Hacker News new | past | comments | ask | show | jobs | submit login
Everyone going to World Cup must have this app, experts are sounding the alarm (nrk.no)
315 points by ingve on Oct 15, 2022 | hide | past | favorite | 336 comments



The permissions mentioned sound like someone that doesn't understand the permissions systems used by Android and iPhone tried to translate them. So this part of the article is almost useless as it is hard to figure out what permissions the app actually has.

I don't understand the Android permissions system well enough here, but I would be especially curious about which API version this is targeting as I don't know how far back you can still go currently to avoid some of the stricter file access permissions newer versions added. As far as I can tell the most problematic storage-related permission in modern Android would be "MANAGE_EXTERNAL_STORAGE" meant for apps like file browsers. And if the app actually requests this permission (or intentionally uses an older API level to get equivalent access) that would be a very clear and specific overreach.

But I would also not be surprised at all if this kind of app asks for excessive permissions, and then provides a lot of telemetry and analytics and sends them somewhere. And in a country where e.g. homosexuality is illegal this kind of stuff presents additional dangers beyond compromising your privacy.


From my phone: I have Eteraz installed

Read and Write to the file system - required to allow storage of a small encrypted file which holds a unique ID, QR code, infection status, configuration parameters, and proximity data of other devices using the Application.

Not much more than a cookie.


Is there a reason this must be in the user's file location and not in the app's own internal files?


You can't know what it is reading though. The app could theoretically be sending all your photos to the government. Would be interesting to see someone reverse engineering it.


[flagged]


My point was that in countries that make private, consensual activities against the law there are much more severe consequences possible for events that compromise your privacy.


[flagged]


A more likely scenario which mirrors how discriminatory laws work elsewhere:

1. Get arrested for a minor offence like speeding.

2. Law enforcement checks your app and infers you are gay (maybe wedding photos of you and your spouse?)

3. It was going to be just a fine, but now you are facing prosecution for the much more serious offence of being gay.

4. Law enforcement officer can make the charges disappear for the right fee, or maybe just decides to go ahead with the much more serious prosecution.

5. Let’s hope you’re not gay and Muslim, because you’re then facing the death penalty too.


No, it’s worse. All of these steps are asynchronous besides #1, which they don’t need to do upfront… We are apparently in the age of “I can draw a square on google maps, so that makes me privy to [chunk of mass privacy information]”.

Worse is they don’t even need the mapping platform to cooperate. Most of this information probably still flows through second-party data brokers or else we would have heard whispers that those organizations are “too big to fail” or something.


Yup, women in the US need to be extremely careful about the apps they install. In Texas, app devs can get massive bounties for reporting if a woman has a medical procedure.


Just a comment on your obfuscating language: lethal injection is also a medical procedure.

Abortion is a complex issue that should be discussed honestly, not obfuscated.


Lethal injection is not a medical procedure. If it was a medical procedure it wouldn’t make the recipient’s condition deliberately worse than it was before the procedure. Just because a procedure involves injecting chemicals in someone’s body doesn’t mean it’s medical.

And abortion is not a complex issue. The only arguments against it are religious and there are religions which require it, so in a purportedly secular country the answer is very simple.


> If it was a medical procedure it wouldn’t make the recipient’s condition deliberately worse than it was before the procedure.

Would you consider donating a kidney to be a medical procedure?

> And abortion is not a complex issue.

I am super pro-choice, but this is a silly statement. Just go ask a bunch of pro-choice people at what point they believe abortion is wrong and you'll get a whole bunch of different answers.


By that definition abortion isn't a medical procedure either, because it makes one of "the recipient’s condition deliberately worse than it was before the procedure".

And there are human rights arguments against abortion that have nothing to do with religion. Most people agree that the unborn acquire the right to live at some point, and the argument is mostly about when exactly. (Even Roe set that point well before birth.)


The recipient of an abortion is the pregnant person who does not want to be pregnant.


There are two people involved. One is sometimes ignored, or dehumanized, but still there.


And nobody has the right to inhabit another persons body without their consent.


Unscientific nonsense!


You would be surprise to know the reality, and people are happily living in Qatar, gay or not gay. I wouldn't worry about it.


I would be surprised because it isn't true.


I know people living in Qatar :) Being gay is not the only thing in a person's life.


"And in a country where e.g. homosexuality is illegal this kind of stuff presents additional dangers beyond compromising your privacy."

What are the dangers if you respect the laws of that country? You are in danger in any country if you entry it with the intent of breaking the laws.


The danger is enabling them and normalizing these particular laws.

It's objectively wrong to punish people for being gay.


[flagged]


I suspect you're not as much for gay rights as some people if you're going to moral relativism state sponsored murder of minority groups.


I would do the exact same for mass genocide or any other atrocity. Logic shouldn't disappear just because the act is above a certain threshold for evil.


This is moral chauvinism


Morality and legality are two different things. If your morality is at odds with Human Rights, maybe your country with DiFfErEnT mOraLiTy shouldn't be part of the UN. Last time I checked, Qatar was part of the UN.


Hmm, I think if UN was based on morality that was in line of Human Rights it would be rather empty and powerless. For example the Security Council would not have any members.


Unfortunately you are right.


Why is arrogant? Because I'm claiming a moral value is objective?

I believe certain moral issues are objective. I'm not a philosopher or anything similar so I can't go into depth but moral relativism and subjective morality are debated subjects. Here's a great article on objective morality.

https://www.psychologytoday.com/us/blog/excellent-beauty/201...


While I appreciate the sentiment, the article performs a sleight of hand by connecting the unassailable "harm is bad by definition" to "those are harmful things". Relativists argue that what is harmful is not a mathematical truth, but rather a result of a given system of values.

In the end, the article just shows one point of reference, but fails to establish that it's objective.


There must be a standard to morality too as every other thing


If normativity isn't real, it's also not problematic for him to claim that harming gay people is objectively immoral, because there is similarly no obligation to apportion one's beliefs to the evidence.


Some of the players must be homosexual? Should they not enter Qatar, and scrafice playing for their country in the World Cup? Should Fifa hold the world cup in a country when some of their players could be prosecuted because of their sexuality?


FIFA was criticized for hosting the World Cup in a country that persecutes homosexuals. FIFA responded by extracting some concessionary-sounding statements from some Quatari officials. But the law hasn’t changed. Homosexuals who visit Qatar are most certainly still facing elevated risks. FIFA should be ashamed, but I suspect nobody has bribed them enough to activate their shame reflex yet.



I know it was more to talk about the slavery and human rights half but it’s sort of fascinating to see flogging in the penalty list. Makes me wonder if that would be a more effective punitive deterrent against recidivism. While I know some people get off from it and it wouldn’t deter everyone, I have to wonder how much more viscerally unwilling to risk the punishment the average criminal would be if instead of 6 months or a year or two, you got 10 to 100 with the lash. Is it more humane to have the violence over quickly and let the rehabilitation begin nearly immediately? Or better they rot away in jail mentally and emotionally for months to years making more associations with other criminals the longer they are in jail?


I think the latter is better, simply because it can be upgraded to its next step, which is to shift the focus of the jail time from punishment to rehabilitation.

https://en.wikipedia.org/wiki/Rehabilitation_%28penology%29

In general I don't think punishments work. I can't imagine one goes back to being a productive, and wholesome person after 100 lashes in public. And other first world leaders seem to think the same.

https://en.wikipedia.org/wiki/Corporal_punishment#Internatio...


Seriously? You're just gonna act like it's okay for them to have laws against being gay?


It's for Quatar to decide what their laws are. They aren't telling other countries what their laws should be.

Why this condescending tone and sense of moral superiority?


Why this defense of laws that go against basic human rights?


Because for some people, the notion of sovereignty is more important than human rights.

The problem is that then leads you to a strange place where you're ok with a government persecuting / murdering its own people because it's the law of the land.


If a country makes Islam illegal, would you think some Muslim countries would try to tell to that country to change its laws or not?


What are the dangers if you respect the laws of that country?

In order to do that you'd need to know the laws of the country because ignorance of the law is not a defence. I imagine very few football fans are reading up on Quatar's legal system. So, really, trying to stay within the law is probably very hard, especially if you go there with a set of Western values.

As a simple example, Qatar has law about "public morals" where showing too much skin is considered indecent, which technically means wearing shorts or your country's football shirt is a criminal offence. Are you suggesting football fans don't wear their team's shirt out of "respect for the country's laws"?

It's very unlikely that the Qatar authorities will enforce that law, but they certainly could use it as a basis to question someone. If they then find out that person is gay, or if that person can't prove they're not gay, then you're in very murky "respect the law" water.


> As a simple example, Qatar has law about "public morals" where showing too much skin is considered indecent

Maybe that's just a bad example, but without knowing exactly how much skin is tolerated, that's just a normal law pretty much everywhere.

Does your country allow public nudity on stadiums and on public streets? If not, you've got the same law in your country... without knowing the "threashold" it's hard to say the Qatar law is unusual even compared to the most liberal western democracies.


