Live data from Hacker News

Android phones are sending significant amount of user data with no opt-out [pdf]

scss.tcd.ie

321–330 of 377 posts

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#321

A distinction needs to be made clear here with regards to the data being transmitted to Google by LineageOS in this study. In the cited paper ( https://www.scss.tcd.ie/Doug.Leith/Android_privacy_report.pd... ), the device used to test LineageOS was a Google Pixel 2 running LineageOS 17.1 which also included an installation of OpenGapps 10.0 nano . It's not the OS that is transmitting the data over to Google, but rath…

Technically, the Internet Connectivity Check on LineageOS also sends your position/IP to Google, and also avoids a VPN tunnel because it's lower down the stack. I can recommend LineageOS, however be aware that lots of malware infected builds have made it to xda dev in the past, so you should build it yourself if possible (or use the official downloads). Regarding the Connectivity Check: You can add all google related…

I'd recommend libredns.gr, it's free and available for non-Android devices.

> You can add all google related domains to /system/etc/hosts if you have root/sudo access.

Root access is harder to get with each new Android release - Google don't like adblockers.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#322
post #229

Earlier quoted context omitted.

Looking through the GrapheneOS source, the servers may not be Google servers but the system is still designed to phone home. As such, have they solved the problem or is this just another case of "Dont' trust them, trust us instead." Has anyone succeeded in running multiboot on "smartphone" hardware, i.e., where the user can boot into a choice of kernel/userland. One choice might be Android, another might be GrapheneO…

My pinephone has multiboot to several different Linux and Android varieties.

Librem 5 can also boot different operating systems.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#323

Earlier quoted context omitted.

> Why is there no money to be made? Not enough people care to use cut rate hardware that actually conforms to the 'wholly open' philosophy. Even Stallman couldn't maintain using fully open hardware. He had to switch to a Thinkpad with Coreboot. People have expectations when using devices as complex as a phone or laptop to where, compared to even a desktop with Linux, having a smartphone that is fully open comes with…

well, "fully open" is just an ideal. I think I could live with proprietary bits that are not involved in the private data trade. it doesn't have to be "cut rate". I left the specs/price point open for that reason. But indeed thinking of it as a tool, not as a trend-following gadget with 12 cameras and the screen size of a laptop. Just interested to see whether this approach is viable.

> Just interested to see whether this approach is viable.

Spoiler alert: It's not. The better SOCs end up becoming more proprietary because it's the companies' own implementations that make them perform better. That leads to proprietary drivers/software.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#324
post #229

Earlier quoted context omitted.

Looking through the GrapheneOS source, the servers may not be Google servers but the system is still designed to phone home. As such, have they solved the problem or is this just another case of "Dont' trust them, trust us instead." Has anyone succeeded in running multiboot on "smartphone" hardware, i.e., where the user can boot into a choice of kernel/userland. One choice might be Android, another might be GrapheneO…

My pinephone has multiboot to several different Linux and Android varieties.

How is Pinephone coming along toward this year's end?

I check in every now and then, but I need it to be where current Lineage/Graphene are. I don't need trivial software (games et al), but I need it to be automatic enough* that I don't have to spend an evening or weekend unbreaking things – and reliable all the same.

* barring basic things like package manager updates

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#325
post #257
post #184

Earlier quoted context omitted.

Did you actually find any examples of GrapheneOS phoning home? GrapheneOS doesn't rely on any third-parties I'm aware of. The only service provided is over-the-air security updates. It doesn't even come with an app store (although you can install F-Droid). For that reason, GrapheneOS alone fits all three categories you mentioned: It is Android, it is GrapheneOS, and it is fully controllable / doesn't ship bloatware.

It is not controllable at all: It still enforces any app author's will against the user's. Root is not offered, and the grapheneos maintainer seems to be personally offended by the thought that root could be helpful.

>enforces any app author's will against the user's

I'm not sure what you mean by this. All apps run in a sandbox and you can deny permissions if you like.

>Root is not offered

Root access on Android is a security hole.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#326

Does anyone here have any experience with the /e/OS mentioned in the article?

Yes, I've been using /e/ in daily use for over a year now.

It's pretty good most of the time. It will not satisfy people who want/need a truly "hardened" device, but if you are just a normal person who wants to feed less data to the ad-tech monsters, then it works well.

The default /e/ app store has both FLOSS apps from F-Droid and free-as-in-beer proprietary apps mirrored from Google Play store. Whether an individual app works well or not depends on how tightly coupled it is to Google Play Services

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#327

Does anyone here have any experience with the /e/OS mentioned in the article?

