Apple launders its sale of your privacy and data through their deal with Google. Google launders its sale of your privacy and data through its ad tech ecosystem. It's all indirection and obfuscation. None of them are leaving money on the table.
I think it’s interesting how anyone who cares about privacy can change that, but the main vocalists are those who are bothered on behalf of those who don’t care and don’t change it.
That’s... a really weak point if we’re discussing actual platform capabilities and not some moral high ground. I didn’t even know what the default search engine is on iOS, and I don’t care very much. It’s literally one of the first things you change while setting up your (first) phone.
It seems like “Google owns the entire OS and logs everything you do” versus “Google might get your search data” are really very different. Your comment to me seemed to imply that they were roughly similar.
On the axis of which OS gives more data to Google it’s clear that android is far and away the worse choice here.
Android lets you change more default apps than iOS.
You can use a purely local maps app and have that be your default address handler. You can change your voice assistant to a local assistant. You don't have to send your location to Google if you want to get your GPS location (iOS sends your location to Apple). You can install an app on your own device without telling Google or Apple. Despite what Apple marketing has told you, Android is far and away the better choice for those who value privacy.
Well unlike iOS, on android you can just change the SMS app.
Nobody is forcing you to use anything, that's the difference, and that's what the DMA is about.
Yeah, but that's pretty weak sauce. I can't control (or even know) whether or not people I may want to SMS with have this enabled. I assume most will due to the power of default settings.
But either way, I have no control over it whatsoever.
True, same thing can be said about iMessage unencrypted cloud backups or WhatsApps unencrypted google backups, it's just that Android gives you the freedom to use an alternative.
I use one from f-droid as well. But hundreds of millions of people are not going to even know that's possible. There will be no yes/no choice offered, e.g., yes to the security patches, no to the "AI". They will just get the "AI" nonsense in the update and it will probably be enabled by default.
How many people know to use different contacts app from the default one, so that neither the system nor apps can access their contacts.
How many know how to use an application firewall.
It should not be necessary to have do all this fiddling around. The defaults are all wrong. That's intentional.
This is the standard Android SMS/MMS app that's even automatically updated in Android version 8 and 9?
I keep my phone unconnected except for cell service, so only get automatic updates every half a year or more whenever I purposefully or accidentally enable the wifi for some purpose. This last happened a week or so ago accidentally and I worried then that my data would be sent to Google despite not having a Google account (the Play Services still automatically updated Messages anyway). I deleted the saved home WiFi connection to prevent access from happening accidentally again, but there will likely come a time when I need to manually connect anyway. Is there a way to shut off these annoying automatic updates and prevent this, or should I just figure out how to switch the messaging app to another SMS/MMS app and say goodbye to my messaging history?
As much as I wish for an open and non evil mobile device, GrapheneOS just gave me a chuckle - “GrapheneOS only officially supports Pixel devices” what a world we live in. To get away from Google, the only devices you do with are made by Google.
I have given up. Regardless of how much tinkering you do at the OS level - hardened kernel, firewalls, VPNs, jailed apps whatever, the moment you want to make good use of your device doing common things we have come to expect - maps with turn-by-turn navigation that doesn’t suck, ability to write messages to other people where they are, without asking them to install some app first so that we can talk, we are bound to make a deal with the same devil we are fighting - Google, Facebook and other ad tracking machines. There is no point in keeping a hardened OS with Google Maps and WhatsApp installed.
I made my deal with the devil that is Apple that atleast publicly pretends to care about privacy(of course, I have no way to verify that they do).
You can't win everything, but GrapheneOS + Pixel is the closest thing we have to a phone you can trust.
They only support pixels because Google follows their own standards and doesn't make up shit on the go, so they can lock the bootloader and sign the OS correctly.
I'll admit, the last time I tried copperheadOS or cyanogenMod was like a decade ago, and I should not be prejudiced. I'll see if I can play with a pixel device and grapheneOS and give it a chance to change my mind.
The other part of my argument still stands...
Do you use WhatsApp, Instagram etc for communication with friends?
What Google services do you use on your phone? Google Maps, Youtube?
Is there a way to use GrapheneOS on a Pixel device without sacrificing modern life social needs too much?
