A study of data collection by Android devices • Hacker News Board

Re: A study of data collection by Android devices

#21

Post by dartharva » Fri, Oct 15, 2021, 2:18 PM UTC

>We find that the Samsung, Xiaomi, Huawei and Realme Android variants all transmit a substantial volume of data to the OS developer (i.e. Samsung etc) and to third-party parties that have pre-installed system apps (including Google, Microsoft, Heytap, LinkedIn, Facebook).

Of course they do. That's the whole reason they're selling high-capacity hardware for cheap, they more than make up for their foregone profits from user data and third party partnerships.

That's why you should always flash a custom ROM whenever you buy a "value for money" Android phone; never stay on the vendor's OS. Thankfully, except Samsung and Huawei, most other Android device manufacturers aren't actively working on locking down their firmware against customization and appear tolerant as of yet. You can even choose not to install Google services on your phone, although it would make using it normally a hassle.

Re: A study of data collection by Android devices

#22

Post by chuckee » Fri, Oct 15, 2021, 3:27 PM UTC

jqpabc123 wrote: post #16

tmsbrg wrote: post #14

I was curious about the LineageOS, so I checked and found: "On all of the other handsets the Google Play Services and Google Play store system apps send a considerable volume of data to Google, the content of which is unclear, not publicly documented and Google confirm there is no opt out from this data collection. LineageOS collects no data beyond this data collected by Google and so is perhaps the next most private…

Does anyone have some info about this setup? Yes, you can use MicroG with LineageOS. If this totally solved the privacy issue, e/OS would be pointless. GApps is a big upper level privacy problem that microG can solve but this is not the only issue. By default, AOSP itself also sends personally identifying info to Google servers through low level system calls. The e/OS fork is needed in order to remove this.

> By default, AOSP itself also sends personally identifying info to Google servers through low level system calls.

Can you explain more about this? What kind of information is sent? And does LineageOS not disable this?

Re: A study of data collection by Android devices

#23

Post by jqpabc123 » Fri, Oct 15, 2021, 4:33 PM UTC

chuckee wrote: post #22

jqpabc123 wrote: post #16

Earlier quoted context omitted.

Does anyone have some info about this setup? Yes, you can use MicroG with LineageOS. If this totally solved the privacy issue, e/OS would be pointless. GApps is a big upper level privacy problem that microG can solve but this is not the only issue. By default, AOSP itself also sends personally identifying info to Google servers through low level system calls. The e/OS fork is needed in order to remove this.

> By default, AOSP itself also sends personally identifying info to Google servers through low level system calls. Can you explain more about this? What kind of information is sent? And does LineageOS not disable this?

No, LineageOS does not disable this.

Personal opinion but the LineageOS project seems more concerned with security than privacy. The idea of Google hijacking your privacy for profit doesn't seem to really bother them too much. Their web site and wiki repeatedly address security but rarely privacy.

As for explaining further, I will defer to the document below from the e foundation.

https://e.foundation/wp-content/uploads/2020/09/e-state-of-d...

Re: A study of data collection by Android devices

#24

Post by smoldesu » Fri, Oct 15, 2021, 5:03 PM UTC

srg0 wrote: post #11

LWN is a nice site, but to save you a couple of clicks, this is the original post by Trinity College Dublin: https://www.tcd.ie/news_events/articles/study-reveals-scale-... And this is the paper it talks about (PDF): https://www.scss.tcd.ie/Doug.Leith/Android_privacy_report.pd... "Key findings from the study: - With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps instal…

I am curious, do iPhones not send a list of opened apps (a la MacOS) back to Apple periodically? I was under the impression that most phone vendors would collect statistics like that.

Re: A study of data collection by Android devices

#25

Post by gigel82 » Fri, Oct 15, 2021, 5:54 PM UTC

I wish someone did this for Windows. Couldn't find anything so started setting up myself (using 2 VirtualBox VMs, internal networking and mitmproxy).

I can see the data with that setup, but it's way too much to parse by a (single) human. I'll collect just the URLs for now, to at least update my PiHole config to block what isn't needed for Windows Update.

Re: A study of data collection by Android devices

#26

Post by nervuri » Fri, Oct 15, 2021, 8:05 PM UTC

srg0 wrote: post #11

LWN is a nice site, but to save you a couple of clicks, this is the original post by Trinity College Dublin: https://www.tcd.ie/news_events/articles/study-reveals-scale-... And this is the paper it talks about (PDF): https://www.scss.tcd.ie/Doug.Leith/Android_privacy_report.pd... "Key findings from the study: - With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps instal…

> - With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps installed on a handset.

/e/OS is no exception. I looked at the requests made by its "Apps" app. Every time it checks for updates, it tells the server what applications you have installed. These requests are made with a User-Agent header revealing your device model, build ID and Android version. Installed languages are also sent via the Accept-Language header. And there is no option to disable update checks; the closest you can get is to set the interval to monthly.

Contrast that with F-Droid, which downloads the package index in advance (like apt does), so it doesn't need to send the server a list of installed apps in order to check for updates.