Help understanding Sandboxing and Network Location on GrapheneOS.

jackdoe

I've read through the GrapheneOS documentation and have done searching on this site, but I am still uncertain on some things.

I've installed GOS on two Pixel 8s for my wife and myself. We're coming from years of Iphones and Gmail.

Our use-case for our new phones:

Phone*
Text*
Browser*
Maps
Camera*
Podcasts (I assume there will be several options for this)
Weather
Finance (our bank works with GOS)
Email

I assume what is included with GOS will suffice.

Maps - From what I've read Googlemaps seems to be what we will use. I think installing the app is preferable to using it through the browser. It will only be a data leak while it is in use, and it won't share data with any other apps, correct?

Weather - Regardless of what I use for this, I assume it will be the same as with maps and only share data when in use.

For both of these what are the best ways to set network locations options?

Email - For the short-term we are both still tied to Gmail. I plan on transitioning us to Proton or similar soon, but in the interim, what happens if I download the Gmail app? Or is going through a browser a better option? Or are both options garbage? Can I use a safer email app and forward from Gmail until I've eliminated them?

ClickClickDrone

jackdoe

Maps - From what I've read Googlemaps seems to be what we will use. I think installing the app is preferable to using it through the browser. It will only be a data leak while it is in use, and it won't share data with any other apps, correct?

In general, no, there won't be much leaks, especially if you avoid using it with your Google accounts. However, there is a small, but possible risk, of any Google apps using IPC to talk to eachother without you knowing, but this doesn't matter since Maps needs internet access anyway and will likely leak via that way instead.

In short: you'll likely be fine if you don't use a Google account

Weather - Regardless of what I use for this, I assume it will be the same as with maps and only share data when in use.

I'd recommend Breezy Weather; it doesn't even need location access! Also, it has got a very pleasant UI.

Email - For the short-term we are both still tied to Gmail. I plan on transitioning us to Proton or similar soon, but in the interim, what happens if I download the Gmail app? Or is going through a browser a better option? Or are both options garbage? Can I use a safer email app and forward from Gmail until I've eliminated them?

What do you mean with "safer"?
More privacy?
More secured against remote email attacks?

pixelfairy

jackdoe

For weather, you can save save bookmark a weather site.

If OSM based maps (organic maps, comaps, etc) don't work for you, theres also "HERE we go". But thats also in the google play store. You can put all the google stuff in a private space. Even if you keep that unlocked most of the time, it will be easy to lock away as you migrate away from them. Then you can deny google services location and use a vpn if you really don't want them tracking you. Here we go works fine with play services disabled, but you'll need it when you want to check for updates.

For email, Tuta works better with graphene. Proton requires google play services for notifications. The CEO has acknowledged this in an interview, and said they don't know a good way to fix it. I guess they don't want to look at Tutas open source code.

You could also use a mail provider like fastmail.com or posteo.de that supports imap and Fair Email, a client that supports conversation threading on android. Its the only android email client I know of that supports email threading, with both sent and received in the same thread and does not need play services for notifications. Thunderbird did not support message threading when I tried it, but that may have changed by now. Both of these clients support gmail.

jackdoe

ClickClickDrone Thank you for the response!

I'll check out Breezy Weather.

As for "safety" regarding email, at the beginning of this journey I am primarily focused on privacy.

DohnJoe

ClickClickDrone you'll likely be fine if you don't use a Google account

Keep in mind that if you logged in with your Google Account (because of Google Play), Google Maps will automatically log you in with the same Google account.

Only after the automatic login, you will be avle to go in Google Maps settings and log out.

I am not sure about what this means in terms of privacy, but if you do not really need navigation (only maps) you can use the webapp through the browser and skip the installation.

I personally use CoMaps, except when I have to do important trips (sometimes I have to change country), in that case I am using Waze.
Still Google owned, but at least doesn't follow my Google Account.

ClickClickDrone In general, no, there won't be much leaks

Let's remember that apps also ship trackers, just for completeness of info.

jackdoe As for "safety" regarding email, at the beginning of this journey I am primarily focused on privacy.

I would suggest Tuta Mail, especially if you do not need to self-host services that need email configuration.

ClickClickDrone

jackdoe
I see.
Honestly, you won't unfortunately get much privacy until you switch to a provider like Proton.

The good news is that you can setup e-mail forwarding from your Gmail address to Proton to help ease the switch.

But I understand if you're hesitant; it's no easy task!

In the meanwhile, you can improve security (and privacy, somewhat) by reducing permissions on Gmail's app.

Lastly, avoid using Gmail's web app, since the UI is terrible on mobile!

jackdoe

ClickClickDrone thank you for the info. Still researching which email I'll use. I've limited Gapps as much as I understand how... I've been using Gmail's web app for nearly 10 years! It is garbage!

jackdoe

DohnJoe I've donwloaded Google Maps anonymously via Aurora.

What does it mean that apps "ship trackers?"

Tuta is definitely on my list.

DohnJoe

pixelfairy For weather, you can save save bookmark a weather site.

