Debloat non-rooted Android devices
github.com
github.com
No user would ever suspect that the keyboard that came with their cell phone would be letting third parties read all their texts and emails to do those things. I'd assumed the keyboard was just a part of the OS. I only found out after I just happened to long press a key long enough to get an "about samsung keyboard" window and clicking around to find a privacy policy that said which company they were sending keystrokes to, and then reading that company's privacy policy.
I immediately found an open source keyboard to replace samsung's with. I'll say one thing for them, collecting everything everyone types into their devices meant that the samsung keyboard had really good spellchecking/predictive text capabilities. I'd never go back to using it, but there are times I wish the keyboard I replaced it with had a better spellchecker.
1. Samsung is able to sell phones like that legally. 2. People are not in jail. 3. Governments somehow think it's ok that random companies can see everything their citizens do online. National security risks maybe? Trade secret issues?
It's almost suspicious to the point where I would start thinking those third party spy companies are possibly (US/5 eyes) government run?
android's have done similar for a very long time; customers have known about it, and turn a blind eye cuz its a new-shiney
So it makes sense from a US-gov perspective.
My point was that the Samsung spyware is sending data about (for example) US users to non-US companies and government (South Korea). I guess they're also integral part of the NSA by now. I have no other explanation :P
“Mind blowing” is too strong a word when every thread about Apple on HN is demanding the iPhone be opened up to the same, taking away non-tech people’s choice to buy a bloat free and privacy defaulted device designed to stay that way even if people more technically savvy try to hook in.
It’s a fine line, of course, since the same non-tech people love IAP and ad-supported, as shown by the folks opting into ads on Hulu, Netflix, and Amazon Prime decades after similarly opting into ads on paid cable. So how to let users have ad-tech supported apps, without ending up like the Android ecosystem?
> legally … not in jail
Apple’s approach was a curated ecosystem, and the level of hate for it tells you app makers aren’t worried they should be in jail, they’re worried iOS users have that sweet sweet “wallet share”. HN’s EU DMA threads tell you plenty voices don’t just want what they do legal, they want it illegal to slow their roll.
PS. A lot of big data and big analytics cross pollinates with the US government. Three letter agencies even do VC deals.
The worst part is that the most used national ID-function now stops you from using third party "approved" keyboard due to (misguided) security reasons. Both AnySoftKeyboard and AOSP keyboard is banned.
Maybe Google broke some API endpoint and the old keyboard didn't do the update grind.
No warning what so ever for their spyware taking over the keyboard functionally.
The need for some FOSS mobile is really over due by now.
Edit:
> I immediately found an open source keyboard to replace samsung's with
Which keyboard did you pick?
There is already a Foss mobile OS, it's called Android, or more specifically a distribution of it like LineageOS. But installing it is so difficult that only 1% of people have the technical know how to even attempt it, and it's getting more difficult as manufacturers introduce more and more hurdles in this process.
Which is all irrelevant anyway because the vast majority of people done even realise that everything they see, do, or type on their phones is reported to hundreds of companies, processed, and te-sold to thousands of companies all over the world.
We need regulation, full stop.
Politicians of course have hard time with technology, so of course the regulation will be terrible for users, especially given the Big Tech lobbying, but still. We should do better.
You can bring this to the attention of other EU citizens so that they too badger their representatives about this. It's not like any individuals vote in a larger EU country is worth more than yours.
BTW magisk has a way to hide from the apps, so that might be the reason - that doesn't mean there isn't a problem with the regulation. But 2 of my 3 banks see through that. And one of them doesn't want to load on LineageOS even if it's not rooted because it's compiled in some dev mode that might allow something...
Aside: there is also /e/OS (or MurenaOS - their naming is inconsistent). It is basically LineageOS that someone else installs for you so you get everything in a package [0].
They sell many phones, but it also runs nicely on Fairphones if you want a phone that you can repair (there is of course a compromise in price / performance there - depends on what matters to you the most).
Not affiliated, just a happy customer.
From what I read, Murena has a Google Play services reimplementation that isn't compatible with Lineage. Is that still the case?
