August 25th, 2024

How de-Googled is Lineage OS?

Kevin Boone shares his experience with Lineage OS, highlighting privacy concerns related to Google services. He suggests alternatives like GrapheneOS and emphasizes understanding data sharing while advocating for a balanced privacy approach.

Read original articleLink Icon
How de-Googled is Lineage OS?

Kevin Boone discusses his experience with Lineage OS as part of his effort to minimize Google's presence in his digital life. While Lineage OS removes Google Play Services, it still retains some connections to Google, which concerns users focused on privacy. Boone notes that hard-core de-Googlers often prefer alternatives like GrapheneOS, which offer a more comprehensive de-Googling experience. He highlights several privacy issues associated with Lineage OS, including the captive portal test that defaults to Google’s servers, DNS lookups that could potentially expose browsing habits, and the use of Google’s servers for Assisted GPS. Although he acknowledges these concerns, Boone believes that the data shared is minimal and manageable. He emphasizes the importance of understanding what data is sent to Google and suggests that users can take steps to mitigate risks, such as changing DNS settings. Boone also expresses a preference for using non-Google browsers to limit exposure to privacy issues related to WebView. Ultimately, he advocates for a balanced approach to privacy, recognizing the challenges of completely escaping Google's ecosystem while still striving to reduce its influence.

- Lineage OS is a popular choice for users seeking to reduce Google’s presence on their devices.

- Privacy concerns include reliance on Google’s servers for captive portal tests and DNS lookups.

- Users can mitigate risks by changing settings and using non-Google applications.

- Boone emphasizes the importance of understanding data sharing practices with Google.

- He advocates for a principled approach to privacy without making life overly complicated.

Link Icon 17 comments
By @Springtime - 5 months
One caution about changing the captive portal as described in various de-Googling guides is you can shoot yourself in the foot, as ime the entire cellular (and even Wi-Fi) connection can fail to work if the captive portal domain doesn't return the correct 204 status code (which can happen when some independent servers randomly fail or their HTTPS cert isn't renewed), which becomes frustrating to troubleshoot as the issue can be intermittent.

Additionally the guide I've seen referenced the most (from Reddit, which a popular Youtube video is directly based upon and which this article covers the main points of) suggests an outdated HTTPS URL which no longer works. I'd imagine many are just blindly copying adb settings and encountering problems (the burden of which often falls onto LineageOS community support as people spend time trying to identify an issue).

By @akimbostrawman - 5 months
>But I’m not paranoid. I don’t think Google is out to get me, or is in league with people who are.

they are a data selling company. anybody now or in the future who deems that data valuable can acquire it. worrying about such data falling into the wrong hands sooner or later is not paranoid but knowing history and learning from it.

i agree that if you are serious about de-Googling that GrapehenOS is a much better fit not to mention superior security, however that is only the first step.

By @jaredhallen - 5 months
I've been running Lineage with microg for a couple years now, and for the same reasons as the author. I don't consider myself a tin-foiler, either. I think the concerns he expresses are perfectly valid. Anyway, FWIW, I have noticed a night and day difference in the targeted advertising. It's a little amusing, because my wife has an iPhone, and she'll get nearly instant targeted ads based on conversations we have, while I don't. Anecdotal, sure, but there seems to be something to it.
By @replete - 5 months
DivestOS is based on lineageOS and while not as good as grapheneOS, does support a number of other devices [0]. I think its the next best alternative to GrapheneOS.

Monthly security updates too.

[0]: https://divestos.org/pages/devices

By @Eavolution - 5 months
I really want to use Lineage, I really do. I have a device thats supported and can easily unlock the bootloader, but I'd need my bank apps all to work, and I know that they don't. Even if they did, I don't want the uncertainty of them not working when a few don't have a internet banking without an app, and others require an app for 2fa, otherwise I'd use Lineage in a heartbeat.

This feels like an issue for the EU to step in on, a functional duopoly created by apps for essential services that almost everyone needs requiring one of 2 platforms to work.

By @rty32 - 5 months
> I just keep it disabled, and live with the disadvantage of longer GPS start-up times.

The reality is that it is extremely painful to spend minutes locating satellites -- it is a battery drain and very difficult to deal with, almost in every case you need to use GPS (location, navigation etc). It is a dealbreaker for me personally and probably most of people.

By @ndr - 5 months
My Pixel 6 Pro just started making a sound anytime I take a screenshot. There's no way to turn it off[0].

I don't care about the de-Googling as much but I'm considering wiping to something freer, maybe Lineage OS. How destructive is that going to be?

[0] It doesn't do it when I take a picture with the camera (mCameraSoundForced=false) and I'm in a country where that would be unnecessary anyway.