Or curl wttr.in/<city> if you have terminals available.

gta3

pixelfairy i stopped suporting Proton products a while back, they very convieniently seem to dodge certain questions & solutions, plus there main office is directly located within the same building (just different floor) to many well known data harvesting and spyware companies.

Im not that naive... When it smells like bs it usually is.

jackdoe

pixelfairy Thanks! Fair Email might be a winner. I've not screwed with imap and pop in nearly 20 years, I've been out of IT for a LONG time.

theloneraven

pixelfairy For email, Tuta works better with graphene. Proton requires google play services for notifications. The CEO has acknowledged this in an interview, and said they don't know a good way to fix it. I guess they don't want to look at Tutas open source code.

That's hysterical. For a company so hateful of Google I would not expect that. Still gonna use it tho. Hopefully they find a way in the future.

gta3

Instead of google maps you could try MagicEarth.

Seeems to be much more car friendly than OsmMaps etc

pixelfairy

gta3 Magic earth is also OSM based. OSM doesn't work well in some areas.

I like the weather thing. I have a desktop link to the weather specifically in my area. One click. Cli junkie, but not on phones.

DohnJoe

jackdoe

With "it ships trackers" I meant that your Google account is not the only way apps can get a grasp of your (pseudo)idendity.
You can read something more here.

In the specific case of Google Maps, I thought they had more trackers, but they have only Google Firebase.
You can read a report here.

userofgos

DohnJoe Exodus is not a reliable or accurate way to assess the presence of "trackers". There are many threads about this, here's one: https://discuss.grapheneos.org/d/471-installing-apps-with-trackers/5

Every user installed app and most of the app-based OS components run in the standard untrusted app sandbox. There is no way to install an app that's not sandboxed.

The 'tracker' detection in Exodus is simply detection for a list of libraries used by apps which they consider bad and marked as trackers. In most cases the claim is not really true. For example, a crash reporting library only reporting data after crashes is clearly not there as a tracker. Many apps make these features opt-in or at least opt-out, but they get marked as having a tracker for using the library regardless. Apps using these libraries do not have any additional capabilities. It has nothing to do with the app sandbox or permission model. It has nothing to do with which data you choose to give to an app or which permissions / access you choose to grant it. It is third party code used by the app which was put on a list of bad things by Exodus. If the app renamed the library / classes / manifest entries, it wouldn't be detected anymore. It will not detect anything custom or with decent obfuscation applied. It will only detect apps using a third party library they consider bad without making any real attempt at hiding it.

Play services being installed isn't particularly relevant to this. Play services on GrapheneOS is a regular app in the standard app sandbox. That's the whole point of the sandboxed Google Play approach. Having Google Play on GrapheneOS gives exactly zero additional access or capabilities to the Google libraries used by apps using Google Play. The whole point is that it runs in the same app sandbox. Every app can do exactly the same things as sandboxed Google Play whether or not it's installed. They can use the same Google services and other services.

Apps can use Google services without Google Play by using them directly. Google Maps is a great example of an app heavily using Google services without Google Play installed since it fully supports it and nearly all the features work fine without it with only a few things like compass calibration missing because they chose not to make an internal implementation. Google's libraries used by apps can have fallback code to use Google services without Google Play being available. Google's Ads SDK is an example of a library fully working without Google Play. Only the lite variant of the Ads SDK has a hard dependency on it since it leaves out the fallback code to make it leaner. The reason they don't do that in more cases is because they want to keep their libraries small and avoid depending on app developers updating the code.

DohnJoe

While I agree Exodus is not the optimal way to have a look at trackers, it's still better than not having a look at all.

userofgos a crash reporting library only reporting data after crashes is clearly not there as a tracker

Exodus is clear about what they consider to be a tracker in their documentation:

No, all trackers do not have the same function and they can present different levels of (privacy) intrusion.

Crash reporters: these trackers specialize in reporting application crashes. In other terms, their goal is to notify > application developers that an app encountered a problem. As such, information collected at the time the application crashed will allow the developer to correct the bug.

I can see why this is not an issue for the vast majority of people, but this is a tracker nontheless, just a different kind.
Some people might not want to give information about their device/os hardware or software versions, and I think it is correct to have a stricter approach to better decide case by case.

If these trackers were not included in the list, the more "paranoid" users would still have to find a way to search for those trackers manually.
Having this trackers included is much easier, because now you can have a look at the list and decide if you want to install the app anyway (recognizing that the tracker is just a crash reporter).

I agree that it could be much better in detecting the trackers themselves, Ecodus' approach is probably a bit shallow.
But again, I still think it's better than not having it.

userofgos

DohnJoe While I agree Exodus is not the optimal way to have a look at trackers, it's still better than not having a look at all.

I tend to agree, it does give you some insight, but also can be misleading especially if you are prone to said "paranoia". Same can be said about the system/app permissions.

DohnJoe Some people might not want to give information about their device/os hardware or software versions, and I think it is correct to have a stricter approach to better decide case by case.

Unfortunately the current state of android makes it difficult to prevent many forms of identifiers being leaked: https://discuss.grapheneos.org/d/17118-identifiers-across-private-space-and-profiles/4