8 ms·

Technically, the Internet Connectivity Check on LineageOS also sends your position/IP to Google, and also avoids a VPN tunnel because it's lower down the stack.

Technically, the Internet Connectivity Check on LineageOS also sends your position/IP to Google, and also avoids a VPN tunnel because it's lower down the stack. I can recommend LineageOS, however be aware that lots of malware infected builds have made it to xda dev in the past, so you should build it yourself if possible (or use the official downloads). Regarding the Connectivity Check: You can add all google related domains to /system/etc/hosts if you have root/sudo access. Additionally I'd recommend everyone to use RethinkDNS as a DNS adblocker and app firewall - and AppWarden to patch out the Analytics parts of proprietary Apps.

hansel_der 5y ago
> Regarding the Connectivity Check the last (stock) android phone i touched had an option to change the url used for the check. i was pleasently surprised - comments here suggest this is not "normal"? > or use the official downloads ime the meaning of the word "official" has been severely diluted esp. in the android community
kekebo 5y ago
One used to be able to change the captive portal url using adb [0], although I'm not sure that's still the case in current android builds. [0] https://gist.github.com/tonyseek/bc5b72197ddb15418c61406061720186 https://gist.github.com/tonyseek/bc5b72197ddb15418c614060617...
- commoner 5y ago
  I can confirm this used to work, but I'm not sure if that's the case now. These were the instructions I used: https://android.stackexchange.com/a/186995 https://android.stackexchange.com/a/186995
johnbrodie 5y ago
I can't recall the exact settings to push via ADB, but the Internet Connectivity Check is "easy" to fix. Create a server that's always up that responds with a 301 (or whatever the check expects), and push the address to the phone. Done. It's a shame that Google's servers are the default, and I wish it were at least called out by Lineage. That said, I doubt they want to cover hosting costs of such a service (although I'd think they'd be fairly minimal).
- twobitshifter 5y ago
  This internet connection check actually caused problems for us when we started having users in China on android. Our code was checking for a connection before transmitting data and android thought the device was disconnected due to the great firewall. I think there’s just a hack around it for now that disabled the android connection check for those users.
- commoner 5y ago
  For anyone trying to implement this, the HTTP status code that Android looks for is 204. https://android.stackexchange.com/a/186995 https://android.stackexchange.com/a/186995
thrtewgg66 5y ago
you can disable captiveportal and block everything else with netguard (check Netguard thread on xda)
yjftsjthsd-h 5y ago
> however be aware that lots of malware infected builds have made it to xda dev in the past, Can you point me to some? How were they caught? I knew this was a possibility, but I hadn't seen it actually happen before.
- cookiengineer 5y ago
  Back in the days I was maintaining the driver support for Cyanogen for the MSM7227 based models and I found some builds on xda dev that came preinstalled with some RATs. I only found out by coincidence of another dev asking me to verify the build. The nature of how Android is built (with all its hundreds of repositories) isn't made for verifiable builds, so it's really hard to prove or audit. From what I've found usually the builds with custom UIs or skins on top are infected with stuff either the person packaging it doesn't know about (benefit of the doubt) or do, but it comes out a year later when someone skeptical checks for it. Verification is especially hard because everybody on xda dev is using some paid adfly links or some google storage or dropbox links that will change in intervals (depending on how much traffic they produce they'll get blocked quickly). So yeah, I think the need for a hash based end to end verification tool is kind of there. But honestly I have no idea how to build it because even the partition setup of old flash storage using devices is so messed up that there can be side effects when an apk is put in /emulated storage folders. I think the only future proof way to do this is going mainline like the postmarketOS devs try to do. But until we're there I'm probably dead of old age already. I don't believe in the Android ecosystem anymore, because this is a governance coordination problem that's not easily fixable. Hosting all outdated kernels alone with all the custom drivers is way too much traffic for any open source project to pay for.
commoner 5y ago
Some Android flavors, including /e/[1] and GrapheneOS,[2] don't use Google servers for the internet connectivity check by default. [1] https://gitlab.e.foundation/e/backlog/-/issues/268#note_18097 https://gitlab.e.foundation/e/backlog/-/issues/268#note_1809... [2] https://grapheneos.org/faq#default-connections https://grapheneos.org/faq#default-connections
- 1vuio0pswjnm7 5y ago
  Looking through the GrapheneOS source, the servers may not be Google servers but the system is still designed to phone home. As such, have they solved the problem or is this just another case of "Dont' trust them, trust us instead." Has anyone succeeded in running multiboot on "smartphone" hardware, i.e., where the user can boot into a choice of kernel/userland. One choice might be Android, another might be GrapheneOS/LineageOS, another might be an OS that does not rely on any third parties whatsoever (no conveniences, "app stores", "connectivity checks", etc.) and is fully controlled by the user. In other words, the third choice lets the pocket-sized computer be used more like a pre-smartphone era desktop/laptop OS. Basic functionality.
  - dyndos 5y ago
    Did you actually find any examples of GrapheneOS phoning home? GrapheneOS doesn't rely on any third-parties I'm aware of. The only service provided is over-the-air security updates. It doesn't even come with an app store (although you can install F-Droid). For that reason, GrapheneOS alone fits all three categories you mentioned: It is Android, it is GrapheneOS, and it is fully controllable / doesn't ship bloatware.
    - summm 5y ago
      It is not controllable at all: It still enforces any app author's will against the user's. Root is not offered, and the grapheneos maintainer seems to be personally offended by the thought that root could be helpful.
      - 5y ago
1vuio0pswjnm7 5y ago
From GrapheneOS FAQ: "Unlike AOSP or the stock OS on the supported devices, GrapheneOS stops making network time connections when using network time is disabled rather than just not setting the clock based on it." "... rather than just not setting the clock based on it." Wow, that is really sneaky and deceptive. The user thinks she has disabled the constant connections to the tech company time servers but in truth the connections persist. The time checks are equally as annoying as the connectivity checks.
paulcarroty 5y ago
I'd recommend libredns.gr, it's free and available for non-Android devices. > You can add all google related domains to /system/etc/hosts if you have root/sudo access. Root access is harder to get with each new Android release - Google don't like adblockers.

