50 ms·
Google promised its contact tracing app was completely private, but it wasn’t
- arsome 5y agoThis title is kind of exaggerated. In order to obtain this data you'd need to get the Bluetooth identifiers from the system log. In order to get the system log, you need root or adb. At that point you can just log GPS directly, inject code straight into the COVID tracking app, etc. All bets are off.
- mkesper 5y agoThis is the interesting thing about it: The signals that a phone’s contact tracing data generates and receives are saved into an Android device’s system logs. Studies have found that more than 400 preinstalled apps on phones built by Samsung, Motorola, Huawei, and other companies have permission to read system logs for crash reports and analytic purposes.
- arsome 5y agoBut again, they also have system privileges on your phone and if they wanted to dump location data or bluetooth scans they could do so trivially. About the worst that could come of this is an accidental capture in a crash report.
- ballenf 5y agoSo maybe Google shouldn't have guaranteed privacy of this app on a phone OS where such a promise is impossible to deliver?
- gruez 5y agoWhat type of guarantees did they promise?
- Sebb767 5y agoBasically any device can be seen as compromised if anyone malicious had hardware or root access - including the manufacturer. If you don't trust your manufacturer, you have far bigger problems than bluetooth IDs in the log.
- dylan604 5y agoBut that's just it. I DON'T trust Google one iota.
- ryukafalz 5y agoThen if you have an Android phone, you have no reason to believe your location data is private from Google, with or without the contact tracing app. I'm not saying this isn't a problem, I'm in the same boat here, just that the contact tracing app doesn't really add to it.
- nthj 5y agoThen you shouldn’t have an Android device. This isn’t complicated.
- dylan604 5y agoI don't have an Android device presicely because of this. I don't use Google Chrome, search, etc. I block all GA,Tagmanager,blahblahblah as well.
- oefrha 5y agoGreat, this “issue” is irrelevant to you and your off-topic rant adds exactly nothing to this discussion of a clearly defined risk. For other people who have made a relevant device choice, the point stands that it’s a non-issue since there’s no additional risk.
- procombo 5y agoHardly. Your privacy also depends on what devices your neighbors use. Bluetooth/Wifi/etc packet broadcast, etc. Apple does _some_ things to midigate privacy risks for their users, but not enough.
- shawnz 5y agoThis seems like saying they shouldn't have guaranteed privacy because someone could be looking over your shoulder while you type your password. Maybe that's true, but it also seems like a uselessly impractical way to interpret things.
- macinjosh 5y ago> About the worst that could come of this is an accidental capture in a crash report. So.. this data is exposed and available even though they said would/could never leak. Seems pretty cut and dry to me. It is a black and white issue. Accidental disclosure is still a disclosure.
- joshuamorton 5y agoIt's accidental exposure to someone who already had root and could record the data themselves.
- shadowgovt 5y agoI think there's a practical difference between what an app could do with root permissions and what is widely understood to be likely or acceptable. The "anything the app could do it is doing" model isn't really the right model to apply for vendor apps that are generally trusted by consumers (and observed by security researchers). We're not talking malware with root; we're talking the regular system health and monitoring apps that vendors install. So it's real unlikely that MotoCare is intentionally trying to de-anonymize someone's COVID-19 data by code injection or continuous GPS logging. It is extremely likely and expected that the app is periodically grabbing the syslog as a crash report, and that means Google's claim of keeping your data private now has to implicitly assume that MotoCare, without doing anything special other than its regular behavior, is also keeping your data private. That's not a claim Google should be implicitly making on behalf of MotoCare (let alone on behalf of every app that could hypothetically be installed on your system and is understood to be well-behaved in the sense that it just reads the syslog). It's really incumbent on a privacy-protecting application to not put private data in the syslog. If it's in the syslog, it's not private (even though it's more private than, say, a notification on the homescreen).
- lofi_lory 5y agoI imagine for semi-criminal actors, injecting code or "accidentally" using systen data, are still two different scenarios. I mean, state actors could also just follow you around, or place agents as friends and family... so why bother about anything?
- not_knuth 5y agoLink to studies?