Update:
I thought about my need from phone a little more. I drive a VW Golf. The default infotainment stuff in the car is useless. I use Google Maps via Apple CarPlay to get driving directions in my car. Is there any way to satisfy this need with GrapheneOS without downloading the Playstore (which I consider as Game over and a submission stand to Google) given all the permissions the Playstore needs from the OS.
Everything you mentioned works on GrapheneOS, I wouldn't use it if it didnt, I am personally kind of on the limit of my inconvenience tolerance regarding such things.
And don't worry, google services are treated as normal user level apps (1), and are sandboxed like any other user app, so you get perfect compatibility with better privacy and security than your average phone.
Even Android Auto works now, issues only arise when dealing with safety net, googles hardware attestation (2).
It mostly only affects bank apps, but in my experience most of them work without issues, however Gpay won't work at all no matter what.
Personally the only worry I have with GrapheneOS is its crazy dev, he said he will step down (3), but he still does a lot (4).
Hmm thanks for the detailed response. It does sound interesting if Google Maps and WhatsApp can be had in an Android OS, but trustable locked down such that they cannot read location, files(other than the ones explicitly allowed to), microphone etc. It sounds truly compromise free if it also works with Android Auto.
I’ll ask a colleague who posted his Pixel 6a for sale to loan it for a few days and try it out.
And that you install Google services through the "apps" app, to get a usable phone.
If gps isn't as fast as you expect, you may have to enable Google location services, I had to do that otherwise it almost never works indoors due to lack of support for local wifi scanning.
GrapheneOS supports almost everything that a normal android does. The exceptions are Google Pay NFC Payments and some banking apps that require the OS to be signed by a trusted party.
The Google apps, if you use them, get sandboxed and prevented from having full access to the phone.
I had the same skepticism, but I realized the rationale behind targeting Pixel phones makes a lot of sense. It makes development much easier for a small development team, Pixel is a high quality phone that also is one of the easiest to install custom ROMs on, and I think there's some sort of integrity checking hardware on Pixels not present on other Android phones.
It would be great if some sort of libre Pixel clone could be made so that Google is not needed at that level, but that simply doesn't exist yet. Otherwise, all you're doing is trading the devil of Google for some other devil like Samsung.
> There is no point in keeping a hardened OS with Google Maps and WhatsApp installed.
Sandboxed Google Maps using sandboxed non-system Play Services or MicroG on an OS with hardened memory allocation is better than Google Maps on a stock ROM.
Pixel phones let you re-lock the bootloader using your own signing keys. This is the feature that graphene requires pixel for.
Also, the easiest phones to de-google are the google branded ones. I don't use graphene, but all my android phones have been google branded, so they could run a de-googled aosp build.
Moto E6. It looks like Lineage OS is available for it. As I don't know what installing a new OS will do to compatibility with my service I think I'll first try installing an alternate app from F-droid and see if it will transfer my SMS/MMS history.
Shit. After disabling Google Messages I found out that Fossify SMS Messenger can't send text messages to email addresses, which is my primary use case. Now I have to figure out a way to re-enable Google Messages without signing into the play store with a Google account. Searching APKMirror.
Edit: Damnit, I'm fucked. I can't reinstall through APKMirror because it calls the Google Play Store to finish the installation, and it won't install because I'm not signed into a Google account.
Edit edit: Got Google Messages working again by installing the most recent beta version with APKMirror. I think APKMirror wasn't installing the prior download because it was an earlier version than the one I had disabled. I'll try to keep Fossify set as the default for receipt of texts and only use Google for sending texts and images to email addresses.
No keyboard for texting. I short text once or twice daily, but don't text enough to learn predictive 9-key texting, and the press each button a certain number of times at a certain rate to write takes way too long and is aggravating.
The very few 4G/5G keyboard equipped phones are way too expensive for my purposes. And almost all of them are Android smartphones anyway.
I also enjoy relatively high-fidelity images and videos of wildlife (and occasionally things at work that I need to email to others). That's the only bonus from the modern smartphones for me. But even then I would have kept a keyboard feature phone if they had still made them or if 3G hadn't gone away.
If they had made a feature phone with a chiclet keyboard that works on 4G LTE or better I would have bought it instead of the Moto E6 with its replaceable battery. Now that I've bought the Moto E6 I'm keeping it until it breaks or 4G LTE goes away.
