deGoogling – Scope and Definition within the context of /e/OS

[eDevelopersBlog]

Purpose: This article proposes to set the scope of the term ‘deGoogling’ as defined by /e/OS.
Ever since the first /e/OS ROM’s rolled out, the term ‘unGoogling’ and then ‘deGoogling’ has gained currency. The term is often loosely defined as a complete removal of all Google related code from the Android Smartphone operating system code base, leading to a dogmatic definition. This document seeks to correct some of these incorrect assumptions behind such ideas and instead attempts to focus on the expected benefits of deGoogling.
Here we share some points to clarify each question. There could be more points.

The Reasons Behind Google’s Use of Personal Data:

• To improve user experience
• Help local business
• Connect business and the customer
• Integrate businesses across the globe

What information about the user is usually leaked from a non deGoogled smartphone and also across various devices such as tablets, computers and smartwatches:

• Location in real time and location history
• Search History
• Browsing history
• Email contents
• Application usage: which application, usage monitoring
• Spending ability
• Address books
• Digital footprint
• Bank information

Why is it dangerous for the user to share this information:

• Loss of privacy
• Sensitive personal information getting into the hands of unscrupulous elements
• Breach of trust. Data pilfering without user approval
• Identity theft

What deGoogling does to the user:

• Returns control of data to the user
• User is aware of what information is being leaked
• Any information shared is with users approval
• Transparency in user data usage

What deGoogling will not do:

• Protect users from Government security agencies when someone is targeted
• Protect users from big Criminal organizations when someone is targeted

How /e/OS deGoogles Android:

• Clean up of the source code by removing most Google server calls
• Connectivity checks traditionally done against Google servers, replaced with our servers
• Replaced Google NTP servers for network time protocol
• Removed default Google DNS and offers more choices for DNS settings
• Replaced all default Google Apps by privacy-safe and feature-equivalent apps
• Adds an anonymity layer to Google services that are difficult to live without, such as push notifications and access to Play Store applications

Additional benefits for a Smartphone user on /e/OS:

• App Lounge offers the full catalog of Play Store applications, open source applications at F-droid and Progressive Web Apps
• Advanced Privacy lets users know about the number of trackers triggered by mobile applications, and cut them. It also adds IP-masking and Geo location-faking features out of the box
• Offers a privacy-safe search engine

Conclusion: deGoogling is aboout making users’ digital life safer. /e/OS with its deGoogled codebase, default applications and unique features, protects users’ smartphones from permanent data collection and surveillance, while ensuring an extremely high level of usability.

Regain your privacy! Adopt /e/OS the unGoogled mobile OS and online services

[petefoth]

@eDevelopersBlog

What information about the user is usually leaked from a non deGoogled smartphone and also across various devices such as tablets, computers and smartwatches:

• Location in real time and location history
• Search History
• Browsing history
• Email contents
• Application usage: which application, usage monitoring
• Spending ability
• Address books
• Digital footprint
• Bank information

It is worth pointing out that users can disable the collection of this data in the Google account settings

[Kea]

Google has more goals than here modestly mentioned.
What about: trying to achieve digital dominance,
and the other aim: bringing mankind to the point of singularity?
Aren’t we supposed to be in service of these aims of Google by using its products?

[Taurus]

@petefoth

users can disable the collection of this data in the Google account settings

This presumes that the user even has a Gulag account. I have never created such an account myself.

Yet, not having an account with them doesn’t stop them from collecting data on the user.

[petefoth]

@Taurus

Yet, not having an account with them doesn’t stop them from collecting data on the user.

Really? Do you have any more information about what identifiable data Google collect and keep any about phone users without a Google account?

Or about how they collect it?

Or about how they use it? Anonymous data isn’t a lot of use when it comes to selling targeted advertising

[Taurus]

@petefoth

Do you have any more information about what identifiable data Google collect and keep any about phone users without a Google account?

I don’t have actual personal evidence, no, but I think it’s pretty much a given that they collect anything and everything they can. Their privacy violations have been all over the news for years. And anyway there are many reasons not to feed their machine.

@petefoth

Or about how they collect it?

