Will you download the contact tracing app?

sydthebeat

Let me be clear, I've no issue myself with location being on from a privacy point of view, it's the battery drain that worries me.

In my day to day I never have Bluetooth and location always on, and I just about get 12 full hours out of my phone. I'd classify myself as a fairly moderate user.

I'll keep an eye on accubattery today to see what impact both of these being on has

sydthebeat

KildareP wrote: »

Welcome to the joy of Android permissions.

The Covid app uses Bluetooth beacons to identify the devices of those around you who also have the app that you come into close contact with.

Traditionally, this type of tracking is used specifically to track your location (an example is when you walk into a shopping centre and your phone offers to show you a map of the shopping centre, but it's also used to target location-based advertising at you too) so it is wrapped up in the Location Services permission.

However the Covid app isn't interested in tracking your location.

Unfortunately Android permissions is a minefield (and Google have made permissions much more granular in Android 10 in recognition of this). At one stage, most apps required pretty much every permission going to work despite it not being in anyway linked to the majority of those permissions requested.

This is why YellowBucket can turn location services off and the app still works (presumably running Android 10) but myfreespirit cannot (running Android 7).

Thanks kildareP, so are you saying that location DOES NOT need to be turned on for this app to work properly?

KildareP

sydthebeat wrote: »

Let me be clear, I've no issue myself with location being on from a privacy point of view, it's the battery drain that worries me.

In my day to day I never have Bluetooth and location always on, and I just about get 12 full hours out of my phone. I'd classify myself as a fairly moderate user.

I'll keep an eye on accubattery today to see what impact both of these being on has

Location Services and Bluetooth being on shouldn't make all that big an impact on battery life on their own.

What usually happens though is some apps are very location happy and will regularly ping for accurate location which does hit battery hard (try running Google Maps on a car journey without plugging into power and see how far you get).

sydthebeat

sydthebeat wrote: »

Thanks kildareP, so are you saying that location DOES NOT need to be turned on for this app to work properly?

Depends on how old your phone is.

KildareP

sydthebeat wrote: »

Thanks kildareP, so are you saying that location DOES NOT need to be turned on for this app to work properly?

I think on Android version below 10 (or perhaps 9, can't remember for certain) you have to have Location Services turned on for the app to work, even though it isn't looking for your location (if that makes sense )

sydthebeat

ronoc wrote: »

Depends on how old your phone is.

Pocophone F1, Sept 2018

Running miui 11 which is based on android 10.

Peregrinus

sydthebeat wrote: »

Thanks kildareP, so are you saying that location DOES NOT need to be turned on for this app to work properly?

ronoc wrote: »

Depends on how old your phone is.

But even if your phone does require you to turn on location services in order to run the app, as I understand it the app still does not actually use location services to identify or record your location.

Tl;dr: The app does not track or record where you have been. It records who you have spent time with but not where that happened, since the latter information is irrelevant to its purpose.

YellowBucket

Unfortunately, there’s nothing this app can do to solve the legacy of Google’s mess of low granularity permissions. The only thing that will solve that is an upgrade to Android 10.

The app isn’t using GPS and isn’t gathering data other than Bluetooth proximity and that’s only linked to meaningless random codes being shared.

You can be alerted to having been in contact with someone without any personal data from your side being shared with the HSE or anyone else. The matching is done by your phone, locally comparing the codes it has gathered to a hotlist off codes uploaded by people who’ve tested positive for covid 19 within a certain time frame.

All your phone does is alert you if you’ve been in contact with a code that’s on that hotlist and for long enough to have been at risk.

Even if you’re diagnosed positive, uploading your codes is in your control entirely.

They don’t even get your phone number unless you’ve specifically given it.

It’s a deliberately distributed, non centralised way of tracing contacts.

sydthebeat

KildareP wrote: »

I think on Android version below 10 (or perhaps 9, can't remember for certain) you have to have Location Services turned on for the app to work, even though it isn't looking for your location (if that makes sense )

That makes sense, though it still means practically that location needs to be turned on in order for the app to work, which is counter to the way the publicity about the phone is being offered.

