Wise knows in which country I am.

Mob

Hi everyone,

First, thank you for the developers of graphene OS. I'm enjoying very much the OS and the safety/privacy feeling it provides!

I have an issue with the application wise. The app managed to access my current location's country and I don't get how.

The app is installed in a separate user profile, no google services. Only additional apps to the defaults apps are Aurora and proton VPN, using the graphene VPN always on kill switch and starting up with a specific country's profile in the UK. No location permission given to wise, only network, sensors and notifications.

Yet, the other day while being in Sri Lanka (traveling there), the app sent me a message "welcome in sri Lanka" (I took a screenshot but I think I can't upload it here through the forum for mobile). At that time, I had a sri Lankan sim card but I doubt it found out through this (if it even could) as I did not have that message in the past based on the sim' origin country.

Any idea how that app got access to my location ? Could it be some "weakness of the OS" or there is something I am missing ?

When i was using a standard android phone with google, wise was always able to follow me everywhere. No matter my IP address (using proton vpn all the time).

nrt

"global OS configuration available to apps are time zone, network country code and other similar global settings"

https://grapheneos.org/faq#non-hardware-identifiers

treequell

A post from stack exchange

Apps cannot access SIM card directly, neither they can get your exact location without getting permission. But they can get your country code if the device is connected to a cellular network. No special permission is needed to call getSimCountryIso or getNetworkCountryIso.

https://android.stackexchange.com/a/247685

Mob

Ok, I understand. Thanks.

Is there a way to setup that user profile so that it does not have access these infos?

treequell

Mob I'm not sure how you can stop a native app getting this information short of removing your SIM card and turning on airplane mode, and even then I don't know if that would work.

One option is to use Wise within the additional sandboxing of Vanadium. Does Wise have a PWA you can use?

lbschenkel

The same happened to me as well, but I was in temporarily in country B with my SIM of country A. While I was in B, I got a Wise notification welcoming me to country B.

The app was in the background and hasn't been launched for a while. To reduce data exfiltration, I changed battery settings to be "limited" and revoked data while the app is on the background.

Mob

Thank you for your input guys.

Treequell, I changed country again, put on airplane mode and started wise, so far I received no notification about the change of country.

The issue with the PWA is that it asked me to use the app to confirm the login on the web. I suspect it will ask for every new IP.

Hopefully in the future, Graphene will find a way to turn on / off app access to this very sensitive info (in my opinion) about the country currently in.