Will you download the contact tracing app?

KyussB

Another security consideration with this is the Bluetooth protocol itself - I deliberately have it disabled due to a long history of security issues - and earlier this year the 'BlueFrag' issue was discovered, which allows remote code execution over bluetooth on many Android devices - and it's not possible to update the OS to fix this on many phones:
https://insinuator.net/2020/02/critical-bluetooth-vulnerability-in-android-cve-2020-0022/

Bluetooth is NOT SECURE, and now there is going to be a huge motivation for people to make use of existing exploits for it - and to search out new ones - with a huge number of people not being able to update their devices to plug these security issues.

In the case of the exploit above, access to everything on your phone is possible, if you aren't patched up - which can then be uploaded over data/wifi - and there is potential for a situation where malware is developed that remains on your phone and hops onto other vulnerable bluetooth devices nearby.

This is a privacy nightmare waiting to happen, despite the best efforts of the developers. People are mad to be using this - bluetooth is not secure, and if you do even a quick read up on recent bluetooth exploits from the past few years, there are a number of critical vulnerabilities that give full access to devices.

If you are going to install this app, update your phones firmare and OS to the latest software - if it's android based, make sure the latest update for your OS is from at least February this year if not using Android 10, or it will be vulnerable.

owlbethere

I happily have my covid app sitting nicely on my front home screen instead of on other pages where all sorts of apps and games are splattered all over the place.

murpho999

1123heavy wrote: »

That is an outrageous spend.

Oh come on, in the grand scheme of things this is nothing.

Are you one of those people who just believe that a government or one of its bodies should not spend any money ever?

Non solum non ambulabit

I am assuming anyone worried about privacy issues with this app does not have a smart phone?

This a national effort. Let's all play our part.

Wear a mask and download an app. Those two simple actions will save us an awful lot of pain over the next year or two.

Sleepy

Has anyone run tests on how much the app affects battery life? I tend to keep location services and bluetooth switched off except for when I explicitly require them for something (e.g. listening to a podcast, using google maps etc.)

Can only imagine that leaving them on all day is going to hammer my battery life? (Samsung Galaxy S9)

GarIT

Sleepy wrote: »

Has anyone run tests on how much the app affects battery life? I tend to keep location services and bluetooth switched off except for when I explicitly require them for something (e.g. listening to a podcast, using google maps etc.)

Can only imagine that leaving them on all day is going to hammer my battery life? (Samsung Galaxy S9)

5% over the first 24 hours including 1 hour of the app open and on the screen. I imagine it will be much lower if I don't keep opening it to check the number of check ins and downloads. Comparatively 1 hour of Reddit open and on the screen used 11%, 3 hours of boards used 24%.

Non solum non ambulabit

Sleepy wrote: »

Has anyone run tests on how much the app affects battery life? I tend to keep location services and bluetooth switched off except for when I explicitly require them for something (e.g. listening to a podcast, using google maps etc.)

Can only imagine that leaving them on all day is going to hammer my battery life? (Samsung Galaxy S9)

Bluetooth on an S9 is low energy. I'll let Samsung explain but the answer is that it will have an insignificant affect on battery life.

https://www.samsung.com/in/support/mobile-devices/what-is-bluetooth-low-energy-ble-technology/

listermint

Sleepy wrote: »

Has anyone run tests on how much the app affects battery life? I tend to keep location services and bluetooth switched off except for when I explicitly require them for something (e.g. listening to a podcast, using google maps etc.)

Can only imagine that leaving them on all day is going to hammer my battery life? (Samsung Galaxy S9)

Hang up from 5 years ago. Unnecessary tbh.


Mines on all the time. Can only imagine the crapness jumping into the car turning on or off bt.. madness. No consequential battery usage

murpho999

Sleepy wrote: »

Has anyone run tests on how much the app affects battery life? I tend to keep location services and bluetooth switched off except for when I explicitly require them for something (e.g. listening to a podcast, using google maps etc.)

Can only imagine that leaving them on all day is going to hammer my battery life? (Samsung Galaxy S9)

App is out 36 hours and you expect tests done?:D

Just leave your bluetooth on from now on. Despite what so many people think it hardly uses your battery.

Location services not so bad either especially on a modern phone and you can disable them for apps that use it too much.

I don't get why people keep thinking this and also just try out the stuff on their phone and see how the battery gets on?

What's the point in getting a good smartphone packed with features and then dumbing it down by turning off all the useful stuff?

murpho999

Non solum non ambulabit wrote: »

I am assuming anyone worried about privacy issues with this app does not have a smart phone?

This a national effort. Let's all play our part.

Wear a mask and download an app. Those two simple actions will save us an awful lot of pain over the next year or two.

Damn, I didn't wear my mask whilst downloading the app. Did'nt think it was required.

Would my camera have recorded that and sent it to the big bad government and now they have my location as well?

plodder

As regards genuine security vulnerabilities, it is important to keep your phone up to date, which most phones don't give you much choice in as they do it automatically. You don't need the latest and greatest OS version (eg Android 10) but ideally you want to be receiving security updates at least.

fly_agaric

listermint wrote: »

There's a heap of folks in here who assume any old chinsese stuff based on Android - IS android.


