Why we need a safety lock against accidentally enabling WAN or location

BillHurdle

Murcielago Thanks for confirming what I always suspected, which is that IMEI broadcast happens even without a SIM.

I think your advice about removing the airplane mode (and location) "shotgun buttons" from the drawer is spot on for preserving privacy. I wish I had known to do that earlier, and that there were an interview question about this during initial setup, but I don't expect that to happen. Perhaps 90% of accidental airplane mode exits happen due to a stray tap of the drawer, with only 10% happening because some poor fool mistakes the "Airplane mode" toggle in Settings for a wifi toggle.

Maybe we should rename "Airplane mode" to "Destroy privacy"!

I'm not too worried about connectivity checks, although I'm glad you mentioned it because I think I'll switch it back to Google so as to look more conventional. Thanks to GrapheneOS's ungoogled design, they won't know it's me checking in anyway.

I'm still hoping for an "Airplane mode lock" toggle, or at least printing the words "Airplane mode" in red with flames on either side.

BillHurdle

de0u @Murcielago You both mentioned this, but as long as one disables autoreconnect, then preserving a list of previously used hidden SSIDs should be fine because then they won't be shouted out unless one actually taps on them, right?

There is another issue with wifi, which is that MAC randomization only seems to work on a per-SSID basis, so you can actually delete an SSID altogether, then readd it later, and you get the same MAC. It would be nice if there were a way to reset the seed used for the randomization, so you because a totally new person everywhere.

other8026

BillHurdle MAC randomization only seems to work on a per-SSID basis

The default is to randomize the MAC address each time the phone connects to wifi.

BillHurdle you can actually delete an SSID altogether, then readd it later, and you get the same MAC

I think the only way to do accomplish this is by using the device's MAC address.

de0u

BillHurdle As long as one disables autoreconnect, then preserving a list of previously used hidden SSIDs should be fine because then they won't be shouted out unless one actually taps on them, right?

I don't know whether the per-network "Auto-connect" toggle controls only connection, as the name suggests, or also scanning. When I go to the "Wi-Fi" screen it seems to show me a list of networks I am in range of, including random networks I've never used, so I can't have selected "Auto-connect" for them.

BillHurdle

other8026 Wait a minute, what do you mean that the default is to randomize the MAC address each time the phone connects to wifi? Try this: connect, check MAC, disconnect, connect, check MAC. Then the same sequence but totally forget the SSID. Do you not get the same MAC every time?

BillHurdle

Murcielago Forgot to thank you for the links to the killswitch leaks. If connectivity checks leak, then you could find all the GrapheneOS users in a locale fairly easily, matching homes with IMEIs quite easily as well, even if WAN is disabled at home. Scary stuff. Yet another reason to ping Google instead. At least then it would require timing analysis to discover that it was GrapheneOS actually doing this.

I'm unnerved by Google's quite reasonable defense on your issue tracker page, which is that this is apparently neither the only nor the most damaging leak allowed despite "always-on" VPN: "the connectivity checks are far from the only thing exempted from the VPN ; privileged apps can also bypass the VPN and this is necessary for their operation in many cases. An example is IWLAN, or tethering traffic." IMO tethering traffic should be routed onto the VPN as well, but I don't ever expect that to change. And FWIW IWLAN is the app that I reported previously as being automatically granted location access when a new a user profile is created, if only momentarily until location is disabled. (I'm not sure this is still the case since I discovered it and brought it up in a previous post.) Not that location has anything directly to do with VPN leakage but this just underscores the extreme privilege afforded to IWLAN.

other8026

BillHurdle yes. Each time my phone reconnects, it uses a different MAC address. I even "forgot" the network and reconnected again with the password and didn't mess with any settings. Each time it connects, new MAC address.

In the network settings, you can change what it's supposed to do for that network under "Privacy". For my home network, I use "Use per-network randomized MAC", but for public wifi I don't change that setting and use the default, which is "Use per-connection randomized MAC (default)".

By the way, I checked the MAC address from both my phone and from my home router's admin page. No MAC address was reused, as is expected.

