3 ms·

If this is true, doesn’t this mean Android is unsafe/compromised by default? The suit, as described, leaves a lot of questions.

adam_arthur 4y ago
If Google is involved and allows random apps like this, then yes
simpss 4y ago
I'm pretty sure these submissions are related: https://news.ycombinator.com/item?id=27558500#27558758 https://news.ycombinator.com/item?id=27558500#27558758
anonymousiam 4y ago
You would be naive to believe that Android/iOS are secure in this respect. Pretty much every government in the world has a "need" to surveil their population, and have "insisted" upon this capability.
- andybak 4y ago
  In this particular instance, color me naive. You're saying a State Government can request Google installs a 3rd party app on 1 million phones? If that's true then I'm genuinely astonished. And more so that it wasn't headline news at the time. Or maybe there's more to this than currently is apparent.
  - deleted 4y ago
    [deleted]
  - jesboat 4y ago
    > You're saying a State Government can request Google installs a 3rd party app on 1 million phones? If that's true then I'm genuinely astonished. And more so that it wasn't headline news at the time. Yes. That's what happened. (I'm not sure if the 1E6 phones claim is accurate, but it was a non-trivial chunk of people near MA).
  - detaro 4y ago
    It was reported at the time: https://9to5google.com/2021/06/19/massachusetts-massnotify-app/ https://9to5google.com/2021/06/19/massachusetts-massnotify-a... https://arstechnica.com/gadgets/2021/06/even-creepier-covid-tracking-google-silently-pushed-app-to-users-phones/ https://arstechnica.com/gadgets/2021/06/even-creepier-covid-... https://www.bleepingcomputer.com/news/security/google-force-installs-massachusetts-massnotify-android-covid-app/ https://www.bleepingcomputer.com/news/security/google-force-... https://news.ycombinator.com/item?id=27558500 https://news.ycombinator.com/item?id=27558500
GeekyBear 4y ago
> The suit, as described, leaves a lot of questions. Here's what the suit alleges: >To increase adoption, starting on June 15, 2021, DPH worked with Google to secretly install the Contact Tracing App onto over one million Android mobile devices located in Massachusetts without the device owners’ knowledge or permission. When some Android device owners discovered and subsequently deleted the App, DPH would re-install it on to their devices. https://nclalegal.org/wp-content/uploads/2022/11/Complaint_Wright-with-Exhibit.pdf https://nclalegal.org/wp-content/uploads/2022/11/Complaint_W... Google made a statement confirming that the app was pushed by the Play Store at the time: >We have been working with the Massachusetts Department of Public Health to allow users to activate the Exposure Notifications System directly from their Android phone settings. This functionality is built into the device settings and is automatically distributed by the Google Play Store https://arstechnica.com/gadgets/2021/06/even-creepier-covid-tracking-google-silently-pushed-app-to-users-phones/ https://arstechnica.com/gadgets/2021/06/even-creepier-covid-...
- lakomen 4y ago
  So Google Play Store installs apps without consent. And one can't unistall Google Play Store. Ergo, we finally need to liberate our phones and tablets with an open alternative which isn't F-Droid.
  - MichaelCollins 4y ago
    Why not F-Droid? F-Droid is great.
toast0 4y ago
If you don't trust Google, commercial Android is not for you. Google can push apps onto your phone and the apps can run without interaction on the phone. Often that's useful and authorized by the user --- you can use the google play website to push things, but this case shows it's not limited to that. I don't think you can disable this through settings, you would have to disable play services or block the networking or not have gapps installed or something. Play services runs in a priviledged mode and generally updates itself, so there's a lot of trust needed. Afaik, all modern commercial OSes intended for end users have a similar level of trust required for the vendor. The capability to push code run in a privileged space enables rapid response to emergent malware, but also enables the vendor to take actions without explicit consent.
- landemva 4y ago
  I keep Play Store disabled and only enable it when I want to update apps. This seems to keep regular apps from auto-updating. I don't often need GPS, so I wonder if disabling Play Services would work for me without allowing forced spyware pushes.

