Avoiding fingerprinting

vtspffg

I'm trying to understand how I can avoid being fingerprinting as GrapheneOS.

As I understand, the OS and bundled apps makes the following connections that are specific to GrapheneOS:
GrapheneOS System Updater app (https://releases.grapheneos.org)
GrapheneOS app repository client (https://apps.grapheneos.org)
Vanadium (update.vanadium.app, dl.vanadium.app)
Time synchronization (https://time.grapheneos.org)
Connectivity checks (https://connectivitycheck.grapheneos.network, http://grapheneos.online)
PSDS (https://broadcom.psds.grapheneos.org)
Hardware-based attestation (https://remoteprovisioning.grapheneos.org)
DNS-over-TLS (randomstring-dnsotls-ds.dnscheck.grapheneos.org)
SUPL (supl.grapheneos.org)

Is this correct?

If I have a VPN with the settings "Always-on VPN" and "Block connections without VPN" enabled, do all of these connections go through the VPN?

If I use multiple user profiles, do I need to use VPN on all the profiles or only on the Owner profile? Is there any way to have a non-VPN profile that doesn't make any of the GrapheneOS-specific connections?

DeletedUser115

vtspffg If I have a VPN with the settings "Always-on VPN" and "Block connections without VPN" enabled, do all of these connections go through the VPN?

Internet connectivity checks go over both plain connection and VPN. This is by design to make captive portals work.

Each profile has it's own VPN connection. If you want to avoid connecting to GOS services from a secondary user profile, disable "Apps" app. Keep it enabled in the Owner profile so GOS apps are kept updated. Once an app is updated in one profile, it's updated in all profiles.

[deleted]

vtspffg Maybe you could set up custom DNS filtering by analyzing live logs and domain block telemtry? NextDNS does this, but I'm sure there are others. I would ensure you're careful with what you block regarding GOS to ensure it doesn't interfere with things like updates.

[deleted]

DeletedUser115 If you want to avoid connecting to GOS services from a secondary user profile, disable "Apps" app.

Won't other system apps still be making connections? Its not just the Apps app that makes connections to GrapheneOS servers.

Phead

As far as websites go, I believe you are also fingerprinted by wallpaper, timezone, language and other settings that differ from the vast majority of users. Not sure if that's what you're asking, though (and if vanadium has built-in settings to avoid that).

DeletedUser115

[deleted] On the secondary user profile the Apps app is the main thing that would make connections to the GOS servers. System Updater runs from the Owner profile. I assume Vanadium still need to check TLS certs validity tho. What other system apps you're thinking?