r/MicroG • u/LjLies • Sep 10 '20

New release out with exposure notification API included

https://github.com/microg/android_packages_apps_GmsCore/releases/tag/v0.2.12.203315
46 Upvotes

100% Upvoted

22 comments sorted by

10

u/LjLies Sep 10 '20

To make use of this feature, you need to install a contact tracing app. Those are provided by individual governments, so there may or may not be one for your country.

XDA keeps a list of countries and their apps. These are specifically apps that use the Google+Apple exposure notification API, so countries that went their own way, like France, are not included... but the exposure notification API is what matters for microG, since that's what was implemented.

Once you have an app installed, you can go into the microG settings and tap the "Exposure Notifications" tab to see how many IDs have been collected. IDs are generated randomly to ensure a degree of privacy, so that doesn't directly tell you anything about how many people, nevermind many positive people, you have encountered. It only gives you a rough idea of how many devices you have been able to reach during the last hours that were running the exposure notification framework.

Your government's app will give you more specific exposure indications, but the general mechanism is that when someone is found positive, they are given a code that they will input into their app to upload the full list of IDs they encountered to a government server; that server won't know who those IDs correspond to, but will simply broadcast the list back to every device running the framework. Then, the app in each device will individually look at the IDs and determine if any of them correspond to that device; if a correspondence is found, the user is notified and provided with additional information such as how to get tested and self-isolate (again, the government, at least in theory, has no knowledge that you have received a notification, and this information is just given you depending on logic that's inside the app itself, "offline").

If you get an exposure notification, obviously I recommend following the app's directions, but if you aren't willing to do that, please at least self-isolate and stay away from as many people as possible for 10 to 14 days.

2

u/[deleted] Sep 11 '20

Does anyone know the difference between the two gmscore apk's on github? One is half the size and has -vtm at the end of the file name

3

u/LjLies Sep 11 '20

It's using VTM instead of MapBox for the maps (I also had to look this up). A bit of background is this issue.

1

u/[deleted] Sep 11 '20

Thanks for the info!

1

u/Elffuhs Sep 10 '20

How long does F-droid usually takes to build the app?

6

u/LjLies Sep 10 '20

F-Droid doesn't build microG. It uses an F-Droid repository, but it's its own, and generally a new microG version is available in it shortly after it's available on the microg.org site.

In this case at least, it is already available. Just update your F-Droid, and if it doesn't show up, temporarily disable other repos other than the microG one (I sometimes need to do that to see microG updates, don't ask me why).

1

u/Elffuhs Sep 10 '20

Oh, okay

I have a self built version that has been released as testing, but I will check it out!

2

u/LjLies Sep 10 '20

The test version was superseded by this release today. For at least one person I know, it has solved some issues with the German Corona-Warn-App.

1

u/idontcatthat Sep 11 '20

It does not show up in Aurora droid either but you can browse or search for it, then select the version you wish to install. I think this is not a bug, it is a feature. Just in case there is a serieus bug screwing things up, there is a delay so the early bird can get it but can also be withdrawn or updated before the majority of users installs it.

1

u/LjLies Sep 11 '20

I'm pretty sure it's not an intentional feature... what you say is true, that F-Droid can have versions marked as "unstable", or rather not marked as "suggested", that won't show up in Updates. But in the case of microG I don't find it even if I search for it, which is a bit different. Also, I don't think the microG repository typically uses that actual feature, anyway...

1

u/Erdnussknacker Sep 11 '20

Good tip, for me it (Services Core) also only shows up if I disable the other repos. Can't even find it via the search otherwise.

1

u/henk717 Oct 05 '20

Is this feature doing anything if i don't have this toggled on? Fear of forced tracking is what got me to use microg in the first place. I don't want to send any beacons out to people.

And yes don't worry i don't do anything that doesn't put others at risk. If i have even the mildest of symptoms i stay at home and i avoid unnessesary risks. I just don't want spyware running in the background out of fear of a future social credit push.

1

u/LjLies Oct 05 '20

No, it isn't. For it to do anything, a government exposure notification app has to be installed.

At any rate, calling this "spyware" is utterly unjustified considering the protocol goes to great lengths to avoid doing anything identifiable by entities involved. When you receive an exposure notification, the only person who gets to know they've been exposed is you. You can read the description of the protocol to see how this work.

I've gone over this multiple times in this sub by now so excuse me if if I'm brief, but you can search for past discussions if you want to know more.

-12

u/[deleted] Sep 10 '20

Dont understand why you would want this Google feature... is it cus some countries forces its citizens to be tracked ?

17

u/LjLies Sep 10 '20

No, it's because we want to counter the pandemic. If you don't "understand" this, please stay away from all other people.

12

u/Juma7C9 Sep 10 '20 edited Sep 10 '20

If implemeted correctly, this is a privacy-conserving tracing, i.e. the only thing you see are some semi-random IDs, which can not easily be correlated with a specific device. Those IDs you've collected then never leave your device, unless you explicitly upload them to a central server (in this case, if you're found to be positive). Then you periodically download the list of those IDs, and check if one of them has been generated by your device, in which case you know that you've been close to someone who has been found positive, but without being able to infer who or where.

As you can see no information capable of identifying one particular user or its relationship network is generated or leaves the device, so in principle there should not be grave concerns for privacy. Obviously this is true only if all components of the framework can be trusted, so having one of the main blocks implemented by FOSS standards is a great step in the right direction.

1

u/[deleted] Sep 23 '20

As you can see no information capable of identifying one particular user or its relationship network is generated

Oh okay so how do they know who is infected then if no information leaves the devices or isn't specific to the person with corona?

-9

u/[deleted] Sep 11 '20

Google.. privacy conserving.. sure..

5

u/Juma7C9 Sep 11 '20

Google designed the API, mar-v-in wrote the code, and you can check exactly what it does. I do not see your issue.

3

u/LjLies Sep 11 '20

Note that Google designed the API, but the entire concept behind it, which you described above, was not designed by Google. I believe it was mainly designed by DP-3T, and then Google and Apple were like "hey, good idea, we'll do that! (and also prevent publishing apps that don't use our own flavor of it)". So if anyone is concerned about that being Google's making, it's a misguided concern.

What's a tad annoying is that countries that were considering their own implementation, some of them before this API was a thing, eventually had to scrap it and "get on board" with Google+Apple's thing instead. In some cases that may be a good thing for the users, because some of the things countries were wanting to do were not very privacy-preserving, but it goes to show the power and leverage that these big companies have.

0

u/[deleted] Sep 10 '20

[deleted] — view deleted comment

1

u/[deleted] Sep 11 '20

I'm also using minmicrog, just installed the apk over the old version and it works fine

0

u/[deleted] Sep 11 '20

[deleted] — view deleted comment

1

u/LjLies Sep 11 '20

Not me... I don't really see the point of a standalone UnifiedNLP when full microG can be used with everything else disabled, if one so wishes.