How can we ensure that apps on GOS know as little as possible about us?

Graphner

Well, I was wondering that after seeing this:

“Any app can see which apps you have installed within the same user profile.”

And this:

“Apps downloaded via Google may be able to communicate and share data with each other if the developers added mutual consent access (which could potentially mean app A with no permissions can communicate with app B with network permissions, which can send app A's mined data out of the device if in the same profile)”

What changes should we make so that apps don't have access to what they shouldn't? No photos, no videos, no contacts, nothing...

Is there any way to prevent all apps or everything in general from accessing the internet, so that when an app is launched, it asks us for access and we can decide whether to grant it or not?

Onlyfun

Graphner good question I would like to know as well.

thmf

Graphner “Any app can see which apps you have installed within the same user profile

For now you can install apps you absolutely don't trust in separate profiles.

Graphner Apps downloaded via Google may be able to communicate and share data with each other if the developers added mutual consent access (which could potentially mean app A with no permissions can communicate with app B with network permissions, which can send app A's mined data out of the device if in the same profile)

Same answer as above. Also, Apps Communication Scopes is a planned feature.

Graphner No photos, no videos

Use Storage Scopes.

Graphner no contacts

Use Contacts Scopes.

Graphner Is there any way to prevent all apps or everything in general from accessing the internet

Disallow Network permission.

All of the above are awesome GrapheneOS features. Stock OS doesn't have them.

Graphner so that when an app is launched, it asks us for access and we can decide whether to grant it or not

Unless it's a permission that can be granted as "Ask every time", then no.

Give GrapheneOS web site ( Features, Usage, and FAQ sections) a read. It has a lot of information on these topics.

Eumenia

Graphner Is there any way to prevent all apps or everything in general from accessing the internet, so that when an app is launched, it asks us for access and we can decide whether to grant it or not?

You could remove the network permission from all apps that you suspect to maybe extract data.

W1zardK1ng

Graphner Currently the only way to block app communication via IPC is to keep them in separate profiles, create multiple profiles and use those apps there.
Every single app doesn't communicate using IPC and this feature is not a bad thing also, developers has to choose to enable this. Eg- if you logged in to uber rider app and when you install uber eats it can fetch the account details logged in to the uber rider app and ask you to whether you want to use the same account.

Also it's a misconception that IPC is designed to bypass network restrictions, most of the apps use IPC from are same corporation like meta which needs network access for all of their apps to function.
So IPC should not be a major concern and no one really knows what data is being shared through IPC so it's all speculation that it will be used in this way but practically I don't think an app will collect data and store it and allow another app to upload that data to their servers, most users on regular Android don't have an option or block network access for apps individually so developers are less likely to create something like this.

tux_

You shouldn't run untrusted apps, aka commercial malware, if possible. That includes anything made by Google.

But yes, you can absolutely revoke Internet access of an app on Graphene.

Graphner

Thanks for the replies. I highly recommend everyone take a look at these 2 videos from “Side of Burritos.” They discuss “Storage Scopes” and “Network permission”, among other things:

https://www.youtube.com/watch?v=WjrANjvrSzw

https://www.youtube.com/watch?v=0ic6QK0xUMY

I have two questions:

1- Sensors can be completely disabled in SETTINGS - PRIVACY - ALLOW SENSORS PERMISSIONS TO APPS BY DEFAULT, but do we have to disable “Network permission” in every app?

I mean, isn't there something in SETTINGS - PRIVACY or somewhere else that allows us to disable it completely without going through each app individually?

I understand that there isn't, but I wanted to be sure.

2- Contact Scopes. I can't find where I can completely prevent apps from accessing my contacts' phone numbers. I want to do this with all apps that are not messaging apps.

With messaging apps (although I may not install any), I wanted to deny them access to my contacts by making them believe they do have it (so they can work). This is possible according to the documentation on the GrapheneOS website, but I don't understand how to do it. I haven't seen any videos explaining it either.

How can I enable Contact Scopes for messaging apps and deny it completely to others?

thmf

Graphner do we have to disable “Network permission” in every app?

You're given an option to allow or deny the permission during each app install with a checkbox.

Graphner isn't there something in SETTINGS - PRIVACY or somewhere else that allows us to disable it completely without going through each app individually?

Settings -> Security & Privacy -> Privacy controls -> Permission manager -> Network
You do need to go through each app, though they're nicely sitting in one place.

Graphner I wanted to deny them access to my contacts by making them believe they do have it (so they can work).

Long tap an app -> App info -> Permissions -> Contacts and accounts -> Contact Scopes -> Enable Contact Scopes
Now tap Label -> Create label -> Type a descriptive name, like "No contacts" -> OK
New label (contacts category) will open. At this point you can add contacts you want to be in this label (category). Since you don't need to add any contacts, swipe back to get back to Contact Scopes screen.
Now tap Label button once again. This time you will also see your new "No contacts" label. Select it and tap "Add to the list of scopes" and you're good to go.

userofgos

Graphner I mean, isn't there something in SETTINGS - PRIVACY or somewhere else that allows us to disable it completely without going through each app individually?

No there is no singular toggle to turn Network Permission off for all apps. The Network Permission is requested upon installing a new app and you toggle it on/off in the dialog as it installs. Alternatively go to the menu thmf mentioned

Graphner Contact Scopes. I can't find where I can completely prevent apps from accessing my contacts' phone numbers. I want to do this with all apps that are not messaging apps.

Graphner How can I enable Contact Scopes for messaging apps and deny it completely to others?

The Contacts Permission is requested upon first-launch of the app. Simply chose to deny the Contacts permission or select the Contacts Scopes option for any app that you do not want to give any access to Contacts.

For the apps that you want to make them think they have the contacts permission, all you need to do is to Enable the Contacts Scope feature and GrapheneOS does the rest. See here: https://grapheneos.org/features#contact-scopes (emphasis added)

thmf

By default, it acts as if the contacts list is empty and users can grant different kinds of access to specific contacts or groups of contacts.