[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
Security Hardening Features - Details

1. Pre-installed microG and F-Droid

same as the LineageOS for microG project

2. Pre-installed AuroraStore

works w/o having to enable the "unknown sources feature"

3. Restrict access to /proc/net for user apps

An adapted SELinux policy prevents user apps from accessing the /proc/net pseudo file system, which can be misused to monitor and track the phone's internet traffic. For technical backgrounds, see here. For the legitimate use case of the smart phone owner him/herself monitoring the network traffic to see, what the installed apps do, the app Privacy-Friendly Network Monitor has been bundled.

4. Enhanced Privacy Guard - Sensor permission switches and background control

An own sensor template to control access to motion sensors ('ask' mode) and all other sensors (allowed by default, but can be restricted) has been implemented into the Privacy Guard. Further, the following background activities can be restricted in Privacy guard:

Background Clipboad access (forbidden by default, can be allowed per app)

Background Location access (allowed by default, if location access as such is allowed, can be forbidden per app)

Background Audio recording (allowed by default, if microphone access as such is allowed, can be forbidden per app)

5. Cloudflare (instead of Google) default DNS

Cloudflare DNS has a better privacy policy than Google Public DNS and has DNS-over-TLS and DNS-over-HTTPS. In the deafult DNS settings (as fallback) and network diagnostics, the Cloudflare DNS adresses 1.1.1.1 and 1.0.0.1 are specified as defaults (instead of Google's 8.8.8.8 and 8.8.4.4)

6. Privacy-preferred default settings

When newly installed, the below settings are defaulted, different from standard LineageOS 15.1 (all settings can be changed at any time later):

Privacy Guard is enabled on install (proposal during Setup)

Anonymous LineageOS statistics disabled (proposal during Setup)

The standard browsing app does not get the location runtime permission automatically assigned

Sensitive information is hidden on the lock screen

Camera app: Location tagging disabled by default

Apps having the PACKAGE_USAGE_STATS permission appear by default as "not allowed" under Settings => Security & privacy => Apps with usage access (instead of opting out here, the user needs to explicitly opt-in in order to have the app collecting this data)

Further, when a lock screen protection is set (PIN, pattern, password), the Nfc, Hotspot and airplane mode tiles require authentication and cannot be set without

7. Optional blocking of Facebook- and Google-Tracking

Until April 2019 build: Settings => Network & Internet => Data usage => Menu => "Apply iptables block script"

Starting with May 2019 build: Settings => Network & Internet (scroll down)

When activated, all outgoing connection attempts to Facebook servers will be suppressed.

Same applies to Google, but certain apps on an internal exception list will still be able to connect (Yalpstore, microG, or e.g. NewPipe, if installed)

8. Optional disable captive portal detection

Until April 2019 build: Settings => Network & Internet => Data usage => Menu => "Disable Captive Portal"

Starting with May 2019 build: Settings => Network & Internet (scroll down)

When activated, the system will not ping a specific Google server any longer when establishing a WiFi connection to determine, whether a captive portal is being used.

9. No submission of IMSI or phone number to Google/Sony when GPS is in use

GPS also works fine, if no SIM card is present, so there obviously is no benefit for the phone holder (different from other involved parties :rolleyes:) to provide this data . . .

10. Default hosts file with many blocked ad/tracking sites

The system's hosts file redirects a comprehensive list of URLs known to be adware, tracking, etc. to 127.0.0.1 (ipv4) and ::1 (ipv6)

11. Privacy-enhanced Bromite SystemWebView

Instead of the default Chromium System Webview component, the Bromite SystemWebView is used offering more privacy, more ad blocking and less Google tracking.

12. Deny new USB option

Settings => Security & Privacy

Control, what happens, if a USB device is connected to the device: Allow, allow when unlocked or block.

13. Option to define an own DNS

Settings => Network & Internet (scroll down)

You can optionally define an own DNS, which is used instead of the default DNS of the ISP (uses iptables)

Note: If your ISP intercepts DNS queries to enforce their own ISP - e.g. to enforce surveillance/censorship - this option won't work . . .

14. Maximum password length increased to 64

15. Additional restriction options for secondary users

- Disallow app installation option

- Disallow audio recording option