Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts health notifications app installed without users’ knowledge

play.google.com

Post reply on HN
Print view View original

371–380 of 407 posts

Re: Massachusetts health notifications app installed without users’ knowledge

#371

Post by NoImmatureAdHom »

grishka wrote: post #308
NoImmatureAdHom wrote: post #246

Fellow humans, there are alternatives! Your neck need not be under FAANG's boot! You don't even need to give up any functionality: CalyxOS: https://calyxos.org/ Privacy-respecting Android distribution that replaces Google spyware with MicroG, so you can have your cake and eat it too. Most everything will work as you're used to, but it does still talk to Google to make that happen. GrapheneOS: https://grapheneos.org/…

I've been thinking about getting away from proprietary Google Services and their backdoors, but the one thing that's holding me back is Google Pay (NFC payments). It's way too convenient and I'm unwilling to give it up. Is there an open-source replacement/reimplementation maybe, or something like a way to run the original proprietary app with MicroG? What about other apps that require SafetyNet? (Important note: I'm…

Have you thought about looking in to the problem yourself, or maybe just throwing some coffee money at the devs who are?

I'd argue you should still be concerned about data collection even if you're successfully blocking ads. It doesn't worry you that some super-powerful faceless corporation tracks your every move in the real world? It's one of those things...it won't be a problem until it is ;-)

Re: Massachusetts health notifications app installed without users’ knowledge

#372

Post by NoImmatureAdHom »

dpifke wrote: post #316
NoImmatureAdHom wrote: post #246

Fellow humans, there are alternatives! Your neck need not be under FAANG's boot! You don't even need to give up any functionality: CalyxOS: https://calyxos.org/ Privacy-respecting Android distribution that replaces Google spyware with MicroG, so you can have your cake and eat it too. Most everything will work as you're used to, but it does still talk to Google to make that happen. GrapheneOS: https://grapheneos.org/…

I really want a Librem 5. I ordered (and paid for) one in October, 2017. It might ship in October or November of this year.

I think of a prepurchase from Purism as something halfway between a purchase and a donation. They're truly doing the work that needs to be done, and I'm happy for them to take my money.

Re: Massachusetts health notifications app installed without users’ knowledge

#373

Post by DontBeEvilMA »

015UUZn8aEvW wrote: post #350
oehpr wrote: post #349

Earlier quoted context omitted.

Likely because it's being perceived as a third party app that was just arbitrarily installed. At least it can be presented that way, which is enough to get the story to spread. It's honestly not that far off from the truth. Just because google uses your phone as a personal playground all the time doesn't make this instance any more or less outrageous. If this is what it takes for it to be perceived as outrageous as i…

Because it was done by the government, not just by Google. Yes, Google played a major role and yes, the tech companies do a lot of deeply concerning things on their own. But I was still taken aback that actual government software was installed on my phone without my knowledge or permission. It's a really bad precedent to set. The fact that Google and the government worked hand in glove to do this doesn't make it less…

Precisely. That helpdesk answer is not adequate. Did Google push an app that the Mass dept of public help develops without MDPH being aware or approving that push? Or did MDPH know that google would do this?

Re: Massachusetts health notifications app installed without users’ knowledge

#374

Post by sp332 »

pooper wrote: post #309
sp332 wrote: post #263

Earlier quoted context omitted.

This defeatist attitude toward legislating is self-perpetuating. We can at least hold our representatives accountable.

> This defeatist attitude toward legislating is self-perpetuating. We can at least hold our representatives accountable. What can we do? I have no confidence that Congress will act in my best interest. Congress has some "partisan deadlock" but somehow I feel confident Intel's payday will go through without a bumpy ride > U.S. senators propose 25% tax credit for semiconductor manufacturing (reuters.com) https://news.y…

Ok those other things I mentioned were still pretty daunting I guess. But corporations are still not interested in having their actions called out. Relatively low-budget operations like https://popular.info/ get good results in shifting behavior of big companies. (Note you can skip the signup page, just click "Let me read it first").

Re: Massachusetts health notifications app installed without users’ knowledge

#375

Post by nephanth »

trulyme wrote: post #364
Quanttek wrote: post #201

Earlier quoted context omitted.

The apps used around Europe, including Germany's Corona-Warn-App, do NOT use GPS. It only asks for location permissions since it utilizes the exposure notification API that indirectly tracks your "location" relative to other users (i.e. the ID exchange)

I fail to see the difference. You say it doesn't use GPS, but then continue to say that it uses location data (and thus, I assume, GPS). So which is it? Or are you saying that the app doesn't receive the user location data, only Google does?

