K8y Maybe this is something the GoS developers can fix?
In theory, yes. In practice, since it would be a lot of work to write and then maintain the code, the first step would be a clear statement of how the current situation is a problem. If it's not broken then they're not likely to "fix" it.
K8y Since it's a security issue, that the apps seem to be able to do questionable things when flicked off.
So far it's not clear to me how it's a security issue. Running in the background doesn't enable an app to do more things than it could do in the foreground.
It's not even clear to me how it's a significant privacy issue. For example, a mapping app that is running in the background could gather location data continuously, and I hypothetically it could report the location data continuously. But if there is a concern that a particular app will maliciously leak location information, it would probably be best to not run the app. As a middle ground, the app could be placed in a secondary profile; if "End session" is used on that profile then the app will definitely not be running.
K8y Maybe allow them to run in background with restrictions, preventing them from opening and using AI to read message apps...
I think it is important to distinguish between two things that are very different:
- If something is definitely a security or privacy threat, with published exploits or due to the agreement of security experts that it's a big deal, the GrapheneOS team is likely to act.
- If something sounds like it would be really bad if it could happen, but there is no evidence that it's happening and there are things that would stand in the way of it happening, the GrapheneOS team is not likely to act -- even if it sounds really bad.
So if there is evidence of apps running in the background and using AI to read messages from other apps, that's potentially actionable. But if the hypothetical idea that maybe apps running in the background might capture data from other apps and then use AI to do something bad sounds really scary but has no evidence, that's very different, especially since regular mechanisms that are part of GrapheneOS protect one app's data against another app no matter which ones are running.
GrapheneOS already has two ways to stop an app from running:
- "End session" the profile that the app is in,
- Disable the app.
Adding more ways isn't impossible, but I suspect the case would need to be pretty strong.