Hacker News Reader

Comment by sohei | Hacker News Reader

Someone should archive a copy for reversing. One comment says it has "permission to utilize all device functions".

It doesn’t. All it can do is request Google Play Services to enable distributed covid exposure notifications, which in turn means the app itself doesn’t even get bluetooth beacon data.

Your calculator app has more tracking than this.

One comment also says that it's a Communist conspiracy.

Over in reality, though, the only permissions it has are to use the internet and bluetooth: https://hastebin.com/yexoyuluzu.xml

I would imagine you can get location by getting in range of those edison beacons google is pushing.

They bundled bluetooth and location permissions not long ago. Claimed their users were too ill-informed to know the difference.

Are you sure about that? Previously they required the location permission to scan for nearby bluetooth devices (because of the obvious implications). Recenly they've split that into it's own separate permission. It that what you're thinking of?

Yes, that is it. I did notice it's not the case anymore, but do you know if they admitted error with the change, or gave any kind of motivation?

I think that in this context, this previous issue is relevant.

Were you just guessing their motivation before, when you wrote "Claimed their users were too ill-informed to know the difference."?

Not guessing no, but I distilled what they said unfavorably. My understanding was that they thought they could not communicate to their customers the complexity of how bluetooth can be used to infer information about location. But somehow this communications barrier meant that they thought it was better to expose GPS data too? - Hence why I feel justified treating them unfavorably in this case. It was just an absurd way to reason that they presented. It should have been obvious that it's better to protect as much data as possible when the user often has no choice but to enable bluetooth.

If it works like all the other covid tracking apps it just records randomized bluetooth beacons emitted by all the phones near you.

You can get location in a ton of ways, but I doubt the OS will let you without the proper permission.

Reply on news.ycombinator.com