How to ensure an ISP doesn't know that I am on GOS?

pizzadequeso

How do I make sure that Starbucks and mall ISPs dont know that I use GOS?

For example, when I arrive at a mall, I connect to their Wi-Fi, then I turn on VPN. So from the time the Wi-Fi connection is established until I turn on VPN, my phone in theory can communicate with GOS servers. This can be logged if they track it. It's really no big deal but is there a way to prevent it?

Also as I leave the mall, I usually turn my VPN off then disconnect from their Wi-Fi. My phone once again has a few seconds to send data to GOS while I am not on VPN.

How do I ensure that these public ISP can't know if I really be picky about it?

Sorry for the long question. Hope to hear back.

Probably9857

pizzadequeso

In Settings > Network & internet > internet connectivity checks, select Standard (Google) server
Reverse your order of operations: start VPN before connecting to WiFi; disconnect from WiFi before stopping VPN.

Also, be sure you have the VPN set to block connections without VPN.

Eumenia

pizzadequeso How do I make sure that Starbucks and mall ISPs dont know that I use GOS?

For example, when I arrive at a mall, I connect to their Wi-Fi, then I turn on VPN. So from the time the Wi-Fi connection is established until I turn on VPN, my phone in theory can communicate with GOS servers. This can be logged if they track it. It's really no big deal but is there a way to prevent it?

Also as I leave the mall, I usually turn my VPN off then disconnect from their Wi-Fi. My phone once again has a few seconds to send data to GOS while I am not on VPN.

How do I ensure that these public ISP can't know if I really be picky about it?

Enable the killswitch in the VPN settings.
In addition to this, MAC address randomization should make sure that the public wifi can't do anything with the information

henry9018

pizzadequeso my phone in theory can communicate with GOS servers. This can be logged if they track it. It's really no big deal but is there a way to prevent it?

As of now it seems to be required that the VPN gets always activated before connecting to an access point, and only deactivated after disconnecting from the access point. Otherwise the usage of GrapheneOS can be visible (at least) due to the recently reported non-tunneled SUPL DNS queries:
https://discuss.grapheneos.org/d/29373-perhaps-reproducible-supl-dns-leak-with-mullvad-vpn/
https://github.com/GrapheneOS/os-issue-tracker/issues/6873

Xtreix

Probably9857 3. In settings > Network & Internet > Private DNS > Select Off ("Automatic" may cause problems with blocking VPN leaks).

Probably9857 disconnect from WiFi before stopping VPN.

If you enable ‘always on’ for the VPN, I don't think you need to disconnect from Wi-Fi before disconnecting from the VPN.

I would also recommend turning off Wi-Fi automatically after a period of time when your device disconnects from a Wi-Fi network because your device is no longer nearby, in Settings > Security and privacy > Exploit protection > Turn off W-Fi automatically.

Probably9857

Xtreix If you enable ‘always on’ for the VPN, I don't think you need to disconnect from Wi-Fi before disconnecting from the VPN

This is true, but it sounds like the OP only uses a VPN on public WiFi networks. If the starting state is VPN off, then the killswitch is probably off too.

If that is the case, starting the VPN and enabling the killswitch needs to happen before connecting to public WiFi.

Edit: I thought you were talking about connecting. You're right that the order of disconnecting wouldn't matter.

tux_

Out of curiosity why would you want to hide GOS from Starbucks or malls?

The obvious answer is not to use their WiFi instead of your cellular data.

Another approach I can think of if you really want to use public WiFi is to route all your traffic through your home ISP (e.g., by means of a Wireguard tunnel). You can go further and run your own DNS server at home to further prevent passive logging of DNS requests by the home ISP.

You can obviously also use a commercial VPN, but the above suggestion is free (as in beer) and does not involve trusting another third party.