Its a bit disingenuous to say to people we won't be tracking your location, but we need you to turn your location tracker on in order for it to work.

I'm still waiting for someone to explain who Bluetooth itself cannot do this job? I don't need location to be on in order to Bluetooth info to another nearby phone, so why does this app need it on?

average_runner

plodder wrote: »

I think the fact remains that the Covid app is not allowed to query GPS location. That is a different thing to "Location Services" which must be switched on to use the exposure notification service. If you check the app in settings you can see which apps request access to "Location" and Covid tracker does not.

I can see why this causes confusion and it's a shame the TCD guy quoted didn't make that distinction.

Telling the truth and good news doesn't sell papers

YellowBucket

It’s not in anyway disingenuous. They aren’t using any GPS data or tracking your location. They couldn’t be any clearer about this.

Google had a stupid system that was a bit like having all your house lights controlled by two switches marked Upstairs and Downstairs.

So you could have all the lights on a given floor on or off, but you couldn’t decide which rooms.

Google saw proximity detection as part of the broader location services as it’s used to fine tune location beyond GPS. So they shoved it all in under one switch.

The app does not use GPS and cannot solve Google’s crappy permissions system on 6 year old versions of Android.

Unfortunately, the only solution to that is to upgrade your mobile phone OS or change phone.

Every single app on your device will have the same kind of grouped permissions and I can assure you that they’ll be far more eyebrow raising than this one. For example games that have access to your call logs and can read SMS etc

This app is the absolute opposite of that. It’s not looking for that kind of data and if you’re using a modern version of Android, you can have the fine tuning control to turn off those aspects of permissions individually.

The HSE can’t fix Android 7.

Peregrinus

sydthebeat wrote: »

That makes sense, though it still means practically that location needs to be turned on in order for the app to work, which is counter to the way the publicity about the phone is being offered.

Its a bit disingenuous to say to people we won't be tracking your location, but we need you to turn your location tracker on in order for it to work.

I'm still waiting for someone to explain who Bluetooth itself cannot do this job? I don't need location to be on in order to Bluetooth info to another nearby phone, so why does this app need it on?

It's the result of a design choice made years ago by those who wrote the Android operating systems. Basically, a whole bunch of related capacities are bundled together into a single permission. The permission called "location services" covers a bunch of capacities, one of which is GPS location. If you want to to use any of the capacities, you have to authorise the whole bundle; you can't pick and choose. But the fact that you have authorised all the capacities doesn't mean that they are in fact being used.

This problem has been ameliorated to some extent in later versions of Android, but (as this thread testifies) many phones are running versions of Android that include capacities this App requires in the "location services" bundle.

ixoy

sydthebeat wrote: »

I'm still waiting for someone to explain who Bluetooth itself cannot do this job? I don't need location to be on in order to Bluetooth info to another nearby phone, so why does this app need it on?

Okay, I found this from Google's Android Developer guide:

Because discoverable devices might reveal information about the user's location, the device discovery process requires location access. If your app is being used on a device that runs Android 8.0 (API level 26) or higher, use the Companion Device Manager API. This API performs device discovery on your app's behalf, so your app doesn't need to request location permissions.

If you don't use the Companion Device Manager API, declare the ACCESS_FINE_LOCATION permission.

So, as mentioned above, it's merely a design flaw in the OS that's been addressed in 8+.

sydthebeat

sydthebeat wrote: »

That makes sense, though it still means practically that location needs to be turned on in order for the app to work, which is counter to the way the publicity about the phone is being offered.

Its a bit disingenuous to say to people we won't be tracking your location, but we need you to turn your location tracker on in order for it to work.

I'm still waiting for someone to explain who Bluetooth itself cannot do this job? I don't need location to be on in order to Bluetooth info to another nearby phone, so why does this app need it on?

Using bluetooth for tracking is a location based permission in android since it can be used to track you very precisely.

YellowBucket

ixoy wrote: »

Okay, I found this from Google's Android Developer guide:


So, as mentioned above, it's merely a design flaw in the OS that's been addressed in 8+.