No doubt they collect Android data through all the server calls described in the OP, unless one takes steps to prevent it.

@petefoth

Anonymous data isn’t a lot of use when it comes to selling targeted advertising

I disagree. Even as an anonymous user, you can be targeted through amassed collected data; it’s not necessary to know who you are. And data can be deanonymized when compiled and collated with other sources of information, if a company wants to go to the trouble.

For me, whether it’s about “do they?” or “can they?” doesn’t change my privacy posture.

[petefoth]

To me your whole post could be summarised as : everyone knows Google is evil, and therefore they defiinitely are doing everything that anyone on the web has ever accused them of doing.

@Taurus

I don’t have actual personal evidence, no, but I think it’s pretty much a given that they collect anything and everything they can.

So, no evidence then: 'it’s pretty much a given` translates to me as ‘I believe it, therefore it is true’.

@Taurus

Their privacy violations have been all over the news for years.

As that link states,when writing about combining information about what ads you click on with ‘what the company learns from the use of other Google services.’

it remains possible to opt-out by going to the “Activity controls” in the “My Account” page of a Google account.

If you do that, then the other stuff - .eg. " build a complete portrait of a user by name, based on everything they write in email, every website they visit and the searches they conduct." doesn’t happen.

@Taurus

No doubt they collect Android data through all the server calls described in the OP,

No doubt? No evidence either? Sure they may get the IMEI of my device in the call to the SUPL server,or my ip address in other calls tp their servers, but I am not aware of any evidence that they actually do keep it or store it in any way that can be identified with me.

@Taurus

you can be targeted through amassed collected data;

That DuckDukkGo marketing page is full of unsubstantiated claims of what Google do, and what they track:

And if you use Android (yeah, Google owns that too), then Google is also usually tracking:

• Every place you’ve been via Google Location Services.
• How often you use your apps, when you use them, where you use them, and who you use them to interact with. (This is just excessive by any measure.)
• All of your text messages, which unlike on iOS, are not encrypted by default.
• Your photos (even in some cases the ones you’ve deleted).

All of that - as far as I am aware - only applies if I am logged in to Google account and I have not opted out of data collection in my user account. And even If I am logged in, are they really tracking all of my text messages? Please do link to some evidence of that, and / or an explanation of how they do it, and what use they make of that information.

@Taurus

And data can be deanonymized when compiled and collated with other sources of information, if a company wants to go to the trouble

Sure, and I really don’t believe that Google do go to the trouble, when they can make billions from using the non-anonymised data that users happily give them. Not to mention the kicking they would get if it were ever discovered that they had been using data in that when way when users have opted out. But again, if you have evidence that they do, then please pass it on - I would be very interested to read it.

@Taurus

whether it’s about “do they?” or “can they?” doesn’t change my privacy posture.

Well it’s key to mine. What services I choose to use, and what data I choose to share while using them, will very much depend on what I believe the entity with which I am sharing it is going to do with it.

I get that you don’t like Google. they are a big corporation and, like most big corporations will do whatever they think they can get away with to increase their profits. But - in my opinion - they are no worse than many other large corporations. In many ways they are better: how many other big corporations make and maintain an open source mobile phone OS, and make it available for anyone to use free of charge?

That’s why I think it is important not to go down the ‘Google is evil, everything they do is bad and must be avoided’ route. And why I will argue (for a while at least - see XKCD ) with statements like yours when I believe - on the basis of the evidence that I am aware of - that they are wrong or misleading.

Have a good evening!

[us3r1d]

@eDevelopersBlog

• Connectivity checks traditionally done against Google servers, replaced with our servers
• Replaced Google NTP servers for network time protocol

Can we get those exposed as user-configurable setting?

A search of Settings returns no results for ‘ntp’, and I’m not sure what to look for to see if I can change the connectivity check.

I moved to /e/os because of the self-hosted cloud backend, and being able to control all the services my phone uses matters to me.

[voyager529]

It is worth pointing out that users can disable the collection of this data in the Google account settings

See, this is where the ‘trust’ element is so crucial. does Google respect when users opt-out of data collection? Or is the logic closer to “IF opt_out=‘true’ THEN data_visible=‘false’”? It’s trivial to collect the data and then hide it, but you’d have to be a busybody who knows their way around Wireshark to prove that the data is being collected.

