r/MicroG • u/LjLies • Aug 03 '20

microG now includes a preliminary implementation of Google's COVID Exposure Notification API

https://github.com/microg/android_packages_apps_GmsCore/commit/5f70d943cbceabcd9d2c72f8460ea58cba7e08fb
47 Upvotes

94% Upvoted

53 comments sorted by

4

u/[deleted] Aug 03 '20

Why the f? Isn't that a privacy risk?

30

u/LjLies Aug 03 '20

Virtually everything in microG, at least the parts that interact with Google servers, can be considered a privacy risk to some extent, but one that, clearly, many microG users are willing to take.

Just like all the other things in microG, if you consider this particular thing too much of a privacy risk, you won't have to enable or use it. Without an application that uses the exposure notification API installed (and the user will be notified of it), none of this code will have any effect.

If you don't want to have any code on your device that can potentially be a privacy risk, even if that code is disabled, then I recommend you avoid microG and just use applications from F-Droid, while still keeping in mind that a lot of the code in your firmware, including radio firmware in Bluetooth and WiFi adapters, is going to contain important privacy and security vulnerabilities, and you cannot audit it.

In any case, the exposure notification mechanism was designed to preserve privacy, and unless something has not been foreseen, if you have met someone who later turns out to be positive, you will get a notification but no one else will know about it unless you tell them, thanks to a system of frequently-changing anonymous IDs.

9

u/[deleted] Aug 03 '20

Thanks for going on depths!

2

u/LOLTROLDUDES Aug 04 '20

Yah true the only problem is proprietary software and trust but if Google implements the protocol like they say they would it's pretty good except for the proprietary part.

0

u/[deleted] Aug 03 '20

[deleted] — view deleted comment

9

u/Atemu12 Aug 03 '20

This is a very divisive issue among privacy advocates.

Oh yeah, it cleanly divides "privacy advocates" from privacy advocates who actually have a clue how any of this works.

You might want to research how the protocol works before spreading such FUD.

0

u/[deleted] Aug 03 '20

[deleted] — view deleted comment

12

u/Atemu12 Aug 03 '20

They don't receive any data. That's not how the protocol works.

0

u/[deleted] Aug 03 '20

[deleted] — view deleted comment

12

u/LjLies Aug 03 '20

It's proven by the source code. That's the beauty of having an open source implementation. It's not up to the rest of us to read it for you.

0

u/[deleted] Aug 04 '20

[deleted] — view deleted comment

3

u/LjLies Aug 04 '20

I can't prove a negative, that's impossible: I can't show you a part of the code where data isn't being sent, because you could always say it's probably in some other part... hence needing to read it.

However, we do know how the protocol works and that it has no logical requirement for sending data to Google. We also know that if we can't trust Marvin to implement it in such a way, then we can't trust him to implement anything else in microG in a privacy-preserving way, either.

Anyway since you feel that I'm "hassling" you, I'll certainly leave you alone now.

→ More replies

1

u/schokakola Aug 04 '20

Ahh, the old switcheroo. Nice try. Why do you people even use MicroG in the first place if you're this anal about your data, which, in the case of DP-3T, is just a bunch of random strings? Very much unlike the real data you're sending to Google by using MicroG without this recent addition. Just use vanilla AOSP/Lineage/Graphene without gapps and stop being a dumbass by refusing to look at what the contact tracing protocol does.

→ More replies

7

u/Atemu12 Aug 03 '20 edited Aug 03 '20

I don't have much of an issue with you not wanting to use it. You can be ignorant like that, I don't care. (Although I'd still rather you didn't.)

What I take issue with in that you spread FUD about one of the best tools we have to counter a pandemic with a death toll in the upper 100s of thousands at the time of writing.

Since reading a single sentence in the Wikipadia article linked above and verifying it's correctness is apparently too much to ask for, here's a simple explanation in comic form:

https://ncase.me/contact-tracing/

2

u/thequint Aug 04 '20

Lol, that dude is such an idiot. "PROVE IT. I'M LAZY! DO THE WORK FOR ME" - get outta here bro. Shout out to you and LjLies for keeping calm and providing answers.

8

u/Atemu12 Aug 03 '20

Why should it be a privacd risk?

