Messenger & Whatsapp on GrapheneOS?

Pavestone2734

Open_Source_Enjoyer My brother in Christ. My one child under God. That app requires the App usage permission which apps don't have by default. By that logic every app has access to all your contacts that you have given explicit contacts permission to.

Open_Source_Enjoyer

Pavestone2734 My brother in Christ. My one child under God. That app requires the App usage permission which apps don't have by default. By that logic every app has access to all your contacts that you have given explicit contacts permission to.

The app doesn't have any other permission that Sensors and the only permissions its requested are Sensors and Notification
https://imgur.com/a/Q0fIPBT

Everyone can reproduce this by installing the app and see that it can show you, your entire app usage without any special permission for this.
Therefor any app can do this.

n3t_admin

Open_Source_Enjoyer quote from AOSP:

To use this API, you must first declare the android.permission.PACKAGE_USAGE_STATS permission in your manifest. The user must also enable access for this app through Settings > Security > Apps with usage access.

You're looking in the wrong place and forgot that you gave this app special permissions.

Dumdum

Open_Source_Enjoyer
User facing (runtime) permissions aren't the only permissions.

https://developer.android.com/guide/topics/permissions/overview#workflow

Some permissions, known as install-time permissions, are automatically granted when your app is installed. Other permissions, known as runtime permissions, require your app to go a step further and request the permission at runtime.

other8026

Open_Source_Enjoyer Everyone can reproduce this by installing the app and see that it can show you, your entire app usage without any special permission for this.
Therefor any app can do this.

This is false. I just tried on my old phone and the app requires the special permission under Settings > Apps > Special app access > Usage access.

Raccoon7h

Open_Source_Enjoyer are you implying meta apps can see all usage data? would this extend to outside private space? I'm starting to wonder if using these apps is even a good idea anymore.

Open_Source_Enjoyer

other8026 This is false. I just tried on my old phone and the app requires the special permission under Settings > Apps > Special app access > Usage access.

I followed the path that you mentioned and I found that indeed the usageDirect App has this permission.
To test it, I removed this permission and after a restart of the App, the App asks me for this permission.
I didn't know about this permission before and I can't remember to ever grant it to the App, this is confusing.

Oggyo

Open_Source_Enjoyer I didn't know about this permission before and I can't remember to ever grant it to the App, this is confusing.

Wondering if was listed as Allowed under Settings > Apps > Special app access > Usage access?

Open_Source_Enjoyer

Oggyo Wondering if was listed as Allowed under Settings > Apps > Special app access > Usage access?

Yes it has this permission.
I can't remember ever giving this permission, but its probably my mistake

Open_Source_Enjoyer

Raccoon7h are you implying meta apps can see all usage data?

It seems that i was wrong or that GrapheneOS/Android received an update to resolve app usage access.

Raccoon7h would this extend to outside private space

To my knowledge, private space apps can see apps outside this space or vise versa.

Raccoon7h I'm starting to wonder if using these apps is even a good idea anymore.

My current setup and probably the thing that i will keep doing is to keep my main profile is to avoid closed source software or at least always remove its network permissions.
For things like Whatsapp, I use another profile.

Pavestone2734

Raccoon7h It's not a good idea, but not because they can spy on what other apps do (because they can't), but because they are shitty services made by an all the more shitty company and there are much better alternatives (in case of WhatsApp).

Raccoon7h just create a separate profile, if you're already registered to Facebook/WhatsApp either install Tor (Orbot) or a VPN in that profile and set it up however you need. You don't even need a separate Google account.

Raccoon7h Peivate Space do hide apps from other profiles. Apps cannot see each other because of the Android app sandbox, except mutual consent (i.e. Meta apps). User profiles and Private Space already offers the best way to compartmentalize apps, they work with different encryption keys so profiles can't access and see each other. The official recommendation is to look at them as separate personas. They allow for several VPN slots to work simultaneously.

Raccoon7h

I want to reiterate that I do not care if Meta can see whatever I do in the app, I only care if Meta gets their disgusting grubby hands onto the rest of my phone.

Raccoon7h

Wait, if the private space really doesn't hide apps from other apps, then what about separate user profiles? I was hoping I could get notifications but I'd rather not have Metash!t seeing everything I do even if the app is on "Private Space"

Raccoon7h

Well, I'm getting conflicting answers. I'll just use a separate user profile with ProtonVPN instead of Private Space with VPN, then. But then, what other problems would arise?

Raccoon7h

I guess I'm abondoning WhatsApp and Messenger...