Thread

I captured 72 hours of idle Android packets behind pfSense

45 points · 27 comments · youngmanyk

youngmanyk · 1789848215 · focus · HN ↗
So i wanted to know what an Android phone actually transmits when you aren't touching it most articles say "Google collects a lot of data" but nobody knows to what extent and publishes some proof lets say some packet captures
Stock Android 16 averaged 348.4 requests/hour to Alphabet ASN 15169 endpoints turning off location and usage diagnostics in settings still left 194.2 requests/hour active mostly checkin.gstatic.com Wi-Fi BSSID surveys. Running GrapheneOS with Sandboxed Play Services dropped traffic to 12.1 requests/hour, while pure GrapheneOS registered zero.
Data is uploaded here : <a href="https://doi.org/10.5281/zenodo.22848749" rel="nofollow">https://doi.org/10.5281/zenodo.22848749
1. kQq9oHeAz6wLLS · 1789853885 · focus · HN ↗
  I'd be curious how LineageOS stacks up against GrapheneOS.
  Also, anyone know if there are downsides to blocking checkin.static.com?
  1. mzajc · 1789861802 · focus · HN ↗
    LineageOS does not come with Google Play services, so it's a lot quieter. It should also be possible to find all instances of outbound requests in its source.
    That being said, I ran tcpdump on my router for about 10 minutes with no background applications and didn't observe any traffic. There's a (weekly? forgot the default) update check that's enabled by default, everything else is disabled.
    When connecting to a network, HTTP and HTTPS requests are sent to Google-owned domains for the captive portal check; you can configure a custom URL instead: <a href="https://gist.github.com/edwardw/cb99236a592900c4f26fb0d8f474af3e" rel="nofollow">https://gist.github.com/edwardw/cb99236a592900c4f26fb0d8f474....
    hn92726819 · 1789917884 · focus · HN ↗
    > LineageOS does not come with Google Play services, so it's a lot quieter
    ... Than stock android. Graphene doesn't come with Play either, so Lineage doesn't have Graphene beat here.
    Graphene also allows changing (or disabling) connections to Google via their proxy for: Widevine checks, Internet Connectivity checks, certificate transparency, PSDS, and SUPL. I do not believe Lineage has this.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.