Live data from Hacker News

Android phones are sending significant amount of user data with no opt-out [pdf]

scss.tcd.ie

201–210 of 377 posts

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#201

I use GraphineOS and LineageOS without Google Play Services. They are great and are suitable replacements for Apple and Google. - Osmand(FOSS) for maps (supports being fully offline!) - Signal and Discord for messaging (Discord is sandboxed) - Newpipe(FOSS) for Youtube - F-droid(FOSS) for my FOSS appstore - APKmirror for the few non-free apps I need - Libretorrent(FOSS) and VLC(FOSS) for watching movies - Firefox(FOS…

I've tried Osmand and found it way too slow/janky for everyday use (since it has to render the tiles locally and doesn't seem to pre-render for scrolling).

Newpipe loads videos much slower than the official app and occasionally fails completely (likely because YouTube changed something).

F-droid (regular, non-root install) shows me notifications to update apps, then when I tap them, I get a "there was a problem parsing the package" - this is a bug that has remained unfixed for over 5 years (https://gitlab.com/fdroid/fdroidclient/-/issues/669).

It's not impossible to use a FOSS phone, but it's truly painful.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#202

Earlier quoted context omitted.

LineageOS for microG supports all phones that LineageOS does. Here's a spreadsheet of the full list along with the specs of each device: https://docs.google.com/spreadsheets/d/1bx6RvTCEGn5zA06lW_uZ... If you want a more specific recommendation, could you provide your budget and your requirements?

No budget restrictions although I’d like the ability for Bluetooth to run in the background and not go to sleep , and ideally ip67 or ip68 water protection.

All of the LineageOS phones I've ever used have been able to maintain a Bluetooth connection in the background.

If you're fine with a used phone, the OnePlus 8 has a high-end Snapdragon 865 processor and 8 GB RAM.[1] The carrier models have IP68, and unlocked models are manufactured similarly but don't have an official IP rating.[2] If you're getting the T-Mobile carrier model (which may be carrier unlocked at sale), you'll need to request a code and wait a week to unlock the bootloader before you can flash LineageOS.[3] Used models go for $200-300 on eBay depending on condition, and a new factory unlocked model is $399.

If you're looking for a new phone, you may want to consider the Pixel 5a which manages to have both IP67 and a headphone jack for $449 new, but uses a mid-level Snapdragon 765G processor paired with 6 GB RAM.[4] The OnePlus 9 Pro is also available with a high-end Snapdragon 888 processor, 12 GB RAM, and IP68 for $969 new or about $600-800 used.[5]

[1] https://www.oneplus.com/8

[2] https://9to5google.com/2020/04/14/oneplus-8-ip68-water-resis...

[3] https://www.oneplus.com/support/answer/detail/op588

[4] https://store.google.com/us/product/pixel_5a_5g

[5] https://www.oneplus.com/9-pro

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#203

Earlier quoted context omitted.

That's more of a process than simply selecting text on the task manager tile.

I guess. You have to hit the screenshot combo and then tap the screenshot, versus hitting the app-switcher button. Are you doing this often enough for that 1 extra step to be a big deal?

For me, yeah this would be a much different experience. I use this feature all the time, to select anything from the title of a song on Spotify to a phone number embedded in an image on the web.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#204

Earlier quoted context omitted.

Far in never. There's no (real) money to be made, manufacturers don't care. I use GrapheneOS. It's rough but at least it gives me peace of mind.

Why is there no money to be made? I would at least pay to buy the hardware and possibly for ongoing software support as well (depending on how they structure such support or any other "soft" features). E.g. I think its a jolly good idea if somebody really checked for a living all those open source apps. In any case if there is really no viable business model for private mainstream mobile computing we have been duped…

In order to have a reasonable, stable supply chain at all, you need quite large scale; and even then your phone would have much smaller scale than the mainstream competitors and so would be be significantly more expensive than their models with similar hardware, both because it's targeting a niche and also because all this tracking&targeting does result in some revenue stream for the manufacturers.

It indeed is a jolly good idea if somebody really checked for a living all those open source apps, however the math works out only if you allocate the salary of those people over a million phones, not if you have only 10000 customers.

Perhaps you would actually be willing to pay a large premium for that, but the vast majority people are not. Perhaps a meaningful number of people would be willing to pay a small premium like 10-20%? But that's not what's reasonably achievable, the differences are much larger as soon as you go off mass market production or start needing software modifications which are a large fixed cost that is cost-effective only if you're distributing it over very many phones.

