There really should be no doubt that a system application can have unlimited and unrestricted access to everything, bypassing all security and sand boxing. That is the extent of the meaning of system app. It’s like having root privileges, admin access.
Whether Google makes use of it or not is something else, but it could be exploiting that privilege and with Google’s history and the fact that the distributed version of android which contains the google services pre installed is a custom version of android of which you’ll never see the source code, you really have to ask yourself.
That’s why GrapheneOS is so important: you are the user and you get to control how Android works: the way it actually should, where if you install google services (which is up to you!) it gets installed under your terms and with your permissions.
Tell me how you know nothing about how Android works, without telling me you know nothing about how Android works. Speak authoritatively once you learn beyond what r/privacy comments tell you.
Would you care to put any weight behind your accusation?
The main issue I’m trying to expose is that any custom distribution by an OEM can implement any app/service the way they want. The android source code is available, any access and permission can be obtained depending on how you implement it in the source code. You can even weaken the security if you want. Any distribution by these OEMs is a secret sauce, you have no way of knowing what shenanigans they are pulling on your phone.
So yes, they can get root access if that’s what they want.
This is not to say they do. I’m just saying we have no way of knowing how things are implemented and hence why open source is so fundamental to security.
Edit: I concede that the strict definition of what considers a system app does not provide with these accesses. I’m saying any custom distribution with built in apps may have been customized to allow for these things to happen. Perhaps this is where we may have misunderstood each other.
No package in Android has the ability to bypass app permission system (introduced with 4.4 KitKat), unless there is an expensive or undiscovered 0day (that allows Pegasus to work), or some malicious “Administrator” user installed onto device allowing to accomplish this. This covers both system and userspace packages. GMS is no different. There exists no evidence to what you claim.
Any distribution by these OEMs is a secret sauce, you have no way of knowing what shenanigans they are pulling on your phone.
Would you care to put your weight behind your claims? If I have to spot a half knowledge person, I just need to spot anyone cheering about GrapheneOS being some kind of revolutionary AOSP fork.
Android, including its OEM and AOSP forks, is fairly very deterministic and not some Madagascar jungle with man-eating plants and magical evil vines.
Just stop blabbering these buzzword phrases “opensource=security” “grapheneos gud” to fuel your confirmation biases.
There really should be no doubt that a system application can have unlimited and unrestricted access to everything, bypassing all security and sand boxing. That is the extent of the meaning of system app. It’s like having root privileges, admin access.Whether Google makes use of it or not is something else, but it could be exploiting that privilege and with Google’s history and the fact that the distributed version of android which contains the google services pre installed is a custom version of android of which you’ll never see the source code, you really have to ask yourself.That’s why GrapheneOS is so important: you are the user and you get to control how Android works: the way it actually should, where if you install google services (which is up to you!) it gets installed under your terms and with your permissions.
Edit: correcting a misinformed message and the irrelevant followup. More clarification on system apps here: https://developer.android.com/guide/platform/
Tell me how you know nothing about how Android works, without telling me you know nothing about how Android works. Speak authoritatively once you learn beyond what r/privacy comments tell you.
Would you care to put any weight behind your accusation?
The main issue I’m trying to expose is that any custom distribution by an OEM can implement any app/service the way they want. The android source code is available, any access and permission can be obtained depending on how you implement it in the source code. You can even weaken the security if you want. Any distribution by these OEMs is a secret sauce, you have no way of knowing what shenanigans they are pulling on your phone.
So yes, they can get root access if that’s what they want.
This is not to say they do. I’m just saying we have no way of knowing how things are implemented and hence why open source is so fundamental to security.
Edit: I concede that the strict definition of what considers a system app does not provide with these accesses. I’m saying any custom distribution with built in apps may have been customized to allow for these things to happen. Perhaps this is where we may have misunderstood each other.
No package in Android has the ability to bypass app permission system (introduced with 4.4 KitKat), unless there is an expensive or undiscovered 0day (that allows Pegasus to work), or some malicious “Administrator” user installed onto device allowing to accomplish this. This covers both system and userspace packages. GMS is no different. There exists no evidence to what you claim.
Would you care to put your weight behind your claims? If I have to spot a half knowledge person, I just need to spot anyone cheering about GrapheneOS being some kind of revolutionary AOSP fork.
Android, including its OEM and AOSP forks, is fairly very deterministic and not some Madagascar jungle with man-eating plants and magical evil vines.
Just stop blabbering these buzzword phrases “opensource=security” “grapheneos gud” to fuel your confirmation biases.