If anything, I love GrapheneOS for its “Network” permission toggle. It’s nice knowing that my keyboard (or any other unnecessary apps) can’t phone home.

First off, if you’re concerned about phone privacy, consider a custom OS for your phone that respects privacy such as GrapheneOS.

It’s easy to figure out that your device isn’t listening to a constant audio stream 24/7, since that would drain battery and send a lot of noticeable data over the network. However, it is entirely possible to listen for certain keywords as you mentioned, and send them encrypted with another seemingly legitimate packet. There’s no way to be 100% certain, but it is possible in theory without draining too much battery.

The steps you took are good, making sure that apps don’t have any permissions they don’t need. Privacy is a spectrum, so it’s not “all or nothing”. As I mentioned before, if you’re seriously concerned about mobile privacy and want a solution, you can get a custom operating system that can remove any privacy invasive elements. GrapheneOS also allows you to disable the camera and microphone system-wide (although this functionality is present on some other Android builds).

If it eases you any, a lot of these advertisements happen to be coincidence and trigger confirmation bias. It could be that those ads happened to show up by coincidence, or that advertisers managed predicted your interests, or that you got tracked by some other means while downloading the movie. The possibilities are nearly endless.

This depends on what you’re trying to defend against. In my opinion (on GrapheneOS):

• “Accessibility” permission (i.e. full control of the device)
• “Network” permission
• “Modify system settings” permission
• “Install unknown apps” permission
• Any permission that allows apps to communicate with one another (such as a reduced sandbox, file permission, or app communication scopes)

Those are the only permissions that I can think of off the top of my head that could potentially allow an app to phone home. Turning off Wi-Fi for the device does little if the app also has the “Wi-Fi control” permission.

Having worked in penetration testing before, one tool I used to query SQL databases represented unknown characters as an underscore (_) before the character gets brute forced.

Bonus story: I used to set the hostname for my phone as a transparent character, so it wouldn’t visibly show up if someone ever did a network scan. I accidentally fooled myself with this while doing a network scan, and got frustrated why the “mystery device” wouldn’t load a hostname.

A password with 300 bits of entropy would take 1.288×10^(-138) seconds to crack with the Planck Cruncher :)

Is it relevant, or was it just a neat extra to add?

Just a neat extra. Most passwords are represented in bits of entropy in this context, and I discovered while researching that the proper unit is a shannon.

I may make a writeup about this, considering a password with all possible Unicode characters instead of just the printable ASCII characters.

I have a friend who absolutely hates that I only focus on theoretical problems, rather than physical problems. Oh well, I’ll be laughing when the Planck Cruncher breeches his accounts :)

The Planck Cruncher has refused to comment about this. ;)

1024 bit. The exact number is about 3.6019×10^72 years, which is orders higher than a vigintillion.

I did consider this while writing this, but I decided to keep it simple. I’m not sure how quantum physics would behave when we’re discussing a computer that can already calculate at Planck “speed”.

One could argue the same about the Tor Project, which has made their own version of Firefox.

It also depends on your layering, or lack of. It’s the complexity issue you ran into.

It leads me to, in the future, simply tell people to know how to stay safe no matter what they use. Perfect security is just as hard as perfect privacy.

Great post by the way.

Thank you! I hope that maybe one day the debate will get a proper resolution. I’m disappointed I couldn’t be the one to provide that.

It depends on what you’re defending against. Both hackers and surveillance can happen behind the scenes, so while no data loss or noticeable breaches happened, that doesn’t mean that nothing happened.

Think of your fed as a guardian angel. That works for the government. And no intentions to guard you. Or any good intentions at all.

After getting the crash issue resolved (it is now fixed), I tested this to see how it behaves by using PCAPdroid. I also attempted to decrypt the traffic, to see what it sends.

This is the traffic analysis:

It sends to a random list of hosts, all of which are listed here:

https://4chan.org

https://www.reddit.com

https://www.yahoo.com

https://www.cnn.com

https://pornhub.com

https://www.ebay.com

https://wikipedia.org

https://youtube.com

https://github.com

https://medium.com

https://thepiratebay.org

After digging through the code, here is the file with a list of hosts. It also seems to randomly generate user agents, which is good.

The developer blocked me from opening issues on all of his projects.

Nitrokey sells laptops that let you remove all wireless connectivity. They are also Qubes OS certified.

Will you be analyzing forks such as tor and mull?

Yes.

Lmk if you need any support finding evidence in source code.

Thank you! I may ask for your help eventually

See Update 1 for answers and clarification.