Gboard Data Collection

ConfusedAboutGraphene

So if I install gboard through playstore and then remove internet access from the gboard app. Will gboad still collect and share data through google play services ?

Sorry if it's a dumb question.

Johnnyloans

ConfusedAboutGraphene

It's possible gboard could send out info via google play services.

You could place your trust in turning off data collecting in your google account settings.

NoahRaketic

Datasapiens No internet - no data.

This is not true. Gboard does not use direct network access to send telemetry data. The only way to disable data collection is through the in-app privacy settings.

TrustExecutor But I havenot seen any evidence that this is the case.

Gboard explicitly does use IPC to send data. It's not theoretical at all.

Johnnyloans It's possible gboard could send out info via google play services.

It's not just possible. That's exactly what it uses to send telemetry.

ConfusedAboutGraphene Sorry if it's a dumb question.

Not a dumb question at all, I use it myself. Just make sure to configure the privacy settings within Gboard to disable telemetry.

Datasapiens

No internet - no data.
But what does the gboard have or do so special, futo or fossify doesn't?

TrustExecutor

There is also inter process communication where apps with mutual consent can communicate with each other. So there is atheoretical possibility that Gboard can exfiltrate data through another app even though network permission is off. But I havenot seen any evidence that this is the case.

Datasapiens

NoahRaketic if gboard does not have internet permission, how does it send data?

n3t_admin

Datasapiens if gboard does not have internet permission, how does it send data?

See here:

NoahRaketic Gboard explicitly does use IPC to send data.

Datasapiens

n3t_admin could you give me source of your information about this IPC?

userofgos

Datasapiens See here: https://discuss.grapheneos.org/d/12924-any-other-ways-to-secure-the-use-of-the-pixel-camera-and-gboard-from-ipc/2

NoahRaketic

Datasapiens If you're interested in the technical details, you can read from the research from a group at Trinity College Dublin. These are three papers from the same research group that build upon each other on the topic:
https://www.scss.tcd.ie/doug.leith/apple_google.pdf
https://www.scss.tcd.ie/doug.leith/privacyofdialerandsmsapps.pdf
https://www.scss.tcd.ie/Doug.Leith/pubs/gboard_kamil.pdf

The relevant information is in section 5.1: Gboard of the final paper I linked. Essentially, Gboard (as well as other Google apps) use a service called Clearcut Logger, which is a component of Play Services, to send data.

userofgos

NoahRaketic Thank you for the research papers!

Datasapiens

NoahRaketic hmmmmm. But the 'sandboxed play services' .......

NoahRaketic

Datasapiens Yes, Play Services are sandboxed on GrapheneOS and play by the same rules as every other app. This includes IPC. Any app on Android can communicate via IPC with any other mutually consenting app. Google apps are no exception. This is an intended feature of the Android sandbox.

The only way the user can currently prevent IPC between two mutually consenting apps is by separating them across secondary user profiles / private spaces. IPC scopes are a planned feature, but it will likely be a long time before we see any implementation of that.

Johnnyloans

Datasapiens hmmmmm. But the 'sandboxed play services' .......

Every app is sandboxed on GOS; however, apps can't be completely walled off from everything--they need a phone to function properly.

Whatsapp notifications--IPC to google play services
App being notified of or using a USB device or BT--IPC
Pausing music at your lockscreen--IPC to the player.
They will need access to your documents or music

The head dev acknowledges apps can use IPC to send info back and forth.
There is a feature planned for app communication scopes to stop IPC.

Datasapiens

NoahRaketic

Johnnyloans

I meant play services itself - does it send this collected from every app data to google, when devs claim it is striped data or something like that

NoahRaketic

Datasapiens I don't understand what you're asking. Could you clarify what you mean?

Datasapiens

NoahRaketic apps, even if they don't have internet permission, give their data to play services via this IPC. Play services gathers this data and sends it to google. Sandboxed version of play services should block this data sending to google

Byku

Datasapiens Sandboxed version of play services should block this data sending to google

This is a misconception. Google Play services is an untampered stock version. It can't send data only if you deny internet permission.

Datasapiens

Byku I disable internet to apps, not play services.

Byku

Datasapiens Yeah, but if you want it not to send data you must disable it for Play services too.

Datasapiens

Byku I expect GOS' play services to be more private than regular play services.