Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts health notifications app installed without users’ knowledge

play.google.com

Post reply on HN
Print view View original

311–320 of 407 posts

Re: Massachusetts health notifications app installed without users’ knowledge

#311

Post by neltnerb »

smeej wrote: post #208
simpss wrote: post #37

I think the real question is what mechanism allows them to push a random app to some phones? google play services is actively listening for remote installation requests? that's essentially a remote-code-execution backdoor to all android phones?

Related question I'm not wrapping my head around: How does the thing know you're a Massachusetts resident? People who have the contact tracing setting disabled are reporting they still got the app, so the obvious answer seems not to apply. Is it just getting installed on any device that enters MA? New England states are pretty small, and there's a lot of crossover, especially with states like Maine and New Hampshire,…

If they're also hitting phones that were only in the state temporarily it must be using cell tower locations right? I use an always on VPN and it still auto installed (without opting in) but I have my E911 address set here so I'd have guessed that otherwise.

Re: Massachusetts health notifications app installed without users’ knowledge

#312

Post by saganus »

madars wrote: post #261

I was reading about this yesterday and confirmed that I did not have gov.ma.covid19.exposurenotifications.v3 nor gov.ma.covid19.exposurenotifications installed. I turned off auto-updates in the Play store (Settings -> Network preferences -> Auto update apps -> Don't auto update apps) and went to sleep. This morning I woke up with a cheerful notification that Google can help with COVID notifications and gov.ma.covid19…

This is why I like installing a firewall in my phone.

I have used Glasswire and am pretty happy with it (no affiliation) because it allows me to block individual apps from having internet connectivity, and can configure it to notify me the first time an app tries to connect.

Of course, the problem is that it's a hassle to have to check and block new stuff, or unblock when I need to use something (e.g. Uber).

Re: Massachusetts health notifications app installed without users’ knowledge

#313

Post by orangecat »

Barrin92 wrote: post #297
thu2111 wrote: post #278

Earlier quoted context omitted.

You are merely arguing that it was worth it because you agree with the goal, not that it wasn't despotic or paranoid.

it was neither desponic nor paranoid. Paranoia is an irrational or delusional bout of fear. Thinking the cleaning crew in front of your house is secret agents trying to kidnap you is paranoia, taking measures against a pandemic is not, because the pandemic is real and deadly. In the same vein, despotism is the tyrannical and arbitrary exercise of power, not merely the exercise of power towards legitimate ends. In fac…

taking measures against a pandemic is not, because the pandemic is real and deadly

The existence of a problem does not imply that any measures taken to address it are reasonable. Child pornography is real. Should the government secretly install an app that scans your photos and reports you if it finds anything suspicious?

because in particular in the US there exists a phobia both to technology as well as government

Surreptitiously installing tracking apps is not going to help with that.

Re: Massachusetts health notifications app installed without users’ knowledge

#314

Post by jesboat »

mandmandam wrote: post #188
avian wrote: post #144

Earlier quoted context omitted.

I'm not from NL, but I am someone that did not install the COVID tracing app that our government provided (for voluntary installation). My reason was that I was not convinced by the PR that it is actually privacy safe. Just repeating "it uses a safe API, trust us/Google/Apple" was not enough for me. The subcontractor that made the app did dump some source code on GitHub saying "see, we have nothing to hide". However…

People here are downvoting you, but you were 100% right to doubt: https://www.iccl.ie/news/serious-privacy-and-data-harvesting... An excerpt: > While Android users can, in theory, opt to turn off Google Play Services, users of the Covid-19 contact-tracing app in Ireland cannot turn the surveillance off if they want the contact-tracing app to work. This means the collection and use of this data is unavoidable for peop…

> users can, in theory, opt to turn off Google Play Services, users of the Covid-19 contact-tracing app in Ireland cannot turn the surveillance off if they want the contact-trac ing app to work. This means the collection and use of this data is unavoidable for people who wish to use the app.

I would find it quite amusing if someone submitted a gdpr complaint saying that unnecessary data collection is not optional.

Re: Massachusetts health notifications app installed without users’ knowledge

#315

Post by _y5hn »

bonoboTP wrote: post #242
kortex wrote: post #227

Earlier quoted context omitted.

