Best way to restrict browser use in GOS?

777funk

Is there a "best practice" on preventing the browser from being used?

I have a case where I would like the phones we hand out to our children to be near impossible for them to access the internet. That means no possibility of installing social media, no way to use the browser, YouTube, etc.

What's my best chance of achieving this? Removal? PW protection? Separate Account? Something else?

p.s. why not get a flip phone? The short answer is mainly the camera and having a real keyboard (text messages).

MineralWater

777funk

I think for this you need Google Accounts and then you could use Google Family Link App, but I don't know if your kids phone needs stock android for this to fully function.

In grapheneOS I would not know if that works together with family link, but you can at least install it on graphene.

Family link gives you control about usage time, which apps can be used or not and you can restrict that apps are getting installed (you have to confirm any installation). That should do what you want.

raccoondad

777funk no real way to do so, sorry. Even if you disable with ADB, you can reset the device easily.

GOS isn't a childrens device OS

Fay_Wilmont

This thread was an educational read, thanks all!

777funk I would like the phones we hand out to our children to be near impossible for them to access the internet

I once gifted an old tablet to a friend to be used as an offline music player. Since he is averse to wireless signals he asked me if I could permanently disable wifi on it. My notes tell me I did this by commenting out the line wifi.interface=wlan0 in the file /system/build.prop. This was on Android 10 I think, and must have required root access (but since it was running LineageOS that was provided out-of-the-box).

I wonder if something similar can be done with a phone, permanently disabling not just wifi but also mobile data, but leaving intact the functionality for phone calls and texting. Doing this with official GrapheneOS, you'd have to temporarily root it to make the necessary edits. Or make your own build.

777funk

raccoondad

Ok thank you. I figured as granular as Graphene seems to get, there'd be a way to restrict a reset or at least PW protect.

It sounds like stock Android may be a better fit than GrapheneOS which comes as a surprise to me. A little disappointing.

DeletedUser495

777funk https://discuss.grapheneos.org/d/24977-possible-to-delete-all-web-browsers/11

raccoondad

777funk there'd be a way to restrict a reset or at least PW protect.

No, that would risk bricking the device anyways.

777funk

raccoondad

I'm not a GrapheneOS dev... but there should be no harm in password protecting a factory reset (assuming this happens from GrapheneOS... of which I'm not familiar). Only the admin should be allowed to do a reset, so why not make it possible to password protect.

n3t_admin

777funk Only the admin should be allowed to do a reset, so why not make it possible to password protect.

Everyone can just boot into recovery mode and factory reset the phone without any passwords whatsoever.
What you are suggesting, is security theater and is actively discouraged by the dev team.

777funk

n3t_admin
Ok so recovery mode as in bios equivalent for a phone (independent of the OS).

LeslieFH

n3t_admin Everyone can just boot into recovery mode and factory reset the phone without any passwords whatsoever.
What you are suggesting, is security theater and is actively discouraged by the dev team.

It is not "security theater".

Security is not "protecting only against the movie-scale threats". Securing a child's phone against breaching of time limits with a password is rather effective, because while the child can boot into recovery mode and factory reset the phone, they can't do this covertly, this is an irreversible action and clear breach of previous settings and of the agreement with the parents.

The problem is, GOS developers don't have the resources to provide child-appropriate phones, where security against the child's attempts to gain more screen time requires different approach then security against NSA trying to get at your files.

(Well, it's either that or they're just not interested)

n3t_admin

777funk pretty much. It's present on every Android phone and you can't circumvent it. Factory reset is one if its main features.

NetRunner88

Google family stuff doesn't work on GOS.

Use tinelimit.io in local mode it works OK to limit app usage.

777funk

n3t_admin

In all reality, I can check in on the phone every so often and make sure it's still GOS. There comes a point where the honor system will be the only thing stopping problems. But making it a real stretch to reach trouble is what I'm after.

777funk

n3t_admin

I believe the company Wisephone pulled it off (with their Samsung Smart Dumbphone, it is not possible to factory reset to stock android).

n3t_admin

777funk Wisephone is a complete scam that simply modifies the standard OneUI with a different launcher. Everything underneath is the same technology and can be reset through recovery, as can all Samsung phones.

Again, factory resetting a phone does not depend on the OS it's running. It just wipes the keystore and data partition to get back to a factory state.

