gstatic.com (a google domain) Connections On Stock Graphene OS On Startup

llama420

Using reverse tethering and network monitoring, very consistent connections to gstatic.com (a google domain) appear when first connecting. This is a major violation of the entire purpose of this OS. One connection is all google needs to track the entire session. Likely culprit is Vanadium, but I haven't confirmed this. Please fix or remove claims of privacy.

de0u

llama420 [...] Stock Graphene OS On Startup [...] major violation [...] Please fix or remove claims of privacy.

Hi, joining a community user forum and starting off with accusations and demands might not be the most productive approach.

While it is of course possible that you have discovered an unknown leak, there are multiple ways that a device could be configured to connect to Google.

It would probably be best to share more details about what is being observed.

What is "stock GrapheneOS"? Does that mean "GrapheneOS immediately after installation, with no configuration changes"?

Is the phenomenon observed "at startup" (meaning during booting), or "when first connecting" (to the tether)?

What kind of "connections" are observed? UDP, TCP, port number, how much information is transferred up and down?

Have any of the SUPL, PSDS, or connectivity-check settings been set to use Google services?

Since any app can choose to connect to a Google server, which apps have been installed?

Sigismund

llama420 Using reverse tethering and network monitoring, very consistent connections to gstatic.com (a google domain) appear when first connecting.

Pcap or it didn't happen.

other8026

llama420 It's likely an app that's doing that. A freshly flashed or factory reset device without a SIM card will only make connections listed here: https://grapheneos.org/faq#default-connections

Exhort14

llama420 Please fix or remove claims of privacy.

Please don't be a jerk or stop posting?

llama420

de0u No apps opened, fresh install, no SIM card. gstatic.com connections likely originating from com.android.rkpdapp/Remote Key Provisioning. Just retested. Same result.

llama420

de0u Not that it matters, but I did say please. Far from a "demand". And it's not just an accusation, it's what is happening.

llama420

Sigismund Behold:
2025-07-27 23:41:03.767 INFO TcpConnection: 10.0.0.2:34162 -> 142.250.69.99:443 Open
2025-07-27 23:41:04.135 INFO TcpConnection: 10.0.0.2:34162 -> 142.250.69.99:443 Close
2025-07-27 23:41:04.284 INFO TcpConnection: 10.0.0.2:34168 -> 142.250.69.99:443 Open
2025-07-27 23:41:04.293 INFO TcpConnection: 10.0.0.2:34174 -> 142.250.69.99:443 Open
2025-07-27 23:41:04.624 INFO TcpConnection: 10.0.0.2:34174 -> 142.250.69.99:443 Close
2025-07-27 23:41:04.681 INFO TcpConnection: 10.0.0.2:34168 -> 142.250.69.99:443 Close
2025-07-27 23:41:04.741 INFO TcpConnection: 10.0.0.2:34182 -> 142.250.69.99:443 Open
2025-07-27 23:41:04.770 INFO TcpConnection: 10.0.0.2:34192 -> 142.250.69.99:443 Open
2025-07-27 23:41:05.145 INFO TcpConnection: 10.0.0.2:34182 -> 142.250.69.99:443 Close
2025-07-27 23:41:05.199 INFO TcpConnection: 10.0.0.2:34192 -> 142.250.69.99:443 Close

llama420

other8026 Fresh install connects to gstatic.com. No apps opened at all.

Byku

llama420 You have to be more clear about when this connection occurs. Gstatic is used on like 50% websites you visit.

llama420

Byku No websites visited, no apps opened but the home screen. Fresh install. gstatic.com.

de0u

llama420 gstatic.com connections likely originating from com.android.rkpdapp/Remote Key Provisioning.

What is "Widevine provisioning" set to?

How is the attribution being made of the originating app?

Which build of GrapheneOS is this? Is it an official build?

What are the answers to the questions previously asked?

other8026

llama420 Please fix or remove claims of privacy.

llama420 If they somehow don't know this connection is happening, it's a huge oversight, and a dishonest one.

Sorry, going to be a little blunt with this one. If you want people to take you seriously, this is not the kind of approach that'll accomplish that.

Nobody is being dishonest here. If a connection is being made and we can figure out why, it'll either be fixed or documented. As of now, this is the first I'm hearing of this. I don't think the developers are aware of this either.

llama420 gstatic.com connections likely originating from com.android.rkpdapp/Remote Key Provisioning

You provide 0 reasons why you think this.

