I know, but since we're referring to permissions here, I wanted to refer to each of them by the permission names.
Charger8232
If anything, I love GrapheneOS for its "Network" permission toggle. It's nice knowing that my keyboard (or any other unnecessary apps) can't phone home.
First off, if you're concerned about phone privacy, consider a custom OS for your phone that respects privacy such as GrapheneOS.
It's easy to figure out that your device isn't listening to a constant audio stream 24/7, since that would drain battery and send a lot of noticeable data over the network. However, it is entirely possible to listen for certain keywords as you mentioned, and send them encrypted with another seemingly legitimate packet. There's no way to be 100% certain, but it is possible in theory without draining too much battery.
The steps you took are good, making sure that apps don't have any permissions they don't need. Privacy is a spectrum, so it's not "all or nothing". As I mentioned before, if you're seriously concerned about mobile privacy and want a solution, you can get a custom operating system that can remove any privacy invasive elements. GrapheneOS also allows you to disable the camera and microphone system-wide (although this functionality is present on some other Android builds).
If it eases you any, a lot of these advertisements happen to be coincidence and trigger confirmation bias. It could be that those ads happened to show up by coincidence, or that advertisers managed predicted your interests, or that you got tracked by some other means while downloading the movie. The possibilities are nearly endless.
This depends on what you're trying to defend against. In my opinion (on GrapheneOS):
- "Accessibility" permission (i.e. full control of the device)
- "Network" permission
- "Modify system settings" permission
- "Install unknown apps" permission
- Any permission that allows apps to communicate with one another (such as a reduced sandbox, file permission, or app communication scopes)
Those are the only permissions that I can think of off the top of my head that could potentially allow an app to phone home. Turning off Wi-Fi for the device does little if the app also has the "Wi-Fi control" permission.
Having worked in penetration testing before, one tool I used to query SQL databases represented unknown characters as an underscore (_
) before the character gets brute forced.
Bonus story: I used to set the hostname for my phone as a transparent character, so it wouldn't visibly show up if someone ever did a network scan. I accidentally fooled myself with this while doing a network scan, and got frustrated why the "mystery device" wouldn't load a hostname.
A password with 300 bits of entropy would take 1.288×10^(-138) seconds to crack with the Planck Cruncher :)
Is it relevant, or was it just a neat extra to add?
Just a neat extra. Most passwords are represented in bits of entropy in this context, and I discovered while researching that the proper unit is a shannon.
I may make a writeup about this, considering a password with all possible Unicode characters instead of just the printable ASCII characters.
I have a friend who absolutely hates that I only focus on theoretical problems, rather than physical problems. Oh well, I'll be laughing when the Planck Cruncher breeches his accounts :)
The Planck Cruncher has refused to comment about this. ;)
1024 bit. The exact number is about 3.6019×10^72 years, which is orders higher than a vigintillion.
Either option works.