By @checkyoursudo - 5 months
I have been a long-time iPhone user, but my daily driver is Linux. Once, a long time ago, I had high hopes for a Linux phone.

TFA mentions Lineage and Graphene. Are these the only realistic alternatives these days? Why would one choose one over the other?

By @elric - 5 months
I've given up on Lineage, mostly because updates are a pain. Switched to GrapheneOS and am pretty happy so far. I think their approach of sandboxing the Google-foo is pretty sensible, as it strikes a balance between usability and privacy.

It's a shame that the mobile phone market is such a complete and utter shitshow. Can't root your device because a boatload of apps will stop working. Can't have an unlocked bootloader because other apps will stop working. You effectively have a choice between two walled gardens (and never the twain shall meet!), with varying degrees of privacy violations.

How did we let it come to this? For a brief moment we had the glorious N900 and Maemo ecosystem, but that's all gone now. Open phones seem impossible now.

By @wkat4242 - 5 months
> I’ve subsequently learned that hard-core de-Googlers eschew Lineage OS, because it remains too close to the stock configuration of the Android Open-Source Project (AOSP) on which it is based.

This is true, LineageOS is mainly used by people that end up installing Google Play Services afterwards. They have said themselves that 90+% of people install it on top of Lineage.

They are also very afraid of pissing Google off, and thus they are extremely against MicroG which is an open-source phone-side API for Google Play that is more privacy preserving. For example it replaces the location service with alternatives and supports firebase push messaging without sharing too much data. But Lineage hate it, if you so much as mention it in their IRC channel you get insta-kicked.

I view Lineage not really as a privacy ROM but more as a long term support ROM for the people that want normal Android with Google but their phone has fallen out of support from the vendor.

PS: There is a great fork from MicroG itself: https://lineage.microg.org/ . Of course not using Google at all is even better but the problem is that most app backends only speak to Firebase (google) for their push messaging.

> I don’t like Google knowing so much about me, but I don’t believe Google’s data collection is directly harmful to me. My disapproval of Google’s activities (and I know Google is not the only culprit) is mainly one of principle.

For me it's not about harmful or not. I just don't want to be spied upon, whether I receive negative effects from it or not.

> I don’t want to be a source of revenue for Google, or to legitimize their behaviour by my own inaction. I don’t want Google to make the Internet more of a hellscape that it currently is.

Well Google and their model of tracked advertising goes hand in hand with enshittification. They're responsible (though not single-handedly) for establishing the model of 'the user is not the customer but the product'. Kowtowing to their services will certainly make things worse.

By @BadHumans - 5 months
As much as I would like an alternative, the downsides to not using Google Play Services is too great for me to seriously consider a degoogled phone. This may be a use case for PWAs but until banking apps and ride sharing apps are fully functional on the webs this isn't an option.
By @z3c0 - 5 months
I've used both Lineage and Graphene extensively, and contrary to a lot of what I see even here in this thread, I find Lineage (without MicroG) to be a more Google-free experience, at least on the surface. Graphene's sandboxed GApps can still learn information about your usage patterns if you log into the services, albeit far less than they would on a standard Android device. However, it's for the sandboxed GApps that I consider Graphene to be more usable for the average smartphone user.

I'll admit to not really understanding what about the AOSP is inherently bad other than being maintained by Google. To my understanding, it's only the GApps binary that remains shrouded in sinister mystery, and obviously that's not present in Lineage.

By @kelsey98765431 - 5 months
I looked into why I was unable to use a secure encryption password on android devices about a year ago and i was shocked to find the AOSP bug that was over a decade old identifying a max 16 character encryption password, and was absolutely floored to see CyanogenFraud now called LineageOS had willingly not patched this until literally the very latest release, which was not available for my one plus device at that time.

16 character max for a decade is a juicy rainbow table for the small cost of a few petabytes, something most law enforcement is easily capable of paying for.

Between the devils I know I much prefer my apple mobile devices, even with a fix applied I wonder about the intentions of a team that ignored security concerns for over a decade (both Alphabet and Lineage)

By @SubzeroCarnage - 5 months
By @oaththrowaway - 5 months
I've moved from Lineage+MicroG to /e/OS. Overall it's fine. I don't feel like I'm missing anything from a full Google experience
By @motohagiography - 5 months
the way to do mobile privacy well would be to run an android image with a VoIP phone number in a cloud container and then actuate the image using another handheld via wireguard.

I don't know that market well, but it seems like you should be able to run a virtual cloud android devices as a digital twin. secure hardware is a honeypot. disposable hardware with keys you manage is the best possible.

By @sulandor - 5 months
tl;dr

not much but it's a start