Keep in mind that ultimately a developer will need to reproduce this. It would be helpful if someone in the community did too. The developers are always busy working on things, so if someone can reproduce the issue, we/they can know it's not an issue for just one person and maybe save them time if it can't be reproduced by someone else.

I will try reproducing this myself later, but don't have time now.

In the meantime, you can try using an app like RethinkDNS or NetGuard to see if it's possible to narrow down what's responsible. That could be very helpful.

Keep in mind that there are a lot of moving parts in an entire OS. You even suggested it might be the browser, also a big app with lots of moving parts. If what you're reporting is true, this is the first I've heard of it (I'm not a developer though, so I'm not very clear on all the moving parts mentioned above myself). We'd need a lot more information and would have to be able to reproduce this to confirm and, if necessary, fix.

llama420

de0u TCP connections to 142.250.69.99. All default settings. A brand new install using the web install method. Here's a log:

2025-07-27 23:41:05.199 INFO TcpConnection: 10.0.0.2:34192 -> 142.250.69.99:443 Close

llama420

de0u Widevine is Graphene proxy.

Running adb shell dumpsys netstats returned this:

Directory:
/data/misc/apexdata/com.android.tethering/netstats
Configs:
netstats_combine_subtype_enabled=false
netstats_store_files_in_apexdata=true
netstats_import_legacy_target_attempts=1
platform legacy stats import attempts count=1
platform legacy stats import successes count=1
platform legacy stats import fallbacks count=0
enable_network_stats_event_logger: true
netstats_fastdatainput_target_attempts=0
FastDataInput successes=0
FastDataInput fallbacks=0
trafficstats.service.cache.isenabled=true
trafficstats_cache_expiry_duration_ms=1000
trafficstats_cache_max_entries=400
trafficstats.client.cache.config=TrafficStatsRateLimitCacheConfig{isCacheEnabled: false, expiryDurationMs: 1000, maxEntries: 400}
Active interfaces:
iface=tun0 ident=[{type=17, ratType=COMBINED, metered=true, defaultNetwork=true, oemManaged=OEM_NONE, subId=-1}]
Active UID interfaces:
iface=tun0 ident=[{type=17, ratType=COMBINED, metered=true, defaultNetwork=true, oemManaged=OEM_NONE, subId=-1}]
All wifi interfaces:

All mobile interfaces:

Top openSession callers:
{uid=1000,package=android}=18
{uid=1000,package=com.android.settings}=2

Poll counts per reason:
DUMPSYS: 0
FORCE_UPDATE: 1
GLOBAL_ALERT: 0
NETWORK_STATUS_CHANGED: 1
OPEN_SESSION: 2
PERIODIC: 1
RAT_CHANGED: 0
REG_CALLBACK: 2
REMOVE_UIDS: 0
UPSTREAM_CHANGED: 1

Recent poll events:
2025-07-27T23:34:47.976214 - Poll(flags=1, PollEvent{reason=NETWORK_STATUS_CHANGED})
2025-07-28T03:29:04.990226 - Poll(flags=3, PollEvent{reason=PERIODIC})
2025-07-28T03:29:04.844039 - Poll(flags=3, PollEvent{reason=OPEN_SESSION})
2025-07-28T03:29:04.832869 - Poll(flags=3, PollEvent{reason=OPEN_SESSION})
2025-07-28T03:28:19.287845 - Poll(flags=1, PollEvent{reason=UPSTREAM_CHANGED})
2025-07-28T03:28:18.446815 - Poll(flags=3, PollEvent{reason=FORCE_UPDATE})
2025-07-28T03:28:18.295004 - Poll(flags=3, PollEvent{reason=REG_CALLBACK})
2025-07-28T03:28:18.291667 - Poll(flags=3, PollEvent{reason=REG_CALLBACK})

Stats Providers:
OffloadController Xt:
NetworkStats: elapsedRealtime=0
BpfCoordinator Xt:
NetworkStats: elapsedRealtime=0
ImsPhoneCallTracker Xt:
NetworkStats: elapsedRealtime=0
ImsPhoneCallTracker Xt:
NetworkStats: elapsedRealtime=0