Now, you may be correct in that Google could be respectful of end users’ wishes…but if you want some light reading to keep in the bathroom, print out copies of the ToS and Privacy Policies shown on Android phones during startup and read through them. Users pretty much have to forego most forms of recourse in the event Google uses data in ways they don’t want. “Trust us, but if we violate that trust, you agree that nothing will happen to us, and we’re not responsible for helping you” isn’t a fantastic vote of confidence.

Now, I personally have a bit of a problem, because I’m not technical enough to really be able to do a full code audit of the eCloud software…but the fact /e/OS lets me host it myself and has the source available means I have greater leverage than I do with Google.

Really? Do you have any more information about what identifiable data Google collect and keep any about phone users without a Google account?

Here’s some light reading on that topic:
https://arstechnica.com/gadgets/2021/03/android-sends-20x-more-data-to-google-than-ios-sends-to-apple-study-says/
Ignore the Ars hot take on it; read the report that’s linked on that page…it’s pretty horrifying in its own right, but what’s particularly hysterical / sad is that the Google spokesperson’s issue with the report essentially amounted to “The report was flawed because the methodology ignored how much UDP traffic Apple does”. This may technically be the case, but even if the comparative difference was off by “an order of magnitude” as claimed, it’s still twice as much as the Apple phone…but the real funny/depressing part is that the counterargument was “Apple isn’t that much better than us”, rather than “the research team was inaccurate in its assessment of the data the Google phone collected”. They flew right past that part, leading one to believe that the Google numbers were probably pretty accurate, meaning that there’s WAY more than DNS traffic going to Google on a stock Android phone with all the opt-outs set to ‘nope’.

But let’s even assume that concerns about Google are completely unfounded, and that the folks in charge really do want to help humanity, and that they would stand up for users’ rights regardless of who came for them or how much it cost, and that none of the data would ever be misused or mishandled. ‘Regular’ Android insists on nagging me INCESSANTLY. There is a massive list of Google Apps that I simply don’t want installed, but are installed anyway…and a whole OTHER list of apps that the phone just-installs the first time there’s a data connection…and a whole lot of notifications and ‘helpers’ and just other obnoxiousness that tries to be “too helpful”. A bunch of completely optional apps are ‘system’ and thus can only be disabled rather than uninstalled, and some won’t even give me that.

If there was a version of Android that said “here’s a phone app, a text app, a web browser, and the Play Store, log in just to the Play Store so we can handle purchases”, I might have used it instead of /e/OS. Unfortunately, Google thinks I want to be part of their ecosystem, and instead of letting me dip my toe in the water and adding things later, it’s an all-or-nothing thing, which /e/OS is way, way better at respecting.

[petefoth]

Thank you. I will give that lot a read

[Aizu]

“When someone is targeted”: I would say to secure populations against political and economical mass spying (including US citizens). More than a personal.

And If I understand correctly Gael’s last podcast, he says that it is difficult for a company to source hardware to build phones without Google at the end. Hardware independance is important.

[Vaughan]

@eDevelopersBlog

The Reasons Behind Google’s Use of Personal Data:

• To improve user experience
• Help local business
• Connect business and the customer
• Integrate businesses across the globe

• Sell users to advertisers!

[Aizu]

Advertisers at best.

[petefoth]

@petefoth

Thank you. I will give that lot a read

That was an interesting read - thanks again for posting the link.

My main takeaways from that study

• Don’t login to a Google account. Then the amount of data sent to Google is significantly reduced
• A suggestion that it may be possible to tie anonymous data sent to Google to a specific user if the user logs in, bit no evidence - indeed no claim - that Google does do this
• No suggestion, claim, or evidence that Google stores any of the data - anonymous or tied to a logged in user - if the user has turned off activity tracking in their Google account
• Using a privacy-respecting ROM that includes microG (such as /e/OS, LineageOS for Microg, IodéOS) will go a very long way towards mitigating the privacy concerns raised in the study