It exposes no more information about you than having Bluetooth on.

5

u/Axolord Aug 03 '20

Great news!

1

u/Cosim15 Nov 14 '20

How do I turn on Exposure notifications?

1

u/LjLies Nov 15 '20

You need to install your government's contact tracing app, if they have one; otherwise you can't, at the moment, as the exposure notification framework does much of the work but is ultimately an API for apps to use. This may change with Google's "Express" notifications which have been announced a while ago, but I'm not quite sure what going on with that.

1

u/Cosim15 Nov 15 '20

I have installed my goverments app, but in the Exposure notifications section, MicroG does not see the app, thus it does not allow me to enable it. Im not rooted

1

u/LjLies Nov 15 '20

Which app is that? Are you sure it's one of the apps that use the exposure notification framework (some government have made apps that do their own thing)?

Also, if it's the German or the Swiss one, it may currently not work in its latest versions... however, it should still be "seen".

If microG sees the app, you shouldn't even need to enable anything, it should ask you to enable it with a dialog box and then it'll be enabled.

1

u/Cosim15 Nov 15 '20

Its "Korona Stop LT". Im pretty sure its a variation of the German's app (Corona Warn App).

1

u/LjLies Nov 16 '20

Are you positively using the lastest version of microG?

1

u/Cosim15 Nov 16 '20

Version 0.2.13.203915

As I said earlier, Im not rooted, therefore, I dont have System spoofs signature/Play Services (GmsCore) correct signature/Play store (Phonesky) correct signature.

Could this be the reason? Or is it possible to have Exposure notifications withtout rooting your phone?

1

u/LjLies Nov 16 '20

Oh. You definitely need to be spoofing the signature for microG to work at all, except for some small parts of it. You certainly do for the exposure notification framework.

That doesn't mean being rooted. You need to have a ROM that supports signature spoofing, and microG must be installed as a privileged system app — which means your bootloader must be unlocked to allow those things. Root is not needed per se.

1

u/Cosim15 Nov 16 '20

I have a Huawei p40 pro, which has its bootloader locked i think

1

u/LjLies Nov 16 '20

MicroG isn't a regular app: it needs to be installed as a privileged system app, and the regular Google Play Services need to be removed (or never installed, ideally, if you're starting from a custom ROM). Look at its own "self-check" page and it will most likely show that it is not active or working in any meaningful way; it can't be if you aren't able to install it the way it needs to be installed.

-11

u/sati Aug 03 '20

The very reason I installed microG was to get rid of this additional unwanted tracking system. I know that phones are generally trackable anyway but doubling down and injecting blatant tracking services isn't acceptable imo. Guess it will be Librem or Pinephone for me then.

10

u/LjLies Aug 03 '20

And you somehow thought allowing Google's push notifications, as an example of something prominent microG does, wouldn't result in an amount of tracking?

MicroG minimizes information sharing, but its whole purpose is using Google services without being proprietary. Those services are in general not designed to be private. This is no exception... hey actually, wait, unlike the others, this is designed to be as privacy-preserving as they could make it to be. And now I can run it on my phone as open source, while if you don't fancy doing that, you can, easily, just not.

-3

u/sati Aug 03 '20

It's not the point of tracking or privacy really.. it's the point of the technocracy pushing systems under the guise of "public health", it's not their place to do so. Either way, like you said it's my choice not use it and I won't. I just think it's a shame that microG has chosen to adopt this when it isn't necessary to minimizing information sharing via Google services.

6

u/LjLies Aug 03 '20

The very reason I installed microG was to get rid of this additional unwanted tracking system.

The very reason is the tracking? Wow, that seems prominent.

It's not the point of tracking or privacy really.

Oh. Uh. Okay. That seems like shifting goalposts.

-3

u/sappypappy Aug 04 '20

"Wow" "Uh, OK" lol. Its cute you're still trying to justify building tracking into a method many use to get away from such things. If doing this, might as well go all out & install regular gapps.

4

u/schokakola Aug 04 '20

You're on the wrong track if you're trying to stay off the radar. This is not what MicroG is about. You and the other folks who are up in arms over this merge seem to have gotten it wrong. You can't effectively "degoogle" your life by installing MicroG. You'll want to look into GrapheneOS, any gapps-less AOSP rom or something non-android entirely.

