Why we need a safety lock against accidentally enabling WAN or location

BillHurdle

We need, at the very minimum, an opt-in toggle that makes it harder to absent-mindedly just enable one of these self-directed shotguns. I've enabled WAN access more times that I care to admit, when I thought I was toggling wifi or bluetooth. I even took the step of moving the WAN button on the drawer to the second page. And yet somehow, once in a great while, I've managed to enable it while distracted with other concerns. Yes, I'm a moron. But I'm also stuck being human. I want something to prevent me from doing that. It could be a forced passcode/fingerprint authentication. It could be a double-enable where I need to touch another switch somewhere else. It could even be a dialog that pops up and warns me what I an idiot I am for even trying. I don't care but these are both loaded shotguns and need to be treated as such.

I did notice that when a new user profile is created, it no longer seems to enable WAN by default. That was a tremendous improvement and whoever did it deserves great appreciation.

Anyways, I think there are others who would want this feature. Those who don't want it should be able to use their phones just as they do now. Maybe the easiest compromise is just to have a toggle that says "Require me to do something else in order to enable WAN or location from the drawer buttons." It could even be an interview question in the "new phone" onboarding pipeline.

I should also add that this should apply even when trying to enable them in Settings, as long as the "antistupidity lock" is enabled. "Hey it looks like you're trying to enable location/WAN. Are you really sure you want to do that? How many beers have you had?"

Murcielago

BillHurdle

I don't know exactly which button you mean by "WAN button", sorry.

A general solution to accidentally pressing a button in the Quick Toggles would be to customize it:

Swipe down, tap on the pencil icon, then hold and drag the button you don't want to accidentally activate anymore to the bottom field. This will remove it from the Quick Toggles.

karsenja

BillHurdle

I agree with this.

Right now if someone purchase a Pixel and they accidentally disable Airplane mode while using Graphene in a location that can be somewhat linked to them, there's a ping and now they have the IMEI of the phone. From then on, that's your phone. If you are a privacy aware person with rights in a nice country, it doesn't matter.

If you are a protestor in a country with an unethical government, it puts you in a dangerous spot. It is much too easy to disable this.

In a country with few safeguards against governmental abuse, an accident like that could lead to police demanding that phone, threatening you with violence unless you unlock it, and using the fingerprints on the phone as a basis for a person's torture or execution.

BillHurdle

Murcielago That's cool! I really wish I'd known about it before. But there's still the problem of the "Airplane mode" toggle right there in the middle of "Network & internet" settings. It's just begging to be swiped by mistake (and I've done it).

"WAN", in the sense that I'm using it here, is the wide-area-network connectivity that comes on and connects you to a mobile phone tower. So "WAN button" just refers to the button that toggles airplane mode. I guess I could have called it the "airplane mode button".

The point being that an "airplane mode lock" toggle would be extremely useful, even if it's located in the network settings immediately below the airplane mode toggle itself. That alone would probably drop the impact of this threat by 100X. (And then people wouldn't even have to know your trick for removing a button from the drawer, because if you set the lock, then you wouldn't be able to turn airplane mode off from either the button or the toggle.)

Even changing the color of anything involving WAN to bright red would be useful, but I'm hoping for a safety lock, akin to the safety lock on an actual gun trigger.

I am a moron. And there are legions more like me, all waiting to press keys that ruin their day.

Murcielago

BillHurdle

I can understand that it would make your life easier if something like this were implemented, but I fear that the small team of Graphene OS developers will hardly have the capacity for such a special solution. Therefore some suggestions for workarounds:

As far as i understood it's about flight mode. I still don't fully grasp when it's OK for you to connect to the internet. So i just bring up a few ideas:

If it's about cellular data, you could disable the SIM in Settings> Network & Internet> SIMs> tap on your SIM>toggle SIM off. Or even better: do not insert a SIM card.

If you are concerned about WiFi, you could prevent your phone from automatically connecting to a known WiFi. Settings> Network & Internet> Internet> Safed networks> your network> disable auto-connect. Your phone will not automatically connect to WiFi networks that you have not saved, so you should be safe from unknown WiFi.

If you don't want to accidentally connect to a network at all (neither Wi-Fi nor mobile), you could install a VPN and set up a killswitch via Settings> Network& Internet> VPN> Your VPN> Block connections without VPN.Be aware, however, that a killswitch may not block all connections.

With all these solutions, there should hopefully be enough steps between you and the network access to make you realize that you are about to connect to the Internet.

bookreader

If you're messing around in SETTINGS vs quick settings, then you're generally expecting to be able to change any settings you like. Just stay out of settings!

BillHurdle

Murcielago Thanks for the good info. I'm sure others will benefit from it as well.

Toggling the SIM off would be great if it prevented IMEI broadcasting. I'm not sure that's the case. It's imperative that we not connect IMEI to locations that we frequent, least of all our homes. I can easily imagine a baseband module shouting out "Hi network! Let me tell you my IMEI! I don't have a SIM but I just wanted to let you know who I am."