adam_arthur 4y ago

If Google is involved and allows random apps like this, then yes

simpss 4y ago

I'm pretty sure these submissions are related: https://news.ycombinator.com/item?id=27558500#27558758 https://news.ycombinator.com/item?id=27558500#27558758

anonymousiam 4y ago

You would be naive to believe that Android/iOS are secure in this respect. Pretty much every government in the world has a "need" to surveil their population, and have "insisted" upon this capability.

andybak 4y ago
In this particular instance, color me naive. You're saying a State Government can request Google installs a 3rd party app on 1 million phones? If that's true then I'm genuinely astonished. And more so that it wasn't headline news at the time. Or maybe there's more to this than currently is apparent.
- deleted 4y ago
  [deleted]
- jesboat 4y ago
  > You're saying a State Government can request Google installs a 3rd party app on 1 million phones? If that's true then I'm genuinely astonished. And more so that it wasn't headline news at the time. Yes. That's what happened. (I'm not sure if the 1E6 phones claim is accurate, but it was a non-trivial chunk of people near MA).
- detaro 4y ago
  It was reported at the time: https://9to5google.com/2021/06/19/massachusetts-massnotify-app/ https://9to5google.com/2021/06/19/massachusetts-massnotify-a... https://arstechnica.com/gadgets/2021/06/even-creepier-covid-tracking-google-silently-pushed-app-to-users-phones/ https://arstechnica.com/gadgets/2021/06/even-creepier-covid-... https://www.bleepingcomputer.com/news/security/google-force-installs-massachusetts-massnotify-android-covid-app/ https://www.bleepingcomputer.com/news/security/google-force-... https://news.ycombinator.com/item?id=27558500 https://news.ycombinator.com/item?id=27558500

GeekyBear 4y ago

> The suit, as described, leaves a lot of questions. Here's what the suit alleges: >To increase adoption, starting on June 15, 2021, DPH worked with Google to secretly install the Contact Tracing App onto over one million Android mobile devices located in Massachusetts without the device owners’ knowledge or permission. When some Android device owners discovered and subsequently deleted the App, DPH would re-install it on to their devices. https://nclalegal.org/wp-content/uploads/2022/11/Complaint_Wright-with-Exhibit.pdf https://nclalegal.org/wp-content/uploads/2022/11/Complaint_W... Google made a statement confirming that the app was pushed by the Play Store at the time: >We have been working with the Massachusetts Department of Public Health to allow users to activate the Exposure Notifications System directly from their Android phone settings. This functionality is built into the device settings and is automatically distributed by the Google Play Store https://arstechnica.com/gadgets/2021/06/even-creepier-covid-tracking-google-silently-pushed-app-to-users-phones/ https://arstechnica.com/gadgets/2021/06/even-creepier-covid-...

lakomen 4y ago
So Google Play Store installs apps without consent. And one can't unistall Google Play Store. Ergo, we finally need to liberate our phones and tablets with an open alternative which isn't F-Droid.
- MichaelCollins 4y ago
  Why not F-Droid? F-Droid is great.

toast0 4y ago

If you don't trust Google, commercial Android is not for you. Google can push apps onto your phone and the apps can run without interaction on the phone. Often that's useful and authorized by the user --- you can use the google play website to push things, but this case shows it's not limited to that. I don't think you can disable this through settings, you would have to disable play services or block the networking or not have gapps installed or something. Play services runs in a priviledged mode and generally updates itself, so there's a lot of trust needed. Afaik, all modern commercial OSes intended for end users have a similar level of trust required for the vendor. The capability to push code run in a privileged space enables rapid response to emergent malware, but also enables the vendor to take actions without explicit consent.

landemva 4y ago
I keep Play Store disabled and only enable it when I want to update apps. This seems to keep regular apps from auto-updating. I don't often need GPS, so I wonder if disabling Play Services would work for me without allowing forced spyware pushes.