Need strong clarification regarding Network Permission toggle

sophia_st

Can someone knowledgeable please explain in details if its true or not that when an application has Network Permission toggle off can it still send data by any means like IPC or something else and sneak out for data its not supposed to?
An example would be sandboxed google play store and gcam/keyboard/gallery/whatever with Network Permission off, and possible some other apps such as signal/instagram/telegram/whatsapp/whatever with Network Permission on all in the same owner profile.

other8026

sophia_st I'd suggest reading the section on the website about the network permission here https://grapheneos.org/features#network-permission-toggle

Apps can communicate if both consent to communication. It's possible for apps to communicate even when their network permission is revoked. I'd suggest considering the likelihood of that happening, though. Is it likely that a Google app like Pixel Camera communicates sometimes with Google Play Services, even on the stock OS? Sure, seems reasonable. Did Google, knowing that GrapheneOS has a network toggle and that we're open about app communication and that the kinds of people who block apps' access to the internet might be very cautious about how they use Google apps, add logic to their apps to send data to Play Services to get around network access being blocked? I think that's less likely. Are apps made by different companies going to communicate with the sole purpose of sharing data with one another to circumvent their network access being revoked? I think that's very unlikely.

That said, if you're still not comfortable with apps being able to communicate, you can use profiles or Private Space as n3t_admin suggested.

Delaney

sophia_st The short answer is - in theory, yes. Practically speaking, it's unlikely this would really happen with malicious intent, because apps don't see that internet is revoked. They just see that internet is unavailable. But I guess it depends on your threat model.

Open_Source_Enjoyer

sophia_st Can someone knowledgeable please explain in details if its true or not that when an application has Network Permission toggle off can it still send data by any means like IPC or something else and sneak out for data its not supposed to?

The network toggle only removes the network permission, but apps can still use IPC.
This is way i seperate closed source apps without network permission from closed source apps with network permission.

n3t_admin

don't install Play Services in the same profile if you don't want other apps communicating with it. Or install the other apps in another profile (private space, work profile through Shelter or Insular) if that suits your threat model better.

sophia_st

other8026 I'd suggest reading the section on the website about the network permission here https://grapheneos.org/features#network-permission-toggle

I did, but it doesn't cover IPC.

other8026 Is it likely that a Google app like Pixel Camera communicates sometimes with Google Play Services, even on the stock OS? Sure, seems reasonable. Did Google, knowing that GrapheneOS has a network toggle and that we're open about app communication and that the kinds of people who block apps' access to the internet might be very cautious about how they use Google apps, add logic to their apps to send data to Play Services to get around network access being blocked? I think that's less likely.

I was more leaning towards that it sends by default, not specifically related to GOS. But I'm not even sure what kind of data IPC can send tbh. Can it transmit files like photos? That's my concern.

other8026 That said, if you're still not comfortable with apps being able to communicate, you can use profiles or Private Space as n3t_admin suggested.

Yes, that's my main issue, I'm not sure what path to take:
1) either to install everything in owner profile with network permission is off for apps like gcam with private space for play services apps(that request play services)
2) install in owner, but push to: daily profile for normal apps like gcam(afaik it doesn't require google services) and play services profile(that request play services)

The problem is that profiles are nightmare in terms of usage as I see it. But the first option is basically given up for the purpose I decided to switch from the first place - privacy and de-googling as much as possible. Because with the first option I will not be able to disable the communication with google play services(not just for gcam, but for every other app too), right?

Frustrating tbh

de0u

sophia_st Part of the problem is that there is no magic wand that converts privacy-invasive apps into privacy-respecting apps, so GrapheneOS isn't one.

If an app is designed to share data about you with other apps and/or entities on the Internet, it may be possible to block communication, but then the app may just stop working.

It may well be frustrating to some users if a company isn't willing to pour millions of dollars into developing software that doesn't collect data on users, but it may also be frustrating to some companies to pour millions of dollars into developing software that users don't pay for by subscribing or by providing tracking data.

Meanwhile, it may be possible to contribute (code or money) to open-source apps to help them improve, or to purchase apps with reasonable privacy policies.

Open_Source_Enjoyer

Delaney because apps don't see that internet is revoked. They just see that internet is unavailable. But I guess it depends on your threat model.

Revoked network permission is not exactly the same as no internet because for example flight mode.
Their are apps that use a internal client/server system and will crash if your try to use them without network permission, but will work if you use them with flight mode enabled.
source: https://github.com/ankidroid/Anki-Android/issues/17903

sophia_st

Delaney The short answer is - in theory, yes. Practically speaking, it's unlikely this would really happen with malicious intent, because apps don't see that internet is revoked. They just see that internet is unavailable. But I guess it depends on your threat model.

What does it mean in practical terms? Like how would this help me with gcam app for example, if it still probably gonna communicate with google play services over IPC, even if network permission is disabled? I'm not sure what this covers exactly(if my photos still can be shared over IPC with google for example) and as a result I can't say a thing regarding threat model.

Open_Source_Enjoyer The network toggle only removes the network permission, but apps can still use IPC.
This is way i seperate closed source apps without network permission from closed source apps with network permission.

That would make sense to me if open source apps(some) won't cause issues in terms of privacy/security(like never), but they also do.
So with your logic, I need to install gcam in separate profile/private space, despite that in that profile/space will be other, not so friendly apps like whatsapp(etc) and with that profile/space I will be doing private photos? That doesn't makes any sense, sorry.