>Maybe that's just a bad example, but without knowing exactly how much skin is tolerated, that's just a normal law pretty much everywhere.

I'll counter that. I think it is a really good example. Everyone has public decency laws - but we probably don't think about looking them up. It is entirely possible many of us are currently breaking the law on that front without knowing it.

By handing the government a list of everything we have worn over the past X years, we are giving them the ability to prosecute us on all past violations.

This is what makes the app dangerous- we are handing them a list of many past activities that they can use to decide if they will prosecute us on.


"In order to do that you'd need to know the laws of the country because ignorance of the law is not a defence."

That is true for any country. You better inform yourself what the laws are and what their customs are in order to not break the laws or offense the locals.

Nobody forces you to travel to that country if their laws and customs conflict with your particular set of values.


laws that make simply existing illegal are dangerous by definition.

not to mention greater dangers to society


I think laws against being gay are wrong, but I have to disagree with your argument that they are laws against existing. You can be gay "inside" but never act on it. That should suffice for you to not get "punished".


Besides the fact that these are terrible conditions for a population to live under, I'm not sure you realise how gay people can be perceived and persecuted in these countries, for those visiting for the world cup I can imagine a lot of problem scenarios.

A couple might try to stay at a hotel in a room together, but because they are both men it could suddenly become a serious problem. Maybe they aren't even a couple and are two friends trying to get a cheaper room, but they get arrested and have to prove they are not gay.

A couple might want to enjoy dinner together at a restaurant, maybe that becomes a problem.

A couple might have "incriminating" pictures on their phone and be arrested.


I don't know how it is in Qatar, but I've been to Russia with 2 other men (all heterosexual) and we stayed in the same room which had only one king-sized bed and a separate, single bed. Two of the guys slept on the king-sized bed (which was big enough for them to not get too close for comfort) but I suppose a gay couple would've been quite happy with the arrangement. No on asked us if we were a gay triangle or something... the hotel was very luxurious so that's all we could afford with the company credit card :D. I am mentioning this because I believe Russia has laws "against gays" similar to Qatar (not sure how similar) but the laws, at least in theory, are about "promoting homosexuality" or something on those lines... I think being openly gay itself is not a crime except in very few, extremely relegious countries, and it's only when you're seen as promoting your lifestyle to others that it becomes unacceptable to them (and I suspect a lot of people in the West would actually agree with that). I suspect, however, that you're right you may get into trouble if you display affection to same-sex partners in public in Qatar... but that may be harder than you think given how in many muslim countries, it's common for men to kiss each other in the cheek... I guess that with some care, you may be seen just as unusually close friends.


Is this website even moderated anymore? Every time I visit Hacker News it gets even more extremist.


There are too many people here who care more about delivering what they think is a clever counterpoint, while being proud of denying the existence of 'soft' forms of intelligence, empathy and morality.


Saying that you are better by respecting the laws is extremism? Since when?


Since it became “rounding up the gays is fine actually because my steadfast adherence to a schoolboy framework of moral relativism is more important”.


Permissions from Aurora Store (3rd party to Play Store):

Hayya:

- control vibration

- have full network access

- prevent phone from sleeping

- run at startup

- run foreground service

- view Wi-Fi connections

- view network connections

- access sensor data at a high sampling rate

- access approximate location only in the foreground

- access precise location only the foreground

- listen to C2DM messages

Etheraz:

- access bluetooth settings

- control vibration

- disable your screen lock

- have full network access

- pair with bluetooth devices

- prevent phone from sleeping

- run at startup

- run foreground service

- this app can appear on top of other apps

- view Wi-Fi connections

- view network connections

- access approximate location only in the foreground

- access precise location only the foreground

- directly call phone numbers

I don't think these are really that extraordinary, but some are not obvious to me at least. Especially "listen to C2DM" seems odd, possibly a side effect of another permission. Of course with these permissions you can track and trace most of your life, but that is now the norm unfortunately.

> In particular, the covid-19 app Ehteraz asks for access to several rights on your mobile., like access to read, delete or change all content on the phone, as well as access to connect to WiFi and Bluetooth, override other apps and prevent the phone from switching off to sleep mode.

The statement about delete/change all content on the phone seems false tho. Also it doesn't "override other apps" whatever that should mean, but can draw over other apps.

edit:fix formatting


I'm guessing they used some framework and the libraries they used ask for a broad set of permissions because they offer access to their functions. But they're not necessarily used.

Also considering they're asking for a permission for a protocol that was shut down 7 years ago, the framework must be quite old. Android permissions were less granular back then.

I know someone in Germany and their covid tracking app tells you when and where you were close to someone who was last tested positive. So everyone does it the same way, recording location.


It only tells you on which day you had "one" or "multiple" contacts with "low" or "high" risk. It's Bluetooth based, and the CoronaWarnApp doesn't even access location data.

See https://www.bundesregierung.de/breg-de/themen/corona-warn-ap...

"Data which can make a person identifiable, in particular location data, is not selected, used or stored."


Hmm. Maybe my friend knew exactly where he was then.

Too bad I can't edit the original comment any more.

Never trust friends :)


> I know someone in Germany and their covid tracking app tells you when and where you were close to someone who was last tested positive. So everyone does it the same way, recording location.

Not sure about Germany, but in France the app doesn't track location. It tracks nearby devices (with Bluetooth, rotating identifiers frequently), and when one marks oneself as positive, it informs the central server of the identifiers used in the last X days, which then other apps checks against their list of known identifiers that were close.

So there is no recording of location.


My friend was definitely told where he was on the last contact. Doesn't mean his location left the phone though.

[He didn't get Covid this time, but off topic for this discussion.]

Edit: or maybe it's on topic because the location was at some amusement park outdoors. Since he knew where and it was relatively safe, he didn't have to worry much about the test results...


No, definitely not. There is no location info anywhere in the app, and never has been.

Obviously you can enter "library visit" in your contact diary manually, but even then there is no location involved, it's just a string of characters.


There isn't even a specific point in time given, only the day.


I believe in android bluetooth requires some location permission, because it can be used to identify your location.


> Also considering they're asking for a permission for a protocol that was shut down 7 years ago, the framework must be quite old. Android permissions were less granular back then.

That’s not how PlayStore permissions work. You have to target a certain Android version to release update apps and that version dictates how permissions work. You can’t get around those requirements by using an old framework.


Yeah, but old framework needed one permission that split into 3. Now it asks for all 3 permissions because they didn't hold to think that they only need 2 of them, and even those not always.


Ah of course, I didn't think about that.


Giving the benefit of the doubt to naivety is reckless in a security context.


> Also it doesn't "override other apps" whatever that should mean, but can draw over other apps.

It's a permission designed for accessibility. Because it's so intrusive you usually have to go through a more complex flow to enable it.

"override other apps" is a defensible colloquial definition because it enables clickjacking. Clickjacking is when you overlay an opaque, innocuous overlay and then open something you maliciously want to trick the user into clicking behind it.


"listen to C2DM" is for push notifications iirc



This name (and GCM, google cloud messaging) still lingers inside packages and error messages when only Firebase Cloud Messaging (FCM) now exist.


I wonder if any of those permissions could be used to give the app access to raw touch screen data. In theory only system drivers should be able to. If possible, it would pose a huge security risk: raw touch screen data reveal where the user taps before the data is sent to any security layer, so that by simply matching the coordinates to the known shape of the virtual keyboard, a malicious app would easily find text, including all passwords.


No, they can't, for the reason you explained.


Permissions analysis of Etheraz from Exodus, for comparison: https://reports.exodus-privacy.eu.org/en/reports/com.moi.cov...

1 TRACKER

- AltBeacon

19 PERMISSIONS

- ACCESS_BACKGROUND_LOCATION

- ACCESS_COARSE_LOCATION

- ACCESS_FINE_LOCATION

- ACCESS_NETWORK_STATE

- ACCESS_WIFI_STATE

- BLUETOOTH

- BLUETOOTH_ADMIN

- CALL_PHONE

- DISABLE_KEYGUARD

- FOREGROUND_SERVICE

- INTERNET

- QUICKBOOT_POWERON

- RECEIVE_BOOT_COMPLETED

- SYSTEM_ALERT_WINDOW

- VIBRATE

- WAKE_LOCK

- BIND_GET_INSTALL_REFERRER_SERVICE

- GET_COMMON_DATA


“access sensor data at a high sampling rate“

If that isn’t some terminator shit right there, I don’t know what is.


> If that isn’t some terminator shit right there, I don’t know what is.

This seems an odd statement. You access sensor data at a higher rate for doing things like sports apps (eg, Strava) or many other scenarios. It's behind a permission at least partially because of the potential impact on battery life.

It can be an incremental decrease in privacy (although not especially concerning if the app already has low sample speed access) but it is unclear why this is some kind of terminator issue.


