What will Google know about me with Android Auto

RRZishe

Hi!

First of all, a huge thanks to the graphene developers for working so hard to get Android Auto to work.

I use Google Play services for notifications so I have it installed without an account and I don't use it to get apps.

Now that graphene is releasing Android Auto support, I understand that it'll only be available for users that use Google Play services. Why is that? And what will Google know about me if I use the new Android Auto? Will they be able to see everything that goes from my phone to the car?

On a separate note, when I use Android Auto does the car send everything from my phone to their database (i.e. the databases of Nissan, Honda etc.)?

Thanks a million!

[deleted]

RRZishe Android auto will only have access to what it contains, like the Sandbox play service

[deleted]

RRZishe the most secure and private way to install app into grapheneos is via Sandbox play service

mmmm

[deleted] secure yes, I'm not sure it's particularly private though, even when you take special measures to create a throwaway account. I could be wrong.

RRZishe

mmmm I never signed in to Google at all

[deleted]

RRZishe The lead developer of grapheneos said so in an interview. Without a sim card and if you connect to a wifi other than your own, you're anonymous.
https://youtu.be/WkQ_OCzuLNg?feature=shared

[deleted]

I'm French and I don't speak English. So I use subtitles and a translator, so it's possible I didn't understand correctly.

RRZishe

[deleted] Thanks for the link to the interview!

But I don't see how that has to do with my question. Must be the language barrier.

Merci beaucoup!

[deleted]

RRZishe That's right. Sorry

GrapheneOS

[deleted] This isn't the lead developer of GrapheneOS and that's not something which was said there.

GrapheneOS

RRZishe Android Auto is a Google app which heavily depends on Google Play. Android Auto is normally integrated into the OS as a privileged app with extensive access through privileged permissions. The feature we've developed is an extension of our sandboxed Google Play compatibility layer to Android Auto.

You should read https://grapheneos.org/usage#sandboxed-google-play since you seem to be unaware of how that works.

Since Android Auto fundamentally requires special access, support for it can't be part of the baseline sandboxed Google Play compatibility layer which runs those as regular apps with no special access. Instead, there are 4 toggles for enabling different special access required for using different parts of it. We've used the compatibility layer to eliminate most of the requirements for special access and we've made special versions of the privileged permissions reducing the access they provide to a bare minimum. The toggles grant it only the bare minimum access needed for the functionality. The baseline of wired Android Auto barely requires any special access and is quite close to working with out. It only gets the ability to manage USB.

RRZishe

GrapheneOS Thank you so much for responding!

I wasn't aware that Android Auto had anything to do with the play store.

I guess the only thing I still don't understand (maybe it's a dumb question) is what does Google collect about me when I use Android Auto? Since they're sending all the info from the phone to the car do they also send it to their servers?

Also, do the car manufacturers have access to whatever is displayed on the car screen via Android Auto?

Thanks for all the AMAZING work you guys do! 🙏🙏🙏

nlroth

GrapheneOS
How do I become a beta tester for your upcoming Android Auto implementation?
I recently purchased a Carlinkit 4.0 (AA to Apple Carplay bridge) that works great with my Motorola Edge+ and 2019 Toyota Sienna and, as I currently have a Pixel 7 running G/OS, it would be great to have that working with AA as well.

Thanks for the excellent OS!

Larry

other8026

nlroth Last I heard, they're testing internally now. When they're ready for people to test, they'll push out a new release. As usual, the release will first be available in the alpha channel, then move to beta, then stable unless there are issues uncovered by alpha/beta testers.

New releases are announced here inAnnouncements. If a new release is pushed out, you can first check if it includes Android Auto then switch to alpha or beta then.

The setting to change which release channel your phone pays attention to is here: Settings > System > System update > Release channel

Gold95

RRZishe do the car manufacturers have access to whatever is displayed on the car screen via Android Auto?

Yes. In fact, it's perfectly legal for cars to harvest your texts and call logs.

RRZishe

Gold95 oh my God! But I don't think that article says if they used Android Auto or just connected via USB.

I wonder if Android Auto has a protection that prevents the car from seeing what is being displayed

Gold95

RRZishe what does Google collect about me when I use Android Auto?

I'm also curious what Google is getting their hands on when using Android Auto. I'd like the GrapheneOS documentation to add a worst case scenario to describe the security implications for every toggle they add in general.

Google Camera
- toggle: direct TPU and GXP access
- implication: ?
Google eSIM
- toggle: execute proprietary code with privileges
- implication: Google learns your esim identifiers and phone number.
Google Auto
- toggle: execute proprietary code with privileges
- implication: Google learns your location, destination and music playlist?

Android Auto must be running to detect a car. I wonder if Android Auto causes google to learn all your locations, not just when a car is connected. 🤔

Gold95

RRZishe I don't think that article says if they used Android Auto or just connected via USB.

This is true. However, that's what Android Auto can do, if for example the "phone control" and "audio routing control" toggles are enabled, I guess it (both Google and the car) can get contacts, phone numbers, messages, recordings such as voice commands, etc. I remember Mozilla wrote a blog post about cars being a privacy nightmare on wheels.

If you want to buy a modern car in the future, don't read Sam's blog Web Hackers vs. The Auto Industry. Let's hope in the future there will be GrapheneCarOS, so we don't have to worry. 😉

RRZishe

Gold95 what can they do with audio routing control? Sounds innocent enough to me