Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts health notifications app installed without users’ knowledge

play.google.com

Post reply on HN
Print view View original

261–270 of 407 posts

Re: Massachusetts health notifications app installed without users’ knowledge

#261

Post by madars »

I was reading about this yesterday and confirmed that I did not have

gov.ma.covid19.exposurenotifications.v3 nor gov.ma.covid19.exposurenotifications installed. I turned off auto-updates in the Play store (Settings -> Network preferences -> Auto update apps -> Don't auto update apps) and went to sleep. This morning I woke up with a cheerful notification that Google can help with COVID notifications and gov.ma.covid19.exposurenotifications.v3 installed -- the app was pushed overnight over explicit instructions NOT to update (sure, one can say auto-install != auto-update, but it is worrying that forced pushes can happen even with every single relevant UI switch turned off).

adb logcat seems to have the following relevant lines:

    06-19 09:27:54.481  1689  1990 I PackageManager: Integrity check passed for file:///data/app/vmdl1074248108.tmp
    [..]
    06-19 09:27:55.580  1689  5456 D PackageInstallerSession: Ignoring abandon after commit relinquished control
    [..]
    06-19 09:27:55.649  1689  2530 W BroadcastQueue: Background execution not allowed: receiving Intent { act=android.intent.action.PACKAGE_ADDED dat=package:gov.ma.covid19.exposurenotifications.v3 flg=0x4000010 (has extras) } to com.google.android.packageinstaller/com.android.packageinstaller.PackageInstalledReceiver
    (+ lots of other similar intents)
After that the package immediately becomes active:

    06-19 09:27:56.539  1689 13571 D ConnectivityService: requestNetwork for uid/pid:10450/30673 NetworkRequest [ TRACK_DEFAULT id=1249, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED Uid: 10450 AdministratorUids: [] RequestorUid: 10450 RequestorPackageName: gov.ma.covid19.exposurenotifications.v3] ]
    06-19 09:27:56.540  1689  3625 D ConnectivityService: NetReassign [1249 : null → 102]
    [..]
    06-19 09:27:56.833  1689  3750 E JobScheduler.Background: App gov.ma.covid19.exposurenotifications.v3 became active but still in NEVER bucket
So no, it is not just "oh those people opted in and just forgot".

Re: Massachusetts health notifications app installed without users’ knowledge

#262

Post by dvfjsdhgfv »

tunap wrote: post #236
dvfjsdhgfv wrote: post #198

Earlier quoted context omitted.

It's actually great it's happened. It showed everybody that the government can install whatever they want on your phone without your consent and knowledge. In this case they decided to leave you the option to uninstall but in the future they might not and spy on you at will. Another reminder you are not the owner of your device.

-In this case they decided to leave you the option to uninstall but in the future they might not and spy on you at will. Then they'll be just like Google, Fecebook, Amazon, etc, etc.

Which leads to the question: if anyone powerful or wealthy enough can take total control of your phone, how comfortable do you feel with that?

There are two routes here. One way is to deal with it the European way, i.e. to try to fix it by a legal framework. The other one is a technical solution like Purism, which is very far from mainstream still. The sooner people realize they have a problem, the sooner they start organizing to find a solution.

Re: Massachusetts health notifications app installed without users’ knowledge

#263

Post by sp332 »

chrischattin wrote: post #91
ElViajero wrote: post #56

It is obvious that we need better legislation to deal with all the new possibilities that technologies have opened. The installation of this app, even done with good intent, open a lot of questions on what should be possible or not to be done by government and corporations. When you get a device with pre-installed, uninstallable, or auto-installed apps. What are the rules? > "By enabling this service, you can be quic…

If you think legislation is the answer, I’ve got a bridge to sell you. Who do you think writes the legislation and hands it to X representative? How niave... HN crowd has fallen pretty far. Used to be WE build the things that make our lives better and now the top comment is calling for some ethemeral they to come up with legislation? That’s BS. And, antithetical to any builder/havker ethic. We build the world we want…

This defeatist attitude toward legislating is self-perpetuating. We can at least hold our representatives accountable.

Re: Massachusetts health notifications app installed without users’ knowledge

#264

Post by aww_dang »

arpstick wrote: post #172
Barrin92 wrote: post #167

Earlier quoted context omitted.

