Google Data Collection on Android
summary
Creates a VPN man-in-the-middle with a custom certificate authority on a Nougat 7.1 device, captures and decrypts most HTTPS traffic but hits a wall because QUIC blocked decryption for many Google endpoints; a 12-hour stationary test with setup defaults and a Gmail account shows frequent Google uploads (about 40 HTTP requests/hour in related studies, ~35% containing location), and quick-search calls send an Android ID, email, SDK and country; an OEM solution, GMS restricted disables all GMS apps, prevents data reaching Google.
AI-written summary · about
chapters (9)
- 0:00Introduction and motivation
- 3:59Variables affecting data collection
- 7:10Testing methodology setup
- 10:01Test conditions and findings
- 14:59Academic research on data collection
- 26:49Value versus privacy concerns
- 29:16Controlling data collection
- 32:23GMS restricted feature demo
- 33:26Q&A and resources
related talks
27mRemoving Google from smartphones
40mSecurity, an Enterprise perspective
39mO-mg what's new in Android Security?
20mDemystifying the Android Telehealth Ecosystem
31mA comprehensive guide to tracker protection on Android
37mHey, You, Get off My Private Data: Do Apps Respect Your Privacy as They Claim?
39mSecurity on Android: What's next
12mIntroduction to counter-abuse technology at Google