It's rather good and at some point they managed to have release for my previous phone model when the lineageos stopped! I used it without their cloud services. Some of the pre-installed apps cannot be removed (like email, pdf readers) which is slightly annoying. They have their own launcher/desktop but it's not that good, it even crashes time to time. Last time I checked, it was not super transparent which non-FOSS s…

> Last time I checked, it was not super transparent which non-FOSS store they used

I'm pretty sure that's deliberately opaque because mirroring APKs from Play store breaks some ToS somewhere and they don't want everyone getting their Google accounts banned.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#328

Earlier quoted context omitted.

> ...and have a better experience in every category than iOS, hardware and software. Really? I tried GrapheneOS on a Pixel 4A, and without exaggerating or trying to come off sensationalist the experience was really tepid compared to iOS, and even "normal" Android. Stuttering and jerky UI (which often also wanted to take a brief nap), very poor GPU hardware acceleration support, notably worse battery life, loads of th…

The mid-level processor on the Pixel 4a may just not be performing to your expectations. A phone with a high-end processor would perform better. For GrapheneOS, the fastest compatible phone available (used/refurbished) right now is the Pixel 4 (or Pixel 4 XL). Also, if you are using a Pixel phone with a non-default flavor of Android, the Google Camera app still works if you download it manually. APKMirror is a trustw…

Pixel 4 running graphene. I'm sure it's fine by android standards, but if you're used to iOS, it is unbearable.

Going back to iPhone as soon as I've got some free time to get everything set up again.

Unrelated, but I'm still very surprised there's no standard way of doing live photos on Android. They really do add a lot to the experience of reviewing old memories and Google has had at least 5 years to catch up.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#329

Earlier quoted context omitted.

Looking through the GrapheneOS source, the servers may not be Google servers but the system is still designed to phone home. As such, have they solved the problem or is this just another case of "Dont' trust them, trust us instead." Has anyone succeeded in running multiboot on "smartphone" hardware, i.e., where the user can boot into a choice of kernel/userland. One choice might be Android, another might be GrapheneO…

Eh, if you want an airgapped phone, use it in airplane mode. Obviously, the phone needs some network infra for things like updates or timekeeping. You can route it over vpn if you want and you can build everything yourself and host all the servers yourself too if you so prefer. This type of pedantry is more harmful than useful to casual users who would be far better served with grapheneos than some non-existent ideal…

"...if you want an airgapped phone, use it in airplane mode."

Right, that's what I do. In fact this post comes from a smartphone sans SIM with airplane mode on, with a firewall against apps phoning home, no Google or Gmail account, all Google Gapps nuked including playstore - in fact all Gapps have been completely removed - not to mention that most replacement apps come via F-Droid.

Yes, technically it's not fully airgapped but it is against Google and that's my main aim.

Of course there's a penalty: I also carry around both a pocket router with WiFi and SIM to which the smartphone connects as well as the dumbest of dumb phones just for phone calls.

Yes, it's a little inconvenient in that the combined paraphernalia is about equivalent to two normal smartphones (both the router and dumb phone being somewhat smaller). Next step is to upgrade to a Fairphone or equivalent. (I've often wondered where I'd fit on a percentage scale of users who'd go to such lengths - somewhere between 0.1 and 0.001% I suspect.)

You may well ask why I've gone to such lenghts. It's more principle than privacy really. It's because governments around the world completely abrogated their responsibility when they deregulated the once-private telephone networks in the 1980s, when they did they let the Wild West take over. This 'vacuum' then led to a depreciation in the value of privacy on telephone networks. The ultimate insult came when the vacuum was filled by the likes of Google and others who usurped the last vestiges of our telephone privacy for good - and these damn governments just stood by and let it happen without so much as whimper. Remember, we telephone users were never first consulted about our privacy - governments just let Google and Apple et al take over the whole damn caboodle without question. (In the future after all the world has finally woken up to the disaster then we'll have dozens of historians trying to figure out what the hell happened and why. When realization finally dawns everyone will be flabbergasted.)

Now, long after the horses have bolted and without so much as an apology, governments are trying to reign in the likes of Google and Facebook. Right, our governance is a fucking farce - it has to be when governments simply allow Big Tech to not only effectively overrule longstanding law but also to go on and do whatever they damned well feel like with impunity.

Re: Android phones are sending significant amount of user data with no opt-out [pdf]

#330
In the book Post Corona, Scott Galloway talks about red vs blue companies. Blue companies (e.g. Apple) charge a premium for their product and offer you some level of privacy, while red companies give you their product (the Android OS and Google Apps) for "free" and then collect lots of data on you (and use that to make money). Amazon is clearly going this route too with the ridiculous number of ads they have started putting on their Echo Speakers.

He predicts that over time there will be paid versions of a lot more products for people who want (and can afford) privacy. I know there is a lot of hate for Galloway, and I take everything he says with a grain of salt, but this struck me as pretty astute.

Post reply on HN