apps & notifications -> See all apps and it comes up under "Massachusetts Department of Public Health". Then when you go to the Google Play Store and search "MassNotify" or "mass notify" or even "Massachusetts Department of Public Health" (the exact name of the app), it doesn't come up in the search results. You have to go to "Manage apps & device" on the Google Play Store then scroll down to "MassNotify" which doesn't even match the name of the app in the other settings menu. This is pretty shady.

Re: Massachusetts health notifications app installed without users’ knowledge

#206

Post by [deleted] »

TomOwens wrote: post #140

Most of the comments on that app as well as here are probably wrong. I'd suspect that everyone who had the app "installed without their permission" opted into the Android COVID-19 Exposure Notification program. This was deployed by Google as part of an update to Google Play Services. When you go to your phone's settings with this update, there's an option to enable COVID-19 Exposure Notifications. When you turn it on…

[deleted]

Re: Massachusetts health notifications app installed without users’ knowledge

#207

Post by kuschku »

studentrob wrote: post #157
dstaley wrote: post #156

Earlier quoted context omitted.

Virtually every non-trivial Android application has these permissions, none of which are even important enough for the system to prompt you for permission. The only interesting one is "pair with Bluetooth devices" which is how the Exposure Notifications system works.

Users expect to see the requested permissions.

All these permissions are granted without ever being shown to the user, due to being in the "other" category. If you install this app normally, Android will never ask you for permission, but just silently grant these permissions.

Re: Massachusetts health notifications app installed without users’ knowledge

#208

Post by smeej »

simpss wrote: post #37

I think the real question is what mechanism allows them to push a random app to some phones? google play services is actively listening for remote installation requests? that's essentially a remote-code-execution backdoor to all android phones?

Related question I'm not wrapping my head around:

How does the thing know you're a Massachusetts resident?

People who have the contact tracing setting disabled are reporting they still got the app, so the obvious answer seems not to apply.

Is it just getting installed on any device that enters MA? New England states are pretty small, and there's a lot of crossover, especially with states like Maine and New Hampshire, which wouldn't take this very well.

Or, if you have a layover at Boston's Logan airport, do you now end up with its contact tracing app?

Re: Massachusetts health notifications app installed without users’ knowledge

#209

Post by kuschku »

mandmandam wrote: post #188
avian wrote: post #144

Earlier quoted context omitted.

I'm not from NL, but I am someone that did not install the COVID tracing app that our government provided (for voluntary installation). My reason was that I was not convinced by the PR that it is actually privacy safe. Just repeating "it uses a safe API, trust us/Google/Apple" was not enough for me. The subcontractor that made the app did dump some source code on GitHub saying "see, we have nothing to hide". However…

People here are downvoting you, but you were 100% right to doubt: https://www.iccl.ie/news/serious-privacy-and-data-harvesting... An excerpt: > While Android users can, in theory, opt to turn off Google Play Services, users of the Covid-19 contact-tracing app in Ireland cannot turn the surveillance off if they want the contact-tracing app to work. This means the collection and use of this data is unavoidable for peop…

MicroG implements the same contact tracing functionality. If you install MicroG, you can avoid all the tracking Google Play Services does usually.

Re: Massachusetts health notifications app installed without users’ knowledge

#210

Post by serial_dev »

arpstick wrote: post #185
015UUZn8aEvW wrote: post #159

Earlier quoted context omitted.

I'm a MA resident and this app was on my (Android) phone...until a few minutes ago when I read about it on Hacker News, found it, and deleted it. I have no memory of ever opting into the program you describe, and it isn't the type of thing I would normally do. It's possible I guess. In any case, the way they did this is creepy. There was no icon for the app; I had to look in Settings/Apps & Notifications to find it.…

MA resident as well, what worries me more is that someone thought that this method of installation was a good idea and even more worrying is that they were also able to execute on it. It feels rather shady and nefarious the lack of public announcement on it. Shenanigans like this how you get the populace to trust the local government less, which is the last thing this country needs.

I don't see anything bad with people not trusting their local government... Exhibit A
Post reply on HN