I'm a little paranoid on this, sure, but moreso I just actively don't want to be socially connected, and am a bit of a personal AI Luddite. ML is great in the sciences that I work in, but I don't want notifications or recommendations annoyances unless I actively search for them.
And an additional point is that one of my work places requires 2FA and doesn't allow yubikeys, or an emailed or SMS code. So I'm forced to use an app for it.
Mind you, this is not news and anyone should have seen this coming: user profiling, which requires spying, is a business, and Google is certainly not alone. In a capitalistic world as soon as one player explores successfully a new business, it is immediately followed by others, so don't expect Apple or anyone else to play nicely with users data. The only way to have privacy on devices is to use only fully open ones: hardware, firmware, drivers, OS, apps, protocols; all of them.
As of today the number of such devices is sadly zero.
Zero privacy on mobile devices. News at 11. The only way to have privacy on devices is to use only fully open ones: hardware, firmware, drivers, OS, apps, protocols; all of them. As of today the number of such devices is sadly zero.
you can buy phones with an OS that is not under the control of google or apple. that is good enough for now. fully open hardware phones are coming too.
and it's also the wrong reaction. because as much as you are right. the general population did not see this coming, and they need to be told to wake up.
we need to make as much fuss about this as possible if we want to change it. dismissing that as not news is not helping
well, i am referring to the efforts of the fairphone and the pinephone as well as purism.
they are not complete, but to the extend that these projects are successful (and they are doing much better than the openmoko before it), eventually a fully open hardware phone will emerge.
basically my confidence is based on these trends. it is likely that an open hardware phone will always be a niche device, but for the past two decades attempts have been made to build such a phone, and i do not believe that these attempts will just stop.
on the contrary, as hardware production gets cheaper and cheaper, as the performance of these phones improves and will eventually reach a peak like it has with laptop and desktop devices, it will be easier and easier to actually produce a fully open hardware based phone. at that point the only thing getting in the way would be lobbying and aggressive acquisition by competitors that do not want to see an open phone.
a good example on the laptop side are framework laptops. similar attempts were made before but only now i find these models actually competitive in terms of features and price. (i am only waiting for them to offer a keyboard with a trackpoint like thinkpads, for them to be an alternative i can use)
open hardware devices will probably always be behind the most cutting edge features by a few years, but these features matter less and less, and to the extent that a 5 year old device is still perfectly usable today, so will an open hardware device with specs that are a few years behind the latest and greatest
Genuine question: why the need to make this point?
The "no one should be surprised" take baffles me: you clearly care about the progressive loss of privacy, and news like this are the only way to spread awareness of this problem. I cannot imagine someone running into this "news at 11" condemnation of laypeople's supposed lack of understanding, and actually becoming more interested in the issue.
This kind of comment is defeatist and demotivating, so I'm curious as to why you, as a proponent of fully open software, would be so intent in making this point.
> This kind of comment is defeatist and demotivating
I apologize if that was the impression, I didn't want to offend anyone nor discourage anyone from hoping to see one day more people becoming aware of the lack of privacy in closed devices; actually if there's someone who is becoming discouraged it's me. I often see people complaining on the lines of "hey, I was chatting about this the other day and now I receive advertising for the same thing", and every single time either they don't care or they're convinced that the next OS/app/contract/whatever version will magically solve every privacy/security problem. How can one hope to raise awareness about the benefits in adopting open platforms if so many users either don't give a damn or can be convinced that security and privacy are a product and not a process?
That doesn't mean I'm giving up, but I'm fully aware that today and in this world nobody would be insane enough to design, manufacture and distribute a fully open platform; there's just not enough incentive to do that.
How can one hope to raise awareness about the benefits in adopting open platforms if so many users either don't give a damn or can be convinced that security and privacy are a product and not a process?
this question can be read in two ways: raising awareness is hopeless because no one cares anyways, and: our attempts to raise awareness so far have not worked, so we need to ask how can we raise awareness in ways that people actually notice?
we need to focus on the latter and explore more effective methods to raise awareness.
today and in this world nobody would be insane enough to design, manufacture and distribute a fully open platform; there's just not enough incentive to do that.
this is simply not true. there is plenty of incentive, and the means to do so are becoming more and more approachable. see my other comment: https://news.ycombinator.com/item?id=39165700
Google pisses me off so much by constantly bloating more and more the "message" app.
