Downloads app contacts gstatic.com

DeletedUser720

Novaliss doesn't fit this https://discuss.grapheneos.org/d/30985-downloads-app-contacts-gstaticcom/25

Novaliss

harp please just try with those app entry icons option turned OFF in RethinkDNS

DeletedUser720

Novaliss It's just a weird coincidence people are seeing "strange things. There is another topic on leaks https://discuss.grapheneos.org/d/33331-rethinkdns-ip-leaks/30 where the person refused to tell if private DNS is set to OFF as advised.

harp

Please people, unless, unexpectedly, there is a relation after all can we leave that stupid charger mention behind? Again, I just mentioned it if there would have been any relation I couldn't imagine. I also apologize for any misunderstandings that may arise/have been arisen because I'm not a native English speaker.

DeletedUser720 Quite often those types of claims ends up with "who would new I need to mention I'm using an Automation2 tool I have configured a day ago to start something upon put on charger"

I think there's a little difference. I tried to mention all aspects which might be related to that as far as I could imagine like settings or installed apps. Of course I didn't mention really every changed setting (which were less), because I was pretty sure that a UI settings like enabling dark mode wouldn't be relevant in any case for that. But I'll appreciate any suggestions and would check these.

Novaliss When I plug in my phone, often this triggers a search for app updates, since the App Store is set to 'optimised' in its 'App battery usage' settings entry.
Therefore, when reading this thread the first take for me would be looking for something similar.

As written there were (and are) no Play Services and Store installed since reflashing GOS. I strongly suspect the GOS app store update search won't trigger any connection to a Google service. As mentioned, between the reflashing of GOS and finishing the second charging process there was nothing installed beside the shipped deafault apps except RDNS. But if anyone has any idea what to check, it's also appreciated.

Novaliss please just try with those app entry icons option turned OFF in RethinkDNS

As written before, there are periodically established expected connections to favicons.nextdns.io rgardless of any charging behavior as the description of that RDNS setting says connections to nextdns.io and duckduckgo.com are used for that. Before the last OS-flashing there were also connections to icons.duckduckgo.com (or something like that, I can't remember exactly), now it's only to nextdns.com.
But of course, I set this to "off" now and will check during the next charge just to ensure.

harp

Novaliss please just try with those app entry icons option turned OFF in RethinkDNS

So meanwhile the next charge happened and it was as expected: Since setting icons option in RDNS to "off" no more connections to favicons.nextdns.io appeared in the log. But quickly after starting charging the connection attempts to gstatic appeared.

Novaliss

harp will check during the next charge just to ensure.

Thanks. I also experienced a bit lighter running RDNS with this turned off.

Victus

harp Since that the device was charged two times. And again while every of these both charging processes Rethink logged connections (or tried and blocked connections, because i defined a blocking rule before) to www.gstatic.com by this "5-apps-couple"

Can confirm this issue on clean setup (only 3rd party app - RDNS) with same behavior and IMO it's not related to RDNS. First connection attempt to www.gstatic.com is made after ~ 20-30 min after phone connected to charger, next 4 attempts - later, every 4-5 min. Total connection attempts is 5. And on every charging cycle I have the same behavior - 5 connection attempts to gstatic.com
At first time, these connections registers by RDNS logs (MTP host, Downloads, Download manager, com.android.providers.media, Sounds). Next time, I disable RDNS completely and reconnect phone to the router with Pi-hole and start charging process, nothing changes - the same 5 connection attempts appear in pi-hole logs.
GOS setup:

Clean state after factory reset
RDNS (source - github)
Sandboxed GPS - not installed
Only main profile (no other separate profiles)
no SIM, Airplane mode - Enabled

Network settings:

Private DNS set to Off
Internet connectivity checks - Off
Attestation key provisioning - Google
Widewine provisioning - Google

RDNS settings:

DNS - Quad 9
Proxy - Disabled
Show website icon in DNS logs - disabled
Also tested with 2 versions of RDNS (v0.5.5n & v.0.5.5u, no difference)

Novaliss

Victus could it be something from your internet provider?

harp

@Victus Thank you, I really appreciate someone trying to reproduce that seriously!

Your setup seems very similar to mine, with few exceptions: Network setting left as default here (GOS servers). May I ask you why you changed provisioning servers to Google?

Your reported behavior is also very similar:

Victus First connection attempt to www.gstatic.com is made after ~ 20-30 min after phone connected to charger, next 4 attempts - later, every 4-5 min. Total connection attempts is 5. And on every charging cycle I have the same behavior - 5 connection attempts to gstatic.com

Here the time of first connection attempt differed. Sometimes it was quickly after start charging, sometimes later (but never later than 30 min after). The intervals between the attempts vary and are often going longer with each attempt, e.g. between attempt 1 and 2 just one minute, between 2 and 3 two minutes and so on. Mostly the longest interval is 5-6 minutes but in the past there was sometimes even up to 15 minutes. But whenever the first attempt appeared and how long intervals were, the 5th attempt is usually the last - in the past there were rarely up to 7 - and even if there was one hour of charging left, no more attempts appeared.

Victus

I don't think so, because it's clean successful outgoing connections. Attempts means connections, because gstatic.com was blocked by both RDNS and Pi-hole block lists.

Emmy

This is happening on one of my Pixel 8 devices, but not on the other one.

Did anybody gain any further info on it?

GrapheneOS

Try without RethinkDNS using something else to monitor it.

harp

GrapheneOS @Victus already tried it on a clean setup without using RDNS, checking connections with Pi-hole.

It's strange that it seems to appear to only a few people/devices/setups, while not to the mass of users. Otherwise more people should have recognized it, I think. Also, it doesn't seem to be related to RDNS because more people should have had that behavior? It's also strange why this seems to be triggered by charging/connectiong the USB-cable.

By the way meanwhile I did another clean install/flashing of GOS on the same phone (for other reasons), still the same.

sebastianha

GrapheneOS I also see the request in an external DNS server and without RethinkDNS

Emmy

harp did you add any apps or SIM at all to your fresh clean setup?

Emmy

sebastianha do you have apps and/or SIM on the device?

sebastianha

Emmy Yes, but not many apps.

Byku

Hmm. I checked for this occurrence and can confirm I have this mysterious connection to gstatic.com as well. Same pattern as discussed here. Sometime after the device is plugged in for charging Download Manager contacts gstatic.com. Using the last stable rDNS version to check this. It's a production device so I can't wipe it to do a test on a clean install but it looks like Victus already did that. SIM card is being used, eSIM manager is on. No Google apps have internet access.

« Previous Page