BillHurdle

other8026 Thanks for actually testing this! I know I tested it myself some time ago and discovered that reconnects to the same SSID were using the same MAC, but perhaps that was on another of my Androids. And I definitely wasn't overriding per-connection with per-network.

BillHurdle

de0u Being a total wifi ignoramus, I would imagine that scanning doesn't involve any transmission at all, since SSIDs seem to be pinged at a constant interval. That's why using public SSIDs is allegedly more private, ironically, than using hidden ones: you don't need to shout out to them as you're walking down the street. On the other hand, some phones might do so anyway, which would connect the user's current location with the routers hosting those SSIDs back at home.

I know from a trustworthy source that there are low-flying planes which siphon up SSIDs and connect them to GPS coordinates. (Gasp! How could they ever have thought of such a shady line of business!) But of course Google Maps was sued for essentially the same behavior. And then there are all the phones around you which have their locations enabled and know where your SSID is hosted. So public SSID is bad. And hidden SSID is bad. Take your pick. Maybe a hidden SSID with autoreconnect disabled is the least leaky.

karsenja

BillHurdle

I agree with this.

Right now if someone purchase a Pixel and they accidentally disable Airplane mode while using Graphene in a location that can be somewhat linked to them, there's a ping and now they have the IMEI of the phone. From then on, that's your phone. If you are a privacy aware person with rights in a nice country, it doesn't matter.

If you are a protestor in a country with an unethical government, it puts you in a dangerous spot. It is much too easy to disable this.

In a country with few safeguards against governmental abuse, an accident like that could lead to police demanding that phone, threatening you with violence unless you unlock it, and using the fingerprints on the phone as a basis for a person's torture or execution.

BillHurdle

karsenja Yeah it's that serious for some people. Imagine having a machine gun with a touchscreen toggle to "Begin continuous firing"! We really need a lock or red text or something. That one-in-a-thousand-day act of carelessness is simply too harmful.

[deleted]

BillHurdle if you are so afraid of accidentally enabling/disabling these toggles in the first place, I would suggest you removing/hiding these tiles and when there is a need to enable/disable them in the future, go the long way through the Settings. That way it will not be accidental. Hope this helps.

BillHurdle

[deleted] Yes, that was suggested by Murcielago above, and I did it, but thanks for trying to help anyway. The problem is that it's still too easy to accidentally hit the toggle next to "Airplane mode" in Settings, especially if one needs WAN access a few times a day. Give it enough days, and anyone is bound to tap the toggle by mistake. It's a loaded gun just sitting around the house.

nunyo

BillHurdle
Use a settings widget that takes you straight to network screen. The stock launcher does this without the need for any other apps

EmLeX932

Removing airplane mode from the quick action toggles is almost perfect. cus in settings you are more observant about what your hitting.

but seems you can still disable airplane mode accidentally turn off airplane mode from the WIFI toggle on the quick action bar. is there a way to remove that part of the toggle under where you pick the access point?

BillHurdle

EmLeX932 Believe it or not, I managed to disable airplane mode from the toggle inside Settings. It's just sitting there waiting for an accidental touch. And thank you for pointing out the other loaded shotgun, which is "Turn off airplane mode" inside the wifi button in the drawer.

nunyo

Long press settings icon, long press the wifi icon that appears and drag it to desktop.

Then use this app to set a password on the settings app
https://f-droid.org/packages/io.timelimit.android.open/

BillHurdle

nunyo Before I do something irreversibly stupid, are you saying that this would put a password on the entire Settings app? So every time I need to change any setting, I need to enter a password? That would definitely reduce the incidence of accidentally disabling airplane mode, but I would prefer to await some less intrusive mitigation from the devs. But thanks for letting us know about this option.

Minimal version would be printing the toggle text in red, or moving the toggle down to the very last option in the "Network & Internet" menu. The latter wouldn't interfere with people who don't care about this issue, as the drawer button is the usual way to disable airplane mode.

missing-root

Agree, and Googles stupid combined internet toggle (that doesnt keep wifi on reliably) doesnt help

nunyo

BillHurdle yes