In /e/os/ they have their own app store, App Lounge, with which you can install apps from Google Play through the Google Play API, similar to how the Aurora store does it. And you can also find open-source and PWA apps in it.
More info: https://doc.e.foundation/support-topics/app_lounge
I use fdroid and aurora store for installing apps, and push notifications work nicely using microg. Of course microg needs to connect to G servers (no way around it), but at least it works and there is no G app running on the phone.
As I see it the problem is with the phone manufacturers, only supporting Google.
Also, there is this problem with banks requiring signed OS:es for their silly app "security".
I did the mistake of trying to find one via Google Play. It pushes so much malware to the top and wont allow you to filter the search. Discoverability there is zero.
It is like I always forgot I need to use fdroid and open Play by muscle memory.
When we were young, this was called a keyloggger and one running was a sign that your computer was compromised.
I guess times have changed.
I use it on all my Android devices. I block all traffic in most apps.
Some Android phones allow you to allow/block Data and/or WiFi separately. My Samsung 4G tablet doesn't allow me to switch off Data or WiFi for some apps, especially the system ones.
This is where NoRoot Firewall does all its good work. It has Global Block list (all ads/trackers go there) and for each app I individually block or allow certain IPs.
So if "Samsung Keyboard" app wants to send your typing home, you block Data/WiFi and leave it trying :)
How did you discover this? Has it been written about? Seems pretty scandalous.
The Samsungs privacy policy on the web states this:
Samsung Keyboard information: The words that you type when you enable “Predictive text”. This feature may be offered in connection with your Samsung account to synchronise the data for use on your other Samsung mobile devices. You can clear the data by going to the “Predictive text” settings.
The Samsung replacement apps is down to personal preference, I find them easier to use than Google "originals".
Having casually interacted with phones from other brands, I consider Samsung among the best Android options as far as software and UX goes.
But even with everything disabled (predictive text, spell checker (as may be obvious reading this), ...), it does cause network traffic.
Any login-data ever used can now be considered leaked. Great.
I've used couple carrier branded phones, that `pm list` commands I posted in a different comment returns literally more than dozen of com.carrier.carriertrademark packages.
The newer phones (since ~2019) don't have Bixby, and Google Pay launches automatically when touching an NFC posnet.
No one in their right mind is suggesting Samsung. Heck, similar to Apple, you have swaths of people warning you about Samsung.
Samsung lives and dies off their huge marketing budget. Buying their phone is more of a psychology thing, than 'I did lots of research and I bought a high quality phone'.
Maybe they got me with their clever marketing but there doesn't seem to be competitive hardware in this class (fast, oled screen, 5g, overall build quality) available from another manufacturer.
Apple and Samsung are the two most popular phone brands in the world, so it's not like "everybody knows not to use them" as you suggest. Actually, it's the complete opposite.
For me it's more of "I'm no longer a kid so I don't have time to do lots of research". Samsung gets my money because their flagships are reliably good.
riiigth.
This is a ridiculous take. Samsung is the entire reason Android didn't go the way of WebOS and Windows Phone.
Samsung had pressure-sensitive pen support on Android 5 years before iOS. Samsung DEX desktop environment can turn my phone into a proper work machine with just a USB-C display cable and a lapdock.
They've also had folding phones that can turn your phone into a tablet for several years, but I suppose we'll need to wait until 2030 when Apple launches it "the right way" to recognize it as an innovative form factor.
it sounds fantastic hence i suppose there is a catch
The catch with Dex is that it's only offered on the high end models: Galaxy S and Galaxy Z Fold series phones.
I got a Samsung S21 as my daily driver, but just wanted to check out a non-Samsung one over time.
So far I've been very impressed. It comes with Google apps for almost everything, the Moto specific stuff seems to be addons you can easily ignore.
Even came with a transparent protective case and audio jack.
Performance-wise I don't notice any difference in normal use, ie surfing, pictures and such. I don't play games though, there the S21 would blow it out of the water according to benchmarks.
Screen isn't quite as good, but close enough that I'd be happy with it as a primary phone.
Only thing that's a bit of a downer is they only do 3 years of security upgrades it seems. This is a bit short I feel.