777funk

n3t_admin

It looks to me like the usual recovery mode resets back to Wisephone's OS.
https://techless.zendesk.com/hc/en-us/articles/38477196837389-Factory-Reset-Wisephone-II

And... scam is kind of strong language. They put in the time to make a dumbed down / governed / limited version of Android. I see no problem with them charging for their service.

n3t_admin

777funk It looks to me like the usual recovery mode resets back to Wisephone's OS.

First, there is no "Wisephone's OS" - it's Samsung OneUI. They just have it enrolled in Samsung's MDM(which is very problematic for various reasons), sell it for insanely high prices and charge insanely high prices for a subscription, without which the phone will become a brick. And that's no surprise, because they have to pay Samsung every month per device. The fact that you have to buy new hardware and pay them a monthly subscription fee instead of just installing a launcher on your existing phone is the biggest indicator of the scam. It is the best definition of a scam and falls into the same category of all the other bullshit products.

Secondly, what do you think a factory reset would do? Revert the phone to stock PixelOS? Lmao. The OS has been replaced in the flashing process. Factory reset means that the phone will be like "new out of the box". Wiped of all data and settings, not magically flashed back to a different OS.

777funk

n3t_admin

I doubt it. Sure, maybe there's a way, but according to the link I posted earlier, it goes back to the OS they shipped it with (from techless) even from Android Recovery Mode. And yes, there's always a way to do almost anything with a phone if a person knows enough. But... I'm talking me or the average user, not someone who's got a degree in comp science.

And as far as what they charge, I'm not finding any real answers on how to reliably DIY what they've done. That's what I came here for. I was hoping to buy a Pixel, put GOS or Lineage on it, make some changes to control apps as desired and continue on with life. At this point, what they offer doesn't seem like a bad deal.

To me it seems like they've done a pretty good job accomplishing their goal. Within their system, I've seen very little reported on... my child found a way to get through their protections. I've seen a lot on the other hand with say Google Family Link.

DeletedUser495

777funk did you try my suggestion from the other thread or are you here to just talk crap?

n3t_admin

777funk OS they shipped it with (from techless)

Techless doesn't ship an OS, because it doesn't exist.
It's just a launcher. There is an almost unlimited amount of minimalist FOSS launchers that are the same thing.

777funk At this point, what they offer doesn't seem like a bad deal.

Perhaps you don't know or don't understand what MDM means. MDM (or mobile device management) is a technology that is usually used for business devices. This gives the admin of the MDM the ability to set policies, remote wipe, install apps, run scripts, locate, install certificates - remotely.
All you are doing, is give a shady company full access to your life. If they decided tomorrow that they don't make enough money, they could just install their own root CA on your device, rewrite your DNS to point to a malicious website and for example phish your banking credentials. You wouldn't even know, because the device is basically their property once it's enrolled.

Your only guarantee that they won't do anything nefarious is a... "trust me bro". And that's it. If you think this is in any way, shape or form comparable to GrapheneOS, I can't really help you. If you want to give control of your life to some random scamlords - go ahead. But I would advise not to downplay or promote anything they offer, because this snake oil crap is not tolerated on this forum.

Lucario1829

777funk according to the link I posted earlier, it goes back to the OS they shipped it with (from techless) even from Android Recovery Mode

so does graphene, the os is replaced. no factory reset changes a phones operating system

777funk

DeletedUser495
I replied on the other thread. If all is ok with that bit of code (I'm in the middle of looking at the source), that application does exactly what I'm hoping to do.

777funk

n3t_admin
As far as giving a shady (I don't know enough about them to say yes or no here... nor am I security aware enough to understand from a computing standpoint) company full access to my kid's life (he's signing up for it), there's really nothing to give. There's no browser. He won't be doing any business on the phone since there's really nothing there but text, phone, and a camera. His texts will be basic day to day nonsense that doesn't mean much to anyone else as will his talk and camera. So there's not much concern here. If the company were out to take banking details, they'd need to be in the smart phone business. At least with the dumbest program they offer, there sure isn't much to scam.

If there were a way to have only these limited tools (phone, text, camera) with Graphene, I'd be all for it. But that doesn't sound like it's the case or at least I've not heard that it is.

EDIT: perhaps the post above this one has more detail there. Thank you. I have used ADB long ago when I loaded Cyanogenmod on a Samsung Galaxy S (maybe S2). I remember rooting etc being painful at that point (maybe 2011 or 12).