Live data from Hacker News

Massachusetts health notifications app installed without users’ knowledge

play.google.com

361–370 of 407 posts

Re: Massachusetts health notifications app installed without users’ knowledge

#361

Earlier quoted context omitted.

Users expect to see the requested permissions.

All these permissions are granted without ever being shown to the user, due to being in the "other" category. If you install this app normally, Android will never ask you for permission, but just silently grant these permissions.

> The permission modal says this [0].

[0] https://news.ycombinator.com/item?id=27558825

Re: Massachusetts health notifications app installed without users’ knowledge

#362
post #309
post #263

Earlier quoted context omitted.

This defeatist attitude toward legislating is self-perpetuating. We can at least hold our representatives accountable.

> This defeatist attitude toward legislating is self-perpetuating. We can at least hold our representatives accountable. What can we do? I have no confidence that Congress will act in my best interest. Congress has some "partisan deadlock" but somehow I feel confident Intel's payday will go through without a bumpy ride > U.S. senators propose 25% tax credit for semiconductor manufacturing (reuters.com) https://news.y…

I admit I got your comment a bit confused with another talking about local government. But the solution I think is in the same direction - start local. The few hundred people in congress aren't self-sufficient. They need support from the rest of the party machines to get campaign money and turn money into votes. Changing what the parties will support at the local level changes who gets the big money and who gets elected.

Shorter version though: campaign finance reform, oppose voter suppression, and ranked-choice voting.

Re: Massachusetts health notifications app installed without users’ knowledge

#363
post #22

Earlier quoted context omitted.

Why do this at this late date? A year ago it would have been useful. Now, 59% of Massachusetts's population has been fully vaccinated. About 70% have at least one shot. A bit more pushing and they'll hit 80%, which seems to be about where the epidemic dies out for lack of new carriers.

> Why do this at this late date? A year ago it would have been useful. Because it took time to develop, and now they just shipped it? Maybe if the US had had a functional federal government prior to January then a national exposure notification app might have been developed, rather than relying on the states to do their own thing. Or not. But it's too late now. I'm not a USAian so I don't know what the take-up of a f…

The US public has (ironically) a long history of being more wary about what their Federal government gets to know about them than the citizens of other nations.

A great example is the lack of any kind of proper federal identification service or registry, something that has been brought up several times over the past century and been met with mass public outcry. So instead we rely on social security numbers, which were literally designed to be bad at identification.

In general the status quo is that the states handle this stuff instead. Whether it be drivers licenses, school circiculums, road maintenance, and emergency responses to natural disasters. Pandemic response is no exception to this. Sure the Federal Goverment often provides funding and guidance but it's largely up to state governments to actually examine and enforce these guidelines.

The point I'm trying to get at here is a federal contact tracing app was never in the cards, regardless of who the President is. The Presidents powers are largely limited to transient international policy (diplomacy, tarrifs, war, border control) and various congress approved Federal agencies.

Re: Massachusetts health notifications app installed without users’ knowledge

#364

Earlier quoted context omitted.

Right. They can change things with the next silent update anyway. In Germany they also started requiring turning on the GPS while using it. Initially it wasn't necessary and only Bluetooth was needed. Who knows what they modify all the time. I have no spare capacity to follow these developments and when they decide to stop caring about privacy and go rogue in the name of harm prevention.

The apps used around Europe, including Germany's Corona-Warn-App, do NOT use GPS. It only asks for location permissions since it utilizes the exposure notification API that indirectly tracks your "location" relative to other users (i.e. the ID exchange)

I fail to see the difference. You say it doesn't use GPS, but then continue to say that it uses location data (and thus, I assume, GPS). So which is it? Or are you saying that the app doesn't receive the user location data, only Google does?