- derpus 5y agoThe researcher linked to the paper (https://haystack.mobi/papers/preinstalledAndroidSW_preprint.pdf https://haystack.mobi/papers/preinstalledAndroidSW_preprint....) in their original blog post on Appcensus (https://blog.appcensus.io/2021/04/27/why-google-should-stop-logging-contact-tracing-data/ https://blog.appcensus.io/2021/04/27/why-google-should-stop-...)
- nl 5y agoYeah it's a ridiculous assertion. It's basically arguing that because the phone knows it's own identity it's not private.
- jrm4 5y agoI get that this might not be useful from a technical point of view for this crowd, but it's not exaggerated at all even if the point of failure isn't Google and the app; if we want to be serious about fixing privacy issues, we can't just wave away vulnerabilities that we've accepted for a long time out of pure convenience and apparent difficulty to solve.
- joeblau 5y agoOn iOS, none of that is even possible with physical access. Nothing that you’re saying sounds hard for a malicious actor to pull off. The interesting thing is that you’re getting is a historical log without the need to install anything.
- arsome 5y ago> Nothing that you’re saying sounds hard for a malicious actor to pull off. A malicious actor would need to be your phone manufacturer, Google or someone with a root exploit (jailbreak in iOS terms) or this "vulnerability" would be completely useless. All of those parties could just as easily push code to your device any number of other ways that could do far worse than reading your logcat for BT IDs. I understand the concern, but if you're at the point where you can't trust the parties who push automatic updates with high privilege levels but you do need to be concerned about reading logcat your threat model here is pretty strange.
- Aerroon 5y agoIsn't the difference based on time though? The device manufacturer can push a patch, but they would get access to the information after the patch, whereas access to the log gives you information from before the patch. Or have I misunderstood?
- hundchenkatze 5y agoThe device manufacturer has access to the device (at the hardware level even) the moment they start building it. They don't need to push a patch to gain access, they could access your logs at any point throughout the lifespan of the device.
- Aerroon 5y agoI think we're talking about different things. If a manufacturer wants to eavesdrop on my device then they need to push a patch to my device. They can only get information about what happens after they push this patch. They can do it at the start of the life of the device, but they'd have to do it then. However, if important data is retained in logs, then the manufacturer could grab the data from the logs. They can get information from a time before they decided to look into you. It's like a wiretap vs access to a diary. A wiretap only gives you information after the tap has been installed, whereas getting your hands on someone's diary would give you access to previous information too.
- 6gvONxR4sf7o 5y agoIsn’t it saying that a bunch of preinstalled apps also have access to this info?
- privacyking 5y agoAnd what is the most common privacy-violating preinstalled app? Facebook.
- iudqnolq 5y agoDifferent kind of pre-installed.
- deleted 5y ago[deleted]
- JAlexoid 5y agoIt's the fact that it logs other people's data, not just it's own, that makes it less than perfect anonymity. But then again... You'd need to have a list from the "other side", to actually deanonimize this data. At that point, you can just get WiFi and Bluetooth physical addresses.
- compiler-guy 5y agoGoogle did claim that the identifiers are ephemeral. They may be hard to access but they aren't ephemeral. This sets up the possibility of post-hoc attacks. Sure, if you get root, all bets are off generally, but now if you get root, you can figure out identifiers used before you got root, which isn't what Google said was possible.
- deleted 5y ago[deleted]
- PossiblyDog 5y agoThe identifiers are ephemeral. About 10 minutes for a given RPI (what gets broadcast over Bluetooth), 1 day for a TEK, and 14 days of local TEK history. The generated RPIs aren't retained, and the TEKs - which can be used to re-derive the RPIs - never leave the device unless you choose to report a diagnosis. All of this is destroyed after 14 days. This report doesn't change any of this. I recommend reading the GAEN cryptography spec: https://blog.google/documents/69/Exposure_Notification_-_Cryptography_Specification_v1.2.1.pdf https://blog.google/documents/69/Exposure_Notification_-_Cry... The issue here is that privileged apps that are bundled with the OS could snoop on the system log to capture new RPIs when they're generated in real-time. Which isn't great... but privileged apps can already do much worse. If one of these apps is malicious, they could just log your GPS position directly (for example). Heck, an application with root could just read the 14-day TEK history directly off disk. Once we're talking privileged apps and processes running as root, all bets are off. You need to be able to trust the device's firmware.
