OS default connections - Questions

Researcher

Hello,

i selected Google Server for Internet connectivity checks to blend in with everyone else. But I'm wondering if it is worth it, to have less Privacy with Google Server, with the reason that no one knows, that I'm using GrapheneOS? Or is it the best to turn it to "Off" ?

other8026

Researcher It's really up to you. The OS sends no identifying information, but the connection doesn't go over a VPN. So you can decide which option is best for you based on that knowledge.

de0u

Researcher Or is it the best to turn it to "Off"?

If connectivity checks are off, things will break. For example, at some point months from now a public Wi-Fi network such as at a library will mysteriously not work.

Researcher

other8026 "The OS sends no information" - do you mean with that, generally or if I select GrapheneOS proxy? And does that mean, if I select Google Server, that there could be a location leak to Google?

other8026

As for your other questions about Widevine and Attestation, kind of the same answer except they go over a VPN connection (if I remember correctly).

Researcher

other8026 So would it then be better to select for both Google to blend in?

other8026

as for the PSDS question, the standard server isn't Google's. Please read https://grapheneos.org/faq#default-connections to better make your own decisions.

other8026

If connectivity checks are off, things will break.

Forgot to mention this, and it's a good point. Most people probably don't want to turn off connectivity checks.

Researcher The OS sends no information

I said no identifying information. Again, I'd suggest reading https://grapheneos.org/faq#default-connections. It goes into detail about connections made by the OS. Like here is a quote about connectivity checks:

The connectivity checks are done by performing an empty GET request to a server returning an empty response with a 204 No Content response code. The request uses a standard, frozen value for the user agent matching the same value used by billions of other Android devices:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36
No query / data is sent to the servers and the response is unused beyond checking the response code.

The answer is right there. I'm sure you'll find a lot of other useful information in that section.

Researcher And does that mean, if I select Google Server, that there could be a location leak to Google?

Google would see the empty GET request, but also your IP. If you don't want them to see that, then you may want to use the GrapheneOS proxy. But since nothing identifying is sent, it kind of doesn't matter much in my own personal opinion. I don't remember what I have mine set to because, for me, I think both are fine.

Researcher So would it then be better to select for both Google to blend in?

I suppose you can do that if you want to blend in.

Researcher

other8026 But the IP is still something identifiable? That confused me a bit.

de0u

Researcher But the IP is still something identifiable?

The IP address is not associated with anything, except that there is an Android device using that IP address at that moment.

Consider the public IP address of a public library. Each hour that IP address will make multiple requests to Apple's connectivity endpoint and to Google's connectivity endpoint.

Now imagine you go to a coffee shop. Likewise the coffee shop's public IP address will be making multiple requests to Apple's connectivity endpoint and to Google's connectivity endpoint. But nothing will connect your device's request from the library to your device's request from the coffee shop. Google will not know that your device moved from the one place to the other.

Now imagine you go home and your home's public IP address contact's Google's connectivity endpoint. Nothing will connect your device's request from the library and the coffee shop to your device's request from your home. True, Google might over time build up a profile of which times of day your home has nobody present. But they probably already know that based on which times of day various devices in your home pull down ads from them.