> Also don't underestimate learned helplessness. Learned helplessness is so real. My partner works at a help desk, and I constantly hear stories of older folks just mentally shutting down as soon as she has them open the start menu or a settings menu. I even see it in myself, a super curious neophile software/hardware hacker. Sometimes I'll come across some particularly arcane API docs and it's like my brain just goe…

It's also an ego-threatening thing. Often the older folks or otherwise nontechnical people are socially higher status and being lectured about something that they may not understand sounds dangerous to them or they take it as being challenged by them, especially if the person explaining it is lower social status, younger, "just a kid" etc. It's easier for them to just refuse to participate and dismiss the topic as ir…

When someone has lived 70+ years and done fine for most of those years. What is the use for them to learn what an "icon" on the "desktop" is, and why should they care about "browsers"?

This very much feels like justification for victim blaming.

Re: Massachusetts health notifications app installed without users’ knowledge

#316

Post by dpifke »

NoImmatureAdHom wrote: post #246

Fellow humans, there are alternatives! Your neck need not be under FAANG's boot! You don't even need to give up any functionality: CalyxOS: https://calyxos.org/ Privacy-respecting Android distribution that replaces Google spyware with MicroG, so you can have your cake and eat it too. Most everything will work as you're used to, but it does still talk to Google to make that happen. GrapheneOS: https://grapheneos.org/…

I really want a Librem 5.

I ordered (and paid for) one in October, 2017. It might ship in October or November of this year.

Re: Massachusetts health notifications app installed without users’ knowledge

#317

Post by sslalready »

I too found this after reading about it here. I contacted them and received the following reply.

> Exposure notifications cannot be enabled without user consent, so if you have not turned MassNotify on, then it is not active on your phone. However, a recent Google update, which makes MassNotify available as an option in your phone's settings, is causing some users to see MassNotify in their app list. Apologies if this caused any confusion.

>

> The appearance of MassNotify in the app list does not mean that MassNotify is enabled on your phone. The presence of the app merely means that MassNotify has been made available as an option in your phone's settings if you wish to enable it. For more information about this, please see this help center article from Google: https://support.google.com/android/answer/10775533

>

> You can see whether MassNotify is active by going to Settings -> Google -> COVID-19 Exposure Notifications. The “Use Exposure Notifications” toggle at the top of the page will show you whether MassNotify is active or not. From this screen, you can also enable or disable MassNotify at any time.

Re: Massachusetts health notifications app installed without users’ knowledge

#318

Post by nverno »

shados wrote: post #197
TomOwens wrote: post #140

Most of the comments on that app as well as here are probably wrong. I'd suspect that everyone who had the app "installed without their permission" opted into the Android COVID-19 Exposure Notification program. This was deployed by Google as part of an update to Google Play Services. When you go to your phone's settings with this update, there's an option to enable COVID-19 Exposure Notifications. When you turn it on…

I don't know what kind of proof you want, but I just looked at my phone settings after reading your comment. The exposure notification option is there and it's off. The region selection is grayed out because of it. Yet I got the app (uninstalled it after I saw this on hacker news). I did get a notification when it got installed but I thought it was just a push similar to amber alerts. I didn't realize it installed so…

I'm in Boston and it wasn't installed on my phone (exposure notifications have always been off AFAIK). I'm on old iphone 5s, not sure if that makes a difference or maybe just specific areas? According to this, https://thesomervillenewsweekly.blog/2021/04/05/massnotify-a..., different cities were piloting at different times, although it all seems opt in.

Re: Massachusetts health notifications app installed without users’ knowledge

#319

Post by jghn »

nverno wrote: post #318
shados wrote: post #197

Earlier quoted context omitted.

I don't know what kind of proof you want, but I just looked at my phone settings after reading your comment. The exposure notification option is there and it's off. The region selection is grayed out because of it. Yet I got the app (uninstalled it after I saw this on hacker news). I did get a notification when it got installed but I thought it was just a push similar to amber alerts. I didn't realize it installed so…

I'm in Boston and it wasn't installed on my phone (exposure notifications have always been off AFAIK). I'm on old iphone 5s, not sure if that makes a difference or maybe just specific areas? According to this, https://thesomervillenewsweekly.blog/2021/04/05/massnotify-a... , different cities were piloting at different times, although it all seems opt in.

Also Boston area. I got a notification on my iPhone that I could turn it on

Re: Massachusetts health notifications app installed without users’ knowledge

#320

Post by beprogrammed »

cblconfederate wrote: post #293
beprogrammed wrote: post #239

Earlier quoted context omitted.

This is just software updating software, so a switch would just be a token gesture, unless it wasn't, in which case you need to have the software be loaded from some ROM and the ROM only writable when the switch was activated, in which case that would be a fantastic device.

all diskettes used to have read-only locks

That's a good point.

But it also brings up the false sense of security, a floppy drive could just choose to ignore the switch and write anyways, just as the phone could secretly write the firmware.

Post reply on HN