Thats not the case lads. The phones are cheaper and they can come with drawbacks. This can include not stock Android.


Xiaomi's , Poco's, One Plus would all fit neatly under this banner. Dont blame the Covid app for not developing for every single niche of android device out there. That is simply not reasonable and even if they did the phones developer could change anything on the fly with an update.


Theres alot to be said for Stock Android.

Wonder if obsessives/paranoids about the government collecting their data do a bit of self reflection on "how did I enable totalitarian governments that spy on people and abuse their powers today"?

Buying Chinese phones with Chinese OS off (possibly) Chinese ecommerce sites to save some money may be somewhat worse than installing HSE covid app on ones Chinese phone!

howiya

Is the check-in part important? I notice that say 235k of the over 800k who have downloaded the app have completed this step today.

jester77

peterofthebr wrote: »

thought there would be more java code, mostly TypeScript i see. good spot on 'crashed without this'

It's React Native, they cheaped out instead of going with proper native solutions. But I guess they don't envisage having to maintain it long term which hopefully will be the case

El Weirdo

howiya wrote: »

Is the check-in part important? I notice that say 235k of the over 800k who have downloaded the app have completed this step today.

Nope.

It's completely optional.

myfreespirit

Big thank you to users YellowBucket, plodder, KildareP and other users who provided crystal clear explanations for Android API quirks that require location services turned on for the HSE app. Very helpful, thank you!

Non solum non ambulabit

howiya wrote: »

Is the check-in part important? I notice that say 235k of the over 800k who have downloaded the app have completed this step today.

Hi howiya, where is this information available, thanks?

murpho999

Non solum non ambulabit wrote: »

Hi howiya, where is this information available, thanks?

Check-ins on "Today's Fight" section on Updates page.

Number of app registrations on Contact Tracing page.

KyussB

plodder wrote: »

As regards genuine security vulnerabilities, it is important to keep your phone up to date, which most phones don't give you much choice in as they do it automatically. You don't need the latest and greatest OS version (eg Android 10) but ideally you want to be receiving security updates at least.

Up to 40% of android phones don't get security updates anymore:
https://www.zdnet.com/article/android-security-warning-one-billion-devices-no-longer-getting-updates/

Not all of the remainder will get automatic security updates. I doubt the claim that most phones do.

If the covid app were limited to phones which are verified as being secure, then I think reaching the necessary percentage of the population for it to be effective, would be a challenge.

sydthebeat

listermint wrote: »

There's a heap of folks in here who assume any old chinsese stuff based on Android - IS android.


Thats not the case lads. The phones are cheaper and they can come with drawbacks. This can include not stock Android.


Xiaomi's , Poco's, One Plus would all fit neatly under this banner. Dont blame the Covid app for not developing for every single niche of android device out there. That is simply not reasonable and even if they did the phones developer could change anything on the fly with an update.


Theres alot to be said for Stock Android.

Very few phones come with stock android these days. Even Samsung have their One UI OS written over android.
Any phone with MIUI, oxygen OS, pixel OS, Xperia UI, EMUI, color OS etc etc etc all have systems based on different versions of android.

I had a xiaomi mi A1 previously. Came with android one which is pure Google android.

Its a bit disingenuous to say that the Chinese phones you mentioned are based on something is not android. For example the poco F1 I have is running MIUI 11 based on android 10 QKQ1.190828.002. which has the last security update in January.

circadian

jester77 wrote: »

It's React Native, they cheaped out instead of going with proper native solutions. But I guess they don't envisage having to maintain it long term which hopefully will be the case

I'd say it's a combination of hoping to not have a long lifespan for the app and that React has started to become quite popular. Several friends/co-workers have been using React for a while and I'm looking into it for my own projects.

listermint

sydthebeat wrote: »

Very few phones come with stock android these days. Even Samsung have their One UI OS written over android.
Any phone with MIUI, oxygen OS, pixel OS, Xperia UI, EMUI, color OS etc etc etc all have systems based on different versions of android.

I had a xiaomi mi A1 previously. Came with android one which is pure Google android.

Its a bit disingenuous to say that the Chinese phones you mentioned are based on something is not android. For example the poco F1 I have is running MIUI 11 based on android 10 QKQ1.190828.002. which has the last security update in January.

There is nothing disingenuous about it, BASED ON does not mean Android.

ive 3 One Plus and a Xiaomi in my house btw

plodder

KyussB wrote: »

Up to 40% of android phones don't get security updates anymore:
https://www.zdnet.com/article/android-security-warning-one-billion-devices-no-longer-getting-updates/

Not all of the remainder will get automatic security updates. I doubt the claim that most phones do.

If the covid app were limited to phones which are verified as being secure, then I think reaching the necessary percentage of the population for it to be effective, would be a challenge.

The issue you mentioned affects any phone that uses Bluetooth whether this app is installed or not. So, it doesn't really make sense to tie it to this Covid app.

