Years ago I wrote about Google’s calculator absurdly requiring permission for network access.

A calculator requires network?

Looking back now, and based on recent headlines, perhaps the calculator story should have been front page news.

Someone just prompted me to answer why Google’s Authenticator app needs to track location and data, and the calculator immediately came to mind. I guess Google is giving me a reason to write analysis of 2FA privacy options better than theirs.

In related news, lately we’re all talking a lot about contact tracing safety and, surprise surprise, Google has screwed up that security as well.

Researchers say hundreds of preinstalled apps can access a log found on Android devices where sensitive contact tracing information is stored.

A calculator misstep seems comical, yet this kind of privacy failure can be catastrophic.

Let this forever be proof that “too big to fail” is a logical fallacy, not to mention an economic fantasy.

The Markup digs even deeper at Google, pointing out an apparent slow response and lack of concern about user safety.

The Markup has learned that not only does the Android version of the contact tracing tool contain a privacy flaw, but when researchers from the privacy analysis firm AppCensus alerted Google to the problem back in February of this year, Google failed to change it. […] “This fix is a one-line thing where you remove a line that logs sensitive information to the system log. It doesn’t impact the program, it doesn’t change how it works, ” said Joel Reardon, co-founder and forensics lead of AppCensus. “It’s such an obvious fix, and I was flabbergasted that it wasn’t seen as that.”

The big rub seems to be between Google’s trust of Android apps and the security researcher who knows that’s a very broken model to rely upon.

Reardon also reached out to Giles Hogben, Android’s director of privacy engineering, on Feb. 19. In an email, Hogben noted, in response to Reardon’s concerns, that the system logs could only be accessed by certain apps.

“[System logs] have not been readable by unprivileged apps (only with READ_LOGS privileged permission) since way before Android 11 (can check exactly when but I think back as far as 4),” Hogben said in his Feb. 25 reply.

Reardon, however, said hundreds of preinstalled apps can still read those system logs. “They’re actually collecting information that would be devastating to the privacy of people who use contact tracing,” he said.

Reading the logs is reading the logs, as we used to say. Reardon is right that a preinstalled app that can read the logs means the data boundary is pierced and thus privacy expectations breached.