Privacy impact of Google Apps from Aurora (anonymous login)

[egx470]

@river

Not that I know. It requires a change in the Android source code. The /e/ team might be able to create some circumvention mecanism where if you deny it, it responds with an empty response, but this is a huge effort that will take a long time to develop.

Disturbing… So no matter if I use a browser or applications all I can do is minimize my unique fingerprint. Pretty alarming. I hope more people wake up.

[loachimsorionirw]

@river

Yes, on a web page it won’t have access to (1), (3), (4), (5) and will have limited access to (2) as it will only show your phone name, but the default browser on /e/ also hides the device, it only shows “Unspecified device”. It also doesn’t show the exact Chromium version nor the correct Android version, so all devices using /e/ have the same user agent to blend more.

So last night I installed WebApps which seems to be sand boxing website each in their ownncontainets while providing a home shortcut. It seems to include tracker blockers and spoofing browser type. Though I’m not sure of what it does in action because it is not verbose about it like other browsers like Brave or DuckDuckGo or like Tracker Control.

[JanH]

1. If you do really care about privacy be careful with PlayStore Ad-,Crap-,Spy-,Malware in /e/ served to you by Aurora. (Many serious Apps include unwillingly Spyware because they have been developed on trojanized developer tools. The providers of those tools make their living by selling the profiles of the users of their costumers, who use their tools…)

2. If you have to use - or think you need - some of those Apps (many of them filled with trackers, and other spyware) make sure your rooted phone runs a well configured AFWall+. Or if you are more comfortable running an unrooted /e/ device install and configure carefully Blokada (Which simulates a VPN and thus spoils real VPN services… but is better than nothing). Sooner or later you will learn that you have to fight for your privacy on package level.
   (After a month or so do a detailed logging of the data streams these apps send and receive - wireshark is your essential friend and guide to privacy!)

3. If you have learned that - have a look on the Xposed framework and things like XPrivacyLua. This opens the Android access for you - and if you have no clue others - to a new level.
   Keep logging and analyzing. Try to attack the ssl encryption of your apps by setting up prepared APs and analyze the packages.

4. If you really need good privacy dump your iPhone, /e/ Android hardware and go for a Linux Phone (iptables, kill switches, and almost no apps…). Make sure it is open hardware and regularly compare fresh X-rays of your phone with reference X-rays the vendor provides. (Hello Andy!)
   “Just because your paranoid doesn’t mean that they are not after you.”

Beeing paranoid on the Wiretap device you call “your” phone is usually justified. /e/ makes bad things less bad - but sadly is only a building block on your way to a less monitored world.

[egx470]

@river

Now for websites, look at the link you just sent from deviceinfo, there’s a lot of information there, each of those is one thing to build a unique fingerprint.

Some additional INFORMATION regarding canvas finger printing done through websites directly using HTML5 /JavaScript. Worth a read especially to understand another dimension regarding utilizing only websites via mobile browsers.

[kontakt]

You can also install Microsoft Translator

to share data with more companies?