- deleted 5y ago[deleted]
- lurkerasdfh8 5y ago> but privileged apps can already do much worse. If one of these apps is malicious One of these apps (google play service) downloads Ads non stop, mine wifi and gps data and send to a central server, etc. All against user wishes ...or even knowledge! At which point do you draw the line for an app to be malicious?
- two_handfuls 5y agoI've seen this described as "the security vulnerability is on the other side of the airtight door", which I found was both poetic and apt. It's apparently pretty common in bug bounty submissions.
- UncleMeat 5y agoReplace "apparently" with "definitely". The number of bounty submissions that I've seen which come in the form of "I can read a program's private data using root" is too high to count.
- throwaway122378 5y agoSurprise surprise
- williesleg 5y agoOf course, it's google.
- deleted 5y ago[deleted]
- cheaprentalyeti 5y agoMaybe I'm stupid but I thought the whole point of a Traffic Analysis app would have been to violate privacy.
- kenmacd 5y agoThe protocol was designed for privacy. In that it seems to have done okay if the worst thing we can complain about is that manufacturer apps that can already see your location, your email, your search history, and your pictures, could also read your generated codes.
- rubidium 5y agoIt’s a little surprising how much effort went into things early in the pandemic that didn’t pan out. Official contact tracing in the US is a complete dud and had negligible impact on the spread. People informing their fiends/family “hey I just got Covid you should probably test/isolate” was what practically can make a difference. Ventilators were the critical thing until we realized they were a very sub optimal treatment. All the surface cleaning was a massive waste too... and the chemicals used in some places destroyed a bunch of furniture. Masks, fresh air, don’t go out when sick or after close contact with someone when sick. Simpler things that make the most difference.
- pradn 5y agoAlso remember how the CDC didn't advise wearing a mask for the first month or two of the pandemic? We came around to that, too.
- mattferderer 5y ago.NET Rocks did a great Geek Out podcast on that which explained it in layman's terms - https://www.dotnetrocks.com/?show=1720 https://www.dotnetrocks.com/?show=1720 If I recall, the CDC was recommending treatment that worked against past similar viruses. This one turned out to be spread in a completely different way than typical.
- wutbrodo 5y agoThis excuse doesn't make any sense. Their messaging at the time was "masks aren't effective, plus we need them for healthcare workers to care for pandemic patients". If they're not effective, why would healthcare workers need them? Higher viral loads put you at higher risk, but the messaging decidedly wasn't that masks are only protective at high viral loads. Let alone the incredibly basic prior on respiratory diseases' vector being limited by _covering up the sources of spread_. The initial recommendation, the flip-flop, and attempts to explain it away have been universally incoherent, because the real reason is that the CDC and FDA combine the worst of the federal government's bureaucratic inefficiency with medical culture's innumeracy and blind status quo bias. Leaving aside the failures of pandemic preparedness stretching back multiple administrations (the PPE stockpile had been depleted since 2013, and I don't need to describe the trump admin's failures..), it would have been trivial to do what we eventually did, and what many other countries did: recommend face coverings of any sort, and encourage people to save n95s for medical personnel. The insane route we ended up taking had people hoarding n95s anyway and deeply poisoned the well of trust in public health authorities in general and masks in particular (helped along by our president).
- foolzcrow 5y agoThe elite have planned on controlling us for at least 80 years.
- fudged71 5y agoMy region never got access to this app, so I’m curious For those who have it, did it change your behavior? Did you have contact and it made you avoid crowded spaces? Did you get tested because of contact logs?
- jrochkind1 5y agoI don't know of anyone in the USA who has used these apps. They never really took off. Since they rely on a "network effect" to be useful... even if you installed one, few people you came in range of would have it installed. https://apnews.com/article/us-news-smartphones-coronavirus-pandemic-district-of-columbia-20aa29d9d018597e2e464128b529e928 https://apnews.com/article/us-news-smartphones-coronavirus-p...