That said, a significant chunk of the 40% you quote are unable to use this feature anyway and only versions 6 and 7 might be affected which is around 25% of the total installed base. I think if you told those people to stop using their phones due to a vulnerability that could be exploited by someone standing within 10 metres, I'm not sure they would do it (unless they have already). So, why worry about it now?

Sure, it's not a great idea to be using a device that is not getting security updates. I think if I were in that position I'd ask myself, why is this suddenly a concern now? I'd probably review my usage of the phone and make sure to keep no sensitive information on it etc, and then install the Covid app or else get a new phone anyway (regardless of this app).

jester77

circadian wrote: »

I'd say it's a combination of hoping to not have a long lifespan for the app and that React has started to become quite popular. Several friends/co-workers have been using React for a while and I'm looking into it for my own projects.

It was popular, but companies are moving away from it. AirBnb was probably the biggest I recall lately moving away from react native.

It's ok for small apps that will require little maintenance going forward, but if you work on a large app then it is troublesome and the devs need native experience of both ios and android anyway to be able to implement components.

If you want a cross platform solution, koltin multiplatform is a better (albeit still in its infancy) approach. You can have all your business logic implemented in kotlin multiplatform and then natively implement the UI in swift/kotlin.

circadian

jester77 wrote: »

It was popular, but companies are moving away from it. AirBnb was probably the biggest I recall lately moving away from react native.

It's ok for small apps that will require little maintenance going forward, but if you work on a large app then it is troublesome and the devs need native experience of both ios and android anyway to be able to implement components.

If you want a cross platform solution, koltin multiplatform is a better (albeit still in its infancy) approach. You can have all your business logic implemented in kotlin multiplatform and then natively implement the UI in swift/kotlin.

It's for a web UI for an internal system I'm working on. Nothing fancy but since there's a few in the company that have experience with it, makes sense to go down that road since I generally don't deal with UI myself. Will take a look at the others you suggested though, always good to be acquainted with other technologies.

hmmm

El Weirdo wrote: »

Nope.

It's completely optional.

Yep. If you want just leave the app on your phone and never look at it, and it will work away.

It's probably worth the HSE mentioning this - there could be a lot of people who think they have to go into it every day and record their symptoms.

sydthebeat

listermint wrote: »

There is nothing disingenuous about it, BASED ON does not mean Android.

ive 3 One Plus and a Xiaomi in my house btw

doesnt mean STOCK android... but they are android based.

as i said, there are very few stock android phones out there, most phones have some kind of manufacturers OS skin written over android.

sydthebeat

anyway, as an experiment ive left bluetooth and location on all day and im at 30% battery power currently , with regular usage.
I turned on battery saver at 50%. so i have noticed a marked impact of having both bluetooth and location turned on on my phone, but its not down to the covid app.

The covid app itself has VERY minimal battery use... only 0.7% of battery or 28.7 mAh according to accubattery (chrome is highly battery intensive, with 30% of my battery capacity)
interestingly though its discharge speed is quite high, which basically means if you open the app and leave it open for a time it has a particularly high discharge rate, even higher than chrome on my phone

so essentially turn the app on and forget about it., and it will use minimal resources on your phone.



However due to this whole issue ive had to reassess what apps have access to location. As i only even turned it on when required ie google maps etc i didnt pay particular attention to the permissions. ive turned off about 10 apps (to allow only when using app) so that currently i have only 3 apps that use location all the time. Hopefully that will have an impact on my battery life.

YellowBucket

If you go into your privacy settings and turn off location services for all the apps other than "while using" it should solve your battery issues, or most of them anyway.

There are FAR too many apps on Android looking for permissions they shouldn't be.

plodder wrote: »

The issue you mentioned affects any phone that uses Bluetooth whether this app is installed or not. So, it doesn't really make sense to tie it to this Covid app.

If anything, this rollout is highlighting a lot people's Android security and housekeeping issues.

tobefrank321

sydthebeat wrote: »

anyway, as an experiment ive left bluetooth and location on all day and im at 30% battery power currently , with regular usage.
I turned on battery saver at 50%. so i have noticed a marked impact of having both bluetooth and location turned on on my phone, but its not down to the covid app.

The covid app itself has VERY minimal battery use... only 0.7% of battery or 28.7 mAh according to accubattery (chrome is highly battery intensive, with 30% of my battery capacity)
interestingly though its discharge speed is quite high, which basically means if you open the app and leave it open for a time it has a particularly high discharge rate, even higher than chrome on my phone

so essentially turn the app on and forget about it., and it will use minimal resources on your phone.



However due to this whole issue ive had to reassess what apps have access to location. As i only even turned it on when required ie google maps etc i didnt pay particular attention to the permissions. ive turned off about 10 apps (to allow only when using app) so that currently i have only 3 apps that use location all the time. Hopefully that will have an impact on my battery life.

Is it not Bluetooth rather than the app that will use the power?

Personally I will probably enable Bluetooth when I am outside the home, but I don't really see the point having it on all the time such as at night time.