Haven't tried any of the other brands over time in recent years, just adding my 2 cents.
Google Pixel 5a... The last Google product before they went full Apple.
Other than the palm pre, my first smartphone was the galaxy nexus. It's still probably my favorite smartphone ever -- samsung hardware and google software both going full throttle really is the ideal, but for some reason they just don't play ball like that anymore.
I got a ZenFone8 when it came out and was very satisfied with it at the time. Then, a month later, posts started popping up with people reporting that their phones just randomly rebooting and bricking. I think there were a few hundred cases reported. To this day, there is no official response from Asus. I used to carry a backup phone with me every time I was away from home for longer than a day because I was afraid that my phone could die at any moment.
Also, every update seemed to introduce a new bug that only got fixed in a month or so with the next update. So we had broken face unlock for a month, broken Google Pay, broken notifications, among other things.
I haven't been following reports for the ZF9 or ZF10, but I think they had similar problems.
To top it all off, the official unlocker / root tool from ASUS has been disabled for over a year by now, and nobody knows when it will work again.
All in all, ASUS phones (at least the ZenFone line) do have great hardware, but official support is abysmal.
> First, please note that unless you have opted in to use a Microsoft SwiftKey Account on your Android device, all personal and language data generated by Microsoft SwiftKey is stored locally on your device and is never transferred.
I use it since it seamlessly swaps between enabled languages. I can write something like "meet me at Østerport Station" smoothly.
I actually use the Samsung web browser, because it allows ad-blocking out of the box, which Chrome on Android won't allow...
I've always used gboard as a keyboard (googles keyboard) and disabled the options to get really predictive and smart as I'm sure that makes it learn more closely and potentially send back data to google etc.
It's insane how prevalent this is. The other day, I opened my calculator app and was met with a cookie banner (https://imgur.com/a/njJEiqY) - I uninstalled it on the spot out of sheer incredulity. The irony was that I originally installed Simple Calculator because it was simple and open source, so I presumed it would escape being a trojan horse for data collection. I guess not.
There's a group that forked the original open source apps:
I only had 1 poor quality phone that cost $400, 10 years ago, and I was traumatized.
Occasionally I get a work Samsung phone and they really are the Apple of Android.
(I get the impression from your comments in this thread that maybe you're trying to create such a consensus or the illusion thereof, to get people used to seeing Apple casually referred to as an exemplar of some unstated kind of badness, or something like that. That sort of thing never works.)
Sony Ericsson, Motorola - Pretty much stock Android. Though this was almost a decade ago, so not sure what's their state now.
Xiaomi - Absolutely filled with bloat, but really cheap + flagship specs. Easily fixed by flashing LineageOS.
Pixel 1st gen - No bloat, stock
Asus - My current phone. No bloat, though it has a lightweight skin + QoL stuff that I don't mind. I use it non-rooted + stock OS
Presumably if you go far enough back you’d find warnings of dystopia applied to coming down from the trees.
`dpkg --get-selections`: `adb shell pm list packages | sort`
`dpkg -r <pkg>`: `adb shell pm uninstall -k --user 0 <pkg>`
1) `adb shell dumpsys activity service SystemUIService`
2) search for "icon slots: " and note down names
3) `adb shell settings put secure icon_blacklist battery,wifi,clock, ...` (blacklist is overwritten by new list upon running this command)why that happens at google so often?
Is the mobile computer hardware industry that hostagedly cowardly locked down that this is no longer possible as it used to be, where people don't even own their own computer devices and instead have to use devices that are owned by other entities? Or what other explanation is there for no such multi-device operating systems? Or did I just miss something that I am blind to?
There are ZERO open source OS for mobile. ZERO. NONE.
even the ones you list doesn't have access to essential drivers. What do they do? they get the driver as binary blobs from the original image, and just ship them. So all those projects are 1) full of closed source kernel drivers. 2) stuck on a specific kernel version to be able to use those binary drivers.
So the MOST those open source versions can do, is set a different set of "system apps" everything else must be the same as the closed source OS. It's barely more than theming in practice.