Stats Observers:
RequestInfo from pid/uid:1359/1000(android) for DataUsageRequest [ requestId=1, networkTemplate=NetworkTemplate: matchRule=MOBILE, matchSubscriberIds=[], matchWifiNetworkKeys=[], thresholdInBytes=0 ] accessLevel:3
RequestInfo from pid/uid:1359/1000(android) for DataUsageRequest [ requestId=2, networkTemplate=NetworkTemplate: matchRule=WIFI, matchSubscriberIds=[], matchWifiNetworkKeys=[], thresholdInBytes=0 ] accessLevel:3

Dev stats:
Pending bytes:
History since boot:
Xt stats:
Pending bytes: 0
History since boot:

InterfaceMapHelper:
BPF map status:
IfaceIndexNameMap: OK
BPF map content:
IfaceIndexNameMap:
ifaceIndex=49 ifaceName=tun0
ifaceIndex=2 ifaceName=dummy0

BPF map status:
mCookieTagMap: OK
mUidCounterSetMap: OK
mAppUidStatsMap: OK
mStatsMapA: OK
mStatsMapB: OK
mIfaceStatsMap: OK

BPF map content:
mCookieTagMap:
cookie=4125 tag=0x1 uid=10174
mUidCounterSetMap:
uid=10142 set=1
uid=10180 set=1
uid=10143 set=1
uid=10146 set=1
uid=10140 set=1
uid=1068 set=1
uid=1001 set=1
uid=10135 set=1
uid=10144 set=1
uid=1027 set=1
uid=10161 set=1
uid=10155 set=1
uid=1073 set=1
uid=10113 set=1
uid=1000 set=1
uid=10150 set=1
mAppUidStatsMap:
uid rxBytes rxPackets txBytes txPackets
10068 360 9 200 5
1000 92779 115 8808 84
1051 15639 35 5692 39
0 0 0 584 11
1021 881 9 609 9
10174 41764 54 15035 49
10060 4970 11 1055 12
mStatsMapA:
ifaceIndex ifaceName tag_hex uid_int cnt_set rxBytes rxPackets txBytes txPackets
mStatsMapB:
ifaceIndex ifaceName tag_hex uid_int cnt_set rxBytes rxPackets txBytes txPackets
mIfaceStatsMap:
ifaceIndex ifaceName rxBytes rxPackets txBytes txPackets
2 dummy0 0 0 392 7
49 tun0 156393 233 31591 202

SkDestroyListener logs:

NetworkStatsFactory logs:
Top distinct tag counts in UidTagSets:
1000=2
1021=1
1051=1
10060=1
10174=1

Among the UIDs was 10174, then run adb shell cmd package list packages --uid 10174 to arrive at com.android.rkpdapp.

llama420

Disabling com.android.rkpdapp stops the connections until reboot. Impossible to uninstall or fully disable.

ron

llama420 what is your configuration under "Settings > Network & internet > Attestation key provisioning"?

llama420

other8026 You can reproduce the results I found with this tool: https://github.com/Genymobile/gnirehtet. Combined with OpenSnitch on Linux, it will usually resolve to gstatic.com rather than just a raw IP. Particularly predictable after a reboot with no external connections. Once it has connected once, it tends to stop, though not always.

I listed the reason in a comment afterward. Once com.android.rkpdapp is disabled, the connections stop until a reboot, but it can't be fully disabled or removed.

I get I came in a bit abrasive. Please understand that I have been fighting for my privacy for a very long time, and I am tired of fighting just to see all my efforts go to shit. I've deleted almost every account I've ever had. I've made genuine sacrifices of things I liked because privacy was more important. I bought the phone I have specifically for Graphene OS, funding google in the process. So yeah, seeing this makes me angry, and why wouldn't it? I feel like I've been duped all over again with shallow promises.

llama420

other8026 Also, confirmed it's not the browser directly, though it may in an unlikely case have to do with the config or webview. But they haven't appeared as connected apps in the early stages of OS startup. RethinkDNS and NetGuard replace the VPN connection and expose my IP, so I'm not super eager to use them.

llama420

ron GrapheneOS proxy.

other8026

llama420 I listed the reason in a comment afterward. Once com.android.rkpdapp is disabled, the connections stop until a reboot, but it can't be fully disabled or removed

Try removing its network permission instead of disabling it if you can. Do you still see connections made to that domain?