I’d like to install shelter but couldn’t find its privacy policy.
Anyone knows where its might be?
Is privacy policy necessary or it’s only just a statement?
You don’t need a privacy policy when the app doesn’t connect to the internet or collect your data in any way.
5 Likes
There’s one permission: “read the contents of your shared storage”. I guess it’s sorta data collection?
I heard that some apps interchange data with another. How do you know if it’s happening?
It’s more about what happens after? If no INTERNET permission there are still ways, eg. Use a Webview that has access, or open a browser with a special link that contains (leaks) your files, etc.
Again, a good enough (read money/government/etc) dev can do these. Butttttttt… since F-Droid needs full source these things need to be programmed “in the open” risking eyes that could see it, users asking questions.
Examples?
Get Netguard from F-Droid, whitelist mode (block all by default, allow only some), look at apps servers, put a hosts blocklist, etc
3 Likes
Not necessarily. Shelter has a “file exchanger” to manage the contents of the work profile and the main profile.
However, there may be other reasons why the permission is required.
1 Like
Oh I see. Thanks for explaining! I’m not really familiar with these
Btw I read on reddit that said, sandbox reddit “shelter runs right on top of the kernel and the sandbox which exposes more attack surface for security and more access to device data.”
Is this true?
This is the only piece I could find. All I know is shelter runs as a work profile.
You need to note which context of security you mean when you use Shelter for sandboxing.
Shelter isn’t a technical sandbox, but more of a partition between your other apps, preventing them from reading your pictures or contacts. And having an easy toggle to stop them all at once.
All apps on Android are already each sandboxed, some apps (like Chromium) even isolate the insides too (isolatedProcess).
2 Likes
(unrelated, but doesn’t merit a whole separate topic)
The “guidelines” page FAQ - F-Droid Forum contains a broken linked labeled “site feedback category” ~~ points to a non-existent https://forum.f-droid.org/c/site-feedback page.
1 Like
Thanks for explaining!
I suppose security and privacy are intertwined in some way. I’ll try to be more specific next time
Of note, the current Protonmail drama highlights one of the issues: never believe the “we don’t log IPs” lie for services that you don’t host, and if you host on machines you don’t own, etc
1 Like
“If no INTERNET permission there are still ways, eg. Use a Webview that has access, or open a browser with a special link that contains (leaks) your files, etc.”
That’s pretty scary. Didn’t know about this.
How to get around this with a universal setting or configuration?
Without root? I don’t think so. Rooting would be worse anyway. I can only give some basic advice:
1 Like
None of the 3 points you suggested require root. So is it at all possible to completely block app from connecting to the internet?
I’m using Oxygen OS which provides native support to block internet access to 3rd party apps (and some pre-installed apps too).
On my non-rooted devices, I use Karma Firewall or Netguard. I’m aware apps can still use Google Play Services for license verifications and some important notifications. But beyond that, I was under the impression they cannot access internet through any means.
Encryption doesn’t seem to be a practical solution for normal use.
For example, if I install a gallery app I must provide it access to my internal storage. But I would disable internet permissions using the methods described above. I was always comfortable thinking that the gallery app (in this case) cannot upload my pictures to anywhere outside the device. But now it seems there is still a possibility that can be exploited to bypass the restrictions in place. Same holds true for file manager apps and other apps.
How can this possibility be taken care of? Even root solutions are welcome.
1 Like
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.