- Forge36 5y agoI tried it, it was state specific and required self reporting positive cases to alert others. I suspect the heavy opt in nature made it much less useful. I'm curious if it was useful in some areas
- dripton 5y agoI installed the contact tracing app as soon as it was available, and still have it running. I've never gotten a contact from it. Some of that is probably me being careful and not being around others much, and some of it is probably that almost nobody else is running it.
- avereveard 5y agopeople often forget the other half: the confirmed cases need to be uploaded. in Italy, that was the biggest weak point, even places with a fairly wide install base didn't get much benefit since the ausl didn't had the processes in place to share the test results, as the ingress effort was fragmented and left to be implemented with local resources, a mess of regional responsibilities and uncertain protocols, i.e. https://corrieredelveneto.corriere.it/veneto/politica/20_ottobre_14/immuni-mai-caricati-usl-dati-positivi-veneto-1972382a-0dea-11eb-a0fa-5985683fd478.shtml https://corrieredelveneto.corriere.it/veneto/politica/20_ott... (source in italian)
- breischl 5y agoHeadline seems to be conflating two different kinds of promises. My recollection is that the promise was that Google and the government wouldn't (couldn't) track you with the data. That appears to be generally true. Finding a bug that exposes some data is unfortunate, but it seems the be an unintentional mistake. tl;dr, they didn't try to do anything evil, they just failed to be 100% perfect. Also as /u/arsome points out elsewhere, the other apps that can read this data could get better data more easily through another method anyway.
- Ceezy 5y agoDo we know what kind of users info are contained in these logs? It seems a bit misleading.
- twirlock 5y agoThat's so surprising how the company that hates privacy and tries to take our data against our will still hates privacy and still wants to take our data against our will.
- renewiltord 5y agoYeah, I wasn't going to touch this shit. Especially when all these people who were going on and on about privacy suddenly decided to about face, it made me very suspicious. No way.
- ChrisArchitect 5y agojust seems like google witch hunt from some random app security firm. Would rather hear from some of the notable developers of say the Canada Covid Alert App about what they think about this
- pyronik19 5y agoThe last entity in the world I would want to trust with all of my location data is google.
- robrenaud 5y agoWhich is why Apple/Google engineered this to not use GPS location data, instead each phone locally kept track of nearby bluetooth IDs. Which made the app scale quadratically rather than linearly with usage (10% adoption means 1% of possible transmissions caught), which made it basically useless without large scale adoption that it never got. Google/Apple timidly did some basically useless engineering, when they could have instead made a significant dent in limiting the spread of covid. If they were going to make the timid, quadratically scaling decision, they should have boldly made it opt out. A quadratic scaling, privacy preserving protocol plus a timid opt in strategy might have cost 30k lives if it ubiquitous/automatic contact tracing would have stopped 10% of the spread.
- jedimastert 5y ago> Google/Apple timidly did some basically useless engineering, when they could have instead made a significant dent in limiting the spread of covid. Are out suggesting they actually should have used GPS data instead? Can you imagine the kind of holy hell that would have brought on them? > If they were going to make the timid, quadratically scaling decision, they should have boldly made it opt out I think the biggest problem is that hospitals and regions had to have their own databases for the ids
- deleted 5y ago[deleted]
- FrameworkFred 5y ago...to which the scorpion replies: "I couldn't help it. It's in my nature."
- bpodgursky 5y agoThis is trite, inaccurate, and proves you didn't read the article whatsoever.
- what_ever 5y agoThis article is full of such FUD. Everyday HN feels less and less Hacker Newsy. Disc: Googler.
- thereare5lights 5y agoI'm shocked! Shocked I say!
- slackfan 5y agoSurprising absolutely nobody that had a modicum of intelligence.
- deleted 5y ago[deleted]
- mgoetzke 5y agoSide topic , how does Google get so highly detailed traffic congestion patterns without transferring gps coordinates from the phones ? Or if they do, where do they tell the users of phones that they do that (I had several pixel phones and never saw that) ? Is it buried in some fine print ?
- bhalina 5y agoshock and awe