Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts health notifications app installed without users’ knowledge

play.google.com

Post reply on HN
Print view View original

341–350 of 407 posts

Re: Massachusetts health notifications app installed without users’ knowledge

#341

Post by IncRnd »

dTal wrote: post #335
IncRnd wrote: post #310

Earlier quoted context omitted.

That's not the behaviour of what happened here, where an app was downloaded without user initiation or intervention. There was no authorization from the user of the actions that were taken by Google or the app's vendor.

From a technical standpoint, it is the same. The phone maintains a connection to a Google server and listens for "authorized" installation requests - where "authorized" means "authorized by Google". When you click "install" on the Play Store on your laptop, you're not talking directly to your phone (how would that even work?) - you're talking to Google, who then speaks to your phone on your behalf.

> From a technical standpoint, it is the same.

Yes, of course, but this isn't a technical issue. Look at the webpage that this hn page references. When people say, "an app was installed on my device without my consent or knowledge," the exact method the device used to listen isn't important.

The first issue is that Google software allows non-authorized software installations. The second issue is that a government forced the installation of the app. The technical specifics are just implementation details.

Re: Massachusetts health notifications app installed without users’ knowledge

#342

Post by dTal »

Aerroon wrote: post #333
kn1ght wrote: post #93

Earlier quoted context omitted.

The whole protocol was designed very cleverly from the start to avoid all the privacy blocks that might inhibit people from using it [1], because the main drawback in this is that it's completely useless unless you have a critical mass of users that actually use it. It is very difficult to explain to people that are not curious about the technology and all they hear is 'tracing = tracking = no privacy'. I imagine thi…

> It is very difficult to explain to people that are not curious about the technology and all they hear is 'tracing = tracking = no privacy'. But this is literally true. This is an app pushed to people remotely without their consent or even knowledge. People cannot trust the claim that there is no privacy gotcha involved in this, especially when previous attempts seem to have opened the log of this information to all…

Is there something special about it being an app? Because the contact tracing framework that the app uses was already pushed to people remotely without their consent or knowledge - as well as the contents of every update ever to Google Services Framework. And in the big scheme of shady shit that Android does without the user's consent or knowledge, that's a pretty benign, privacy-respecting one.

Re: Massachusetts health notifications app installed without users’ knowledge

#343

Post by dTal »

IncRnd wrote: post #341
dTal wrote: post #335

Earlier quoted context omitted.

From a technical standpoint, it is the same. The phone maintains a connection to a Google server and listens for "authorized" installation requests - where "authorized" means "authorized by Google". When you click "install" on the Play Store on your laptop, you're not talking directly to your phone (how would that even work?) - you're talking to Google, who then speaks to your phone on your behalf.

> From a technical standpoint, it is the same. Yes, of course, but this isn't a technical issue. Look at the webpage that this hn page references. When people say, "an app was installed on my device without my consent or knowledge," the exact method the device used to listen isn't important. The first issue is that Google software allows non-authorized software installations. The second issue is that a government for…

This subthread is about the technical issue. The root comment asks "the real question is what mechanism allows them to push a random app to some phones?".

Re: Massachusetts health notifications app installed without users’ knowledge

#344

Post by kuschku »

riekus wrote: post #243
kuschku wrote: post #44

Earlier quoted context omitted.

> I have an app that can save your life, trust me. And give me your email so I can send it to you ;) Great, send me the source code, I’ll get it released on f-droid and then I’ll install the f-droid version of it, just like I’ve got the f-droid and microG version of the Corona Warn App installed :)

So where is the source code for this tracking app?

The upstream from which this app is forked is at https://github.com/corona-warn-app/cwa-app-android, the fork itself is not publicly available, as far as I can tell.

Re: Massachusetts health notifications app installed without users’ knowledge

#345

Post by mavhc »

underseacables wrote: post #280
ElViajero wrote: post #56

It is obvious that we need better legislation to deal with all the new possibilities that technologies have opened. The installation of this app, even done with good intent, open a lot of questions on what should be possible or not to be done by government and corporations. When you get a device with pre-installed, uninstallable, or auto-installed apps. What are the rules? > "By enabling this service, you can be quic…

“ When you get a device with pre-installed, uninstallable, or auto-installed apps.” We’ve never had televisions in the house, but I finally broke down and bought a television so my kids could watch Disney+ on the big TV. The first television I purchased was a Samsung, and it came with these apps that I could not uninstall, did not what, and in fact used storage space that I couldn’t do anything about. I put it back i…

That's why it was cheap. But why care about storage space inside your TV?

Re: Massachusetts health notifications app installed without users’ knowledge

#346

Post by Animats »

ehsankia wrote: post #103
Animats wrote: post #22

Earlier quoted context omitted.

Why do this at this late date? A year ago it would have been useful. Now, 59% of Massachusetts's population has been fully vaccinated. About 70% have at least one shot. A bit more pushing and they'll hit 80%, which seems to be about where the epidemic dies out for lack of new carriers.

Isn't contact tracing actually more useful when the number of cases are reasonably low?