hansel_der 5y ago

> Regarding the Connectivity Check the last (stock) android phone i touched had an option to change the url used for the check. i was pleasently surprised - comments here suggest this is not "normal"? > or use the official downloads ime the meaning of the word "official" has been severely diluted esp. in the android community

kekebo 5y ago

One used to be able to change the captive portal url using adb [0], although I'm not sure that's still the case in current android builds. [0] https://gist.github.com/tonyseek/bc5b72197ddb15418c61406061720186 https://gist.github.com/tonyseek/bc5b72197ddb15418c614060617...

commoner 5y ago
I can confirm this used to work, but I'm not sure if that's the case now. These were the instructions I used: https://android.stackexchange.com/a/186995 https://android.stackexchange.com/a/186995

johnbrodie 5y ago

I can't recall the exact settings to push via ADB, but the Internet Connectivity Check is "easy" to fix. Create a server that's always up that responds with a 301 (or whatever the check expects), and push the address to the phone. Done. It's a shame that Google's servers are the default, and I wish it were at least called out by Lineage. That said, I doubt they want to cover hosting costs of such a service (although I'd think they'd be fairly minimal).

twobitshifter 5y ago
This internet connection check actually caused problems for us when we started having users in China on android. Our code was checking for a connection before transmitting data and android thought the device was disconnected due to the great firewall. I think there’s just a hack around it for now that disabled the android connection check for those users.
commoner 5y ago
For anyone trying to implement this, the HTTP status code that Android looks for is 204. https://android.stackexchange.com/a/186995 https://android.stackexchange.com/a/186995

thrtewgg66 5y ago

you can disable captiveportal and block everything else with netguard (check Netguard thread on xda)

yjftsjthsd-h 5y ago

> however be aware that lots of malware infected builds have made it to xda dev in the past, Can you point me to some? How were they caught? I knew this was a possibility, but I hadn't seen it actually happen before.

