App has network access even when disabled?

[deleted]

I seriously don't understand how I'm getting ads by Google's DoubleClick inside "Pedometer" when the network access is disabled.
This hasn't happened for any other app. I'm probably missing something obvious but I don't know what it is.

https://files.catbox.moe/vi7pr8.png
https://files.catbox.moe/9tcriz.png

Dumdum

[deleted]
As far as I'm aware, apps can have ads bundled in to the app itself. They're not necessarily fetched from ad servers.

[deleted]

Dumdum That's likely what it is, thank you! The ad being served by Google's DoubleClick was the reason I had to double check on here, had it been a simple banner, I would've assumed it was bundled in.

Ammako

If you have play services installed with network permissions, it's not impossible that they are using inter-process communications to fetch ads through play services.

[deleted]

Ammako Holy shit, you're right. I reinstalled Play Services a day ago and forgot to turn off the network permission for it.
Those mf's with their cross-communications. That's really disturbing.
Thank you so much!

[deleted]

[deleted] @GrapheneOS Is this a normal function of Play Services (network access enabled) on GrapheneOS? Being able to inject DoubleClick ads into apps that have network access disabled.

DeletedUser87

[deleted] that is completely normal on Android, and GOS is built upon AOSP. Apps can communicate when in the same profile (if they mutually agree), thus it's not uncommon for something like this to happen. The app expects com.google.android.gms for its ad delivering functionality and will contact that app when it's available. The sandboxed Play Services are basically unchanged apart from losing their system privileges. The GOS team is working on App Communication Scopes though, which should address that problem. There's sadly no ETA yet on when it will be available.

de0u

DeletedUser87 The GOS team is working on App Communication Scopes though, which should address that problem.

How?

If the pedometer app offloads part of its work to Play (that's the whole point of Play being split out as support apps), and App Scopes is used to prevent the pedometer app from contacting Play, the pedometer app just won't work. There are already lots of apps that won't run without Play being present.

I don't believe App Scopes will work to transform privacy-invasive apps into privacy-respecting apps.