Basically the issue is: you’re running obsolete software and need to upgrade your OS or phone and if you haven’t done that, you are exposed to security issues and they are not coming from this or being exploited by this simple app.

KildareP

sydthebeat wrote: »

That makes sense, though it still means practically that location needs to be turned on in order for the app to work, which is counter to the way the publicity about the phone is being offered.

Its a bit disingenuous to say to people we won't be tracking your location, but we need you to turn your location tracker on in order for it to work.

I'm still waiting for someone to explain who Bluetooth itself cannot do this job? I don't need location to be on in order to Bluetooth info to another nearby phone, so why does this app need it on?

With Bluetooth on by itself, you're communicating with a paired device.

You can extend Bluetooth as a tracking tool in two ways:
(1) to keep a record all of the devices you come into passive contact with, even those you haven't paired with
(2) to allow your device to track where it is by using known Bluetooth beacons which are devices that are specifically planted in key areas and broadcast a unique "beacon ID" that allows your device to locate itself to a high degree of accuracy. This is one of the ways your phone knows you've entered a shopping centre that mightn't otherwise have a GPS signal.

These extensions are wrapped up under the Location Services permission banner on earlier versions of Android.

The Covid app turns your phone into a beacon that lets other phones with the app installed to identify it as a unique device, whilst also using your phone as a way to record all of the "beacons" it comes into contact with (which is all of the other users who have the app installed).

This is then used so that, lets say I come down with Covid symptoms and I have the app installed, the HSE can subsequently identify all those users that have my beacon ID logged as being within close proximity within the previous 14 days (or rather, all of the beacons I have logged as being within range).

That's all it identifies, though - that you and I were within close proximity at some stage in the prior 14 days. It can't tell you where you and I were within close proximity.


This was also an issue in iOS versions prior to iOS 13 - when iOS 13 hit, loads of apps suddenly started requesting access to Bluetooth even though they didn't use typical Bluetooth features. Rather, they were using Bluetooth as a means of tracking your location.

sydthebeat

So, are you saying that the apps info which states that location must be turned on, is not if fact true for everyone?


And if not, who is it not correct for?

Edit : just saw the reply above.

So anyone using android 8 or newer doesn't have to turn on location for this app to work properly?
Good news for me then as I'm on android 10

ixoy

sydthebeat wrote: »

So, are you saying that the apps info which states that location must be turned on, is not if fact true for everyone?

If you're running Android 7 or below - location is required.
Android 8 and above it should not be.

If you're unsure what version you have, go to Settings - About Phone and you should see the version under Software Information (this may vary between devices).

YellowBucket

sydthebeat wrote: »

So, are you saying that the apps info which states that location must be turned on, is not if fact true for everyone?


And if not, who is it not correct for?

If you’re using an old version of Android, a bunch of location services all share the same on/off switch. You cannot distinguish between GPS and Bluetooth proximity beacons. The phone just has all on or all off.

That DOES NOT mean the app is using those services, but has to turn on the one big crude switch to access the Bluetooth aspect only.

If, for whatever reason, you aren’t happy with that, the only solution is to upgrade your phone to a more modern version of Android that gives you finer control over permissions.

The app isn’t causing this problem - it’s just how Android worked until recent versions.

As far as I’m aware (open to correction) you’ll need at least Android 9 to have that.

Android 10 is current.

sydthebeat

Thanks all, I just edited my previous post after reading the replies.

Maybe the app info should be clearer about this issue seeing as so many people are paranoid about things like this.

sydthebeat

sydthebeat wrote: »

Thanks all, I just edited my previous post after reading the replies.

Maybe the app info should be clearer about this issue seeing as so many people are paranoid about things like this.

Android permissions suck

I have an iPhone 6s so it’s old enough. I’m on software update 13.5.

Ive just turned location services off on my phone and the app is still working the same.

sydthebeat

So I've turned off location, but I'm still getting the message that exposure notifications are off and need location to be turned on to use this feature.