Only if coupled with a public health program that does something. We might reach the ring vaccination stage, where each case triggers contact tracing and testing and vaccination of all contacts and the people around them. That's how smallpox was wiped out.

Re: Massachusetts health notifications app installed without users’ knowledge

#347

Post by KronisLV »

NoImmatureAdHom wrote: post #246

Fellow humans, there are alternatives! Your neck need not be under FAANG's boot! You don't even need to give up any functionality: CalyxOS: https://calyxos.org/ Privacy-respecting Android distribution that replaces Google spyware with MicroG, so you can have your cake and eat it too. Most everything will work as you're used to, but it does still talk to Google to make that happen. GrapheneOS: https://grapheneos.org/…

Here's my phone: https://www.gsmarena.com/ulefone_armor_x7_pro-10293.php

It's not supported by CalyxOS: https://calyxos.org/get/

It's not supported by GrapheneOS: https://grapheneos.org/faq#supported-devices

It's not supported by LineageOS: https://download.lineageos.org/

It's not supported by Sailfish: https://shop.jolla.com/

It's not supported by Replicant: https://www.replicant.us/supported-devices.php

Librem 5 is 8-9x more expensive than my current device: https://shop.puri.sm/shop/librem-5/

PinePhone seems more promising, but the battery capacity is lower, as well as the other specifications are (slighty) worse: https://pine64.com/product-category/pinephone/?v=0446c16e2e6...

I feel like that perhaps calls for an asterisk to be added to your statement:

  Fellow humans, there are alternatives*!
  *As long as your device is one of the supported pieces of flagship hardware and/or you get a device specifically for it.
Which is unfortunate, because a lot of those devices won't be as affordable. I bought my phone for just over 100 euros, in part because it has a recent enough OS version and is pretty tough.

I feel like this situation won't improve until manufacturers get their crap together and make devices based on more open standards which may or may not ever happen. I still dream about the same level of hardware support that GNU/Linux has (with proprietary drivers), where most distros just run on most hardware.

Re: Massachusetts health notifications app installed without users’ knowledge

#348

Post by grishka »

caeril wrote: post #322
grishka wrote: post #308

Earlier quoted context omitted.

I've been thinking about getting away from proprietary Google Services and their backdoors, but the one thing that's holding me back is Google Pay (NFC payments). It's way too convenient and I'm unwilling to give it up. Is there an open-source replacement/reimplementation maybe, or something like a way to run the original proprietary app with MicroG? What about other apps that require SafetyNet? (Important note: I'm…

NFC is perhaps two seconds more convenient than a chipped card. Two seconds is worth the price of living in a panopticon?

It is 2 seconds if you're paying less than 1000₽. With a physical card, you have to enter the pin if you're paying more. You only have to unlock the phone before tapping if you're using NFC.

Re: Massachusetts health notifications app installed without users’ knowledge

#349

Post by oehpr »

dTal wrote: post #340
015UUZn8aEvW wrote: post #328

I emailed massnotifyhelp@mass.gov to ask why the app was on my phone, and I got the following response: Hi [my name], In order for MassNotify to be available to users in their phone’s settings, an update was made by Google that resulted in some users seeing MassNotify appear in their app list in the Google Play Store. Apologies if this caused any confusion. The appearance of MassNotify in the app list does not mean t…

This raises an interesting point. Android subdivides much of its core functionality into various hidden "apps". Everyone's all up in arms about this, but I don't remember a similar outcry when the Covid-19 exposure API was "forcibly" added to the Google Services Framework. This isn't really any different from that, or any other OS update. I naturally agree that Google's remote-root is creepy and weird, but why is thi…

Likely because it's being perceived as a third party app that was just arbitrarily installed. At least it can be presented that way, which is enough to get the story to spread.

It's honestly not that far off from the truth. Just because google uses your phone as a personal playground all the time doesn't make this instance any more or less outrageous. If this is what it takes for it to be perceived as outrageous as it is, then fine.

Re: Massachusetts health notifications app installed without users’ knowledge

#350

Post by 015UUZn8aEvW »

oehpr wrote: post #349
dTal wrote: post #340

Earlier quoted context omitted.

This raises an interesting point. Android subdivides much of its core functionality into various hidden "apps". Everyone's all up in arms about this, but I don't remember a similar outcry when the Covid-19 exposure API was "forcibly" added to the Google Services Framework. This isn't really any different from that, or any other OS update. I naturally agree that Google's remote-root is creepy and weird, but why is thi…

Likely because it's being perceived as a third party app that was just arbitrarily installed. At least it can be presented that way, which is enough to get the story to spread. It's honestly not that far off from the truth. Just because google uses your phone as a personal playground all the time doesn't make this instance any more or less outrageous. If this is what it takes for it to be perceived as outrageous as i…

Because it was done by the government, not just by Google. Yes, Google played a major role and yes, the tech companies do a lot of deeply concerning things on their own. But I was still taken aback that actual government software was installed on my phone without my knowledge or permission. It's a really bad precedent to set.

The fact that Google and the government worked hand in glove to do this doesn't make it less disturbing. Arguably it's more disturbing.

Post reply on HN