Question about preventing network traffic and Google account data

WukZarathustra

One last question relates to the unlimited Google storage for photos. Is this the same with Grapheneos as with PixelOS?
I know it misses the mark and is less privacy friendly, but I still want to use Google. I still think GraphenOS is the most secure and privacy-friendly Custom Rom.

GrapheneOS

WukZarathustra

One last question relates to the unlimited Google storage for photos. Is this the same with Grapheneos as with PixelOS?

It's still a Pixel and it still has the Pixel features marked as being there. It likely works the same way despite being a different OS.

I know it misses the mark and is less privacy friendly, but I still want to use Google.

That's fine, and you're not missing the point of GrapheneOS at all.

Custom Rom

We don't use this terminology, it's just an OS.

Titan_M2

The body of the thread has nothing to do with the question, can you elaborate?

WukZarathustra

Titan_M2
Sorry if my English is not so good. The beginning of the question has strangely disappeared. I'll try to answer it without naming names. I use a good VPN firewall from GitHub/f-Droid. Now VPN also has gaps and the app can also fail at short notice. In this case, it would be nice if I could prohibit WLAN or mobile data from an app via the operating system.

The last question above is about the fact that with Pixel smartphones or Pixel Custom Rom, the photos in Google storage are not counted and therefore have unlimited photo storage. Now Graphenos is completely different, it is still a Pixel smartphone, but not a Pixel-like operating system. That's why I don't think it's there.

de0u

WukZarathustra I use a good VPN firewall from GitHub/f-Droid. Now VPN also has gaps and the app can also fail at short notice. In this case, it would be nice if I could prohibit WLAN or mobile data from an app via the operating system.

For a better answer, can you say which VPN, which gaps, and identify an example of a VPN app failing?

You can remove the Network permission from an app.

You can also disable the app except in one profile, and "end session" that profile, which will ensure the apps in that profile are not running.

de0u

WukZarathustra With Pixel smartphones or Pixel Custom Rom, the photos in Google storage are not counted and therefore have unlimited photo storage.

I am not familiar with the details of such a policy. It seems a little unlikely that Google has a written policy addressing custom OSs on Pixels. Can you provide a link to documentation of this policy?

User2288

WukZarathustra
your writing is not understandable.
You are using a translator.
Make your sentences shorter and simpler, so the translator can translate correctly.

GrapheneOS

Now VPN also has gaps and the app can also fail at short notice. In this case, it would be nice if I could prohibit WLAN or mobile data from an app via the operating system.

This isn't correct. Always-on VPN and blocking connections not through VPN are both enabled by default on GrapheneOS for any modern VPN app. There aren't leaks if the VPN goes down or the VPN app crashes unless the VPN app is implemented incorrectly.

The toggles you're talking about for disabling access to Wi-Fi and mobile data on LineageOS are very leaky and don't really work as privacy or security features. They're only an approximation of blocking access, since only direct access is blocked, not access through many APIs requiring the INTERNET permission.

gk7ncklxlts99w1

GrapheneOS

I'm curious about the articles that have come out in recent years about Always-On leaking data due to captive portal or something. Mullvad reported it to Google but Google said it's all quiet on the western front. Is this still present in Android but mitigated in GrapheneOS?

In case you want sources, these aren't the article I read, just found them from googling the topic:

https://www.bleepingcomputer.com/news/google/android-leaks-some-traffic-even-when-always-on-vpn-is-enabled/
https://www.techtimes.com/articles/281824/20221011/android-always-on-vpn-leak-data-android-android-vpn-leak-ip-address.htm

Relaks

gk7ncklxlts99w1 Daniel Micah answered this here: https://www.kuketz-blog.de/grapheneos-der-goldstandard-unter-den-android-roms-custom-roms-teil7/

Quote:

Connectivity checks aren’t a VPN leak but rather are part of the low-level functionality for establishing a connection to the internet. They’re empty HTTP/HTTPS GET requests with a standard frozen user agent to a standard URL. They don’t send any data. VPNs require that the OS establishes an internet connection and resolves their hostname via DNS in order to connect. Connectivity checks allow the OS to determine which networks have internet access to choose a working one and the main reason they exist is to detect and handle captive portals. On a Wi-Fi or other network with a captive portal, the connectivity checks will detect it, create a notification about it and the user can use the WebView-based interface opened from the notification to handle the captive portal since it has a special case bypassing the VPN. This allows you to deal with captive portals while leaving your always-on VPN enabled instead of temporarily disabling it and connecting to a non-HTTPS website in a browser to trigger the captive portal UI. GrapheneOS provides 3 choices for connectivity checks:

the default of using GrapheneOS servers with at most 4 day logging

standard connectivity checks to blend in with other Android devices while using a VPN and disabling them.

We recommend using the default when not using a VPN and using the standard mode when using a VPN if you want to blend in with other Android users who use VPNs. Disabling it is provided as an option for people who want it, but there isn’t really a good reason to do it.

WukZarathustra

Thank you for your answers. My native language is German. Sorry for my bad English and your understanding. I'll make short sentences now. I use Netguard firewall from GitHub. i would continue to use it in Graphenos.
Sometimes Netguard went down for a short time. You don't always notice it straight away. That's why I'm asking whether additional blocking is possible without root.
I have heard that a VPN firewall does not always block all network traffic. There are supposed to be small gaps. At least this has been recorded by users. But that was a few years ago.

The other question related to the Google photo storage. I'm currently testing PixelOS on a Samsung Galaxy Note 10 Plus. The free unlimited photo storage is active there, as with the original stock.

But that would just be a bonus. I'm determined to buy a Pixel smartphone and run GraphenOS on it. I hope that the apps that require Google services will run on it. The most important apps would be WhatsApp and the DKB banking app. Unfortunately, I need WhatsApp for other parents who only use WhatsApp.
I also like reading Mike kuketz. Many thanks for your help and answers.

WukZarathustra

I came to you via the kuketz-blog. The blog praised GraphenOS, as did several others in the neighbourhood. I have now read the article again. It also says that network traffic can be restricted for an app. I have always wished that there was some kind of firewall in the stock or custom roms.