Usage

This page is currently a placeholder and will be filled with lots of content over time.

Auditor ¶

See the tutorial page on the site for the attestation sub-project.

Default connections ¶

GrapheneOS makes connections to the outside world to test connectivity, detect captive portals and download updates. No data varying per user / installation is sent in these connections. There aren't analytics / telemetry in GrapheneOS.

The expected default connections by GrapheneOS (including all base system apps) are the following:

• The GrapheneOS Updater app fetches update metadata from https://seamlessupdate.app/DEVICE-CHANNEL approximately once every four hours when connected to a permitted network for updates.

  Users can control which types of connections the Updater app will use, and although it's strongly recommended to always leave it enabled it can be disabled.

• On devices with a Qualcomm baseband (which provides GPS), when location functionality is being used, GPS almanacs are downloaded from https://xtrapath1.izatcloud.net/xtra3grc.bin, https://xtrapath2.izatcloud.net/xtra3grc.bin or https://xtrapath3.izatcloud.net/xtra3grc.bin. GrapheneOS has modified all references to these servers to use HTTPS rather than a mix of HTTP and HTTPS.

• Connectivity checks designed to mimic a web browser user agent are performed by using HTTP and HTTPS to fetch standard URLs generating an HTTP 204 status code. This is used to detect when internet connectivity is lost on a network, which triggers fallback to other available networks if possible. These checks are designed to detect and handle captive portals which substitute the expected empty 204 response with their own web page. These need use a very common domain and URL in order to bypass whitelisting systems only permitting access to common domains / URLs so a domain like grapheneos.org would likely be inadequate. GrapheneOS leaves these set to the standard four URLs to blend into the crowd of billions of other Android devices with and without Google Mobile Services performing the same empty GET requests. For privacy reasons, it isn't desirable to stand out from the crowd and changing these URLs or even disabling the feature will likely reduce your privacy by giving your device a more unique fingerprint. GrapheneOS aims to appear like any other common mobile device on the network.

  • HTTPS: https://www.google.com/generate_204
  • HTTP: http://connectivitycheck.gstatic.com/generate_204
  • HTTP fallback: http://www.google.com/gen_204
  • HTTP other fallback: http://play.googleapis.com/generate_204

  Standard AOSP user agent for the GET request:

  Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36

  No query / data is sent and the response is unused beyond checking the response code.

• DNS connectivity and functionality tests

• DNS resolution for other connections

Similar connectivity checks are also performed by the hardened Chromium browser (Vanadium).