Re: Massachusetts health notifications app installed without users’ knowledge

#365

It is obvious that we need better legislation to deal with all the new possibilities that technologies have opened. The installation of this app, even done with good intent, open a lot of questions on what should be possible or not to be done by government and corporations. When you get a device with pre-installed, uninstallable, or auto-installed apps. What are the rules? > "By enabling this service, you can be quic…

“ When you get a device with pre-installed, uninstallable, or auto-installed apps.” We’ve never had televisions in the house, but I finally broke down and bought a television so my kids could watch Disney+ on the big TV. The first television I purchased was a Samsung, and it came with these apps that I could not uninstall, did not what, and in fact used storage space that I couldn’t do anything about. I put it back i…

I can relate completely. A bit surprised by the LG though - was it any better wrt. preinstalled crapware?

Re: Massachusetts health notifications app installed without users’ knowledge

#366

Fellow humans, there are alternatives! Your neck need not be under FAANG's boot! You don't even need to give up any functionality: CalyxOS: https://calyxos.org/ Privacy-respecting Android distribution that replaces Google spyware with MicroG, so you can have your cake and eat it too. Most everything will work as you're used to, but it does still talk to Google to make that happen. GrapheneOS: https://grapheneos.org/…

Here's my phone: https://www.gsmarena.com/ulefone_armor_x7_pro-10293.php It's not supported by CalyxOS: https://calyxos.org/get/ It's not supported by GrapheneOS: https://grapheneos.org/faq#supported-devices It's not supported by LineageOS: https://download.lineageos.org/ It's not supported by Sailfish: https://shop.jolla.com/ It's not supported by Replicant: https://www.replicant.us/supported-devices.php Librem 5 is…

The alternatives are just that - alternatives. Don't want to make compromises needed for them? Then don't and stay in Google / Apple candyland. Or, make a sacrifice yourself and develop the missing support for the phone you fancy. Manufacturers don't have incentives to help out here, with a precious few like Librem and Pine. I for one am happy they exist and will be glad to shell out 8-9x as much money for a promise of better privacy. And when many do so, the prices will come down too. There is no reason for having a load of tracking on your phone, it is there just because its OS was developed by an advertising agency. And the alternative is worse in freedom-to-fix view because Apple.

Re: Massachusetts health notifications app installed without users’ knowledge

#367

Earlier quoted context omitted.

Here's my phone: https://www.gsmarena.com/ulefone_armor_x7_pro-10293.php It's not supported by CalyxOS: https://calyxos.org/get/ It's not supported by GrapheneOS: https://grapheneos.org/faq#supported-devices It's not supported by LineageOS: https://download.lineageos.org/ It's not supported by Sailfish: https://shop.jolla.com/ It's not supported by Replicant: https://www.replicant.us/supported-devices.php Librem 5 is…

The alternatives are just that - alternatives. Don't want to make compromises needed for them? Then don't and stay in Google / Apple candyland. Or, make a sacrifice yourself and develop the missing support for the phone you fancy. Manufacturers don't have incentives to help out here, with a precious few like Librem and Pine. I for one am happy they exist and will be glad to shell out 8-9x as much money for a promise…

Hmm, the way i like to think about alternatives is to only consider the feasible ones - for example, if i'm developing a software project and i'd require a RDBMS, then i'd consider PostgreSQL and MariaDB to be alternatives to one another, because both of them would be likely to provide good results.

I'm happy that PinePhone seems viable as a daily driver (as long as certain concessions are made) and to be honest, their SoC offerings also seem extremely affordable even when compared to the likes of Raspberry Pi, for example: https://pine64.com/product/pine-a64-lts/?v=0446c16e2e66

That said, a lot of what was offered (alternative OSes) are not feasible alternatives in many use cases, such as when wanting to escape the dominance of Google with an existing device that has regular consumer hardware, particularly those that are already in the budget segment. Being able to install a new OS on any phone would be awesome, but sadly there hasn't been an effort, legislative or otherwise, to ensure that it's possible - right to repair seems to address some of the hardware aspects, but i've seen nothing like that for software (like mandating the use of open bootloaders and for manufacturers to publish drivers).

> Or, make a sacrifice yourself and develop the missing support for the phone you fancy.