All it takes is a tired brain at the end of a long day to decide that switching off airplane mode is how you enable wifi. Been there, done that. Maybe even making the "Airplane mode" item in Settings bright red would be enough to scare away fools like me. I can't imagine that I'm unique in this regard. And that would be a lot less work than adding a lock toggle.

I'm not as worried about wifi because I disable autoreconnect. I assume that if I had it enabled, then it would be shouting out all the names of all the wifis I've ever connected to, as I walk down the street. (This might not be the case for visible wifis but it would have to be the case for hidden ones.)

Your killswitch trick is a good one, although again, I don't know if it would prevent IMEI broadcast if I accidentally enabled WAN. I'm also curious as to why you think killswitches wouldn't necessarily block all connections. I have observed poorly designed firewall rules allowing some traffic (or tons of traffic) to leak through when the VPN suddenly disengages. The whole concept of firewall rules reeks of race conditions, as though perhaps it's not a completely solvable problem. Can you explain your doubts?

bookreader LOL trust me, I get that. In this latest gaffe, I just happened to have Settings open for other reasons and decided that disabling airplane mode was the way to enable wifi. And more generally it's just too easy to tap the toggle by accident. It's the "compromise all the privacy you've maintained for years in a few hundred milliseconds" button.

Murcielago

BillHurdle

Thanks for the long explanation, now it's clearer to me what your exact goal is. In this case, some of my suggestions do not help with what you want to achive.

Toggling the SIM off would be great if it prevented IMEI broadcasting. I'm not sure that's the case.

If it's about your device not connecting to the cellular network at all and possibly revealing your IMEI, it's not enough to deactivate the SIM. Even without a SIM card, your device will connect to cell towers:

https://discuss.grapheneos.org/d/9571-does-airplane-mode-emit-zero-rf/8

Only airplane mode could resolve this problem:

https://grapheneos.org/faq#cellular-tracking

I'm not as worried about wifi because I disable autoreconnect. I assume that if I had it enabled, then it would be shouting out all the names of all the wifis I've ever connected to, as I walk down the street. (This might not be the case for visible wifis but it would have to be the case for hidden ones.)

That's how I would handle it too. As you rightly said, it should be ok, especially if you don't use hidden APs.

I'm also curious as to why you think killswitches wouldn't necessarily block all connections. I have observed poorly designed firewall rules allowing some traffic (or tons of traffic) to leak through when the VPN suddenly disengages. The whole concept of firewall rules reeks of race conditions, as though perhaps it's not a completely solvable problem. Can you explain your doubts?

https://www.bleepingcomputer.com/news/google/android-leaks-some-traffic-even-when-always-on-vpn-is-enabled/

https://issuetracker.google.com/issues/250529027

If I understand it correctly, it is mainly about connectivity checks. I cannot judge to what extent this is relevant for you and your threat model. With GrapheneOS, these connectivity checks do not run by default via Google's but instead via GrapheneOS servers.

https://grapheneos.org/faq#default-connections

They can also be completely deactivated in Settings>Network & internet>Internet connectivity checks.

Now that it understood better what you're exactly trying to achieve, my workaround would be (as long as and if the feature you suggested is not implemented):

Enable airplane mode. Remove the Airplane mode button from the Quick Settings Panel. Use the Internet button in the Quick settings to switch the Internet connection on and off. As you are in airplane mode, mobile internet connection is not offered there (except for the "Turn off airplane mode" button - but you are hopefully less likely to press this by mistake than the airplane mode button). I hope this helps.

de0u

BillHurdle I'm not as worried about wifi because I disable autoreconnect. I assume that if I had it enabled, then it would be shouting out all the names of all the wifis I've ever connected to, as I walk down the street. (This might not be the case for visible wifis but it would have to be the case for hidden ones.)

Users with a strong privacy focus arguably should avoid joining "hidden" Wi-Fi networks, or should forget each such network immediately after use.

If a device knows of zero hidden networks then there should be no Wi-Fi "shouting out" issue.

BillHurdle

Murcielago Thanks for confirming what I always suspected, which is that IMEI broadcast happens even without a SIM.

I think your advice about removing the airplane mode (and location) "shotgun buttons" from the drawer is spot on for preserving privacy. I wish I had known to do that earlier, and that there were an interview question about this during initial setup, but I don't expect that to happen. Perhaps 90% of accidental airplane mode exits happen due to a stray tap of the drawer, with only 10% happening because some poor fool mistakes the "Airplane mode" toggle in Settings for a wifi toggle.

Maybe we should rename "Airplane mode" to "Destroy privacy"!

I'm not too worried about connectivity checks, although I'm glad you mentioned it because I think I'll switch it back to Google so as to look more conventional. Thanks to GrapheneOS's ungoogled design, they won't know it's me checking in anyway.

I'm still hoping for an "Airplane mode lock" toggle, or at least printing the words "Airplane mode" in red with flames on either side.

