GrapheneOS Sensors and Network permission toggle

[@tonytoenight6759]

Hey Big Burrito!😁 Wanted to stop by and give you a big thanks for advice for Graphene OS! I have an OEM Locked pixel 6, but soon I'll get an unlocked Pixel 6a. You're on top of it and I'm glad you share this info! Thanks

[@sideofburritos]

Hi Tony! You're very welcome! The Pixel 6a is a solid device, I think that's a great choice!

[@tato1271]

Verizon locked phones are a pain.

[@Dar123abc]

Always great information.

[@sideofburritos]

Glad it was helpful!

[@timogiese316]

Hi Josh - I stumbled across your channel searching for Graphene OS hands on Video. Great videos! +1 subscriber 🙂

[@sideofburritos]

Hi Timo, thanks for the compliment! Glad to hear they've been useful!

[@TheBoomshine]

An actual sign off this time :O Great stuff! Thank you!

[@sideofburritos]

Haha, thought I would test it out again. Thank you!

[@jgn2112]

I used to use NetGuard and considered it invaluable, must-have. But this built-in permissions toggle is perfect -- even better. I now regulate all my apps' connectivity and permissions with this feature. I only wish there was a "Revoke all permissions" toggle, as some apps have 4 or 5 permissions I want to disable and I have to do them one at a time.

[@thrik]

"Revoke all permissions" would be great.

[@sideofburritos]

I could see a firewall serving a purpose if you had specific URL's you wanted to block, but if it's an "all or nothing" sort of block the toggle is the way to go. For sure, a "Revoke all" option would be a great addition. Maybe someone in the comment section has the skills to code that feature for the project.

[@uriknight5530]

i became a big fan of yor channel, I used your graphene os installation tutorial and worked great. Would be great to see a video of the new android 13 that graphene os are working to release at the end of this month. Keep up your good work. Greetings!

[@sideofburritos]

Thank you! Glad to hear it worked well! For sure, once they release the stable version I'll be upgrading and testing.

[@boija5746]

Hey, can you please make a video about weather it is good to put a sim card in your Graphene OS pixel and use it as a cell phone or not? And if it is needed what should one do and what practices should i use to make it as privacy friendly as possible

[@sideofburritos]

Hi there, hmm I might make one on that topic. Personally I put a SIM card in since I use it as my personal phone device. It's unfortunate that you're at the mercy of the carrier once you use a SIM card, but I'll think about doing a video on the topic if there's anything useful I come across.

[@teacon7]

This is really neat technology. Question: What apps DO you recommend, and why? I'm thinking in the Chat/Maps/Mail/Browser/Podcast/Keyboard categories.

[@teacon7]

and weather, I guess. but we could always just... look outside.

[@sideofburritos]

I don't know if you've seen this video yet, but this has all the apps I use - kzbin.info/www/bejne/fHaxkIGsgNiJeMU For the ones you asked about specifically: Chat - Signal Maps - Magic Earth Browser - Vanadium Podcast - AntennaPod Keyboard - OpenBoard (still testing others) Weather - I used to use Geometric Weather, but now I just use my browser to look if up if i need.

[@branislavavramovic2601]

Oh, man, I really need to get my hands on one of those Pixel devices. They are quite pricy in the country where I live. Darn Google. I'm currently using Sailfish OS on Xperia XA2. Although I like the OS very much, the device is really old, and I'm ready for a change.

[@sideofburritos]

On the plus side, the newer models have 5 years of security updates vs 3 years for the old ones which helps extend the useful life of the device considerably.

[@garyschwartz3665]

What video did you go over how to use Read You to install New Pipe? Also, how is burner working on your phone on the separate profile? Any bugs?

[@sideofburritos]

I cover ReadYou in this video - kzbin.info/www/bejne/fHfdZmqwg7eSg5I The app worked well, but the VOIP numbers they had were getting blocked by the scammers I was trying to call (which is common). Overall though if you need a "burner" number, I liked the app/service.

[@lars5288]

You blurred the picture of your location, but you forgot to blur longitude and latitude. Though you mentioned to use a vpn, however, knowing which vpn is used can destroy privacy too.

[@sideofburritos]

That's a valid point about the latitude and longitude, I'm truthfully not worried about it though in this scenario. I've shared recordings of my phone screen and all the apps I use + answered about my VPN provider in the past. I agree for most people it's a good idea to not share that info on the internet, but in my case I intentionally share different things to hopefully benefit others. Would I share my home IP? Absolutely not. Same reason I spend a lot of time blurring out IMEI and serials in my install videos.

[@homie4235]

Grapheneos is so great the only thing holding me back is not being able to use android auto. I have thought about getting a dedicated GPS for navigation but still not sure.

[@sideofburritos]

Yea, that is definitely a downside to it. After a few months I stopped missing android auto. I have a suction cup mount for my windshield for my phone, and it's worked great for navigation.

[@Dan-kb2oz]

So you can't block individual sensors from apps and leave others working, like revoking access to the microphone but allowing accelerometer access?

[@sideofburritos]

This explains it in full detail - grapheneos.org/features#sensors-permission-toggle but essentially any sensors not covered by the already exposed sensor permission toggles (microphone, location, camera, etc.) are controlled by the "sensors" toggle. For the example you provided, microphone is an exposed sensor that you can manually control. The accelerometer sensor is not. So you could revoke the microphone permission from an app, but allow "sensors" and that app would not have access to the microphone, but it would have access to the accelerometer.

