Looking for a guideline to handle Network and Sensor Permissions

WiredRhino

Reading through the other posts I learned why network and sensor permissions are granted by default (https://discuss.grapheneos.org/d/1115-why-have-network-permissions-for-non-network-apps).

As others in the forum I denied all non-system Sensor Permissions. This has worked out well so far and not broken anything.

I'm more hesitant to deny network permissions because I don't entirely understand how much and which apps actually need them. For example is it possible to update an app if network permissions are denied?

TL;DR I would be happy if someone could write a guideline on how to handle the decision whether to give an app Network and/or Sensor Permissions.

matchboxbananasynergy

WiredRhino For example is it possible to update an app if network permissions are denied?

Yes, that would be possible. The app store app you're using would need to have the network permission, however.

mythodical

TL;DR I would be happy if someone could write a guideline on how to handle the decision whether to give an app Network and/or Sensor Permissions.

From a privacy perspective, the network guideline could be summarized into one sentence, "Grant network permissions only to apps that you entrust with the personal information they will have access to."

Having network permission means that whatever information is accessible to the app can be sent home. That includes any information you provide the app directly, as well as any information the app has permission to access on your filesystem, and any information the app may obtain mutually from other apps via inter-process communication (IPC).

In my opinion, every app with network permission is essentially a backdoor to your device (within the confines of the app's sandbox) and any information the app can access. It can dial home, it can transfer data to/from your device, it can log your public IP, etc. My best advice is to think carefully about which apps are granted network access, particularly if privacy is a concern.

WiredRhino

Thanks for your answers. I will deny all non-sytem apps network access which don't obviously need it, like Vanadium. Will see how it goes and hope that nothing breaks. If something would break I would write an update here in case someone else has the same question.