How to control/see permisions listed on the app store?

[HooD42]

Hello All,

I have just purchased the Fairphone 6 with /e/OS and am currently manually migrating my old phone, switching to better apps where I can. I have tried Newpipes, and while it is excellent, I would still like the option to have the YouTube app on my phone, and also YouTube music.

I have some questions regarding the ramifications of installing YouTube on my Phone and signing in with my google account, as well as some general questions about how privacy and permissions work.

The general vibe I’m going for is: if Youtube wants to track what I do in youtube while using the Youtube app, fine, that’s the price of using their service. But I want google contained to the app, it cant see the rest of my phone, and it has nearly no permissions.

1. On the app store, I see a long list of specific permissions the app has, but I see no way to specifically control those permissions. Does /e/OS block any of these automatically? Is there a way to finely control these? If I install an app and give it no permissions, are any of these other permissions overwritten by the app? I cannot see what fine permissions the device is using on /e/OS? If I install an app that has this long list of permissions, by installing it am automatically giving control over to that app regardless of any settings I can play with in /e/OS?
2. If YouTube is installed on my Phone, and I sign in with my google account, what can google see about the rest of my device outside of the app? What identifiers about me or my device can be leaked that it could see coming from other apps I’m using that interact with google else where on the internet? For example, can YouTube see my device Id, and then my browser visits a google site but not signed in, can google can then see my device ID thru my browser and link my two sessions? I could split tunnel my VPN and have Youtube separated so its coming from a different IP address for example, would this be helpful or if its coming from the same device is this pointless?

[tcecyk]

1. there are different tiers to permission that Android auto-grants (including the “INTERNET” permission itself) and what the users is prompted for (“runtime, dangerous permissions”). You could read this thread that isn’t far off to your own questions: How to manage app permissions in /e/OS - /e/OS behaves the same way as standard Android on this.
   Of that “long list” you cite, most are “normal permissions” and auto-granted on install time.
   /e/OS has no menu to have fine-grained control on those (it will list them through Settings → App → x → upper right "All Permissions), but can revoke “dangerous” permissions when stepping a few levels deep into menus (or search settings for “Permissions Manager”).
   Probably could be better. That linked App “Permissions Summary” brings things up a few levels even though it doesn’t add any new functionality. I wouldn’t get too lost in long permissions list, what matters beyond standard Android behaviour was implemented by GrapheneOS: the network permission patch, contact scopes. Those are good ideas.
2. as for implications on using microG without or with a real Google Account (that is added through Youtube) check Anonymous calls to Google servers - to answer your question directly: no, there’s no data channel identifier between Browser and microG, but as you say, it will happen on the same IP Address anyway. You can read the privacy texts of the services how they aggregate for profiling. Pointless? depends what’s the goal. If you like youtube for some specific content and they offer funding options outside youtube, more effective and long term than attacking the advertising scheme.