I admit that its not really an FP3 question as its more AndroidPie related. But since I have not found anything useable on the web I think it fits well here. I do not use WhatsApp (WA) but by better half does.
I am no WA expert, but it scares me to see what premissions the device needs. You need to open all your whole device to this application. Luckily 99% of the features are not used in our case, and a few restrictions and workarounds would be fine (e.g. not address book access, not images, not audio etc). But I can not wait until a root/Recovery solution has been found.
So I am looking for a way in an unrooted FP3 to lock down data leakage to WhatsApp/Facebook as much as possible. Or phrased differently: What are my attack vectors to shrink down this tool to its basic messaging features?
Here is what I have so far.
After spending some time here and at www.kuketz-blog.de (very recommendable read but unfortunately only in German), I do have in place NetGuard and replacements for all major apps from the F-Droid store, so I could disable or block almost all Gapps and com.google.andoid.xx services. I use every permission and control feature I could find to limit access of whats app, but my feeling is that most build in functions are quite useless against WhatsApp. Imho there is not point in unsing its built-in functions
There are other blocking tools, but unfortunately they either require root or use VPN. Since Android 9 only allows one app to use the VPN I think its not possible to combine them. NetGuard does a great job and should be enhanced with Pro functions, but its not clear to me how to get the pro version without using PlayStore.
I did not really find a lot on how WhatsApp really operates. It sends out encryted, so we can not tell what in there. For example it there an outer encrytion for User and Metadata and an inner for the actual message? Or are packets are actually sent to destinct servers. And do we know what information goes where?
I am sure there are a lot of people who know a lot more about this than I do. And I would like to learn what I can. So please give me some hints where to look or tell me what you have found out or how you did solve that issue.
The basic concept is clear but I did not find really a lot of information about the tool and usage details (also on github). Maybe someone knows a linke where to find a bit more depth.
I installed it and got an installation with an easy to start link on the desktop. Also it starts.
I did not yet find out how to remove file from the shelter
I did not understand yet where the workspace/Shelter concept stops, e.g. Android as a single VPN limit. So should I close NetGuard to shelter and run it in parallel, or will this cause the other version to fail?
I know this was not really your question, but before you put a lot of work into running WhatsApp, have you asked your better half and others if they (would) use another messenger? There is a nice list here in the forum:
My favorite suggestion would be Conversations which is also available in a free and easier-to-get-started edition called Quicksy:
(Again, my apologies for hijacking the thread and not actually helping with your question.)
I know this was not really your question, but before you put a lot of work into running WhatsApp, have you asked your better half and others if they (would) use another messenger?
Thanks, but as you guessed, thats the first thing I tried…
But my strategy is now changed. As I never uses WhatsApp (and never will) I try to convince family to use Signal internally hoping by getting used to it they might convice their friends to give it try, too
There’s a Universal (non-GSF) version of Signal in another repo called Ember. I don’t know what GSF is, so be cautious with that one. The rfc one is the same signature as the Google Play one, as they can update over each other =)
NetGuard uses a VPN profile for its firewall functionality, as that method does not require root. So you cannot combine it with another application using VPN functionality to filter data, such as Blokada.
You can use a DNS server which does ad blocking though, such as a Pi-Hole, or a publicly available one.
This is also why I don’t use NetGuard; I use the VPN functionality already (WireGuard, to be specific). However, I can set WireGuard up so that network connectivity is down without the VPN being up. On top of that, I use a DNS server on the WireGuard endpoint which utilizes DNSCrypt and Pi-Hole. So the connection is secure regardless of the network, roaming works well (due to WireGuard), and ad blocking works as well. What does not work is firewalling. I’d need root for that (ie. IPTables with AFWall).
I did read something about clustering SOCKS proxies, haven’t looked into it though.
I still have an old Android phone, which I only turn on to download from Play Store. (Or, if the app in question does not match the old phone, I ask somebody else to download it.) Then I use an app extractor to get the APK, and copy that to my FP2. Some apps thus installed complain about missing Google, but all I encountered so far work well if you acknowledge these messages.
People using it without PlayStore seem still to be an absolute minory. I hoped I could spare the author to invest time in a single purchase but thats all the information I do not have about the app without GooglePlay (even not from his web site)
actual cost info
terms of the license (one time, abo, how many devices per user etc)
how licensing works w/o google at all
how this works with updates. Re-applying some code or re-activation after each update would be an usability nightmare