All I want is it just handling low tech SMS messages. Not uploading all kinds of data about me to do "smart" things, not sending all my message through their servers or operator data servers to show stupid bubbles like iMessage.
And more than all, a lightweight application. Now the app is at least 150MB, before Ai, just to send SMS...
Well good news, because Google stripped out the super lightweight default Dialer and original Messages app in the AOSP codebase, probably as a way to steer vendors into Google Messages!
And then from there, they dangled the RCS stick, then Jibe, and now look at the enshittifcation we have today :)
Enabling it is OPTIONAL. Such as enabling the former Google Assistant.
If you want a wise assistant, you need to feed it with knowledge. Period. Directors in traditional companies have assistant persons who answer private phone calls, read private messages, and more.
On my android home screen, the prime real estate formerly occupied by the weather app is now a permanent unremovable banner add saying "google assistant disabled, tap to continue." AFAIK there is no way to remove it without signing away more of my privacy. I can't substitute it for a normal widget that will tell me the local weather.
Google clearly doesn't consider assistant use to be "optional"
It seems apparent that this is one of those things that everyone knows is wrong, but the companies have made a conscious decision that it's worth the cost of litigation that will come in a few years. That is how important it is to win the AI race for these companies. They are dead otherwise. The stakes are that high. Microsoft is doing[1] it and will continue to expand it. All your Windows interactions that can be mined will be sent to the the mothership.
Does this apply to SMS as well? I already do my best to avoid sending emails to Google addresses and certainly would not use any Google messaging services, but if this covers SMS, then I'm a bit hosed here.
Maybe I have to fall back to just using voice calls?
79 comments
[ 2.6 ms ] story [ 108 ms ] threadIt seems like “Google owns the entire OS and logs everything you do” versus “Google might get your search data” are really very different. Your comment to me seemed to imply that they were roughly similar.
On the axis of which OS gives more data to Google it’s clear that android is far and away the worse choice here.
Android lets you change more default apps than iOS.
You can use a purely local maps app and have that be your default address handler. You can change your voice assistant to a local assistant. You don't have to send your location to Google if you want to get your GPS location (iOS sends your location to Apple). You can install an app on your own device without telling Google or Apple. Despite what Apple marketing has told you, Android is far and away the better choice for those who value privacy.
Two companies can be evil.
> this is why i would never switch to android-- the amount of sheer "oh my god what now"
Android is an open source OS, you can use a variant without the AI stuff in it, unlike Apple where you don't have a choice.
Are you afraid Google will kill Android?
> and "they killed my favourite product"
Are you worried Google might kill Android?
But either way, I have no control over it whatsoever.
Not like anyone can choose the "non-Bard" update option. It does not exist.
More unpleasant defaults.
How many people know to use different contacts app from the default one, so that neither the system nor apps can access their contacts.
How many know how to use an application firewall.
It should not be necessary to have do all this fiddling around. The defaults are all wrong. That's intentional.
I keep my phone unconnected except for cell service, so only get automatic updates every half a year or more whenever I purposefully or accidentally enable the wifi for some purpose. This last happened a week or so ago accidentally and I worried then that my data would be sent to Google despite not having a Google account (the Play Services still automatically updated Messages anyway). I deleted the saved home WiFi connection to prevent access from happening accidentally again, but there will likely come a time when I need to manually connect anyway. Is there a way to shut off these annoying automatic updates and prevent this, or should I just figure out how to switch the messaging app to another SMS/MMS app and say goodbye to my messaging history?
I have given up. Regardless of how much tinkering you do at the OS level - hardened kernel, firewalls, VPNs, jailed apps whatever, the moment you want to make good use of your device doing common things we have come to expect - maps with turn-by-turn navigation that doesn’t suck, ability to write messages to other people where they are, without asking them to install some app first so that we can talk, we are bound to make a deal with the same devil we are fighting - Google, Facebook and other ad tracking machines. There is no point in keeping a hardened OS with Google Maps and WhatsApp installed.
I made my deal with the devil that is Apple that atleast publicly pretends to care about privacy(of course, I have no way to verify that they do).
They only support pixels because Google follows their own standards and doesn't make up shit on the go, so they can lock the bootloader and sign the OS correctly.
It's very usable and far better than an iPhone.