[@GKW25308]

I currently use LineageOS which after enabling developer options you can add a tile to the drop down menu to turn on/off all sensors. I'd like to try GrapheneOS, does it have something similar or do you have to turn permissions on/off for every app individually?

[@batboy4210]

Thank you for all your GrapheneOS videos! Question, why do you use fingerprint lock on your phone instead of a password or a pin? Is it convenience? Have heard that pins/passwords are more secure than fingerprint lock.

[@sideofburritos]

You're welcome! Yea, convenience is the main part and the second is that someone can't "shoulder surf" a fingerprint. If I ever need to disable the fingerprint (traffic stop or something else), you can hold the power button down and select "Lockdown". I think the other argument for pin/password is that a court can't compel you to divulge your pin/password, but they can get you to use your fingerprint (not completely sure about this though).

[@vulcan6940]

Another awesome video! Question. I added another user so I could get notifications from a security system app for my office system. I installed Google Play Services as the app needs it for notifications (unfortunately). What now would be the implication if I disallow Network Permissions for Google Play Services?

[@sideofburritos]

I don't know the exact specifics of what it might break, but the GrapheneOS team suggest leaving the network permission as is. I have the same setup as you with a separate user profile for Google services which is a great way to keep things separate and allow Google Play Services networking on the separate profile.

[@vulcan6940]

@@sideofburritos Thank you!

[@joannaconnelly4701]

I asked some questions in the GraphneOS Matrix Channel. If I had a second user on my phone, and if this space had Google Play Services installed, would there would be back-and-forth communication for apps with the first space and vice versa. At first, I got multiple responses saying that yes, in fact, this happened. I then kept asking and got this, whatever it means: ( If app A in the first profile has a server that can be accessed via localhost, then app B in the second profile can access that server, and vice versa (if they both have network permission). Does this mean that apps in the second user account not work profile can read the apps and other settings on the first user account that does not have gplay installed? I am confused. Can you help clear this up please.

[@cvl14]

I'm not able to answer your question, but I understand the response that you've been given. Consider the two profiles as two computers on the same network. Supposing both apps have been granted network permissions, if app A on the first profile has a server (i.e. listens for incoming connections on some port), app B can communicate with app A by interacting with the server of app B (i.e. starting connections towards port opened by app A). This is because from a user point of view the two profiles act as different computers, but from a network point of view they are the same computer: both profiles are on the same localhost and share the same ports. You can think of the two profiles as two *NIX users whose home directory are readable only by the owner. I cannot answer your question because I don't know which mechanisms are usually employed for cross-app communications, but in the scenario app A and app B have both network permissions they can communicate even if they are installed on different profiles. If you're worried that gplay or other apps in the second profile may read data from the first profile, install in the first profiles only trusted apps that don't do spooky things (i.e. do not install an app A that has a server). For example, if you install an FPT server app in your first profile without configuring authenticated access, theorically gplay/any other app can connect to it and read your files. Are these apps going to do it? probably not, but it would be technically possible. Hope it helps.

[@eliastv5498]

So what about an old now unsupported phone like the Pixel 3. Is it worthy of putting GrapheneOS on it or does the fact it is no longer supported by the latest android update render it useless? What are the cons of taking the old phone approach?

[@sideofburritos]

The main reason GrapheneOS no longer supporter end of life devices is that they stop receiving full security updates. So for me, I would not trust using an EOL device since they'll be lacking critical security patches.

[@eliastv5498]

@@sideofburritos How quickly does that occur and what kind of vulnerabilities exists in what timeframe after EOL? Does it render a device unsecure immediately?

[@tinoes.nijhuisnijhuis4474]

ip geolocation where can i download grapheneos which app 

[@Tschubritza]

3:30 "OpenBoard" is a one to one OS clone of the Google Keyboard...use this instead

[@sideofburritos]

Agreed, I've been testing it for a few weeks, and it's been great.

[@derfenstergucker8821]

„If you are criticized, you're doing it right. Because people attack anyone who has brains“ This ongoing attacks against GOS is ridiculous. I‘m using it for two years now and it works perfect in many ways.

[@sideofburritos]

I like that quote. It's an unfortunate it happens and leads to more confusion in the privacy/security community.

[@derfenstergucker8821]

@@sideofburritos Yes, that's exactly the point. But thanks to channels like yours people may understand and give it a try.

[@nickandrewmarc]

Hmm, I tried leaving a comment but somehow it wasn't posted

[@sideofburritos]

I do see this comment 🤓

[@nickandrewmarc]

@@sideofburritos Do you have keywords set up that are blocked? And no, I didn't use any profanities :)

[@sideofburritos]

Nope, I don't. That's odd that would happen.

[@markcuello5]

HELP

[@madinventor6327]

Fantastic video! Are you saying that GrapheneOS will eventually also disable (or allow to disable at once) all the system apps that don't explicitly need the Sensor permission? It's very tedious to go through that long list, esp. wondering if you're going to inadvertently break something. Other than GPS apps and some health/sports apps, I don't believe anything else requires it. Please correct me if I'm mistaken.

[@sideofburritos]

I believe in the future, they're planning for it. GrapheneOS is good about making sure a change like that won't break anything, as they don't want to suddenly impact a large amount of end users. As to what currently requires it, I don't know for sure. I think a review of each system service would be required to see if any call the sensor permission, and then see if it's actually needed by it. I've disabled it for quite a few and have come across any issues yet.