Possibly a concern might be at an open hotspot, and connecting to the laptop of the 15-yr-old guy next to you who is running an impersonation of the hotspot captive portal - with the intention of "testing" your box with malware-laden responses!? In the old laptop days, one could run a quick passive scan of the hotspot before connecting to assure that there were no mischievous Friday-night cowboys.
Disabling connectivity checks on GrapheneOS
[deleted]
What are the exact consequences of disabling internet connectivity checks?
- Edited
Forget about the connectivity checks, WiFi Calling also completely bypasses the VPN. Even if you turn it off, it still resolves the domains which could be used to fingerprint devices on a WiFi network. There is currently no way to prevent this, though the issue has been brought up: https://github.com/GrapheneOS/os-issue-tracker/issues/887
Also, the network assisted location (SUPL) bypasses the vpn, though there is now a toggle for that service.
[deleted]
nodsocket Also, the network assisted location (SUPL) bypasses the vpn, though there is now a toggle for that service.
Source? As far as I know that's not true.
[deleted] If you are connected to WiFi but there is no upstream connection, you're supposed to get a notification. With connectivity checks disabled, you won't get any notification if the connection breaks.
[deleted] This article explains what SUPL is. https://www.kaspersky.com/blog/gps-agps-supl-tracking-protection/
SUPL services work by either looking at your nearby cell towers, or by the WiFi network you are connected to. Either way, it must bypass the VPN in order to get that network information. PSDS, which is the downloaded data about satellite positions, is another matter.
I leave mine disabled all of the time. I have noticed however where some public WiFi hotspots have a some kind of log-in screen/ terms and conditions to agree to this page won't open open so the WiFi stays connected but says no internet access.
nodsocket Also, the network assisted location (SUPL) bypasses the vpn, though there is now a toggle for that service.
That is not true for Tensor Pixels.
evalda This post talks about how WiFi Calling works. https://discuss.grapheneos.org/d/3158-wifi-calling-bypasses-vpn
It seems that the phone will always resolve the domains after a sim is inserted for the first time, until the device is factory reset.
matchboxbananasynergy How does SUPL work differently on Tensor phones?
nodsocket https://twitter.com/GrapheneOS/status/1631706697751314432
On 4th/5th generation Pixels, SUPL is implemented by Qualcomm in the baseband and only uses mobile data for the connections.
On 6th/7th generation Pixels, SUPL is implemented by Broadcom gpsd in userspace. It can use any available network and gets routed through an active VPN.
evalda I think so. The phone needs to know which domains to resolve first, which would require a sim.
[deleted]
The only downside of disabling internet connectivity checks is that captive portals will not work?
- Edited
[deleted] How I am understanding it, if the connectivity checks are disabled, it won't bring up the sign in page automatically for a captive portal. You can still open your browser and go to a website and it should redirect you to the sign in page. After you sign in, the network should work like normal.
If you try to go to a https page it should give you a certificate warning as the portal is redirecting you to the sign in website. If you try going to an http page it should redirect properly.
The only other drawback I am aware of is say you are connected to WiFi and the internet connection goes down, you won't get prompted that the network went out. So you can be joined to WiFi and not be aware that it is not working.
[deleted]
matchboxbananasynergy It's something that's inherently not a big deal (no user data is sent) and has been blown way out of proportion.
I think that it's quite a big deal because every time you will identify yourself as a GrapheneOS user to every public Wi-Fi and your ISP.
So if you're the only one using GrapheneOS in your city or place, then you can be traced and identified.
[deleted]
matchboxbananasynergy GrapheneOS also adds the ability to fully disable the connectivity checks. This results in the OS no longer handling captive portals itself, not falling back to other networks when some don't have internet access and not being able to delay scheduled jobs depending on internet access until it becomes available.
The OS will no longer handle captive portals itself
It will not fall back for example to cellular when your Wi-Fi has lost connection and vice versa.
The part that I don't understand is "not being able to delay scheduled jobs depending on internet access until it becomes available".