The other part of my argument still stands... Do you use WhatsApp, Instagram etc for communication with friends?
What Google services do you use on your phone? Google Maps, Youtube?
Is there a way to use GrapheneOS on a Pixel device without sacrificing modern life social needs too much?
Update: I thought about my need from phone a little more. I drive a VW Golf. The default infotainment stuff in the car is useless. I use Google Maps via Apple CarPlay to get driving directions in my car. Is there any way to satisfy this need with GrapheneOS without downloading the Playstore (which I consider as Game over and a submission stand to Google) given all the permissions the Playstore needs from the OS.
And don't worry, google services are treated as normal user level apps (1), and are sandboxed like any other user app, so you get perfect compatibility with better privacy and security than your average phone.
Even Android Auto works now, issues only arise when dealing with safety net, googles hardware attestation (2). It mostly only affects bank apps, but in my experience most of them work without issues, however Gpay won't work at all no matter what.
Personally the only worry I have with GrapheneOS is its crazy dev, he said he will step down (3), but he still does a lot (4).
1. https://grapheneos.org/usage#sandboxed-google-play
2. https://grapheneos.org/usage#banking-apps
3. https://news.ycombinator.com/item?id=36089104
4. Just check the commit logs in any of the grapheneOS repos.
For example https://github.com/GrapheneOS/hardened_malloc
I’ll ask a colleague who posted his Pixel 6a for sale to loan it for a few days and try it out.
And that you install Google services through the "apps" app, to get a usable phone. If gps isn't as fast as you expect, you may have to enable Google location services, I had to do that otherwise it almost never works indoors due to lack of support for local wifi scanning.
The Google apps, if you use them, get sandboxed and prevented from having full access to the phone.
It would be great if some sort of libre Pixel clone could be made so that Google is not needed at that level, but that simply doesn't exist yet. Otherwise, all you're doing is trading the devil of Google for some other devil like Samsung.
> There is no point in keeping a hardened OS with Google Maps and WhatsApp installed.
Sandboxed Google Maps using sandboxed non-system Play Services or MicroG on an OS with hardened memory allocation is better than Google Maps on a stock ROM.
Also, the easiest phones to de-google are the google branded ones. I don't use graphene, but all my android phones have been google branded, so they could run a de-googled aosp build.
which model is it? maybe it is already supported. then all you need to do is back up your data and flash it it with an alternative android.
fossify SMS will import your existing messages. Then you can uninstall/disable the Google one in your app settings.
https://f-droid.org/en/packages/org.fossify.messages/
Edit: Damnit, I'm fucked. I can't reinstall through APKMirror because it calls the Google Play Store to finish the installation, and it won't install because I'm not signed into a Google account.
Edit edit: Got Google Messages working again by installing the most recent beta version with APKMirror. I think APKMirror wasn't installing the prior download because it was an earlier version than the one I had disabled. I'll try to keep Fossify set as the default for receipt of texts and only use Google for sending texts and images to email addresses.
The very few 4G/5G keyboard equipped phones are way too expensive for my purposes. And almost all of them are Android smartphones anyway.
I also enjoy relatively high-fidelity images and videos of wildlife (and occasionally things at work that I need to email to others). That's the only bonus from the modern smartphones for me. But even then I would have kept a keyboard feature phone if they had still made them or if 3G hadn't gone away.
If they had made a feature phone with a chiclet keyboard that works on 4G LTE or better I would have bought it instead of the Moto E6 with its replaceable battery. Now that I've bought the Moto E6 I'm keeping it until it breaks or 4G LTE goes away.
I'm a little paranoid on this, sure, but moreso I just actively don't want to be socially connected, and am a bit of a personal AI Luddite. ML is great in the sciences that I work in, but I don't want notifications or recommendations annoyances unless I actively search for them.