Would it even be useful to access data like gyro, accelerometer, compass or proximity sensor at low rate useful? And what really is high sampling rate?


This was the same situation for the UEFA Women’s Euros in England this year.

For those wondering, the app was simply for storing, transferring, and displaying your tickets. A ticket being a QR code for you to scan at the stadium turnstiles.

Was the app required? Absolutely not, there was nothing specific that the mobile app could do that a simple website couldn’t (apart from the screen brightness jumping to 100% when displaying the QR code). I’m sure even a printed QR code would of sufficed.

Both UEFA and FIFA should reconsider their approach to ticketing.


> there was nothing specific that the mobile app could do that a simple website couldn’t … I’m sure even a printed QR code would of sufficed.

I don’t know about that app specifically, but most of the major ticketing providers are doing dynamic barcodes[1] now that are effectively TOTPs for entry. You can’t do this reliably on the web for a major event because you can’t assume network connectivity, and obviously a printout or screenshot won’t work.

1. https://techcrunch.com/2019/05/16/ticketmaster-put-an-end-to...


> You can’t do this reliably on the web for a major event because you can’t assume network connectivity

I can't believe I'm saying this, but you could've use PWA instead (except for brightness).


You're not wrong, but the pushback for doing an app like this as a PWA will always be discoverability - it's a lot easier to just say "search UEFA 22 in the App Store" than it is to point people to a URL and teach them how to use the add to Home Screen functionality.


But dont these apps require network access to function?


Not at the venue, no. The relevant tokens are saved locally and the barcodes are rendered on-device once you’ve accessed the ticket, which you can do hours/days in advance.

Some of TicketMaster’s API docs for this are publicly available so you can get an idea of how it works - https://developer.ticketmaster.com/products-and-docs/apis/pa...


I just used (against my will) the Axs app to go to a local show. It required location services to be enabled and didn't show the random qr code until it could verify I was at the venue.

I haven't seen a paper ticket in a long time.


How exactly does that not work with browsers and local storage though? It seems like they're just caching stuff in the app and they definitely can do the same in browser storage.


> How exactly does that not work with browsers and local storage though?

On iOS, at least, local storage for web apps doesn't have guaranteed persistence. Safari can and will "randomly" clean up, usually if the device is low on storage. This happens less frequently for pinned PWAs but still happens.

If you need to absolutely guarantee that your thing will work on an offline mobile device, you have to use a native app.


It's not the same thing. There are two apps, not one - one is for ticketing, the other is supposedly for "COVID".

Second: the UK government does not have a death penalty for being LGBTQ (or blasphemy.) It's been decades since any form of official corporeal punishment happened in the UK, whereas in Qatar it's probably been weeks, at best.


Paper tickets can be resold into the tout/scalper market. Electronic tickets can't. That's a nice feature for FIFA.


It seems like it adds a barrier, but wouldn't the scalpers just sell phones with the app and ticket loaded? Old Android phones are quite cheap.


For countries that already require you to register SIM cards with your government ID, I wouldn't be surprised if one day they require that all phones be biometrically locked to their owner.

When producing a QR code, the signature could include the date that the QR code was generated, and the date that the phone was biometrically linked to the user (signed by a device-specific key in the secure enclave, itself signed by the manufacturer's key).

Venues could then require that you were using a phone that had been soul-bound to you since before the tickets were first available for purchase.

(For the avoidance of doubt, what I'm describing here is the basis of an Orwellian dystopia, not something that I think should ever be implemented.)


What stopping you from taking a screenshot of the qr code and send it to the buyer? The timestamp can be bypassed by sending the screenshot when the buyer is already at the ticket-checking gate.


These apps generate a new code based on the time, etc. Its basically a TOTP password for an event.


They still get scalped but you have to do it through their approved scalper app


You would be surprised how well app screenshot in full screen with the qr code works.

Seen this many times with covid vaccination passes.


No idea about this app, but presumably that's the reason why quite a few apps show animations and a rotating code word alongside the QR codes, so staff can easily spot that kind of thing.


Doesn't work for these tickets since they're generating new underlying values as time passes.

Even Costco has self-modifying barcodes now, so covid vaccination passes are behind on the times.


Wouldn't an easy work-around be to get a cheap new Android phone? I assume you only have to install the apps on one device, if you take two; otherwise, just take the new one. I doubt that the expense would be an issue for somebody attending the World Cup.

It seems like this would be good practice these days for any international travel.


At some point few years ago it became practically impossible to do any business in China from the outside without what's app (no idea why as allegedly its banned there). This is around the some time samsung had their "My Knox" feature on their S8 or S9 phone. This feature was like an isolated container for apps, an android equivalent of VM. The purpose was to place your banking and other critical apps there and the normal android system wouldn't be able to access it.

However I found a much better use case is to keep your phone's os secure by putting all dodgy apps in "my knox". This way I could've had what's app and give it access to all my 1 contact I prepared for it etc.

These days I don't know if they still have "my knox" feature on the flagship models as, I decided to get a different phone.

However for going to an autocratic country I would just buy a burner phone (or not go there in the first place).


It still does, it's now called "Secure Folder". There's "Insular" from F-Droid as well.


> Insular

Does anyone else have any experience with this app?


Xiaomi have a similar feature, where only some specific combination of buttons/fingerprins would unlock the phone into the special mode containing the special apps (so more tailored for stuff you want to hide than the inverse).


Xiaomi isn’t a company I would trust these days.


Hmm, that certainly sounds… extremely measurable.


If Whatsapp is a "dodgy app" I can't imagine what non-dodgy apps you might be running on your phone.


I wonder if I can even find one technical sentence in the article that even makes sense. It is a total mess. There are so many “what about” questions here. What about people who don’t own/carry a smartphone? What about just denying all requested permissions? What about installing the apps then deleting them once you are in the stadium? Or as you say have a burner phone that you leave off? So silly.


When I went to China I got a phone to run WeChat, which I erased and reinstalled once I got back. Android phones are cheap now, you can get something which is quite decent for a couple hundred dollars.


Cut that by a factor of 10. If you need do be connected, but don't care about things like cameras or gaming specks, then I can get you an android phone for the equivalent of about $30.

This is cheap enough to throw in the trash as you board for your flight home.

Connectivity is a slightly larger problem. In some places you can get a prepaid SIM card for less than a dollar, other places need some form of registration. Really depends on the country and local laws.

It's probably possible to go SIM-less and just hop between open hotspots.


> This is cheap enough to throw in the trash as you board for your flight home.

Maybe you know this and it's just an expression, but just in case: never throw electronics in the trash. At the very least the battery is toxic and needs recycling, but other parts of it probably too.


Good luck running even something as "simple" as slack on a $30 dollar Android phone. If new you usually want to throw in at least 150-250$ for an Android phone that doesn't run things with high latency, at least in my experience as a mid-range device user.


I am no smartphone expert but it seems to me there are amazing options in the 200-250 euro range. Things with 8gb RAM, decent CPU, and storage. I would gift itto someone before throwing it away


If I'm travelling for leisure, I would prefer things like Slack to stay as far away from me as possible. Preferably on my work machine that I left behind on my home continent.

If I travel for work, or if my employer requires me to have Slack (or similar) on my device and with me at all times, then they can provide me with a dedicated device for that purpose and that purpose alone. It's then their problem to worry about operational security associated with having work comms on a device that might have to be compromised by a foreign government.

Even the most basic android phone supports email and text (sms) out of the box. My country enjoys incredibly deep WhatsApp penetration, and subsequently it's become the default mode of communication for almost everyone. WhatsApp runs on almost anything. Back in the day they even had .jar files to download and install on your Symbian dumb phones.

I'm talking here about a "burner" device as it's sometimes called. The minimum viable communicator that you can take with you so that you can keep in touch with friends and family and be reachable in the case of an emergency.

But you make an interesting argument for not needing to go with a new device. A beat-up second-hand mid-ranger from a few years ago will probably work just as well. I have a drawer full of them, and if I don't have any, they can be had for very cheap.


I was under the impression that you buy a cheap burner for whatever app is required and only use that phone for the required function and not put any content or connect services to it.


As long as it runs WeChat, does it need to be decent?

Probably being bad is a feature here, because you won't be tempted to use the phone that's infected.


How many people are even aware that there is a problem, and among those, how is it realistic and reasonable to expect them to simply "buy a new phone and create a new burner google account (if you use your own you defeat the purpose)"?


Then they can install the apps, blissfully unaware, and suffer the consequences, if any.


> It seems like this would be good practice these days for any international travel.

This also seems like a great use case for privacy focused OSes for unlocked phones. I’ve been trying to get into CalyxOS or GrapheneOS for a while. Just waiting for either to come to the Pixel 7 Pro. I wouldn’t throw it afterwards, but probably wouldn’t connect it to any home networks without nuking it once or twice.


Install it on a cheap Android phone, and "forget to charge" it.


Presumably just backing up your phone, wiping it, installing everything from scratch with a new account would work as well?


