Security Feature Suggestion: Add "Network Permission" like on GrapheneOS.

[MarkCyberSecDev93]

This was a security feature (recommended by GrapheneOS) because:
https://madaidans-insecurities.github.io/android.html#firewalls

I suggested this because I was curious that in your website you mentioned you added "Sensor PERMISSION" for app permission. So yeah, I would like to see whether you would add this feature in the future or not.

Wish you guys/gals devs could implement this feature! Best of luck!

The First custom ROM aside from GrapheneOS implemented this feature is Havoc OS.

I know this is a problem for some apps (app crashing) but it can be solved by reinstalling the app and never disable/deny the "Network PERMISSION".

[SkewedZeppelin]

The current network restrictions available are fine for now. https://divestos.org/images/screenshots/11/Network.png

[rsssxd]

I set Signal messenger app as my SMS app on DivestOS and turned off all network permission of Signal.

However, Signal continues to send network requests in the background.

[rsssxd]

It would be nice to see a feature that turns off network permission completely. This will cause more users to prefer DivestOS.

[SkewedZeppelin]

You know the Signal app has proprietary libraries in it?

[rsssxd]

I know Signal is completely open source. What does this change? Network request keeps going.

[SkewedZeppelin]

Signal includes numerous proprietary dependencies:
https://github.com/signalapp/Signal-Android/blob/master/app/build.gradle#L437-L444

Signal or any app should not be able to connect to the Internet if you long press on it go to app info and disable network in the options.

[rsssxd]

I already disabled network permission from settings. However, as you can see in the Signal firewall, it continues to send requests.

[MarkCyberSecDev93]

However,

https://divestos.org/images/screenshots/11/Network.png

the "network control" used by DivestOS, LineageOS and other ROMS is not as restricted and secure as GrapheneOS' (CopperheadOS and Havoc OS) permission control. The network control used by LineageOS (which DivestOS is currently using) is still leaky like reyis4402 has shown in the screenshots.

When I say permission control, what I meant is where you control app's access to camera, files, camera and so forth.

This is what Network PERMISSION looks like:

Here's what GrapheneOS said about the network PERMISSION security.

GrapheneOS adds a user-facing Network permission toggle providing a robust way to deny both direct and indirect network access to applications. It builds upon the standard non-user-facing INTERNET permission, so it's already fully adopted by the app ecosystem. Revoking the permission denies indirect access via OS components and apps enforcing the INTERNET permission, such as DownloadManager. Direct access is denied by blocking low-level network socket access.

[MarkCyberSecDev93]

@SkewedZeppelin btw, do you have a community group chat like telegram, matrix or xmpp?

[SkewedZeppelin]

https://divestos.org/index.php?page=about#community

[rsssxd]

It would be nice to see this kind of restriction. This would make users more secure about untrusted apps.

Offering such a feature shouldn't be difficult. 😥

[SkewedZeppelin]

5e15217