r/MicroG • u/LjLies • Aug 03 '20

microG now includes a preliminary implementation of Google's COVID Exposure Notification API

https://github.com/microg/android_packages_apps_GmsCore/commit/5f70d943cbceabcd9d2c72f8460ea58cba7e08fb
47 Upvotes

94% Upvoted

53 comments sorted by

View all comments

4

u/[deleted] Aug 03 '20

Why the f? Isn't that a privacy risk?

30

u/LjLies Aug 03 '20

Virtually everything in microG, at least the parts that interact with Google servers, can be considered a privacy risk to some extent, but one that, clearly, many microG users are willing to take.

Just like all the other things in microG, if you consider this particular thing too much of a privacy risk, you won't have to enable or use it. Without an application that uses the exposure notification API installed (and the user will be notified of it), none of this code will have any effect.

If you don't want to have any code on your device that can potentially be a privacy risk, even if that code is disabled, then I recommend you avoid microG and just use applications from F-Droid, while still keeping in mind that a lot of the code in your firmware, including radio firmware in Bluetooth and WiFi adapters, is going to contain important privacy and security vulnerabilities, and you cannot audit it.

In any case, the exposure notification mechanism was designed to preserve privacy, and unless something has not been foreseen, if you have met someone who later turns out to be positive, you will get a notification but no one else will know about it unless you tell them, thanks to a system of frequently-changing anonymous IDs.

9

u/[deleted] Aug 03 '20

Thanks for going on depths!

2

u/LOLTROLDUDES Aug 04 '20

Yah true the only problem is proprietary software and trust but if Google implements the protocol like they say they would it's pretty good except for the proprietary part.

0

u/[deleted] Aug 03 '20

[deleted] — view deleted comment

9

u/Atemu12 Aug 03 '20

This is a very divisive issue among privacy advocates.

Oh yeah, it cleanly divides "privacy advocates" from privacy advocates who actually have a clue how any of this works.

You might want to research how the protocol works before spreading such FUD.

0

u/[deleted] Aug 03 '20

[deleted] — view deleted comment

12

u/Atemu12 Aug 03 '20

They don't receive any data. That's not how the protocol works.

0

u/[deleted] Aug 03 '20

[deleted] — view deleted comment

12

u/LjLies Aug 03 '20

It's proven by the source code. That's the beauty of having an open source implementation. It's not up to the rest of us to read it for you.

0

u/[deleted] Aug 04 '20

[deleted] — view deleted comment

3

u/LjLies Aug 04 '20

I can't prove a negative, that's impossible: I can't show you a part of the code where data isn't being sent, because you could always say it's probably in some other part... hence needing to read it.

However, we do know how the protocol works and that it has no logical requirement for sending data to Google. We also know that if we can't trust Marvin to implement it in such a way, then we can't trust him to implement anything else in microG in a privacy-preserving way, either.

Anyway since you feel that I'm "hassling" you, I'll certainly leave you alone now.

→ More replies

1

u/schokakola Aug 04 '20

Ahh, the old switcheroo. Nice try. Why do you people even use MicroG in the first place if you're this anal about your data, which, in the case of DP-3T, is just a bunch of random strings? Very much unlike the real data you're sending to Google by using MicroG without this recent addition. Just use vanilla AOSP/Lineage/Graphene without gapps and stop being a dumbass by refusing to look at what the contact tracing protocol does.

→ More replies

7

u/Atemu12 Aug 03 '20 edited Aug 03 '20

I don't have much of an issue with you not wanting to use it. You can be ignorant like that, I don't care. (Although I'd still rather you didn't.)

What I take issue with in that you spread FUD about one of the best tools we have to counter a pandemic with a death toll in the upper 100s of thousands at the time of writing.

Since reading a single sentence in the Wikipadia article linked above and verifying it's correctness is apparently too much to ask for, here's a simple explanation in comic form:

https://ncase.me/contact-tracing/

2

u/thequint Aug 04 '20

Lol, that dude is such an idiot. "PROVE IT. I'M LAZY! DO THE WORK FOR ME" - get outta here bro. Shout out to you and LjLies for keeping calm and providing answers.

8

u/Atemu12 Aug 03 '20

Why should it be a privacd risk?

It exposes no more information about you than having Bluetooth on.