> Security experts believe Qatar's required mobile app will be like giving the World Cup country's authorities the key to your house.

Qatar would be just a small player in this field. Other security agencies and security incumbents are surely having fun with the app. Prepare for a world cup full of advisories.


There is certainly an issue with people being required to install government apps.

And this is an interesting case of that but this is wildly overblown.

I don't have to go to the world cup, it'll actually be really hard to go. I'd have to be desperate or wildly rich.

But I do have to use several government apps on my phone even if just installing them for a brief period. That's the really issue.

Installing an app on a luxury holiday in Qatar is such an absurd complaint given indebted servants bordering on our right slavery died organising it.


I don’t think they’re complaining, which leads me to believe that’s another reason for them to field test this and even just capture info on how many idiotrich leave the country with a rootkit on their phone.


Luckily my country is already so creepy this qatar thing is a fully non-issue for me. In fact, i wouldn't even have to know about the app before travelling to deal with this.

ANY time I go through US airport security, I don't take my phone. I take a burner phone that doesn't have any of my accounts logged in or personal data on it.

From my understanding, they can and will dd your whole phone image to some national security database while holding you for 'enhanced screening.'


>From my understanding, they can and will dd your whole phone image to some national security database while holding you for 'enhanced screening.'

this is not true, maybe at customs but not when traveling domestically. i had a dog sit down while walking through security and TSA had to swab everything i was traveling with. my phone was swabbed but nothing was ever connected to it.


It's the same TSA. You didn't have the appropriate database flag at the time. Those are explosives dogs, looking for explosives not selfies.


This is the reason that when I travel I carry two phones. One is the phone I actually use, and the other is the one I give to authorities when they ask for my phone. It is astonishing to me that not once have I ever been asked if I have a second phone.

(It will be an interesting experiment to see if that happens now that I have posted this here.)


Where do authorities ask for your phone? Just curious


It happens everywhere, from the developed countries to the far east. You have zero rights when crossing the border at immigration control, especially when your passport is weak or they believe you will not leave the country. They log into your IG and WhatsApp and check everything. Otherwise, they will deny entry. They made it legal. Sometimes a person has nothing to hide but nerves first time traveller and gets sucked into that void too.

Do you know the worst part? Once you unlock your phone and give them your passcode, they take it away and tell you to wait. So now have no idea what they are doing with your phone. Would you trust that device? That is why a burner phone is needed, I guess.


I can recall getting a surprisingly intrusive investigation coming into Montreal as a tourist on an American passport in 2017.

Taking everything out of my luggage while I'm desperately trying to warn them that some of the socks are wrapped around a DSLR and lens I'm trying to protect from damage, fiddling through my phone camera (since there was nothing good on the new DSLR with like 40 photos of local insects). Evidently they were trying to find background evidence that my claimed objective-- visiting the Exporail museum-- was plausible. Who doesn't like trains (and it is, indeed, an excellent museum)? Fortunately, I had a photo of the Acela I took last year on my phone, and that seemed to satisfy them.

After all that, the agent chastised me because I followed my grandmother's advice and left CAD40 in the pocket of my suitcase in case I got my wallet stolen-- "It's very safe here". Is it safe here because you make random tourists feel like terrorists?


> It happens everywhere, from the developed countries to the far east.

It can happen everywhere, but I don't think it is frequent. I travel fairly frequently and I've never had it happen to me, or seen it happen to anyone around me, or personally know anyone it has happened to.

It's true it happens, and you do read about it on the internet. But I think in every case I've read the person was already being questioned by immigration at a heightened level when it occurred.


I carry two phones just in case

Nobody asks me for my second phone because nobody cares about brief interactions that distract them

It happens everywhere

from the developed countries to the far east (makes large sweeping gesture representing entire planet)

you have zero rights crossing the border at immigration control in these awful countries I am continuing to not mention for some reason.

Tell us where this happens.


It's a huge problem in India at the moment. Police in several cities have caught on to this idea of searching for incriminating content and harassing people into paying bribe.

https://www.newslaundry.com/2022/03/29/are-bengaluru-cops-fo...


I went to the US for tourism and the immigration asked for my phone. They checked the contacts and asked me about random people (who they are, how I met them etc.)


Airport security mainly. Also immigration, though that has never actually happened to me (yet). It's more of an insurance policy than a defense against an actual threat that I experience. But people do have their phones seized. This way I don't have to worry about it as much.


On border patrol shows, I have seen it in US, AU and UK. Usually to identify if people come there for work without a work permit.


This probably gives you much better privacy than someone with just one phone, but I have read of people doing analysis where they identify phones that move together.

As always, it's a question of threat model, but if your opponent is a state, they definitely do this kind of thing.


Sure. This is mainly protection against being asked for my phone at airport security or immigration. If a state actor really wants to fuck with me there is probably very little I can do about it.


What do you use the "authorities phone" for? Is it set up with a mock account? What kind of emails are associated with it?


Yes, it has its own email account, which at this point is basically a spam honeypot. I don't think anyone has ever actually tried to unlock the phone. Every time I've been asked for it, it looked to me like they were checking it for explosive residue. But this way I don't have to worry about it, I just hand it over and smile.

It also has some apps installed, mainly games. I sometimes use it for casual internet browsing, especially if I want to visit a website with a bunch of Javascript of questionable provenance. But all my real stuff is on the other phone.


Free countries should shut down all travel including airlines in and out of Qatar, and issue a travel warning.

In fact this should have happened years ago..

https://www.hrw.org/news/2020/10/27/women-reportedly-subject...

Otherwise, what do we believe in? what do we stand for? Do we truly only car about money?


Define free country? I'm curious what level of protection and freedom qualifies for that designation.


The uncritical acceptance of Qatar as the next hot business location, like an area of the map unlocking on Civ, is a total catastrophe for the cause of human rights. The entire country should be boycott, not embraced.


All the news about slavery and bad treatment of workers to build the infrastructures and silencing or minimizing by western press and now this. No surprise when you organize a thing like the Football World Cup in a dictatorship like Qatar in exchange for money this is you can expect. Just let's hope it does not get used as a backdoor by other with even worse intentions.


Just to emphasize your point, we're talking about a death toll of 6k+ people to build these stadiums. What a stain on fifa, football and worldwide respect for human rights to say the least.

https://www.theguardian.com/global-development/2021/feb/23/r...


That article itself contradicts its own spin. It reads more like a hit job.

"More than 6,500 migrant workers from India, Pakistan, Nepal, Bangladesh and Sri Lanka have died in Qatar since it won the right to host the World Cup 10 years ago"

"death records are not categorised by occupation or place of work"

"There have been 37 deaths among workers directly linked to construction of World Cup stadiums, of which 34 are classified as “non-work related” by the event’s organising committee."

"its 2 million-strong migrant workforce"

6500 deaths in a 10 year span, out of a 2 million demographic. Only 37 of those 6000 were workers actually linked to the construction of the stadiums. Only 3 of those are confirmed to be dead on site.


"Classified as “non-work related” by the event’s organizing committee", I guess the same committee that bribed FIFA[1] and from the same government that has not really high values for human rights and much less for the rights of immigrant labor force. And no autopsies allowed to investigate deaths even. And there are much more reports about deaths[2] just search around the web . But We know that money washes everything away .

[1]https://en.wikipedia.org/wiki/2015_FIFA_corruption_case#Hist... [2]https://sports.yahoo.com/news/14-reasons-qatar-world-cup-174...


I can't find any primary sources for excessive deaths during construction. FIFA corruption is completely unrelated.

The Qatari government is only being questioned about the 34 of 37 workers dying, and there's no evidence of a coverup either.

If your general point is "I don't like the Qatari government" that's fine. If your point is hundreds of workers died at work but was covered up then a lot more solid evidence is needed to back that up.


Define primary sources, you mean the Qatari government?, the one that blocks the autopsies?. Because news around are easily found about it: https://www.theguardian.com/world/2013/sep/25/revealed-qatar... I know we can only talk human rights when is about China, Iran or Russia, Qatar, Emirates and Saudi Arabia are off limits because they are our economic allies.


> what a stain on fifa

Their collar is so stained already, you’d be hard pressed to find a tiny peck of dignity there…


only if your country can offer these people jobs so they don't have to die this way. Let poor people migrate to developed country, why people are turned away in immigration because they come for economic reasons?


What if you don’t have a smart phone? Or hell, what about one that’s 5+ years old? Are they just SoL?


Most likely you are SoL. By the sounds of it they simply won't let you into the country unless you can show that you've installed their covid tracking app


Wow. Just pretty insane we're at that point.

I have a smart phone and generally against telling people how to host their events... but requiring smart phones with tracking apps on them to do X or Y for the "pursuit of progress" is pretty dystopian.


what is SoL?

> What if you don’t have a smart phone?

Remember, that you want something from them (entering the country). They can refuse you if they don't like your old-fashioned lifestyle.