There have been many companies in the past which have found out the hard way that few people really care about privacy that much (or they care but can't really afford much, which has the same effect), but for a recent example, you can look at the troubles of Librem 5; IMHO it's trying to do similar things, but its price/performance is suffering because of that and you be the judge whether their business model looks viable. And if you want a trustworthy supply chain, then your (already high) costs literally double, again, Librem 5 "USA" model is an example of that - a $2k phone where the core functionality (excluding the privacy) is essentially the same or worse as a $200 phone from a Chinese brand.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#205
post #203

Earlier quoted context omitted.

I guess. You have to hit the screenshot combo and then tap the screenshot, versus hitting the app-switcher button. Are you doing this often enough for that 1 extra step to be a big deal?

For me, yeah this would be a much different experience. I use this feature all the time, to select anything from the title of a song on Spotify to a phone number embedded in an image on the web.

In the latter case, you could just select the text in the image directly. How often do you use this feature per day?

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#206
post #95

I use GraphineOS and LineageOS without Google Play Services. They are great and are suitable replacements for Apple and Google. - Osmand(FOSS) for maps (supports being fully offline!) - Signal and Discord for messaging (Discord is sandboxed) - Newpipe(FOSS) for Youtube - F-droid(FOSS) for my FOSS appstore - APKmirror for the few non-free apps I need - Libretorrent(FOSS) and VLC(FOSS) for watching movies - Firefox(FOS…

Do banking applications work? I mean as in "I buy X online. It requires me to login to my bank application and press 'confirm'. I perform this sequence, and online purchase is completed. "?

I switched to /e/ rather recently, and it also just happen that I am in the process of switching banks, which means I currently have two banking apps on my phone.

Both are rather strict on having a clean, non rooted, non modified phone. Currently, they both work without any caveats, but I had to install magisk, add them to magisk hide, and use the magisk renaming feature to have them work.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#207
post #4

Earlier quoted context omitted.

https://play.google.com/store/apps/details?id=org.dslul.open... OpenBoard is a 100% foss keyboard based on AOSP, with no dependency on Google binaries, that respects your privacy.

Thanks for this, just installed it and when I click to enable in my settings, I get an Attention message: "OpenBoard may be able to collect all the text you type, including personal data such as passwords and credit card numbers" This appears to be from Samsung, trying to deter users from using keyboards other than their own.

I'm glad they let people know it's possible, a keyboard isn't something you should install without some careful consideration because they can be used as keyloggers. I just wish they'd been as clear about that with the keyboard already installed on the phones when they ship. Anyone seeing that warning might easily think it's safer not to replace their stock keyboard even though it's already doing the very thing they fear a new keyboard might do.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#208

Earlier quoted context omitted.

Some Android flavors, including /e/[1] and GrapheneOS,[2] don't use Google servers for the internet connectivity check by default. [1] https://gitlab.e.foundation/e/backlog/-/issues/268#note_1809... [2] https://grapheneos.org/faq#default-connections

Looking through the GrapheneOS source, the servers may not be Google servers but the system is still designed to phone home. As such, have they solved the problem or is this just another case of "Dont' trust them, trust us instead." Has anyone succeeded in running multiboot on "smartphone" hardware, i.e., where the user can boot into a choice of kernel/userland. One choice might be Android, another might be GrapheneO…

For your later linked examples, those can be changed.

But as for the microG/GApps question, GrapheneOS provides a sandbox for the actual GApps, so that almost everything can run properly, with very strong control over what is seen by Google.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#209

Earlier quoted context omitted.

Thank you. Much appreciated. :) (Perhaps WhatsApp might work as well, since, IME, it can be sideloaded and will work without a functional Google Play Services.)

Signal is specifically designed to work without Google Play Services, so expect a 1:1 experience when using it with these privacy conscious distros. I'm confident Whatsapp will work, but I have not tried. Push notifications will not work without Google Play Services.

According to Plexus, WhatsApp works perfectly on Android without Google Play Services, whether or not you have microG installed.[1] I think they implement their own push notification system if you download directly from them,[2] though I haven't confirmed this.

Discord works perfectly with microG, and has a 3/4 rating without it since notifications will only work if you have microG.

[1] https://plexus.techlore.tech/applications/whats-app

[2] https://www.whatsapp.com/android/

[3] https://plexus.techlore.tech/applications/discord

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#210
post #95

I use GraphineOS and LineageOS without Google Play Services. They are great and are suitable replacements for Apple and Google. - Osmand(FOSS) for maps (supports being fully offline!) - Signal and Discord for messaging (Discord is sandboxed) - Newpipe(FOSS) for Youtube - F-droid(FOSS) for my FOSS appstore - APKmirror for the few non-free apps I need - Libretorrent(FOSS) and VLC(FOSS) for watching movies - Firefox(FOS…

Do banking applications work? I mean as in "I buy X online. It requires me to login to my bank application and press 'confirm'. I perform this sequence, and online purchase is completed. "?

I just use the website
Post reply on HN