This isn't feasible either, since many people like me simply won't be smart enough to do so, won't have the time to do so due to their current life responsibilities or both. That suggestion is good in spirit, but is not something that can be suggested to the common folk as genuine advice.

> I for one am happy they exist and will be glad to shell out 8-9x as much money for a promise of better privacy.

I am happy that you are able to do that and my hat's off to you, since "voting with your wallet" is indeed a good option. However, short of supporting a few content creators on Patreon, i'm unable to afford to live like that.

Buying expensive hardware like that would mean that i'd have to sacrifice any sorts of savings/investments that i could make that month, and it would cost a significant chunk of my salary (which is around 2000 euros after taxes per month). It's reasonable when you have decent savings or income, but that's not my situation and that's not the situation of many people out there.

> There is no reason for having a load of tracking on your phone, it is there just because its OS was developed by an advertising agency.

Ergo, that reason is the current stranglehold by the dominant powers that be within the industry, lack of interest/motivation for any of them to provide more open solutions and perhaps something to do with the reasons behind why AOSP can't just be a drop in replacement for Google's Android offering that could just be installed in ~15 minutes and would just work (consider migrating PCs from Debian to CentOS, or vice versa, which often works like that).

I applaud the efforts of people like you and others who invest in these technologies, but for the rest of society, we'll just have to wait and see how things play out, perhaps buying the budget devices when they become available. In that regard, ARM architectures overall seem to be promising, maybe some day all of what i'm saying no longer will be relevant in any way.

Re: Massachusetts health notifications app installed without users’ knowledge

#368

Earlier quoted context omitted.

The apps used around Europe, including Germany's Corona-Warn-App, do NOT use GPS. It only asks for location permissions since it utilizes the exposure notification API that indirectly tracks your "location" relative to other users (i.e. the ID exchange)

I fail to see the difference. You say it doesn't use GPS, but then continue to say that it uses location data (and thus, I assume, GPS). So which is it? Or are you saying that the app doesn't receive the user location data, only Google does?

Neither the App nor Google use location data. However, Google still prompts your for these permissions because, in their mind, the swapping of rotating IDs presents an indirect way of tracking somebody's location (although that data is solely stays on the device and is never transferred, unless a positive person decides to upload the list of IDs there were in contact with)

Re: Massachusetts health notifications app installed without users’ knowledge

#369

Earlier quoted context omitted.

All these permissions are granted without ever being shown to the user, due to being in the "other" category. If you install this app normally, Android will never ask you for permission, but just silently grant these permissions.

> The permission modal says this [0]. [0] https://news.ycombinator.com/item?id=27558825

On Android 6.0 (2017) and later, there is no permission modal if all permissions are in the "other" category, as they are in this case.

Android 6.0 introduced requestable permissions, were critical permissions had to be requested (and could be denied) at runtime.

At the same time it removed all modals for non-critical permissions.

Re: Massachusetts health notifications app installed without users’ knowledge

#370

Fellow humans, there are alternatives! Your neck need not be under FAANG's boot! You don't even need to give up any functionality: CalyxOS: https://calyxos.org/ Privacy-respecting Android distribution that replaces Google spyware with MicroG, so you can have your cake and eat it too. Most everything will work as you're used to, but it does still talk to Google to make that happen. GrapheneOS: https://grapheneos.org/…

Here's my phone: https://www.gsmarena.com/ulefone_armor_x7_pro-10293.php It's not supported by CalyxOS: https://calyxos.org/get/ It's not supported by GrapheneOS: https://grapheneos.org/faq#supported-devices It's not supported by LineageOS: https://download.lineageos.org/ It's not supported by Sailfish: https://shop.jolla.com/ It's not supported by Replicant: https://www.replicant.us/supported-devices.php Librem 5 is…

It looks like you can get a used Pixel 3a for ~$100: https://www.ebay.com/sch/i.html?_nkw=pixel+3a&_sacat=0&LH_Ti...

(this is US ebay, but I assume prices are similar)

I think Calyx still supports Pixel 2, but you've got to trade off the likely length of continuing support against price, of course.

Post reply on HN