> compiling all the hardware variations to have drivers and support for practically everything for everyone to get mostly the same experience regardless of which hardware they use
Again, there is ZERO open source on those. All you need to support device X is a root exploit so you can get the binary blobs. Done. Now you can ship to that device.
the whole project was done by teenagers extracting blobs.
then, one, a single, Samsung model was chosen as the holygrail for no other reason other than two devs had it. they worked on reverse engineering some of the essential blobs and providing very crude drop ins (thing barely functional. absolutely no power efficiency concerns, etc).
that one device then got older and cheaper and more devs got it. continue to reverse engineering.
today, a decade latet, that model is very old. functionality is still stuck on 2g or 3g for a 4g modem.
...if modem is that far behind take a guess how bad is the rest of the components.
it's a shit show. and you are correct in that this one is indeed the best example of a fully open source driver mobile.
This is false. Sent from my Librem 5, which runs FSF-endorsed PureOS.
they signed the same NDA as other OEM.
your so called open source drivers are full of binary blobs, which ironically are just the chip manufacturer reference implementation code compiled, with little else.
librem5 just shouts the lie louder. it's as closed source as any other device. like raspberrypi in terms of drivers.
...and I'm not going into the illegal investment scam librem company spams every one of their customers.
There is no scam in Purism. I received all my devices, and they're as advertised.
about fsf. well, the least worse is still just the least worse. doesn't make it magically open source.
> doesn't make it magically open source
It does make the OS FLOSS, which is all they say.
https://androidauthority.com/grapheneos-3287030/
> "Even if you stomach the Pixel-only requirement"
I have not and will not stomach that at all. Nope!
https://grapheneos.org/faq#supported-devices
Nope! I wasn't paying attention, but if I remember, Alphabet/Google was funded to deploy/release Android operating system, and they also were financed to deploy some hardware phones before disappearing to let other companies continue the things and then reappear somehow taking advantage of all the othre companies to outperform all of their manufacturings and whatnot, and then operating systems exist only for the Google phones and none of the others, and this is normal? What? I say F to that coward hijacking others efforts stuff!
I see https://calyxos.org/#Devices Devices section is showing a little bit more than I remember not too long ago http://web.archive.org/web/20230605161332/https://calyxos.or... but still not comparable to what I remember with the likes of OpenWRT, HyperWRT, DD-WRT, Tomato, etcetera. Therefore I do not and will not trust anything GrapheneOS or CalyxOS. Whatever the efforts were that led to wifi routers having lots of open source firmware developments to be supporting lots of different devices, I'd like to see similarly for mobile phones, and whatever concentration there is to finance only developments for Google made phones only, this is red flag hostage coward impression to me, and I will not submit or acquiesce or capitulate to invest in any of that at all, even if nothing else exists.
edited for grammar
> "Base system is open source, but many devices use proprietary drivers for hardware support, and most Android operating systems include Proprietary apps (such as Google Play and other Google apps)."
Okay, so, look at history of AMD GPus and NVIDIA GPUs for proprietary linux drivers and open source/free software alternative drivers that even without the AMD/NVIDIA companies to help at all (regardless of if they did, especially NVIDIA blatantly refusing to help and intentionally making it difficult and whatnot), still there are open source drivers for practically every single AMD and NVIDIA graphics processing unit hardwares to make them work. So, why not the same possibility outcome for mobile computers running Android operating system or other Linux AArch64 or ARM64 architecture o/ses. How is it that barely any signs of strong brave developer programmer humans remain able to dedicate their attention to these efforts that decade ago such skilled programmer developer humans existed but no longer
> "Google Pixel 5a... The last Google product before they went full Apple." - resource_waste https://news.ycombinator.com/item?id=39733518
lol
Second you forget that while not supporting full 3d performance on those gpu, you still had at least a 2d framebuffer to use your system.
On mobile, Without those blobs, the CPU doesn't initialize. The bootloader won't pass some signature safeboot check. The radio won't turn on. Wifi and bluetooth won't work. The screen won't display anything. the digitalizer won't work. no battery charging. usb into otg? nope. etc etc etc.
