6 ms·
This is the interesting thing about it: The signals that a phone’s contact tracing data generates and receives are saved into an Android device’s system logs.
by mkesper 6y ago
This is the interesting thing about it:
The signals that a phone’s contact tracing data generates and receives are saved into an Android device’s system logs. Studies have found that more than 400 preinstalled apps on phones built by Samsung, Motorola, Huawei, and other companies have permission to read system logs for crash reports and analytic purposes.
- arsome 6y agoBut again, they also have system privileges on your phone and if they wanted to dump location data or bluetooth scans they could do so trivially. About the worst that could come of this is an accidental capture in a crash report.
- ballenf 6y agoSo maybe Google shouldn't have guaranteed privacy of this app on a phone OS where such a promise is impossible to deliver?
- gruez 6y agoWhat type of guarantees did they promise?
- Sebb767 6y agoBasically any device can be seen as compromised if anyone malicious had hardware or root access - including the manufacturer. If you don't trust your manufacturer, you have far bigger problems than bluetooth IDs in the log.
- dylan604 6y agoBut that's just it. I DON'T trust Google one iota.
- ryukafalz 6y agoThen if you have an Android phone, you have no reason to believe your location data is private from Google, with or without the contact tracing app. I'm not saying this isn't a problem, I'm in the same boat here, just that the contact tracing app doesn't really add to it.
- nthj 6y agoThen you shouldn’t have an Android device. This isn’t complicated.
- dylan604 6y agoI don't have an Android device presicely because of this. I don't use Google Chrome, search, etc. I block all GA,Tagmanager,blahblahblah as well.
- oefrha 6y agoGreat, this “issue” is irrelevant to you and your off-topic rant adds exactly nothing to this discussion of a clearly defined risk. For other people who have made a relevant device choice, the point stands that it’s a non-issue since there’s no additional risk.
- procombo 6y agoHardly. Your privacy also depends on what devices your neighbors use. Bluetooth/Wifi/etc packet broadcast, etc. Apple does _some_ things to midigate privacy risks for their users, but not enough.
- heavyset_go 6y agoThis. My wireless networks, MAC addresses etc are collected on Google's end by my neighbors' Google devices for things like advanced location tracking.
- radicalbyte 6y agoI consider Facebook malicious, and I've just learnt that their pre-installed app basically has root on my Android. How is that not the story here?
- arsome 6y agoNo, the Facebook app most likely does not have any special permissions. These are typically granted by manufacturers based on their own signing keys.
- Bud 6y agoHow are you even remotely surprised by that? If you are expecting any privacy or security from a combo of Facebook and Android, you've been asleep for the last 13 years.
- ahupp 6y agoA preinstalled fb app does not have any special permissions.
- shawnz 6y agoThis seems like saying they shouldn't have guaranteed privacy because someone could be looking over your shoulder while you type your password. Maybe that's true, but it also seems like a uselessly impractical way to interpret things.
- macinjosh 6y ago> About the worst that could come of this is an accidental capture in a crash report. So.. this data is exposed and available even though they said would/could never leak. Seems pretty cut and dry to me. It is a black and white issue. Accidental disclosure is still a disclosure.
- joshuamorton 6y agoIt's accidental exposure to someone who already had root and could record the data themselves.
- shadowgovt 6y agoI think there's a practical difference between what an app could do with root permissions and what is widely understood to be likely or acceptable. The "anything the app could do it is doing" model isn't really the right model to apply for vendor apps that are generally trusted by consumers (and observed by security researchers). We're not talking malware with root; we're talking the regular system health and monitoring apps that vendors install. So it's real unlikely that MotoCare is intentionally trying to de-anonymize someone's COVID-19 data by code injection or continuous GPS logging. It is extremely likely and expected that the app is periodically grabbing the syslog as a crash report, and that means Google's claim of keeping your data private now has to implicitly assume that MotoCare, without doing anything special other than its regular behavior, is also keeping your data private. That's not a claim Google should be implicitly making on behalf of MotoCare (let alone on behalf of every app that could hypothetically be installed on your system and is understood to be well-behaved in the sense that it just reads the syslog). It's really incumbent on a privacy-protecting application to not put private data in the syslog. If it's in the syslog, it's not private (even though it's more private than, say, a notification on the homescreen).
- lofi_lory 6y agoI imagine for semi-criminal actors, injecting code or "accidentally" using systen data, are still two different scenarios. I mean, state actors could also just follow you around, or place agents as friends and family... so why bother about anything?
- not_knuth 6y agoLink to studies?
- derpus 6y agoThe researcher linked to the paper (https://haystack.mobi/papers/preinstalledAndroidSW_preprint.pdf https://haystack.mobi/papers/preinstalledAndroidSW_preprint....) in their original blog post on Appcensus (https://blog.appcensus.io/2021/04/27/why-google-should-stop-logging-contact-tracing-data/ https://blog.appcensus.io/2021/04/27/why-google-should-stop-...)