"Shit outta luck"


Soldier Out of Luck.


Sol is the star of the Solar system, the home system of the human species.

On a more serious note: “Shit/Sorry, Outta Luck!”


Is it still not possible to allow an app read/write access to only a single directory on Android? Ony all directories or none?

From a quick check on my Android, that seems to be the case. How archaic. Why is it this way?


It is possible, with Scoped Storage. The problem is that apps know when they've been denied permissions, so it will indicate that, and then you'll be either refused entry or thrown in jail.


Wasn't that a feature of Lineage?

It never "denied" access, it just claimed that it didn't exist, or there was a fault so apps never actually knew they were blocked.


I wish the "experts" were also sounding alarms about required face-scanning when I am trying to board an airplane in the West?


Or that certain border agencies demand you to give electronic devices and password to them. Seems extremely late to get on board of this issue.


It's never too late to fight authoritarianism.


I really would like to know how Qatar got the World Cup… it can’t have been legitimate, it’s just got so many obvious disadvantages… For example, it’s too hot to host it in summer as usual, so it’s in the northern hemisphere winter, which interrupts all the leagues.


Bribes, some of which came out and are currently under investigation/prosecution.

Other reasons why it's a terrible idea: they have a small population, little football culture (in terms of absolute size), no infrastructure (all the stadia are newly built and some will be demolished afterwards; there aren't enough hotels); they have many laws incompatible with what usually happens at World Cups. There literally isn't a single positive thing to be said about Qatar hosting the World Cup.


Qatar has a pretty good airport with an extremely convenient location (more than 80% of the world population live within a 6 hour flight)


That makes it a great airport hub, but it doesn't have the infrastructure to host, feed, transport, place in a stadium the hundreds of thousands of fans that want to watch a World Cup.


A lot of fans will actually be staying in Dubai and flying over. I read that there will be dozens of flights per day between the two locations.


That sounds great for the airlines but terrible for the environment.


I’m sure you already know the answer.



...there's this thing called 'the dollar'.


Since Electronic Arts righteously dumped FIFA like a ton of rotten bricks, why don't they organise a football world cup instead? Less corruption money must mean more leftover for the players and staff involved. Also instead of some nebulous process for the host country selection, get game owners to vote, they're already very securely identified. The time to ride on the complete stink the air conditioned slave-labour edition will produce is now. Get your lawyers to review the contractual structure of leagues and clubs, it can't be that the whole international set of deals is failsafe, players can probably just walk.


> Since Electronic Arts righteously dumped FIFA like a ton of rotten bricks

It wasn't righteous, it was over money (FIFA asking for too much).

> why don't they organise a football world cup instead

Because FIFA is the organising body of football, all regional (UEFA, CONCACAF, etc.) and country Football Associations are under FIFA's jurisdiction (and are members of FIFA). Countries couldn't participate in a rival event even if they wanted to, because many of the smaller association basically only exist on FIFA subsidies, and of course there are exclusivity deals. And i doubt many countries and players would prefer the glory of the "EA Cup". The World Cup has never been about money, and the prize pool is already significant.


Does FIFA own a copyright on the word "football"? no Does shipping 20 players from 50 poorer countries cost a lot? no does FIFA even owns a copyright on the words "Football World Cup"?


EA could very well setup "The EA Football World Cup" and invite the world's football associations to participate in it, with substantial prize money as a reward. But even if the countries could participate (they couldn't, unless they sent their Under 21s or other development/reserve players, see my other comment) and even if they did participate (many wouldn't) the tournament would be seen as an inferior knock-off and wouldn't gain the support from the fans that would be required to make it worthwhile.


How do you know this? A size 140 Arsenal jersey wearer I know would beg to differ, the Quatar catastrophe being clear for any age to understand. How do you think it would be inferior? The rules of football would be respected, and also it would match EA's official console football game!


You just need to look back at Arsenal's (and others') last year's proposal for an European Super League and the massive backlash resulting, which made them not only drop it (for now) but also, hilariously, also agree to pay fines to UEFA for conspiracy to treason or something.

EA dumping FIFA is a good thing to kickstart the mere idea of competition against FIFA's monopoly (and by extension continental bodies), but any actionable outcome is still decades away.


If your Arsenal-supporting friend sincerely believes that a rival World Cup would go anywhere at all, then they're a little bit naive and don't really understand the game. Qatar could end up being (more of) a catastrophe, and heads may roll at FIFA but the FIFA World Cup isn't getting replaced any time soon.


They... is a kid. so point taken, still one can dream, right?


Ah sorry I did not get the "size 140" reference, it's in a sizing format I'm not familiar with!

As a former-kid who had his own dreams (Scotland winning the World Cup) which have had to be progressively scaled back as I grew up (Scotland qualifying for the World Cup) I sympathise, and I hope your Arsenal pal gets to see the tournament they dream of :)


Do all clubs people want to watch have contracts with FIFA? Yes

Do all the manufacturers of sports clothing, shoes, balls, goal posts, etc. have deals with FIFA? Yes

Does FIFA use bribes and any means necessary to prevent anyone from disturbing their racket schemes? Yes

Don’t forget you’re dealing with a lot of very powerful and dangerous people here that make really big money, are deeply intertwined with governments, and have a history of doing anything it takes to earn more money. You’re not going to cut them out of the deal, that simply won’t happen.


What clubs have contracts with FIFA?


Clubs are members of their local association, which is a member of and regulated by FIFA.


OK that's both wrong (FIFA isn’t involved in regulating the confederations or the members or the clubs) and not what you originally said. I think you just made a mistake in understanding what FIFA does. Same with this:

> Do all the manufacturers of sports clothing, shoes, balls, goal posts, etc. have deals with FIFA? Yes

FIFA will have a relationship with sponsors of FIFA events (the dozens of brands you see during the World Cup or the Club World Cup) and will select who provides the official ball during these events (usually Adidas) or who makes FIFA-branded merch (lame stuff, relatively small market). But each individual player chooses their own boots + equipment, each national team or club negotiates their own sponsors and kit providers. At Qatar you'll see a wide variety of them - Nike, Adidas, Puma, Hummel, Marathon, Majid, Le Coq Sportif, Kappa, New Balance - FIFA weren't involved in the selection of any of them. And I'm not sure what to say about the goal posts - they'll just be whatever is already in the stadiums in use at any given World Cup.

FIFA is a corrupt enough organization, we don't need to pretend they're also some sinister dictator controlling every level of the global game. Not least because it lets the different confederations and national football associations off the hook for their own mixtures of incompetence and corruption.


I think you're mistaking me for the original person you responded to.

However, this is flat our wrong:

> FIFA isn’t involved in regulating the confederations or the members or the clubs

Of course it is. It makes the rules that are implemented by the federations (stuff like 5 subs, the new loan regulations), and it also is the one providing the main funding for the majority of smaller football association (so even if it didn't have any de jure power over them, and it absolutely does, it would have still had de facto power with financing).


> stuff like 5 subs

No this is flat out wrong, since the laws of the game are governed by IFAB, of which FIFA is a member alongside the Football Associations of England, Scotland, Wales and Northern Ireland. And even then it seems they're flexible in some regards - for example the Scottish FA permitted five subtitutes before IFAB updated the laws and the English FA had a similar trial in the past permitting four subs - both have fiddled with extra stuff like VAR.

I'll grant that FIFA have brought in restrictions on international loan signings - though that's hardly controlling the game the way the original comment implied


> Get your lawyers to review the contractual structure of leagues and clubs, it can't be that the whole international set of deals is failsafe, players can probably just walk.

I think you're mixing up two things:

1. domestic club competitions - Serie A in Italy, the Bundesliga in Germany, The Premier League in England etc - where players have contracts with clubs and where the most successful teams in each league will compete things like the Champions League.

2. the national game - where country-level football associations select teams based on various national eligibility criteria to compete with other countries in continental competitions (European Championship, CONCACAF Cup etc) and the World Cup.

FIFA are not really involved with #1, it is primarily concerned with the nation-level competitions. It does have a club-level competition between the winner of each confederations' Champions League equivalent, but only the non-European participants really care about that. Additionally, players can and do "just walk" at the national level - some choose not to play either because they don't want to be injured playing for their country in a 9-0 victory over San Marino when their domestic club is in a tight race for the title or they're on a Champions League run. Players also refuse to play for personal reasons - like due to a falling out with a coach (Roy Keane for Ireland in 2002) or with an association (like Duncan Ferguson for Scotland in the '90s). So they know they can refuse to play, but they continue to do so.

There is not a snowball's chance in hell that an alternative World Cup would gain any sort of traction at all. Fans would be dismissive and the various national football associations would not take it seriously either. Additionally, the footballing calendar is already quite full so you couldn't run it in parallel with the existing tournaments, meaning that you couldn't slowly develop and grow the competition gradually, you'd need to replace the world cup from day one.

As shitty as FIFA are, they're here to stay.