Open_Source_Enjoyer Their are apps that use a internal client/server system and will crash if your try to use them without network permission, but will work if you use them with flight mode enabled.
source: https://github.com/ankidroid/Anki-Android/issues/17903

If I understand it correctly, it fetches data each time with no caching and that's why it doesn't work when the network toggle is disabled... but with that logic, why would it work with flight mode? I didn't find there anything regarding flight mode.

Open_Source_Enjoyer

sophia_st That would make sense to me if open source apps(some) won't cause issues in terms of privacy/security(like never), but they also do.

Do you have good examples of that?
At least is it possible to investigate if their have a function to extract data from other apps with no network permission.

sophia_st So with your logic, I need to install gcam in separate profile/private space, despite that in that profile/space will be other, not so friendly apps like whatsapp(etc) and with that profile/space I will be doing private photos? That doesn't makes any sense, sorry.

No, I say that you don't put GCam along with apps like Whatsapp in one space, exactly the opposite, here how i would do it:

Main Space:

Most Open Source Apps
Closed Source Apps without network permission like for example Google Camera
Maybe Google Play Services without network permission

Private Space:

Google Play Services with network permission
Other Closed Source Apps with network permission like for example WhatsApp
Maybe Open Source Apps that work more reliable with Google Play Services for notifications like Signal.

Google Camera in the Main Space can't use Google Play Servies or WhatsApp that are in the Private Space to extract data over IPC.
Note that this is not a 100% guarantee that your data is safe, because there are some exploits to still communicate, but this attack vector is a lot smaller that extraction over IPC (which is also not so likely).

Open_Source_Enjoyer

sophia_st If I understand it correctly, it fetches data each time with no caching and that's why it doesn't work when the network toggle is disabled... but with that logic, why would it work with flight mode? I didn't find there anything regarding flight mode.

No, the reason that AnkiDroid is crashing when someone tries to use it without network permission is that the app is relying on runing it's own local HTTP server to execute some of its code.

I think this more precise on it: https://github.com/GrapheneOS/os-issue-tracker/issues/3282#issuecomment-1971735317

"Sounds like somehow either your device or the F-Droid build does not allow AnkiDroid to create it's own network socket?

The exact error messge if you trie to run AnkiDroid without network permission is:
"Caused by: java.net.SocketException: socket failed: EACCES (Permission denied)
at java.net.ServerSocket.createImpl(ServerSocket.java:331)"
If you run AnkiDroid with network permission but in the airplane mode, this issue will not happen.

sophia_st

Open_Source_Enjoyer Do you have good examples of that?

I read about it, but I don't remember where. But it's known, not making this up ofc. I bet someone here could point it out.

Open_Source_Enjoyer At least is it possible to investigate if their have a function to extract data from other apps with no network permission.

Yeah, I agree... it's better than a closed source from that stand point. no questions.

Open_Source_Enjoyer No, I say that you don't put GCam along with apps like Whatsapp in one space, exactly the opposite, here how i would do it:

Main Space:
Most Open Source Apps
Closed Source Apps without network permission like for example Google Camera
Maybe Google Play Services without network permission

Private Space:
Google Play Services with network permission
Other Closed Source Apps with network permission like for example WhatsApp
Maybe Open Source Apps that work more reliable with Google Play Services for notifications like Signal.

Google Camera in the Main Space can't use Google Play Servies or WhatsApp that are in the Private Space to extract data over IPC.

Oh I see. But what about google play services in the main space, what's the plan: install the necessary apps and then remove it? or disable it's network? Because leaving it as it is isn't very smart, it still gonna transmit some data.

Open_Source_Enjoyer No, the reason that AnkiDroid is crashing when someone tries to use it without network permission is that the app is relying on runing it's own local HTTP server to execute some of its code.

I think this more precise on it: https://github.com/GrapheneOS/os-issue-tracker/issues/3282#issuecomment-1971735317

"Sounds like somehow either your device or the F-Droid build does not allow AnkiDroid to create it's own network socket?

The exact error messge if you trie to run AnkiDroid without network permission is:
"Caused by: java.net.SocketException: socket failed: EACCES (Permission denied)
at java.net.ServerSocket.createImpl(ServerSocket.java:331)"
If you run AnkiDroid with network permission but in the airplane mode, this issue will not happen.

Interesting! Thanks for that!

Open_Source_Enjoyer

sophia_st I read about it, but I don't remember where. But it's known, not making this up ofc. I bet someone here could point it out.

It is of course possible, but not as likely as with closed source.

sophia_st Yeah, I agree... it's better than a closed source from that stand point. no questions.

🤝

sophia_st Oh I see. But what about google play services in the main space, what's the plan: install the necessary apps and then remove it? or disable it's network?

I use it to activate premium in one app (that itself doesn't have network permission) and then deactivate it.

sophia_st Because leaving it as it is isn't very smart, it still gonna transmit some data.

Without network permission it can't extract data.

sophia_st Interesting! Thanks for that!

Your welcome :)

sophia_st

Open_Source_Enjoyer It is of course possible, but not as likely as with closed source.

I read about very tricky ones... like it's open source with lots of users and audits etc and then for some specific update it was injected with something for a short period and then uninjected and was unnoticed due that.
Or there was the XZ Utils backdoor if I remember correctly.

Open_Source_Enjoyer I use it to activate premium in one app (that itself doesn't have network permission) and then deactivate it.

Open_Source_Enjoyer Without network permission it can't extract data.

Yeah, got it!

Open_Source_Enjoyer

sophia_st I read about very tricky ones... like it's open source with lots of users and audits etc and then for some specific update it was injected with something for a short period and then uninjected and was unnoticed due that.

Yeah this is some problem.
But I am more anxious about my operating systems (GrapheneOS and Fedora Linux) getting malicous code injected then some of my sandboxed apps.