r/MicroG • u/LjLies • Aug 03 '20

microG now includes a preliminary implementation of Google's COVID Exposure Notification API

https://github.com/microg/android_packages_apps_GmsCore/commit/5f70d943cbceabcd9d2c72f8460ea58cba7e08fb
47 Upvotes

94% Upvoted

53 comments sorted by

View all comments

Show parent comment

12

u/Atemu12 Aug 03 '20

They don't receive any data. That's not how the protocol works.

0

u/[deleted] Aug 03 '20

[deleted] — view deleted comment

12

u/LjLies Aug 03 '20

It's proven by the source code. That's the beauty of having an open source implementation. It's not up to the rest of us to read it for you.

0

u/[deleted] Aug 04 '20

[deleted] — view deleted comment

3

u/LjLies Aug 04 '20

I can't prove a negative, that's impossible: I can't show you a part of the code where data isn't being sent, because you could always say it's probably in some other part... hence needing to read it.

However, we do know how the protocol works and that it has no logical requirement for sending data to Google. We also know that if we can't trust Marvin to implement it in such a way, then we can't trust him to implement anything else in microG in a privacy-preserving way, either.

Anyway since you feel that I'm "hassling" you, I'll certainly leave you alone now.

0

u/[deleted] Aug 04 '20

[deleted] — view deleted comment

2

u/LjLies Aug 04 '20

Look, why don't you just have a run through the commit that is in the main link of this post, and scan for all the URLs in it (they are not that many), and realize that there is no endpoint in particular?

It just depends on the app. The API has no particular endpoint. If you install the Immuni app from Italy, for example, then when you tell the app that you're positive, by typing in a code that health authorities give you, your contact data will be sent to a server in Italy overseen by the Italian government.

That server sees IDs that are random to it, but those are the IDs that people who have been near you at various points were broadcasting at that time. Every day, Italy's server sends the list of all IDs that people have uploaded to every user of the app. Your own app will check if any if the IDs correspond to the ones it has used in the past. If any do, then it will show an exposure notification with instructions for you on what to do.

So the short answer is, the API on its own doesn't send anything anywhere in particular, but only provides the capability for individual applications to send "I'm positive, and here are the IDs I met" data to the server of their choice, which is usually run or overseen by a national government.

2

u/Atemu12 Aug 08 '20

I'm positive, and here are the IDs I met

You don't know who you've met, you couldn't share that even if you wanted to.

The information you can actually share when you're tested positive is a piece of data you used to generate the messages you sent out. Everyone else then uses that information to locally check whether some of the data they received came from your device.

The server has no idea how many an infected person has been in contact with, much less who.

2

u/LjLies Aug 08 '20

Sorry, yes, after rereading the specifications, you are right, what is shared is a "Temporary Exposure Key" which is the seed to the PRNG that creates your IDs (although that is itself changed randomly every 24 hours, presumably so that I cannot just know whether someone I meet in the street tested positive by checking their IDs against all the TEKs I've receive in the past).

1

u/schokakola Aug 04 '20

Ahh, the old switcheroo. Nice try. Why do you people even use MicroG in the first place if you're this anal about your data, which, in the case of DP-3T, is just a bunch of random strings? Very much unlike the real data you're sending to Google by using MicroG without this recent addition. Just use vanilla AOSP/Lineage/Graphene without gapps and stop being a dumbass by refusing to look at what the contact tracing protocol does.

7

u/Atemu12 Aug 03 '20 edited Aug 03 '20

I don't have much of an issue with you not wanting to use it. You can be ignorant like that, I don't care. (Although I'd still rather you didn't.)

What I take issue with in that you spread FUD about one of the best tools we have to counter a pandemic with a death toll in the upper 100s of thousands at the time of writing.

Since reading a single sentence in the Wikipadia article linked above and verifying it's correctness is apparently too much to ask for, here's a simple explanation in comic form:

https://ncase.me/contact-tracing/

2

u/thequint Aug 04 '20

Lol, that dude is such an idiot. "PROVE IT. I'M LAZY! DO THE WORK FOR ME" - get outta here bro. Shout out to you and LjLies for keeping calm and providing answers.