Huh? Why should a video game company organize a football world cup?


Football is too traditional to play EA Cup it already sounds like a McDonald's league.


Yeah the "EA Cup" sounds like the name they'd use in a non-licensed football game to avoid being sued


No-one plays in the World Cup for the money.


Don't know why you're getting downvoted, this is correct. There's maybe some bonuses and appearance fees for national teams ... but all the big names people care about earn their money playing for their club.


> This means that if you want to go to the WC, you have no choice. This is a mandatory app, with no options.

it’s fashionable to make the case against tech by arguing the privacy angle. i sometimes wish we could raise the discussion one level of abstraction and speak about control more broadly (privacy being the control over which information you make public). you can make this app as private as you want, but i’d still be upset that its mandatory use is contradictory to my desire for agency.


At this point I think everyone should probably buy a disposable phone for installing this type of app.


Iif you really need to be there, use a burner phone. Or just don't go. Keep in mind those stadiums were built by slaves. Do you want to support slavery?


I doubt this is gonna stop anyone with a ticket from going.


this is going to disproportionately affect people in the global south - there aren't data privacy laws that google and apple need to stick to. suddenly, any group that is not politically favorable in a country is going to be a target.

HN can't hide behind the argument that this doesn't affect iOS. thats a very elitist argument. the majority of the world uses android.


HN can't hide behind the argument that this doesn't affect iOS. thats a very elitist argument

My point was that this is an indictment of the Android ecosystem, not a snooty nod to why everyone should use iPhones.


It’s perfectly fair to point out that Apples approach, which HackerNews loves to whine about, prevents exactly this kind of spyware.


First, this is further proof that the Apple iOS permission model is just better. There's no laundry list of permissions. You get asked for very few things and they're the things users care about (eg app running in background). Less is more. Very few people understand these laundry lists.

Second, Qatar is one of those places that you should realize what you're getting into by going. It is a religious monarchy with essentially sharia law. Insulting the ruling family will get you in serious trouble. Drinking will get you in serious trouble. Homosexuality or even out-of-marriage sex will get you in serious trouble. There are lots of rules and the punishments are harsh. Personally I wouldn't go. If you do, you have to accept a bunch of things you wouldn't wherever you're from most likely.


In general, when travelling internationally, it is just easier to leave your phone at home and buy a cheap phone with a prepaid plan when you get to country. This avoids all of the potential intrusions that come with passing through security and borders.


But when your phone is inspected at the border, and you have only 2 days of chat history, no browser history, no call log, and no saved photos, won't that raise even more questions?


You could answer: I just got a new phone 2 days ago, because my old one broke down.


Except then you can’t take good quality photos of your vacation…


If only there would be a device that lets you take high-quality pictures. Maybe storing it on a SD card. Maybe you could even put a real flash on it, for pictures at night.


This is really not about you "giving keys to your house" to Qatar. You already given keys of your house to Google and other parties, now they own your house and they don't like sharing it with Qatar.


Well nobody coerces you to use Google stuff or buy an Alexa etc.


In some cities (in western countries) you can't travel or do internet banking if you don't have the right app. Are you coerced? Yes you are. That is the same thing here. But you don't see "security experts" complaining.


Surly these permissions aren’t actually possible on iPhone? Apps can’t access other apps even with permission, or disable the lock screen etc.


I for one can't wait until this app is decompiled, so we can judge it on facts rather than rumours. It'd be interesting to see what techniques they employ and how far reaching their invasion of privacy is.


It's also not possible on Android to access other apps' data. (even as a user which is frustrating). But it can ask for access to all common storage which usually contains images, downloads and some other stuff.


You can track location in iPhone too, what's different?


Tracking location isn't what this is saying - it's saying you're giving them access to EVERYTHING on your phone - all the apps, all the data.

Yeah, sharing location's not great, but you have to accept that if you're connecting to cell towers they pretty much know where you are all the time anyway.


A required app? Do they think that everyone uses Android or iOS on their smartphones, or even has a smartphone at all?


Welp, great to know I can’t escape false equivalency attempts to dampen COVID as a threat even in an article about an extremely larger threat; I mean not to me, who cares, but Qatar World Cup sounds like you might need to be an important businessperson to be there… that needs their phone… and will forget they installed it. That shit cray.


They employ slaves to build the stadiums. That's fine.

THey make people install an app. OMG the humanity!


And the fun thing is that once you grant these permissions, the app has them through all updates.

So even if the current version of the app "doesn't do anything" the next version could do whatever it wants within those.


With the high churn of devices and increasing privacy intrusion, there's probably a small market for burner phones that will re-emerge just for apps in the next years.


Even using a burner phone doesn't fix the situation if you're still required to have the said phone with you all the time and it can't be turned off, it tracks your location, other phones you meet with etc.


I was thinking more about before/after the event to avoid it reaching to more details about your private life outside of that specific timespan, text messages, whatever tictoc harvests these days, etc.


Linked to your ticket too!


What lovely world us all software developers have build. Everything online or as digital application on your phone. Maybe we should really have stopped at some point to think should we instead of could we...


Well it's a little late, isn't it.

You still have nothing to hide ?


Everyone going to the world cup can afford a burner phone.


Yay! More e-waste!


When it comes to IT-required mobile crapware:

- Install it on a burner phone, not your real device.

- Install it on an Android emulator (e.g. Nox Player) on a laptop PC.


Articles/headlines on human rights issues in XYZ country bring out the brattiest comments in all of hackernews.


This is really no different than what other countries do, e.g. US border officials extensively questioning foreigners or asking for usernames and passwords for social media. As a visitor you have to abide by the law of the country, which may be different from your own country, and whose interpretation may be stretched by border control at the point of entry.

The only difference here is that they were able to build an app to do all the tracking in plain sight. I'm sure governments in the US and Europe would love to be able to force all visitors to install a similar app.


Does being similar excuse it somehow? Behavior by customs at the US border is abhorrent as well.


Yes. I think it does excuse it. If the US does X and expects everyone to accept it. Then Country Y doing X is excused… how else could it be? Any other way leads to disadvantage of Country Y


Applying this logic to X="wiping out its native population and taking their land" and Y=China just gets me downvotes around here sadly


The original point was that if a country is doing something now, that can be an excuse for another country doing the same thing now.

If you want to extend your excuse to "a country did something bad 50 / 100 / 500 / 1000 years ago (and later regretted it)" then you need to provide extra reasoning for why that still works as an excuse for what a country is doing now.

Edit: I'm guessing from the downvotes that I didn't make my comment clear enough (or I didn't understand the comment I was responding to). My intent was to point out the logical gap in an argument that could be seen as justifying China's genocidal policies.


That's taking it way out of context of the original point.

There isn't a lot of evidence of China doing that (your X). I expect Xinjiang will jump to front of mind for people, that is largely a "Mass Incarceration of an ethnic group"... which while not at all what my original point was, there is definitely an element of hypocrisy from the US here... But unlike travel restrictions, I don't think my original point holds.


> This is really no different than what other countries do, e.g. US border officials extensively questioning foreigners or asking for usernames and passwords for social media.

I’ve never encountered this when crossing a border and don’t even know how I would sensibly answer any of this. I don’t use social media and don’t travel with a smart phone. So what now? Would they make me buy one in the airport and sign up for Facebook there?


When I applied for a us tourist visa I was explicitly signing away any rights to privacy. I forgot the exact formulation but it went along the lines of “I understand that by travelling into the US I have no expectation of privacy whatsoever”, click checkbox or you can’t continue to the next page, where I was asked to enter all my social media usernames.


It's definitely a thing. I believe ESTA now asks for all social media user names (not passwords, but I suppose the US government doesn't need those), and it is definitely a requirement for getting a US visa.


They ask but it’s not a requirement to fill it in.


Remember that entry into the USA for a foreigner is entirely at the mercy of the border control officers. If they deem you "suspicious", they can refuse you access, and you don't really have any appeal.



According to https://esta.cbp.dhs.gov/faq?lang=en it's optional in the esta although they remind you that they can reject for any reason.


Well of course it is optional, endless people don't use social media for anything at all, and have never, and will never, have logins or handles.

Huge, massive amounts of people are like this. Huge. Twitter, Facebook, others have massively inflated usage numbers.

I suspect people with social media logins are the minority in the US, for example.

Doubt me? Do you think most people's 68 year old parents, or grandparents, all have logins?

Either way, how can you make it a requirement to provide, what is not a requirement to have?


> Either way, how can you make it a requirement to provide, what is not a requirement to have?

You simply make it a requirement to provide it if you have it. That is not the same as optional. If its optional then you aren't lying to immigration if you leave it blank. If it is not optional then you are.


Bearick, that guy fron LOTR

Wherick, the inverse of Waldo.

Nareick, always says nope.

Tearick, always rips up newspapers.

Hairick, ironic, guy's bald.

Lairick, dude is a shut in.

Stareick, stop looking at me!

Pairick, it's a chick.