On android, a lot of APIs that have nothing to do with GPS (such as watching wifi networks, looking for devices on the same network, etc.) actually need the "location data" permission.

This is misleading, but it is made so because one could potentially use data harvested through those APIs to infer your location (for example, if an app has a map of wifi networks, knowing which networks are around allows it to infer your position)

Re: Massachusetts health notifications app installed without users’ knowledge

#376

Post by grishka »

NoImmatureAdHom wrote: post #371
grishka wrote: post #308

Earlier quoted context omitted.

I've been thinking about getting away from proprietary Google Services and their backdoors, but the one thing that's holding me back is Google Pay (NFC payments). It's way too convenient and I'm unwilling to give it up. Is there an open-source replacement/reimplementation maybe, or something like a way to run the original proprietary app with MicroG? What about other apps that require SafetyNet? (Important note: I'm…

Have you thought about looking in to the problem yourself, or maybe just throwing some coffee money at the devs who are? I'd argue you should still be concerned about data collection even if you're successfully blocking ads. It doesn't worry you that some super-powerful faceless corporation tracks your every move in the real world? It's one of those things...it won't be a problem until it is ;-)

It doesn't really track my every move in real world either — I removed the location permission for the Google app and disabled the creepy as hell location history a while ago. It doesn't track anything at all in the virtual world because I have third-party cookies disabled and run ad blockers on everything I own.

> Have you thought about looking in to the problem yourself, or maybe just throwing some coffee money at the devs who are?

The problem with this particular thing — making a free software, non-Google NFC payment app — is that it's a regulatory hell and requires partnering with banks. No way an individual would be able to pull this off. Also probably no way to keep it open, I'd be surprised if there are no NDAs involved.

Re: Massachusetts health notifications app installed without users’ knowledge

#377

Post by [deleted] »

sohei wrote: post #69
simpss wrote: post #37

I think the real question is what mechanism allows them to push a random app to some phones? google play services is actively listening for remote installation requests? that's essentially a remote-code-execution backdoor to all android phones?

A corollary of your question. If Google can lawfully install arbitrary apps on ordinary users' phones, can it also run arbitrary code on the personal devices of government officials investigating it for price fixing in the ad market?

[deleted]

Re: Massachusetts health notifications app installed without users’ knowledge

#378

Post by rhn_mk1 »

webinvest wrote: post #351
mrtksn wrote: post #326

Earlier quoted context omitted.

Remember when Tim Cook put Bono's album in the iTunes library of everybody? That's when it felt that the smartphones are not our devices. Someone you don't know can and U2 album to your library without you ask for it or being able to do anything about it. You can understand it with an OS update. It's the new shiny thing that comes with bunch of stuff and this new one has this new app. However, getting it without acti…

I quite like Bono’s U2 album. Also it doesn’t come with any downsides like the Massachusetts app does.

Wouldn't it bloat the album collection, making it harder to search/skim the list?

Re: Massachusetts health notifications app installed without users’ knowledge

#379

Post by kevincox »

dTal wrote: post #337
grishka wrote: post #306

Earlier quoted context omitted.

It's pure madness that Play Services comes with this sort of backdoor. This is clearly what I would consider a deliberate RCE vulnerability.

It doesn't "come with" this backdoor. It is this backdoor. Maintaining a connection with the Google mothership is, approximately, Play Service's entire function.

It does come with this backdoor, and I don't think it is necessary for Google Play to function. The client could be written so that it won't install a new app without user consent. IIUC that doesn't really affect Google Play's main functionality.

Re: Massachusetts health notifications app installed without users’ knowledge

#380

Post by trulyme »

KronisLV wrote: post #367
trulyme wrote: post #366

Earlier quoted context omitted.

The alternatives are just that - alternatives. Don't want to make compromises needed for them? Then don't and stay in Google / Apple candyland. Or, make a sacrifice yourself and develop the missing support for the phone you fancy. Manufacturers don't have incentives to help out here, with a precious few like Librem and Pine. I for one am happy they exist and will be glad to shell out 8-9x as much money for a promise…

Hmm, the way i like to think about alternatives is to only consider the feasible ones - for example, if i'm developing a software project and i'd require a RDBMS, then i'd consider PostgreSQL and MariaDB to be alternatives to one another, because both of them would be likely to provide good results. I'm happy that PinePhone seems viable as a daily driver (as long as certain concessions are made) and to be honest, the…

I see your point, I'm just saying that for many people viable alternatives already exist. But I understand completely that not everyone can (or is willing to) make the tradeoffs needed.

Btw, I hear FairPhone 3+ with e.foundation OS is a good choice too, if you want to avoid Google but still need Android. No first hand experience though, and it's still a few hundred euros.

Post reply on HN