Again, running MIUI 11 based on android 10

Did the Chinese feck up this version on android with their tampering!

seamus

Seems to have topped out around 900,000 overnight, with 20k-30k uninstalls. Probably people on older phones for who it doesn't work properly.

Now is the time for promotional campaigns. Outside of Facebook crazies, there would be a decent chunk of people who have questions about privacy but don't have the knowledge to know where to get more information. A 30-second ad from the HSE about how it works would do wonders.

brianomc

Wrong inage attached originally. But anyway, the ios app clearly shows that location is not being used. Check the settings for any app that does use location and you will see it clearly stated

brianomc

listermint wrote: »

If you are agreeing with someone who is okay with spreading absolute falsehoods then I'd suggest you do a bit more reading.
.

I was only agreeing with him about a side topic of boarding passes not alerting revenue, it went back to business as normal after that. I can agree with someone on one topic and not another I think

YellowBucket

They could maybe add an explanation but they have been abundantly clear that they are not gathering that data and they’ve also explained how the app works and the lengths they’ve gone to to ensure privacy and anonymity.

It would be hugely counterproductive to have a Big Brother tracing app. The NHS in the U.K. as well as the French and German health authorities tried to build their own ones which did just that - big central database systems.

The result was Apple (not so much Google) refused point blank to play ball as they saw it as intrusive, unnecessary and open to function creep and also as being potentially counterproductive to encouraging uptake, which would have a negative impact on public health benefit.

All three countries tried to bully and badger Apple into line with threats of legislation, security services ans also just throwing accusations of refusal to cooperate in the public interest at Apple and they got nowhere, other than landing themselves in a PR mess trying to justify a data grab. The U.K. for example failed to even get their app to work and has had to backtrack and develop something very similar to this on the same APIs.

The result of that has been the development of a joint Google and Apple API and frameworks that allow contact tracing apps to work using just Bluetooth beacons and random codes, with the tracing effectively being done by your phone itself and without exposing you to being tracked in anyway. It’s genuinely a very smart and slick solution and very much in the spirit of data & privacy protection.

The Irish approach eliminated and ruled out the path towards a central database very early on in the planning for this and the HSE very quickly went with the Google / Apple route, which has meant a slick app that reflects privacy concerns and isn’t data trawling and can’t really be abused by design.

The HSE just developed a front end and the higher level aspects. The underlying tech is part of the OS - android or Apple iOS.

Peregrinus

seamus wrote: »

Seems to have topped out around 900,000 overnight, with 20k-30k uninstalls. Probably people on older phones for who it doesn't work properly.

Now is the time for promotional campaigns. Outside of Facebook crazies, there would be a decent chunk of people who have questions about privacy but don't have the knowledge to know where to get more information. A 30-second ad from the HSE about how it works would do wonders.

Information about this might in some ways have more credibility if it came from an independent source rather than from the HSE. ("They would say that, wouldn't they?")

The source code for this app has been published, hasn't it? So presumably there are plenty of well-qualified and technically competent people out there who can verify that it doesn't track or record location, or do various other nasty things that are rumoured.

ixoy

There is a good chunk of this explained in the app under Settings for what it's worth.

It might not be a bad idea though for the App designers to streamline some of it and put it in a 'FAQ' section (even via a button the home screen) for clarity as it's a bit of a wall of text right now.

timetogo1

YellowBucket wrote: »

If you’re using an old version of Android, a bunch of location services all share the same on/off switch. You cannot distinguish between GPS and Bluetooth proximity beacons. The phone just has all on or all off.

That DOES NOT mean the app is using those services, but has to turn on the one big crude switch to access the Bluetooth aspect only.

If, for whatever reason, you aren’t happy with that, the only solution is to upgrade your phone to a more modern version of Android that gives you finer control over permissions.

The app isn’t causing this problem - it’s just how Android worked until recent versions.

As far as I’m aware (open to correction) you’ll need at least Android 9 to have that.

Android 10 is current.

I'm using Android 10 and I get the same notification "Exposure notifications are off" when I turn off Location. I don't care, but I was just testing it out after reading your post.