Mareick, this chick is a centaur.

Fairick, redhead.


My wife just filled an ESTA and it was still optional.


Yes it is still optional. I travelled on an ESTA a few months ago , left the social media handles section blank, and they made no comment at the border. That said it is still very capricious.


“What psycho doesn’t have a social media account? Search him/her!”


Depends what you mean by requirement. Visiting/moving to USA is not a requirement. Not perjuring yourself is not a requirement if you don't mind staying in prison and/or paying fines. If, however, you do want to travel to USA and want do it without worrying about spending extended "vacation" you do need to fill the form truthfully. That includes giving a list of handles you have used on those listed social media sites (at least on DS-160).


It is different. A user can change their social media passwords and device after entering the country (sure, you can be stopped by border patrol anywhere, but that's relatively "rare"). The overreach takes place in a limited time and place, when entering the country, and aside from the data-harvesting concern can be counteracted afterwards to prevent future tracking. This app is a pocket spy that you're mandated to keep that pocket spy on your device throughout your entire stay.


US has infamously heinous border controls, what they do should not be the acceptable way. It also doesn't excuse that other countries behave in similar and disgusting ways.


> The only difference here is that they were able to build an app to do all the tracking in plain sight. I'm sure governments in the US and Europe would love to be able to force all visitors to install a similar app.

Yet, we do not because unlike in Qatar, the UAE and other religious dictatorships, we are a democracy and we have the ability to change our government.

You can do better than whatbouatism.


"It's okay when we commit the same immoral acts that authoritarians commit because we're a democracy"

American democracy commits heinous crimes across the world. Being a democracy doesn't absolve them of the moral degeneracy.


He's right about the whataboutism though.


Right on


he is right, but raising whataboutism isn't an argument. It's absolutely valid to point out immoral doings of the very people who are doing the accusations. Otherwise, it's a race to make the accusations and the first one wins - everyone else is whataboutism. You can easily see who came up with the inane whatboutism - the one who did a whole lot of crimes in the past, and wants to judge others now for similar crimes.


" It's absolutely valid to point out immoral doings of the very people who are doing the accusations."

What has this parent done that makes them ineligible to criticize others?


not the parent, but the others who responded with "whataboutism". Holding one accountable to the same standards that he holds others accountable isn't wrong. I refuse to take anyone who raises the bogey of "whataboutism" seriously. It has the same validity as someone responding to an argument that it's wrong to make that argument at this time of the day.


Whataboutism isn't pointing out a contradiction or hypocrisy.

It's a method of deflection.

"Whataboutism' is a rhetorical device that involves accusing others of offenses as a way of deflecting attention from one's own deeds."


This is the motte-and-bailey fallacy. When people cry whataboutism, it is because the person they're crying it at pointed out their hypocrisy. Then when they get called out on it, they fall back to saying it's a method of deflection.


Yep. It's an inversion so that you're the bad guy for taking a look at the ledger you both (implicitly or explicitly) agreed to use.

Variations of:

"Hey can I get back that $50 I lent you? I always pay you back and thought we had a mutual understanding, what gives?"

"Nice whataboutism, quit trying to make it about me."


You example doesn't make sense for this situation. It's between two people and things they did. However, The OP isn't the US government and hasn't committed war crimes (I assume).

Also your example isn't even whataboutism which is defined as "the technique or practice of responding to an accusation or difficult question by making a counteraccusation or raising a different issue."

What other accusation or difficult question is being raised in your example? It's person A asking for money he lent to person B back and pointing out what when person B lent him money he paid it back.


Holding another group or person to the same/similar standard is often called "whataboutism" though. I will concede that that is probably misplaced (and malicious) application and not what was originally intended.

That's why claims of hypocrisy against the other party, backed up with examples of the same behavior in other situations from them instead of you, can be cheaply dismissed as "whataboutism".


Using whataboutism to deflect a claim of hypocrisy is wrong, I'm completly with you on that. However to be even more firm about this, regardless of the intentions of whataboutism, you can't hold citizens of a country responsible for the actions of their government unless they were directly involved.

However... visa V mastercard , using whataboutism is valid in this situation. Bringing up something the US government did in the past to silence the criticism of a US citizen to another countries actions is wrong.

EDIT: Just another thought about your example. There isn't even hypocrisy. Person B lent money to A and A paid it back, then Person A lent money to B and B didn't pay it back.

- B doesn't pay back money

- A pays back money

There's no contradictions in their actions.


decrying whataboutism is starting to just look like deflection. Calling out hypocrisy is not whataboutism.


It is. I could see point if the people from USA seriously cleaned their own house before attacking others. Anything else comes out just as malicious. Maybe they should start with privacy for everyone and getting rid of slavery...


What if this person is 16 and can't vote. How is he responsible for the acts of the US government?


There is always the militias.


So he just has to be a member of one? How many meetings does he have to attend?, how much larping and dinner theatre does he have to do before he is allowed to criticize other countries without the burden of things past and current governments have done?

Are you bloody serious? For real real not for play play? Some other poster made the comment that "whataboutism" is deflection. Considering every country has done some amount of bad things, either in the past or now, according to you and other parents, no one would be allowed to criticize any other country's govermnet. That's the ultimate deflection.


It's not hypocrisy because the poster has never been the president of the United States, the person who authorizes military operations. I'm also going to go out on a limb an assume they haven't committed a war crime as soldier, commander, or any person who would be directly involved.

Whataboutism: "the technique or practice of responding to an accusation or difficult question by making a counteraccusation or raising a different issue"

Hypocrisy: "the practice of claiming to have moral standards or beliefs to which one's own behavior does not conform; pretense."

You can't be a hypocrite for something another person, group, or country has done. Even if you are a member of that grouping*. Notice how the definition clearly states "one's own behavior".

-----------------------------------------------

* I'm sure there's an exception here if you represent that group or control that group, like the CEO of a company or a spokesman. However just being a citizen of a country doesn't apply.*


There is no political party in the US that is against the rigorous collection of private information of people entering the country. Biometric data, social media account disclosure, excessive questioning by the TSA. You literally have no option to change any of this.


> You literally have no option to change any of this.

I'm guessing you only figuratively mean literally. You have the option of starting your own party that does care about privacy (and then voting for yourself), and you have the option of "contributing to the election campaigns of" (i.e. bribing) politicians who will then vote for legislation you want.

More practically, you can campaign within an existing party (presumably the Democrats) for them to support electoral reform (e.g. RCV or Approval Voting, at least for state elections) so that new parties can emerge, and so that the existing parties become more reflective of the actual wishes of voters.


Yes, I too enjoy my decision on a daily basis as to whether I prefer Pepsi or Coke.


[flagged]


There is no way to answer your trolling without a significant amount of sarcasm. Good day to you.


The US is a flawed democracy[0].

You're acting like the US invented democracy and is a champion of freedom and acceptance which is confidently wrong. Try growing up as a gay kid in the bible belt. It won't be so different from doing so in Qatar.

0.https://en.m.wikipedia.org/wiki/Democracy_Index


I mean, I get “why”. But nonetheless this is having and eating cake at its best.


It seems like owning an iPhone is a good way to protect yourself from a lot of this. But if you're an Android user, couldn't you buy a burner phone for these two apps, to avoid installing them on your primary phone?

I don't think I would trust a device that ever had these apps installed.


You can track location in iPhone too, so that's no different.

The only permission that is problematic is the storage access one, but that too has been addressed in later Android versions with scoped storage.


What if you show up to the games without a phone?


I think this calls for an outrageous break with smartphone design, someone bold needs to design the voice only flat black slate with no instructions and requiring practice to master. Take that!


It's worth reading in full, but this is the perfect tl;dr:

>NRK has submitted the findings about the apps' security holes to FIFA. They tell us that they do not wish to comment on the matter.


- Sir, you have to install this application, it's available on both iOS and the Google Play Store.

- Do you have a Debian package?

- I beg your pardon?

- My Pinephone runs a modified version of Debian, the Universal Operating System.

- ... What is that?

- Oh fine. I'll settle for a Flatpack then.

- I'm not sure I follow.

-Does Qatar's Law require me to have an Android phone xor an iPhone?

- No ... ?

- Well your Law specification is incomplete and buggy.

you get arrested for obstruction of justice


The great news is that just like you're not forced to buy an Android or iOS device, you're not forced to travel to Qatar.

"Vote with your feet" applies to jurisdictions just like it applies to technologies. Of course, like with technologies, making such a choice has the potential to limit you in other ways.


Do not worry, the WEF and UN will be diligently taking notes of this field test and by the time it's rolled out in your country this will be resolved.

I cannot wait to have a social credit score! It is a wonderful idea and I am only disappointed that our wise un-elected WEF and UN leaders are being so shy in rolling it out.


Can we go back to FEMA death camps? This is just tiresome at this point.


Tiresome? You don't think the WEF goal of "I Own Nothing, Have No Privacy And Life Has Never Been Better"[0] needs more awareness?