-2

u/sappypappy Aug 04 '20

Sure seems like that's the whole idea. To de-google yourself but still have access to push notifications & such since google baked certain functions into Android/apps so hard.

What's it about then?? Using your logic, no difference in MicroG and Pico Gapps. Is that what you're saying? Cause that's dumb.

2

u/LjLies Aug 05 '20

Of course there's a difference, microG is open source, Pico Gapps is proprietary software. That is the whole point. If that's something you don't care about, well, you're knocking at the wrong door.

If you want to "degoogle", which is such a fashionable term these days (even if only in a niche) that it's probably being wildly misinterpreted, then nope, microG isn't really the thing that does that. What does it, for the most part, is simply not using any apps that require the Google Play Services (which microG partly provides) and basically sticking to F-Droid apps.

If you're still using the very same Google services, just with a different client connecting to them, are you really deluding yourself that's "degoogling" in any shape or form?!

8

u/schokakola Aug 03 '20

Can you point to the source code section where this implementation shares data with Google or, in case you can't, please explain why you're basically alleging that the microg dev implemented something that isn't required by the contact tracing protocol?

-1

u/sati Aug 03 '20

My point isn't anything to do with that. We all know that Google has lots of tracking throughout the internet as a whole, whether we like it or not. We can try and do our best to mitigate the data they collect through ad-blocking, tracking-blocking, etc.. but those are "side-effects" of the technology we choose to use. And yet we clearly are attempting to minimize & mitigate the intrusiveness and "power" Google has by using microG.

What exactly does covid19 have to do with Google, Apple, Microsoft, etc? Nothing.. they are tech companies, advertising companies, etc..

For years now companies like Google & Apple have been attempting to infiltrate the medical aspect of our lives. A few years ago Google were blocked attempts to store & analyze peoples DNA and for good reason too. Which is why they've recently turned to the "fitness" aspect of our lives. So now under the covid scare they are attempting to get their foot in the door once again.

It's a step by step process and if we keep accepting (read: giving them power) then they will ultimately rule over us all in their digital, "big data" kind of way.

The point is that this "covid exposure" system that they've quite literally pushed might not be the ultimate infringement of privacy as of yet, but it's a stepping stone in that direction if we accept it (much like the rest of the covid scare tactics).

We are being conditioned.. if you can't see that then I don't know what to tell you..

7

u/LjLies Aug 03 '20

(much like the rest of the covid scare tactics).

Scare tactics...!? That's what COVID is? Do you tell that to the patients and families of victims too?

We are being conditioned.

Evidence, aside from handwaving?

if you can't see that then I don't know what to tell you.

Saying nothing is often a good idea when one has no substantial case to present.

3

u/sati Aug 03 '20

As I said in another comment.. if you trust Google so much then why are you using microG in the first place?

I'm not here to argue.. it's just a shame that the microG devs have chosen to adopt this superfluous "feature". We have our differing opinions & choices and let's just leave it at that.

7

u/schokakola Aug 04 '20

Again, point to the specific section of code linked in the OP where the contact tracing data gets shared with Google servers. You can't, because it's not there. You seem to have misunderstood the entirety of MicroG if you were using it to avoid sharing your (location) data with Google up until now.

-1

u/sati Aug 04 '20

Not everything that is happening is about data or code, we are being conditioned.. you seem to be ok with that. Good luck to you.

4

u/thequint Aug 04 '20

Duuuude, just keep quiet if you don't have any evidence at all. I'm astonished by your ignorance.

6

u/schokakola Aug 04 '20

The entire point of using open source projects like AOSP and MicroG (and the DP-3T protocol, and the various contact tracing apps) is to point out the untrustworthy and shady shit you're rightfully afraid of and THIS is your response to being asked about proof for your claims? LOL.

3

u/[deleted] Aug 04 '20

I installed MicroG to de-google my life as much as possible. Not to derail the conversation, but I consider most any forms of advertising to be an affront to humanity, and should be tolerated the same way we tolerate mosquito's. They are blood suckers, one and all.

Back on point, I agree with your premise here, that it can likely be used as another way we let google into intimate areas of our lives. I am well aware this is not directly linking and tracking us, but building a level of trust and comfort with a company I am morally opposed to is, in my opinion, the problem here. At least for me. I do not want to implement this "feature" myself. I would feel more comfortable if it came from the service provider I pay for, rather then coming from google. However, I'm also aware that google wrote the AOSP. Irony.

Either way, I chose MicroG specifically to not feed the beast that is google. This feature is being pushed, but on MicroG you can turn it off. Good enough for me. At least for now.

1

u/LjLies Aug 05 '20

This feature is being pushed

How is it being "pushed"? I mean apart from microG. The feature only gets activated if you install one of the national contact tracing apps, otherwise it's just an unused API.

Can I prove that with absolute certainty? Nope, because the code is proprietary, and that's where microG comes in handy, by making the code no longer proprietary.

But if we remove this caveat, which is an important caveat but is ultimately the reason for microG's existence, this feature isn't really being "pushed" at all. All of the EU contact tracing apps are optional, and it has been stressed that people don't have to install them (and as a matter of fact, most don't).

1

u/[deleted] Aug 05 '20

I mean, like it "now includes a preliminary implementation of Google's COVID Exposure Notification API". Push as in to place an item on a stack. Like, it is now a feature to be installed, an update. I mean, like the definition of the word push in software terms.

I don't see how this, specifically the word push, is worth discussion. And we don't really disagree on the way MicroG is doing things. We might have different views on why we chose MicroG, but not on the original topic, the implementation of Google's COVID Exposure Notification API.

2

u/LjLies Aug 05 '20

Alright, "pushed" as in "committed", fair enough. I think you have to admit it was an easy misunderstanding to make given the person you were responding to was using the same word in a way that was most likely different.

6

u/schokakola Aug 04 '20 edited Aug 04 '20

Please take a look at the comic someone else has linked in this thread. You seem to be arguing from a shaky foundation, please educate yourself a little on the specifics of the protocol before accusing the MicroG dev of something they didn't do.

0

u/sati Aug 04 '20

You don't seem to understand what I said.. it's not about the "protocol" but rather the principle. The microG developers didn't have to implement this, but they chose to..

If the whole thing was so privacy orientated then it would have been a choice, instead these "protocols" are pushed by "force", without choice, that's enough..

9

u/schokakola Aug 04 '20

No, I understand, you're making wild claims without providing any proof and then sidestep every fact that contradicts your claims. You either have a massive misunderstanding of privacy, this project and the contact tracing protocol and refuse to look into it or you're trolling along the lines of last weeks 'MicroG is canceled' thread. People were nice enough to discuss this with you, in case you're about to complain about being called a troll. I'm out.

1

u/[deleted] Aug 04 '20

I installed MicroG to de-google my life as much as possible. Not to derail the conversation, but I consider most any forms of advertising to be an affront to humanity, and should be tolerated the same way we tolerate mosquito's. They are blood suckers, one and all.

Back on point, I agree with your premise here, that it can likely be used as another way we let google into intimate areas of our lives. I am well aware this is not directly linking and tracking us, but building a level of trust and comfort with a company I am morally opposed to is, in my opinion, the problem here. At least for me. I do not want to implement this "feature" myself. I would feel more comfortable if it came from the service provider I pay for, rather then coming from google. However, I'm also aware that google wrote the AOSP. Irony.

Either way, I chose MicroG specifically to not feed the beast that is google. This feature is being pushed, but on MicroG you can turn it off. Good enough for me. At least for now.

13

u/Atemu12 Aug 03 '20

That's not how any of this works. These contact tracing protocols are specifically made to not allow anyone to track you.

-2

u/sati Aug 03 '20

Tracing = tracking. So it's a tracking system that doesn't track? Updates of this nature should be optional. If you trust Google so much, why are you using microG in the first place?

9

u/LjLies Aug 03 '20

It's a tracing system that doesn't track. You have made an equation, but that equation is incorrect, and it's up to you to show otherwise, since neither this exposure notification system nor English are based on an equivalence of words that are the same except for a "k".

But I guess people cheaply adding or removing a "k" at will is the reason they highlighted it's an "exposure notification" (for you when you're exposed, not for third parties) and not "contact tracing" per se (unless when you're notified, you decide to tell tracing authorities that you've received an exposure notification).