Google’s latest flagship smartphone raises concerns about user privacy and security. It frequently transmits private user data to the tech giant before any app is installed. Moreover, the Cybernews research team has discovered that it potentially has remote management capabilities without user awareness or approval.
Cybernews researchers analyzed the new Pixel 9 Pro XL smartphone’s web traffic, focusing on what a new smartphone sends to Google.
“Every 15 minutes, Google Pixel 9 Pro XL sends a data packet to Google. The device shares location, email address, phone number, network status, and other telemetry. Even more concerning, the phone periodically attempts to download and run new code, potentially opening up security risks,” said Aras Nazarovas, a security researcher at Cybernews…
… “The amount of data transmitted and the potential for remote management casts doubt on who truly owns the device. Users may have paid for it, but the deep integration of surveillance systems in the ecosystem may leave users vulnerable to privacy violations,” Nazarovas said…
I like calyx, might try graphene some day. But I absolutely won’t run Google’s play services ala graphene. It’s sandboxed, supposedly, but why run it at all?
Calyx uses microG, a much smaller, fully open source emulator of Google’s services.
Because it is unfortunately required by some apps. microG is not a viable alternative, as it requires root access on the device, which drastically reduces the security. It also has worse compatibility than Sandboxed Play services, and doesn’t offer much of a benefit. It still downloads and executes proprietary Google blobs in the background in order to function. Apps that require Google services also include a proprietary Google library, making microG essentially useless. It’s an open source layer that sits between a proprietary library and a proprietary network service, using proprietary binaries and requiring root access. You gain absolutely nothing from using it, and significantly increases the attack surface of your device.
This is simply false, as I explained, only a tiny bit of what microG requires to function is open source
You’re far better off using Sandboxed Play services on GrapheneOS
Dude I’m looking at the source code, there’s only a binary downloaded for enabling Safety net. Why are you making false statements?
The legacy SafetyNet check bypass may not be around much longer especially because hardware based attestation will be gradually replacing it.
https://grapheneos.social/@GrapheneOS/111504057847795464
Below is a guide for app developers who want to support third party OSs in a way that does not rely on Google. Most apps work on GrapheneOS just fine already but there are some banking apps and NFC payment systems that do not.
https://grapheneos.org/articles/attestation-compatibility-guide
Sigh. It just doesn’t stop. But it’s ok, Pokemon go required attestation and so I simply stopped playing. Thanks for your links.
I’ve wanted to run graphene but absolutely do not want google code running on my system if I can avoid it. If only there were some way to run microG on graphene.