cookiengineer 5y ago
Back in the days I was maintaining the driver support for Cyanogen for the MSM7227 based models and I found some builds on xda dev that came preinstalled with some RATs. I only found out by coincidence of another dev asking me to verify the build. The nature of how Android is built (with all its hundreds of repositories) isn't made for verifiable builds, so it's really hard to prove or audit. From what I've found usually the builds with custom UIs or skins on top are infected with stuff either the person packaging it doesn't know about (benefit of the doubt) or do, but it comes out a year later when someone skeptical checks for it. Verification is especially hard because everybody on xda dev is using some paid adfly links or some google storage or dropbox links that will change in intervals (depending on how much traffic they produce they'll get blocked quickly). So yeah, I think the need for a hash based end to end verification tool is kind of there. But honestly I have no idea how to build it because even the partition setup of old flash storage using devices is so messed up that there can be side effects when an apk is put in /emulated storage folders. I think the only future proof way to do this is going mainline like the postmarketOS devs try to do. But until we're there I'm probably dead of old age already. I don't believe in the Android ecosystem anymore, because this is a governance coordination problem that's not easily fixable. Hosting all outdated kernels alone with all the custom drivers is way too much traffic for any open source project to pay for.

commoner 5y ago

Some Android flavors, including /e/[1] and GrapheneOS,[2] don't use Google servers for the internet connectivity check by default. [1] https://gitlab.e.foundation/e/backlog/-/issues/268#note_18097 https://gitlab.e.foundation/e/backlog/-/issues/268#note_1809... [2] https://grapheneos.org/faq#default-connections https://grapheneos.org/faq#default-connections

1vuio0pswjnm7 5y ago
Looking through the GrapheneOS source, the servers may not be Google servers but the system is still designed to phone home. As such, have they solved the problem or is this just another case of "Dont' trust them, trust us instead." Has anyone succeeded in running multiboot on "smartphone" hardware, i.e., where the user can boot into a choice of kernel/userland. One choice might be Android, another might be GrapheneOS/LineageOS, another might be an OS that does not rely on any third parties whatsoever (no conveniences, "app stores", "connectivity checks", etc.) and is fully controlled by the user. In other words, the third choice lets the pocket-sized computer be used more like a pre-smartphone era desktop/laptop OS. Basic functionality.
- dyndos 5y ago
  Did you actually find any examples of GrapheneOS phoning home? GrapheneOS doesn't rely on any third-parties I'm aware of. The only service provided is over-the-air security updates. It doesn't even come with an app store (although you can install F-Droid). For that reason, GrapheneOS alone fits all three categories you mentioned: It is Android, it is GrapheneOS, and it is fully controllable / doesn't ship bloatware.
  - summm 5y ago
    It is not controllable at all: It still enforces any app author's will against the user's. Root is not offered, and the grapheneos maintainer seems to be personally offended by the thought that root could be helpful.
    - 5y ago

1vuio0pswjnm7 5y ago

From GrapheneOS FAQ: "Unlike AOSP or the stock OS on the supported devices, GrapheneOS stops making network time connections when using network time is disabled rather than just not setting the clock based on it." "... rather than just not setting the clock based on it." Wow, that is really sneaky and deceptive. The user thinks she has disabled the constant connections to the tech company time servers but in truth the connections persist. The time checks are equally as annoying as the connectivity checks.

paulcarroty 5y ago

I'd recommend libredns.gr, it's free and available for non-Android devices. > You can add all google related domains to /system/etc/hosts if you have root/sudo access. Root access is harder to get with each new Android release - Google don't like adblockers.