COVID-19-app-Android-BETA

> The UK "hack" for the bluetooth was quite clever from what I saw - in essence they implemented the "background discovery of an iPhone" feature. I don't think the government deserves the credit they have received for this. The "hack" was well understood and documented before this App was created, and it has been implemented poorly [1]. [1] https://github.com/nhsx/COVID-19-app-Android-BETA/issues/10

Seems like a "throw it over the fence" development model. See also this issue: https://github.com/nhsx/COVID-19-app-Android-BETA/issues/49

Just to update for anyone time travellers that arrive here in the future, the source came out on day of the binary "going live" to the public https://github.com/nhsx/COVID-19-app-Android-BETA https://github.com/nhsx/COVID-19-app-iOS-BETA

Some quite interesting stuff around how they might be getting around the background iOS restrictions[1] can be found in the Android source. Looking at the Apple documentation on background peripheral bluetooth, they state "All service UUIDs contained in the value of the CBAdvertisementDataServiceUUIDsKey advertisement key are placed in a special “overflow” area; they can be discovered only by an iOS device that is explicitly scanning for them"[2] I wonder if they have managed to reverse engineer this overflow area so it is accessible via Android. Someone did some looking into this and it seems at least feasible[3] [1]: https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... [2]: https://developer.apple.com/library/archive/documentation/Ne... [3]: https://crownstone.rocks/2018/06/27/ios-advertisements-in-th...

According to the repo [1] they're using: apply plugin: 'com.google.firebase.crashlytics' com.google.firebase:firebase-messaging [1] https://github.com/nhsx/COVID-19-app-Android-BETA/search?p=1... I assume crashlytics is for crash dumps only, could firebase-messaging pull in firebase-analytics?

Which they're using to track a couple of events, i.e. when the app fails to register with the API: https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... (Though that analytics platform itself does do device fingerprinting, inasmuch as detecting phone model, OS version etc -- I assume no individually identifying stuff like IMEIs, but who knows what a bad actor can do with sufficient entropy?)

From [1]: // TODO: We need a real device to test Bluetooth scanning if isMultipleAdvertisementSupported == false // TODO: We need analytics to identify number of devices that fall into this bucket I don't know whether to laugh or cry reading those comments, the fact that this is a "to do" whilst the app is in "testing" and the fact they've decided the appropriate procedure is to reinvent the work Google and Apple have already done. Google already published their code/APIs in [2]. I'm sure these considerations are taken care of by the framework the OS vendors have published themselves. It's absolute pure arrogance that anyone would even attempt to re-create the work that is being done at the OS level and not 'fall in line'. Germany back tracked, Australia back tracked, and the UK too, will back track and implement Google's APIs. In a time

ACCESS_FINE_LOCATION is an immediate red flag. Yikes.. that's gonna be a no from me. https://github.com/nhsx/COVID-19-app-Android-BETA/blob/43a16...

Further context: In the UK, NHSX (Technology division of the UK's NHS) rejected the Apple-Google contact tracing API to make their own COVID 19 tracing app using Bluetooth, and the source code for the apps are now open source [0] [1] [0] https://github.com/nhsx/COVID-19-app-iOS-BETA [1] https://github.com/nhsx/COVID-19-app-Android-BETA

https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... appears to be looking for Apple devices to wake them back up.