>"if the Mass Gov truly wants to minimize harm this is the opposite of what needs to be done." where is the actual evidence for this? Both Taiwan and South Korea deployed massive, digital tracking efforts to respond to covid often at the cell-provider/ infrastructure level so the entire population was covered whether they wanted to or not. Nothing about this was despotic or paranoid, it was simply the correct, swift,…

defaults absolutely matter, which is why surveillance being the default is deeply troubling to me. I do not care what the justification flavor of the day is, it's not a good trend to normalize. all it takes is another donald trump type figure to abuse this for evil. hell even a 3rd party could if this was implemented poorly, which is an all too common occurrence. In the USA, nothing is more permanent than a temporary…

Critics of the current US administration have been labeled as white supremacists and terrorists. Many of them are currently held in solitary confinement. Most are held on the misdemeanor of trespassing in the Capitol Building.

>"...was beaten by a prison guard and left with permanent eye damage."

https://www.washingtonpost.com/nation/2021/05/13/capitol-rio...

https://www.politico.com/news/2021/04/19/capitol-riot-defend...

That's the current climate surrounding a single politically charged incident. There's a long history of abuse, from the COINTEL program, extraordinary rendition, torture and current events. Yes, we should absolutely be concerned - regardless of the partisan takes.

>"...Arar protested that he only had a casual relationship with Almalki, having once worked with Almalki's brother at an Ottawa high-tech firm..."

https://en.wikipedia.org/wiki/Maher_Arar

https://en.wikipedia.org/wiki/COINTELPRO

Re: Massachusetts health notifications app installed without users’ knowledge

#265

Post by IG_Semmelweiss »

aceazzameen wrote: post #224
TomOwens wrote: post #140

Most of the comments on that app as well as here are probably wrong. I'd suspect that everyone who had the app "installed without their permission" opted into the Android COVID-19 Exposure Notification program. This was deployed by Google as part of an update to Google Play Services. When you go to your phone's settings with this update, there's an option to enable COVID-19 Exposure Notifications. When you turn it on…

Another MA resident here. Never opted in and it still shows I'm not. The app was silently installed on my Android. There's no icon so I thought it didn't install at first, until I looked at my app list in settings. I'm curious to know if there's any MA Android users that previously removed Google Play, and if they still have the app or not. My guess is no?

You cant remove google play in andtoid versions beyond 6 i believe.

You can only disable it

Re: Massachusetts health notifications app installed without users’ knowledge

#266

Post by sokoloff »

marcan_42 wrote: post #86
esyir wrote: post #84

Earlier quoted context omitted.

This sounds worse to me? Rather than violation of a relatively small privacy (phone number), you instead get timestamp social graph interactions in the physical world. This seems like fat more extreme an invasion than the former.

Read up on how the contact tracing apps work. They do not upload your data to the cloud. Phones broadcast a rolling random identifier, other phones collect received identifiers, and only on confirmed infection does the person's phone upload its last two weeks of broadcast IDs to the cloud, where other phones can grab them and cross-check. Having someone's phone number allows you (via the phone company) to trace their…

> only on confirmed infection does the person's phone upload its last two weeks of broadcast IDs to the cloud

Alternatively phrased: “only upon government request does the person’s phone upload…” with the implied promise that such request will only come as a result of a CV-19+ test result.

Re: Massachusetts health notifications app installed without users’ knowledge

#267

Post by 0x0nyandesu »

fragileone wrote: post #101
0x0nyandesu wrote: post #80

Well well well. Looks like all my fears have been fully realized. Please tell me more about how unrootable devices are for my own good.

Bootloader unlockable is sufficient to replace the OS. Rooting is likely to die in the near future now that Google hired the Magisk dev.

It's an open source project. Someone else will pick up the baton.

Re: Massachusetts health notifications app installed without users’ knowledge

#269

Post by notwhereyouare »

madars wrote: post #261

I was reading about this yesterday and confirmed that I did not have gov.ma.covid19.exposurenotifications.v3 nor gov.ma.covid19.exposurenotifications installed. I turned off auto-updates in the Play store (Settings -> Network preferences -> Auto update apps -> Don't auto update apps) and went to sleep. This morning I woke up with a cheerful notification that Google can help with COVID notifications and gov.ma.covid19…

Did you check your covid19 exposure opt-in settings? Of everything you mentioned you checked, I didn’t see you say you checked that setting.

That setting could be what caused the install

Post reply on HN