News for hackers. Stuff that matters.
Re:Massachusetts health notifications app installed without ... by sohei on Saturday June 19, 2021 @03:33AM (#27558575)
Someone should archive a copy for reversing. One comment says it has "permission to utilize all device functions".
Re:Massachusetts health notifications app installed without ... by kuschku on Saturday June 19, 2021 @04:01AM (#27558714)
It doesn’t. All it can do is request Google Play Services to enable distributed covid exposure notifications, which in turn means the app itself doesn’t even get bluetooth beacon data.

Your calculator app has more tracking than this.

Re:Massachusetts health notifications app installed without ... by murderfs on Saturday June 19, 2021 @03:54AM (#27558664)
One comment also says that it's a Communist conspiracy.

Over in reality, though, the only permissions it has are to use the internet and bluetooth: https://hastebin.com/yexoyuluzu.xml

Re:Massachusetts health notifications app installed without ... by m463 on Saturday June 19, 2021 @03:57AM (#27558689)
I would imagine you can get location by getting in range of those edison beacons google is pushing.
Re:Massachusetts health notifications app installed without ... by ganzuul on Saturday June 19, 2021 @03:59AM (#27558702)
They bundled bluetooth and location permissions not long ago. Claimed their users were too ill-informed to know the difference.
Re:Massachusetts health notifications app installed without ... by delusional on Saturday June 19, 2021 @04:07AM (#27558748)
Are you sure about that? Previously they required the location permission to scan for nearby bluetooth devices (because of the obvious implications). Recenly they've split that into it's own separate permission. It that what you're thinking of?
Re:Massachusetts health notifications app installed without ... by ganzuul on Saturday June 19, 2021 @04:14AM (#27558782)
Yes, that is it. I did notice it's not the case anymore, but do you know if they admitted error with the change, or gave any kind of motivation?

I think that in this context, this previous issue is relevant.

Re:Massachusetts health notifications app installed without ... by corin_ on Saturday June 19, 2021 @05:57AM (#27559224)
Were you just guessing their motivation before, when you wrote "Claimed their users were too ill-informed to know the difference."?
Re:Massachusetts health notifications app installed without ... by ganzuul on Saturday June 19, 2021 @09:28AM (#27560278)
Not guessing no, but I distilled what they said unfavorably. My understanding was that they thought they could not communicate to their customers the complexity of how bluetooth can be used to infer information about location. But somehow this communications barrier meant that they thought it was better to expose GPS data too? - Hence why I feel justified treating them unfavorably in this case. It was just an absurd way to reason that they presented. It should have been obvious that it's better to protect as much data as possible when the user often has no choice but to enable bluetooth.
Re:Massachusetts health notifications app installed without ... by delusional on Saturday June 19, 2021 @04:03AM (#27558723)
If it works like all the other covid tracking apps it just records randomized bluetooth beacons emitted by all the phones near you.

You can get location in a ton of ways, but I doubt the OS will let you without the proper permission.