[0] https://www.forbes.com/sites/worldeconomicforum/2016/11/10/s...


No kidding. If we miraculously pull out of this nose dive before climate change erases us all we’re immediately going to be tossed into a world where AI makes us basically zoo animals for the ultra wealthy.


> a world where AI makes us basically zoo animals for the ultra wealthy.

... for about 3 years, before one of the ultra wealthy elites presses the wrong button and the AI ends up putting them in the zoo (or paperclip raw materials hopper) too.


It is certainly unsettling how laws will blindly introduce a dependency on Google or Apple


This is the aspect of Qatari law that stands out to you as unsettling?


I didn't realize subthreads weren't allowed to isolate subcontexts and discuss them. Are the other 50+ comments not enough to satisfy you?


Qatar is our friend. Qatar is a democracy.


They certainly have a lot of money. Aren’t dollars basically people these days? Not to mention, oil.



But they said they're friendly :)


Last summer I had to travel to South Korea for business, I was required to install a government app due to covid. Obviously this app was only for android and iOS. I had an iphone so i didnt have issues. But if i had a pinephone, i probably would had to board the next plane out of the country.

Crazy how our lives are becoming so dependent on private company techs.


Same thing for Japan. For Android it's also only available on the Play Store which requires you to have a Google account.


If they really really want to track people:

- Sir, you have to install this application, it's available on both iOS and the Google Play Store.

- Do you have a Debian package?

- Give me a moment to check our database of alternative OSes.. Why yes, yes, we do have this as a Debian package.

- ... Well... is the app truly compulsory?

- Yes Sir, indeed it is I'm afraid. Security, safety and all that.

- ...


Even if the government went to the trouble of creating the Debian package, they wouldn't allow it to run on an OS that doesn't support a particularly restrictive "Secure Boot" setup, which would provide the mobile network with a remote attestation that you are running only "certified" packages and system services (including a minimal set of mandatory ones).

Naturally, this certification process would ban apps which could spoof the UI of any official apps, but the ban would have to go further and include any apps which users have built from source themselves. End-to-end encrypted messaging apps (without backdoors) would similarly be banned.

At that point, the fact that you have the source code for all of the software running on your surveillance device isn't much comfort. What good is a phone when you are unable to speak?


Are you implying that Debian does not support Secure Boot? Because it does.


I did worry that my comment might incorrectly imply that, so I deliberately reworded it to say a particularly restrictive "Secure Boot" setup, but I guess that's still ambiguous.

You're right, Debian "supports" such a set of restrictions, in the sense that a manufacturer could build devices that would comply with these hypothetical laws while only using vanilla Debian packages, but my point was that such a device wouldn't really feel like Debian, since the moment you installed an unapproved application (or removed a mandatory application) half the functionality would stop working.


No. Debian supports Secure Boot, and that means anybody can add their own signing key and sign and boot their own kernel, packages and everything else.

As long as users can update the signing keys it's all good.

If not, it's tivoization, and it breaches GPL.


> anybody can add their own signing key

That's assuming the hardware supports it. I'm imagining a (very likely) world where devices will either no longer support self-generated keys, or where using such keys makes your device unable to access the mobile network or the internet. (The latter sort of device might in theory be buildable, and run Debian just fine, but I don't think it would have enough buyers for a manufacturer to waste money on producing it).

> If not, it's tivoization, and it breaches GPL.

Contracts (and software licences) cannot override the law. If a government wants to ban self-generated keys (and/or make anti-Tivoization clauses unenforceable), then it can easily do so, and make all "Debian phones" either not feel like Debian, or not feel like phones.


> Contracts (and software licences) cannot override the law

I never said they could.

> If a government wants to ban self-generated keys (and/or make anti-Tivoization clauses unenforceable), then it can easily do so

Wrong. That would require abandoning copyright enforcement.

Tivoization breaches the GPL. When a license is in breach, integrators, developers and users have no right to use such software.


> That would require abandoning copyright enforcement.

Who do you think writes copyright laws?

Obviously I'm not suggesting a government would just abandon the entire concept of copyright, but it could amend its copyright law to say that a copyright holder cannot claim (in court) that their proprietary rights were breached solely due to a defendant applying "security measures" to prevent software tampering.

That would be grossly unfair to people whose code is then used in ways that go against their wishes, but government policies don't have to be fair. (For the avoidance of doubt, I'm not accusing you of saying that they have to be fair, I'm just providing some obvious context to help make my position clearer to anyone reading this).


In this context: Does Mobian on PinePhone support Secure Boot?


That’s cute, except that of course in the real world you get some nice quality time with border control/the police/secret services well before that if you try playing these games.

Or: try arguing about the fourth amendment, human rights and the constitution when a uniformed thug wants to seize your phone when you fly into the US. It does not sound that clever in the real world.


As the article points out, you do have the option of traveling without a smartphone...


No plan to travel to Qatar, but I don't own a mobile phone anyway.


> access to read, delete or change all content on the phone

The article is pure fiction, as no app has any possibility of ever being granted those permissions on iOS.

No such capability even exists for any app on an iPhone.


Can't you do this with an MDM device profile? In that case the device probably insists on the installation of the profile or it won't validate your tickets.

[edit]: so I did some brief research and it seems you can't. For the curious, here is what I think is the full list of possible MDM restrictions/permissions on iOS https://support.apple.com/en-gb/guide/deployment/dep0f7dd3d8...


what is with you people thinking like nothing else other than Apple products exist?


> what is with you people thinking like nothing else other than Apple products exist?

I was addressing the specific claim that “everyone” had to give these permissions.


Can they ask for read/write permissions on dozens of folders?

I have no idea I never got interested in iphones.


They can ask for access to their own directory on iCloud, or arbitrary files on the iCloud Drive. They cannot ask for access to other directories than their own on the device, sandboxing is rather strict.

It’s still not ideal; mobile platforms are not designed to protect you from state actors.


A small minority of mobile devices are iphones .... Most of the world uses Android devices manufactured in China.


Android


We need better app sandboxing on phones yesterday, with system call filtering so it would be possible to just fake the data app requests


I have two phones, one for my personal shit and one for privacy intrusive shit like my work wants to install or this.

Seems to be the best solution.


A fair bit of fear mongering and false news here… almost all of these permissions are not possible on an iPhone / and likely not even possible on modern android!


Android and iOS have almost equal market share in Norway. Worldwide Android is a lot bigger (~70%). This affects most people, just not in the US.


You can’t grant access on iOS “to view / edit / delete all/any data”, that’s physically not possible, even with the hidden SDKs that only select parties have access to.


Good for the 24% of users, then.

It doesn't change the fact that tracking your detailed location and who you are around in combination can be used to determine your affiliations or sexual orientation. If you, with your secure iPhone, are located around numerous people with Grindr installed, they may jump to conclusions.

They are capable of targeting gays or political opponents with this, which is the point of the story.


Are you talking about secret government back door stuff? Not into phones but that sounds interesting, lol


I’m not aware of any government back door access, but carriers that I worked with had access to all sorts of crazy hidden SDKs within iOS. For transparency, last time I worked on those was 5-6 years ago, so things may have changed.


Still really interesting. Thanks for sharing.

I heard of a software called Pegasus but couldn't tell if it was legitimately that powerful.


Doesn't Apple's MDM allow that?


Something close to that, AFAIK. But then, it’s not “go download this app from the store”. More like “we steal your phone, jailbreak it, and now we can see everything”. Not sustainable at scale.


You don't need to jailbreak a phone to set up MDM on it.


You do if you don’t want to need the cooperation of the people in question.


Qatar doesn't mind needing the cooperation of the people in question, since they can put you in jail or deport you if you don't cooperate.


Yep lucky us 30% of smartphones holders are safe; nothing to see here.


Every country should have rights to control what enters their borders. Be it phones or people. Nothing unreasonable here considering the existing standards of border control around the world. Just next logical step to prevent terrorism and undesirable activities. Don't like it, don't go.


One has to wonder, if Qatar is so afraid of terrorists and undesirables coming into them from abroad that they feel the need to have as much control as possible over their personal data and communications, why did Qatar want to host a global event in the first place?


> Don't like it, don't go.

I am not going, but I guess players do not have this choice?


I don't think they are forced either. At least from most countries. It is actually pretty competed job.


It can have some repercussions. Few decisions in life are really easy…


You’re gonna get downvoted but I don’t think you’re altogether wrong. If the World Cup gets hit by extremists, Qatar’s reputation will be hit harder than anything else.

Who now blames anyone but Germany and its incompetence for Black September’s actions in the 1972 Munich Olympics?


I have never heard anyone blame the 1972 Munich Olympics terrorist attack on the Federal Republic of Germany's lack of authoritarian state surveillance powers, their lack of motivation to keep track of the exact location of every foreign person in the country, nor on the fact that they did not require every single visitor to surrender the contents of all their personal documents for potential state scanning.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: