I captured 72 hours of idle Android packets behind pfSense

youngmanyk

So i wanted to know what an Android phone actually transmits when you aren't touching it most articles say "Google collects a lot of data" but nobody knows to what extent and publishes some proof lets say some packet captures Stock Android 16 averaged 348.4 requests/hour to Alphabet ASN 15169 endpoints turning off location and usage diagnostics in settings still left 194.2 requests/hour active mostly checkin.gstatic.com Wi-Fi BSSID surveys. Running GrapheneOS with Sandboxed Play Services dropped traffic to 12.1 requests/hour, while pure GrapheneOS registered zero. Data is uploaded here : https://doi.org/10.5281/zenodo.22848749

youngmanyk

please share your thoughts if i should have done things differently

grebc

Shockingly bad, any move away from big tech is a good one in my opinion. And I’ve got a lot of moving to do! Care to run the same experiment for an iPhone?

aucisson_masque

Grapheneos with Google play services (sandboxed) only send 12 packets per hour, instead of around 350. That’s great, but the sandboxed Google play services are by default set to normal in battery usage. Meaning it’s subject to dooze and other ways to artificially limit its background activity. You neee to set the battery usage to unrestricted to reliably revive notification. I wonder what the packet count would have been with unrestricted Google play services.

VCFundedGenYer

This isn’t new. The disgraced Lunduke did this same test nearly a decade ago and observed the same results. Android is malware disguised as a consumer operating system.

perching_aix

Was there any TLS interception in place? Mind you, that can be detected and ignored... Cause the (obviously AI generated) page is fairly ambiguous in this regard. In one section it claims certain pieces of info were sent outright. In others, it refers to them as "Privacy Threat Vector" items. Were they possibly sent or were they actually sent? Why is this left unclear? Why is transmission alone counted as evidence of later misuse? What data is technically necessary to send as part of a protocol? I'm really quite tired of the run of the mill "privacy minded" folks thinking they're the hot shit because they can launch WireShark, and gawk at packets flying about. Like no, various corporate SNIs appearing in a chatty network log is not evidence for illegal or unethical corporate espionage/surveillance, especially not a clear one. Nor is the network log being chatty any evidence one way or another. Do you really think that surveillence is a more likely explanation for them than just regular enterprise sprawl? If you're bringing receipts, bring them whole, disclaimers and limitations included. Any analysis that stops before decrypting the traffic is deeply unserious, and only serves to discredit actual research findings & real violations of privacy.

orliesaurus

If you turn the WiFi/mobile off with airplane mode (and ensure wifi is off) this should go away right?

skeledrew

Doesn't really work for me. It's just a site likely checking what the browser tells it any the system. Meanwhile I have a VPN blocking most connections and every Google app is either uninstalled or disabled.

orliesaurus

How does iOS compare?