Managed to fix it, but learned to be careful - what might be critical for one model might be bloat for another.
Here's a writeup about packages which are safe to remove in MIUI: https://wooptoo.com/blog/safe-to-remove-packages-miui/
This is from a few years ago but it should still apply today.
https://github.com/Universal-Debloater-Alliance/universal-an...
I'll try to reproduce if I get time.
Not to mention FI is cheap as hell if you use internet mostly over wifi.
Edit: bloat, not boost
What tangible harm is it doing that makes you think you can't live with it? If there's a Facebook binary on my phone that I've never logged into, is it doing anything? Is Candy Crush playing itself in the background if I never launch it?
Couldn't it? Apps can start without ever being launched by the user, or continue running in the background after they are "closed", and that means that they can collect data then send it home or to third parties. There's a ton of things an app can do without any permissions or indicating to the user that anything is happening. It's been used for things like listening for audio beacons and reporting them when overheard.
I wouldn't want to trust a company like facebook to not abuse every option available to them to collect data. There's also a problem with vulnerabilities. That "unused" facebook binary might contain a flaw that could be exploited. Getting rid of installed applications you don't need/want is a good way to reduce your attack surface.
Android does not do the 'phone' part right. I constantly complain of a friend with his new expensive s23 or whatever that acts like a cheap phone whenever he gets in a group call and my whole group complains of the ear shattering noise and artifacts from his side immediately (nothing at all wrong with all of our iphones). It was bad enough we couldn't do higher quality facetime audio together, but the expensive phone's hardware on wasn't even good for various apps we tried to talk through.
From another thread they aren't even good at web browsing. https://news.ycombinator.com/item?id=39729397 the entire ecosystem of Android is a mostly poorly cobbled together mobile Linux computer aiming to lower costs as much as possible to sell you ads. Notice how older iphones with worst specs are still working fine?
Still my Samsung S3 with it's forward thinking 2gb of ram in 2012 (4x the 512 in the iPhone 4s) is still sometimes being used as a Linux computer for me in 2024. Awful mic on it then as well.
Sure the hardware might be better but the software though... Anything related to icloud, the appstore and the accounts themselves looks like it's holding up together with duck tape.
> The internet is full of threads of people with this exact problem but there's never any documented way to fix anything in an iPhone, it either fully works or good luck.
Is that hyperbole? There's a video of a guy putting a headphone jack in an iphone 7.
I can't remember the exact error text but any attempt to install or update an app said something about an error setting up payments (even a free app) and the only way to stop this modal loop was to reboot the device. It's just in a drawer now.
That kind of sums up the general experience I had with the device.
For my wife's keyboard issue it's pretty random, you are typing and then the whole screen freezes for 4 seconds, when whatever you typed while frozen unbuffers all at once. I guess it's some bug in the Vietnamese IME since the keyboard needs to buffer diacritics (I'm just guessing)
> Is that hyperbole? There's a video of a guy putting a headphone jack in an iphone 7.
No it's just how it works in iPhone, full of random suggestions in case anything sticks because nobody has an idea on how it works and there's never any debug info.
Another example, I had another error setting up the dev account, nobody knew what to do, even their own support at Apple!
You can get debug info. I have copied my crash logs.
If your wife's using a 3rd party keyboard they are treated worst and may crash. Android has always gotten better with their interface but they are locking more and more stuff. I would use Android if i didn't always get audio issues, I would rather use a computer with a phone, but not if the phone makes me unlistenable. Hope your Android issues are nonexistent or manageable.
Maybe you can, it just seems harder than adb since I only have Linux machines now.
> If your wife's using a 3rd party keyboard they are treated worst and may crash
No this is the standard iphone keyboard which is freezing the screen, I didn't even know you could have third party ones on iphones, I thought they were not allowed by Apple. I guess that changed.
> I've never heard of it, but it sounds like a very easy fix.
Yeah sure it can be done technically, I would have to factory reset the iPhone again and it might fix it but I really didn't want to fiddle with it anymore to make it work though, I was already tired of it.
> Android has always gotten better with their interface but they are locking more and more stuff. I would use Android if i didn't always get audio issues, I would rather use a computer with a phone, but not if the phone makes me unlistenable.
