9.4 KiB
| title | icon |
|---|---|
| Android Overview | material/cellphone-check |
Android is a secure operating system that has strong app sandboxing, Verified Boot, and a robust permission control system.
The main privacy concern with most Android devices is that they usually include Google Play Services. This component is proprietary, closed source, has a privileged role on your phone, and may collect private user information. It is neither a part of the Android Open Source Project (AOSP) nor is it included with the below derivatives.
Avoid Root
Rooting Android phones can decrease security significantly as it weakens the complete Android security model. This can decrease privacy should there be an exploit that is assisted by the decreased security. Common rooting methods involve directly tampering with the boot partition, making it impossible to perform successful Verified Boot. Apps that require root will also modify the system partition meaning that Verified Boot would have to remain disabled. Having root exposed directly in the user interface also increases the attack surface of your device and may assist in privilege escalation vulnerabilities and SELinux policy bypasses.
Adblockers (AdAway) which modify the hosts file and firewalls (AFWall+) which require root access persistently are dangerous and should not be used. They are also not the correct way to solve their intended purposes. For Adblocking we suggest encrypted DNS or VPN server blocking solutions instead. RethinkDNS, TrackerControl and AdAway in non-root mode will take up the VPN slot (by using a local loopback VPN) preventing you from using privacy enhancing services such as Orbot or a real VPN server.
AFWall+ works based on the packet filtering approach and may be bypassable in some situations.
We do not believe that the security sacrifices made by rooting a phone are worth the questionable privacy benefits of those apps.
Firmware Updates
Firmware updates are critical for maintaining security and without them your device cannot be secure. Original equipment manufacturers (OEMs)—in other words, phone manufacturers—have support agreements with their partners to provide the closed source components for a limited support period. These are detailed in the monthly Android Security Bulletins.
As the components of the phone such as the processor and radio technologies rely on closed source components, the updates must be provided by the respective manufacturers. Therefore it is important that you purchase a device within an active support cycle. Qualcomm and Samsung support their devices for 4 years while cheaper products often have shorter support. With the introduction of the Pixel 6, Google now makes their own system on chip (SoC) and they will provide 5 years of support.
Devices that have reached their end-of-life (EoL) and are no longer supported by the SoC manufacturer, cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.
Android Versions
It's important to not use an end-of-life version of Android. Newer versions of Android not only receive security updates for the operating system but also important privacy enhancing updates too. For example, prior to Android 10, any user apps with the READ_PHONE_STATE permission could access sensitive and unique serial numbers of your phone such as IMEI, MEID, your SIM card's IMSI, whereas now they must be system apps to do so. System apps are only provided by the OEM or Android distribution.
Android Permissions
Permissions on Android grant users control over what apps are allowed to access. Google regularly makes improvements on the permission system in each successive version. All user installed apps are strictly sandboxed, therefore there is no need to install any antivirus apps. The savings you make from not purchasing or subscribing to security apps is better spent on paying for a supported device in the future.
Should you want to run an app that you're unsure about, consider using a user or work profile.
Advanced Protection Program
If you have a Google account we suggest enrolling in the Advanced Protection Program. It is available at no cost to anyone with two or more hardware security keys with FIDO support.
The Advanced Protection Program provides enhanced threat monitoring and enables:
- Stricter two factor authentication; e.g. that FIDO must be used and disallows the use of SMS OTPs, TOTP, and OAuth
- Only Google and verified third party apps can access account data
- Scanning of incoming emails on Gmail accounts for phishing attempts
- Stricter safe browser scanning with Google Chrome
- Stricter recovery process for accounts with lost credentials
For users that are using the privileged Google Play Services (common on stock operating systems), the Advanced Protection Program also comes with additional benefits such as:
- Not allowing app installation outside of the Google Play Store, the OS vendor's app store, or via
adb - Mandatory automatic device scanning with Play Protect
- Warning the user about unverified applications
SafetyNet and Play Integrity API
SafetyNet and the Play Integrity APIs are generally used for banking apps. Many banking apps will work fine in GrapheneOS with sandboxed Play services, however some non-financal apps have their own crude anti-tampering mechanisms which might fail. GrapheneOS passes the basicIntegrity check, but not the certification check ctsProfileMatch. Devices with Android 8 or later have hardware attestation support which cannot be bypassed without leaked keys or serious vulnerabilities.
As for Google Wallet, we don't recommend this due to their privacy policy, which states you must opt-out if you don't want your credit rating and personal information shared with affiliate marketing services.
Advertising ID
All devices with Google Play Services installed automatically generate an advertising ID used for targeted advertising. Disable this feature to limit the data collected about you.
On Android distributions with Sandboxed Google Play, go to ⚙️ Settings → Apps → Sandboxed Google Play → Google Settings → Ads and select Delete advertising ID.
On Android distributions with privileged Google Play Services (such as stock OSes), the setting may be in one of several locations. Check
- ⚙️ Settings → Google → Ads
- ⚙️ Settings → Privacy → Ads
Depending on your system, you will either be given the option to delete your advertising ID or to "Opt out of interest-based ads". You should delete the advertising ID if you are given the option to, and if you are not, we recommend that you opt out of interested-based ads and then reset your advertising ID.