WhatsApp can still read your phone's imei, unless grapheme has changed this
Sandboxed Whatsapp is private?
- Edited
mmmm Better to define the threat as the service provider as a whole rather than "big tech", data leak scandals don't achieve much apart from sensationalist articles and ill-thought-out legislation, defining a clear threat model is the first step.
graphy00 WhatsApp can still read your phone's imei
This is no longer the case since Android 10 and GrapheneOS enhances it because Google Play is not privileged :
https://grapheneos.org/faq#hardware-identifiers
https://developer.android.com/about/versions/10/privacy/changes#non-resettable-device-ids
https://stackoverflow.com/questions/57993401/no-imei-for-android-developers-in-android-10
Xtreix Better to define the threat as the service provider as a whole rather than "big tech", data leak scandals don't achieve much apart from sensationalist articles
It wasn't a data leak. It was 'acquired' by seemingly legitimate means. Anyway, thats missing the point. The point is not to brush off what can happen by underestimating seemingly non criminal organisations such as big tech and governments regarding using our data for whatever purpose.
6 days later
Xtreix we have unlimited call and text packages starting at 1p per month, so it will be a long time before the UK steps away from that technology
CodexAG So downloading WA, meta, Uber even from grapheneos sandbox still leaves one open to backdoors?
The GrapheneOS sandbox applies some limits to apps as they are running. The GrapheneOS sandbox doesn't download anything.
If an application is designed to contain a back door GrapheneOS can't in general solve that (no OS can). If, hypothetically, WhatsApp is designed to use a weak encryption key whenever a message contains the words "Meta" and "privacy", no OS (including no sandbox) can fix that.
Fundamentally, if one provides an app with data about one, and the app is designed to leak the data, there is a fair chance it will be able to do so.
CodexAG I thought the whole point of sandboxing was to let people still use normal apps while being protected...
It would be nice if there were a magic spell that could enable nice people to use nasty apps with nice results. That is not the case now and not likely to become true any time soon.
In some cases it is possible to track/limit some unwanted behavior. But typing something into an app with network access pretty much means the app can transmit the data to machines on the network, along with other things that were not typed.
- Edited
de0u so
de0u It would be nice if there were a magic spell that could enable nice people to use nasty apps with nice results. That is not the case now and not likely to become true any time soon.
Ha. Well...so all my effort to get a Grapheneos phone will be for naught if I download normal apps like uber, twitter, tgram, Whatsapp and meta? I want to be able to use these while still having at least some layers of protection from these apps themselves... [removed question answered in reply]
@CodexAG Using a bunch of mainstream apps with sandboxed Google Play doesn't at all defeat the purpose of GrapheneOS and in fact you'll get more benefits out of the privacy features. Using a far less private OS that's substantially rolling back security rather than improving it is not going to make you better off. That doesn't make any sense. Why would you be better off using a non-hardened OS without the hardening and privacy features like Contact Scopes, Storage Scopes, Sensors toggle and much more? You've been here for quite a while now asking lots of questions and should know better by now.
GrapheneOS and CalyxOS are very different. GrapheneOS is a hardened OS with substantial privacy/security improvements:
https://grapheneos.org/features
CalyxOS is not a hardened OS. It greatly reduces security vs. AOSP via added attack surface, rolled back security and slow patches.
Compatibility with Android apps is also much different. GrapheneOS provides our sandboxed Google Play compatibility layer:
https://grapheneos.org/usage#sandboxed-google-play
Can run the vast majority of Play Store apps on GrapheneOS, but not CalyxOS with the much more limited microG approach.
https://eylenburg.github.io/android_comparison.htm is a third party comparison between different alternate mobile operating systems. It could include many more privacy/security features but it's a good starting point.
https://privsec.dev/posts/android/choosing-your-android-based-operating-system/ is an article with more long form comparisons between OSes.
GrapheneOS thank you, that's what I was hoping. Is there a certain way you recommend downloading these apps to ensure they are installed in Grapheneos in the most maximized privacy way possible?
- Edited
CodexAG So all my effort to get a Grapheneos phone will be for naught if I download normal apps like uber, twitter, tgram, Whatsapp and meta?
No (see GrapheneOS).
I want to be able to use these while still having at least some layers of protection from these apps themselves...
If you are concerned that a maliciously-formatted message might exploit a vulnerability in a messaging app and allow a third party to extract your message traffic from that app, various GrapheneOS hardening methods will reduce the likelihood of that scenario (most reduction at present on Pixel 8 hardware).
If you are concerned that a malicious app might break into Play Services and use Play Services's privileges to extract information from your device, it's great that on GrapheneOS Play Services is not privileged. However, given the catastrophic legal and regulatory implications, it seems unlikely that a mainstream app would do anything like that.
If you are concerned that a ride-hailing app might compute a list of people who get picked up outside bars four or more nights per week, and sell that information to alcohol-abuse counseling services, GrapheneOS can't help with that, because no OS can. Providing sensitive information about yourself to an app with network access means the sensitive information may well be available to the app authors.
GrapheneOS definitely provides "some layers of protection". It cannot in general convert nasty apps into nice apps (no OS can).
If one has committed to running Uber and WhatsApp on some phone, GrapheneOS is a great OS for reducing downstream risks. GrapheneOS does not make those apps, or any apps, free of risk, especially not privacy risks related to potental misuse of usage data.
9 months later
I think the ideal solution would be message forwarding, imagine if all your received texts from what's app messages and SMS can be sent to signal. And when you send messages using signal, it would be routed to what's app or SMS. Does this exist ? Is it even possible ?