Personally I never encountered audio issues on Android. Except if we're talking about Bluetooth but I'm convinced it's impossible to make a Bluetooth device that works, I had Bluetooth bugs on Windows, Linux, Android and iOS.
https://xdaforums.com/t/windows-linux-tool-fire-toolbox-v33-...
You might be able to install a third-party, community-maintained OS, like LineageOS, though, if your hardware is supported. The downside is that I believe apps like Google Pay won't work anymore, since they require Google's SafetyNet attestation system to pass. Sometimes there are ways around that, but they always seemed like unreliable hacks to me.
One and only problem i see with Lineage is that VoLTE wont work and as we dont have 3G anymore it is must have.
Now it seems only Google's own Pixel phone is the only one that's hackable enough to run LineageOS or /e/ or other de-Googled distros.
https://shizuku.rikka.app/ https://github.com/samolego/Canta
[1] - https://github.com/Universal-Debloater-Alliance/universal-an...
In some countries (Scandinavia...) not having the banking app is inconvenient, as it's used for authentication with many other services.
Most apps I use (ie. banking) are bypassed simply by adding them to a hide-list.
The only apps that require a bit more work / expertise are apps that require integrity checks (ie. google wallet).
"A bit more work" but only for now... There is a loophole (spoofing the device fingerprint with the one of an old model where non-hardware attestation is still accepted) but Google is starting to ban those models and it's only a matter of time until they're all banned.
I would find it annoying if I had to carry the keyfob. I have it as a backup.
https://www.mitid.dk/en-gb/get-started-with-mitid/mitid-auth...
By using an app or various hardware keys — with a maximum of three active methods — they can reduce the chance that additional people have access, and prevent duplication of the private keys. This isn't possible with a QR code to scan for TOTP (you can scan it on multiple devices, or print it out, or have a computer with malware doing this).
Initial authentication is done using a passport, or in-person at a local government office for people without one (or without access to a phone capable of reading the passport's chip).
(This is just my general understanding of the system.)
Disable Knox on a Samsung device and it will brick itself. Luckily when this happened to me I was still connected over ADB, able to re-enable it and the device unbricked
Is there any Android phone brand/model that is not exploiting its users?
I've used flagship Android Samsungs since Google stopped Nexus phones, and they were great. The hardware is fantastic, you can install and change any default app, and their performance doesn't degrade in time.
I can count 4 pre-installed apps that I forgot about. It has much less bloatware than an iPhone, that comes preinstalled with a dozen useless apps that cannot be removed from your home screen.
Safari was the most egregious, since all other browsers had to use it as a backend.
Doesn’t that exactly explain why Safari couldn’t be removed?
It’s poor design, but Safari is one of those special apps that is both UI and system component. Same thing behind the PWA mess.
My tablet came with a weird Google Now replacement that I can't remove, but that's the only bloatware I really encountered. The rest was free versions of paid apps like drawing software and the standard Samsung suite. No weird shopping apps, no ads anywhere, just what I wanted for the tablet.
Xiaomi is pretty bad, though. It kind of makes sense, because they need to develop their software for China, where there is no Google cloud, so they've become their own Google. Every app prompts for agreeing with a privacy statement. Some models of phones actually include ads in the system apps (which can be disabled by a setting, but it's still a problem). Their privacy policy is also a blatant lie. I love the bang-for-the-buck nature of Xiaomi phones, but I wouldn't buy them unless there's a good custom ROM available. Other Chinese brands suffer similar problems, but not to the same extend.
I'm considering buying one as I'm paying £16/mo for just a SIM but I can get a 7a on a contract for the same price!
That sounds like a pretty sweet deal!
My parents both each have some Samsung and it's awful whenever I have to help them do something.
In this case I actually agree with your “side” of the argument, but not the construct.
I made the mistake of only lending the same amount of effort as the comment I was replying to: not a lot. Everyone else has said it, but these tools are essential to avoid a lot of the awful OEM software that Samsung forces on its users.
https://discuss.privacyguides.net/t/universal-android-debloa...