Comment by fc417fc802
6 hours ago
Unless you're running Graphene or a similar security minded distro the sandboxing isn't very good. Okay let's be honest it's fairly abysmal at preventing fingerprinting. It could almost be accused of not even bothering to try.
But one example: https://news.ycombinator.com/item?id=43518866
> Unless you're running Graphene or a similar security minded distro the sandboxing isn't very good. Okay let's be honest it's fairly abysmal at preventing fingerprinting.
Hmm... the sandboxing is a security feature, it's not there to prevent tracking (not sure what "fingerprinting" includes here). The sandboxing of Android is actually pretty good (a lot better than, say, desktop OSes).
There is pretty much nothing you can do against an app requesting e.g. your location data and sending it to their servers. Fundamentally, the whole goal of apps is that they can technically do that. Then you have to choose apps you trust, and it's easier to trust open source apps.
What GrapheneOS brings in terms of sandboxing is that the Play Services run sandboxed like normal apps. Whereas on Android, the Play Services run with system permissions.
Even with graphene I don't believe it mitigates much as far as apps collecting data. The idea for more privacy is you run open source apps instead that just don't collect data.
AFAIK Graphene is oriented towards strong device security with privacy as more of a side effect.
One thing with the sandboxed Play Services being that Google has fewer permissions on the device, so presumably they can collect less data.
Which I believe is GrapheneOS' argument when people praise microG: microG being open source does not fundamentally add privacy: apps using microG will phone to Google's servers (that's the whole point of microG). What microG solves is that it removes the Play Services that are root on your device, and it turns out that sandboxed Play Services do that as well.
> The idea for more privacy is you run open source apps instead that just don't collect data.
Yep exactly, I just wanted to add about the sandboxed Play Services, because it was not obvious to me at first :)
The mobile operating system developed by the enormous ad tech company doesn't try to prevent fingerprinting?! :O
>Unless you're running Graphene or a similar security minded distro the sandboxing isn't very good
Grapheneos doesn't prevent the installed apps fingerprinting you linked either.
Color me surprised. But if you run the app using the sandboxing feature that it provides surely it will only be able to see other apps installed within that same sandbox?
What is "the sandboxing feature" you're talking about? The standard app sandbox built into android allows apps to discover each other for various purposes, and grapheneos doesn't do anything to attempt to plug this.
3 replies →