BillHurdle

Murcielago Forgot to thank you for the links to the killswitch leaks. If connectivity checks leak, then you could find all the GrapheneOS users in a locale fairly easily, matching homes with IMEIs quite easily as well, even if WAN is disabled at home. Scary stuff. Yet another reason to ping Google instead. At least then it would require timing analysis to discover that it was GrapheneOS actually doing this.

I'm unnerved by Google's quite reasonable defense on your issue tracker page, which is that this is apparently neither the only nor the most damaging leak allowed despite "always-on" VPN: "the connectivity checks are far from the only thing exempted from the VPN ; privileged apps can also bypass the VPN and this is necessary for their operation in many cases. An example is IWLAN, or tethering traffic." IMO tethering traffic should be routed onto the VPN as well, but I don't ever expect that to change. And FWIW IWLAN is the app that I reported previously as being automatically granted location access when a new a user profile is created, if only momentarily until location is disabled. (I'm not sure this is still the case since I discovered it and brought it up in a previous post.) Not that location has anything directly to do with VPN leakage but this just underscores the extreme privilege afforded to IWLAN.

BillHurdle

de0u @Murcielago You both mentioned this, but as long as one disables autoreconnect, then preserving a list of previously used hidden SSIDs should be fine because then they won't be shouted out unless one actually taps on them, right?

There is another issue with wifi, which is that MAC randomization only seems to work on a per-SSID basis, so you can actually delete an SSID altogether, then readd it later, and you get the same MAC. It would be nice if there were a way to reset the seed used for the randomization, so you because a totally new person everywhere.

other8026

BillHurdle MAC randomization only seems to work on a per-SSID basis

The default is to randomize the MAC address each time the phone connects to wifi.

BillHurdle you can actually delete an SSID altogether, then readd it later, and you get the same MAC

I think the only way to do accomplish this is by using the device's MAC address.

de0u

BillHurdle As long as one disables autoreconnect, then preserving a list of previously used hidden SSIDs should be fine because then they won't be shouted out unless one actually taps on them, right?

I don't know whether the per-network "Auto-connect" toggle controls only connection, as the name suggests, or also scanning. When I go to the "Wi-Fi" screen it seems to show me a list of networks I am in range of, including random networks I've never used, so I can't have selected "Auto-connect" for them.

BillHurdle

other8026 Wait a minute, what do you mean that the default is to randomize the MAC address each time the phone connects to wifi? Try this: connect, check MAC, disconnect, connect, check MAC. Then the same sequence but totally forget the SSID. Do you not get the same MAC every time?

other8026

BillHurdle yes. Each time my phone reconnects, it uses a different MAC address. I even "forgot" the network and reconnected again with the password and didn't mess with any settings. Each time it connects, new MAC address.

In the network settings, you can change what it's supposed to do for that network under "Privacy". For my home network, I use "Use per-network randomized MAC", but for public wifi I don't change that setting and use the default, which is "Use per-connection randomized MAC (default)".

By the way, I checked the MAC address from both my phone and from my home router's admin page. No MAC address was reused, as is expected.

BillHurdle

other8026 Thanks for actually testing this! I know I tested it myself some time ago and discovered that reconnects to the same SSID were using the same MAC, but perhaps that was on another of my Androids. And I definitely wasn't overriding per-connection with per-network.

BillHurdle

de0u Being a total wifi ignoramus, I would imagine that scanning doesn't involve any transmission at all, since SSIDs seem to be pinged at a constant interval. That's why using public SSIDs is allegedly more private, ironically, than using hidden ones: you don't need to shout out to them as you're walking down the street. On the other hand, some phones might do so anyway, which would connect the user's current location with the routers hosting those SSIDs back at home.

I know from a trustworthy source that there are low-flying planes which siphon up SSIDs and connect them to GPS coordinates. (Gasp! How could they ever have thought of such a shady line of business!) But of course Google Maps was sued for essentially the same behavior. And then there are all the phones around you which have their locations enabled and know where your SSID is hosted. So public SSID is bad. And hidden SSID is bad. Take your pick. Maybe a hidden SSID with autoreconnect disabled is the least leaky.

BillHurdle

karsenja Yeah it's that serious for some people. Imagine having a machine gun with a touchscreen toggle to "Begin continuous firing"! We really need a lock or red text or something. That one-in-a-thousand-day act of carelessness is simply too harmful.

[deleted]

BillHurdle if you are so afraid of accidentally enabling/disabling these toggles in the first place, I would suggest you removing/hiding these tiles and when there is a need to enable/disable them in the future, go the long way through the Settings. That way it will not be accidental. Hope this helps.

BillHurdle

[deleted] Yes, that was suggested by Murcielago above, and I did it, but thanks for trying to help anyway. The problem is that it's still too easy to accidentally hit the toggle next to "Airplane mode" in Settings, especially if one needs WAN access a few times a day. Give it enough days, and anyone is bound to tap the toggle by mistake. It's a loaded gun just sitting around the house.