Mind you, this is not news and anyone should have seen this coming: user profiling, which requires spying, is a business, and Google is certainly not alone. In a capitalistic world as soon as one player explores successfully a new business, it is immediately followed by others, so don't expect Apple or anyone else to play nicely with users data. The only way to have privacy on devices is to use only fully open ones: hardware, firmware, drivers, OS, apps, protocols; all of them. As of today the number of such devices is sadly zero.
you can buy phones with an OS that is not under the control of google or apple. that is good enough for now. fully open hardware phones are coming too.
and it's also the wrong reaction. because as much as you are right. the general population did not see this coming, and they need to be told to wake up.
we need to make as much fuss about this as possible if we want to change it. dismissing that as not news is not helping
Do you have any reference? Not that I don't trust you, I'm actually curious because that would be the #2 conquest of the century, right behind AI.
they are not complete, but to the extend that these projects are successful (and they are doing much better than the openmoko before it), eventually a fully open hardware phone will emerge.
basically my confidence is based on these trends. it is likely that an open hardware phone will always be a niche device, but for the past two decades attempts have been made to build such a phone, and i do not believe that these attempts will just stop.
on the contrary, as hardware production gets cheaper and cheaper, as the performance of these phones improves and will eventually reach a peak like it has with laptop and desktop devices, it will be easier and easier to actually produce a fully open hardware based phone. at that point the only thing getting in the way would be lobbying and aggressive acquisition by competitors that do not want to see an open phone.
a good example on the laptop side are framework laptops. similar attempts were made before but only now i find these models actually competitive in terms of features and price. (i am only waiting for them to offer a keyboard with a trackpoint like thinkpads, for them to be an alternative i can use)
open hardware devices will probably always be behind the most cutting edge features by a few years, but these features matter less and less, and to the extent that a 5 year old device is still perfectly usable today, so will an open hardware device with specs that are a few years behind the latest and greatest
The "no one should be surprised" take baffles me: you clearly care about the progressive loss of privacy, and news like this are the only way to spread awareness of this problem. I cannot imagine someone running into this "news at 11" condemnation of laypeople's supposed lack of understanding, and actually becoming more interested in the issue.
This kind of comment is defeatist and demotivating, so I'm curious as to why you, as a proponent of fully open software, would be so intent in making this point.
I apologize if that was the impression, I didn't want to offend anyone nor discourage anyone from hoping to see one day more people becoming aware of the lack of privacy in closed devices; actually if there's someone who is becoming discouraged it's me. I often see people complaining on the lines of "hey, I was chatting about this the other day and now I receive advertising for the same thing", and every single time either they don't care or they're convinced that the next OS/app/contract/whatever version will magically solve every privacy/security problem. How can one hope to raise awareness about the benefits in adopting open platforms if so many users either don't give a damn or can be convinced that security and privacy are a product and not a process? That doesn't mean I'm giving up, but I'm fully aware that today and in this world nobody would be insane enough to design, manufacture and distribute a fully open platform; there's just not enough incentive to do that.
this question can be read in two ways: raising awareness is hopeless because no one cares anyways, and: our attempts to raise awareness so far have not worked, so we need to ask how can we raise awareness in ways that people actually notice?
we need to focus on the latter and explore more effective methods to raise awareness.
today and in this world nobody would be insane enough to design, manufacture and distribute a fully open platform; there's just not enough incentive to do that.
this is simply not true. there is plenty of incentive, and the means to do so are becoming more and more approachable. see my other comment: https://news.ycombinator.com/item?id=39165700
I think this is a new business that was made possible by technology, but in its current state, it undermines the social fabric of society
So????
All I want is it just handling low tech SMS messages. Not uploading all kinds of data about me to do "smart" things, not sending all my message through their servers or operator data servers to show stupid bubbles like iMessage.
And more than all, a lightweight application. Now the app is at least 150MB, before Ai, just to send SMS...
This is one of the main reasons I use iPhone.
“iOS
No. You can not send or receive insecure SMS/MMS with Signal on your iPhone […]”
"Signal Android can be configured as your default SMS/MMS app"
"Apple does not allow other apps to replace the default SMS/messaging app"
And then from there, they dangled the RCS stick, then Jibe, and now look at the enshittifcation we have today :)
If you want a wise assistant, you need to feed it with knowledge. Period. Directors in traditional companies have assistant persons who answer private phone calls, read private messages, and more.
It's easy to make clicks on Google, no?
Google clearly doesn't consider assistant use to be "optional"
Also, is it only enabled if both or in case of group texts, all parties agree to it?
[1] https://proton.me/blog/outlook-is-microsofts-new-data-collec...
Maybe I have to fall back to just using voice calls?
When the Matrix becomes intolerable, the ride on the Nebuchadnezzar must begin.