Copperhead seems designed to protect against malicious attackers, but does it protect confidentiality against commercial tracking (another kind of attack)?
I'll add: I haven't come across another fork of Android that focuses on security so I'm rooting for these guys.
Privacy enhancements are definitely within the scope of the project. Most of the current features are exploit mitigations though. If you look through https://copperhead.co/android/docs/technical_overview you'll see that there are a few privacy features already, and there are many in-progress. They won't be listed there until they're actually completed though.
That's not what the response to #184 means. #194 wouldn't be open if removing that connection wasn't planned.
CopperheadOS is not going to outright prevent connections to Google. That doesn't mean the OS is going to have Google services.
The only known case where AOSP connects to Google is an HTTP GET to test if internet access is available. It could just as easily use something like example.com but Google's domain is known to have effectively 100% uptime. All that switching it would accomplish is pinging a CloudFlare/OpenShift server instead of Google. And CloudFlare might break it for users behind a VPN... so in the end, what would that really accomplish?
> CopperheadOS is not going to outright prevent connections to Google. That doesn't mean the OS is going to have Google services.
I didn't meant to imply that; I'll clarify.
> The only known case where AOSP connects to Google is an HTTP GET to test if internet access is available. ... in the end, what would that really accomplish?
The GET tells Google and the user's ISP, and probably a few others, that someone at the IP address is using Android, plus whatever is in the GET headers, and that they just booted/woke their phone (which also locates the user at home or elsewhere, in some cases). It shouldn't be hard to identify people by IP. EDIT: In these days of one mass surveillance overreach after another, by government and business, it's doesn't seem rational to assume these companies aren't monitoring users and collecting all the data they can.
> The only known case where AOSP connects to Google ...
When I read this I think, 'Copperhead's priority isn't investigating whether there are other cases.' That is Copperhead's choice; I have no criticism of them.
Personally, I very much would like just one OS that prioritizes privacy (which is attacked much more than the exploits Copperhead focuses on) and gives me full end-user control over the information my device sends to others. EDIT: Again, I appreciate Copperhead's efforts and free OS; also, I realize they can't implement everything at once
It does this check when you connect to a new network and it repeats every so often to make sure the connection still works. It's how Android notifies you if there's a network connection but no internet access.
It's not a browser making the request so there's not much information in these requests. It's just a GET request with an unused result. It only checks to see if it succeeds. Every Android device does this, so it barely leaks any information. If it was changed to a CopperheadOS-specific URL, it would actually be leaking more information to networks.
I don't think there are other connections to Google in the base system but that doesn't extend to the user-facing apps like Chromium. I know for a fact that it doesn't make any other connections in normal usage, but there are a lot of edge cases.
We could make the internet access checks optional, but what about update checks? Those are leaking strictly more information (a phone connecting to builds.copperhead.co runs CopperheadOS and that can be seen without access to the HTTPS data) and it tells us which device is being used since it has to ask for the available updates. We don't really know how many people use CopperheadOS, but it would be possible to make a solid estimate from the update checks. Most people won't change the default of 1 check per day, so the number of checks per day in total is the approximate number of users, and the server has the IPs they connected from. It doesn't log anything itself but CloudFlare could.
F-Droid also does updates checks itself, so any F-Droid repositories that are enabled end up with similar information.
I am not really sure how this could be improved. You can use Tor... but in some ways that makes the situation worse.
An option to disable the internet access checks is possible, but I don't know what it would really accomplish. I don't want to make changes without a clear threat model in mind. So I'm not inclined to touch stuff like the internet connectivity check unless there are clear benefits rather than it just feeling right to people.
Those are all excellent points. Where there are tradeoffs, perhaps you could put some settings in your security slider UI.
An optional software firewall that requires outgoing connections to be whitelisted would be great for my purposes, but everyone knows how painful those can be.
Regarding connections, I've come across the following potential issues; I haven't looked into them but they give me the impression that locking down Android's network activity is too complex even for technical users, and that only a carefully secured OS will solve the problem (a big reason I've looked forward to Copperhead):
* Some connections are made during bootup so an effective firewall somehow has to load early, or at least first in the network stack.
* The address of the DNS server, Google's, is hard-coded in an in-kernel DNS resolver. Among other issues, it makes it hard to choose a different DNS server or to identify the application doing the lookup.
* Some other kernel connection activity is hard to stop even with a firewall [1][2]
> I don't want to make changes without a clear threat model in mind.
Confidentiality is part of security, and exploits of confidentiality by businesses are almost certainly the most common security exploits.
People tend to overlook them because usually they are technically legal and currently they are a sort of technological norm -- though remember that lead and asbestos were once norms. Certainly users should have the option; they should control their data.
I'll add: I haven't come across another fork of Android that focuses on security so I'm rooting for these guys.