[OnePlus 3 & 3T Cross Device Development] MSe1969:
Security Hardening Features - Details

1. Pre-installed microG and F-Droid

same as the LineageOS for microG project

2. Pre-installed AuroraStore

works w/o having to enable the "unknown sources feature"

3. Restrict access to /proc/net for user apps

An adapted SELinux policy prevents user apps from accessing the /proc/net pseudo file system, which can be misused to monitor and track the phone's internet traffic. For technical backgrounds, see here. For the legitimate use case of the smart phone owner him/herself monitoring the network traffic to see, what the installed apps do, the app Privacy-Friendly Network Monitor has been bundled.

4. Enhanced Privacy Guard - Sensor permission switches

An own sensor template to control access to motion sensors ('ask' mode) and all other sensors (allowed by default, but can be restricted) has been implemented into the Privacy Guard.

5. Cloudflare (instead of Google) default DNS

Cloudflare DNS has a better privacy policy than Google Public DNS and has DNS-over-TLS and DNS-over-HTTPS. In the deafult DNS settings (as fallback) and network diagnostics, the Cloudflare DNS adresses 1.1.1.1 and 1.0.0.1 are specified as defaults (instead of Google's 8.8.8.8 and 8.8.4.4)

6. Privacy-preferred default settings

When newly installed, the below settings are defaulted, different from standard LineageOS 16.0 (all settings can be changed at any time later):

Privacy Guard is enabled on install (proposal during Setup)

Anonymous LineageOS statistics disabled (proposal during Setup)

The standard browsing app does not get the location runtime permission automatically assigned

Sensitive information is hidden on the lock screen

Camera app: Location tagging disabled by default

Further, when a lock screen protection is set (PIN, pattern, password), the Nfc, Hotspot and airplane mode tiles require authentication and cannot be set without

7. Optional blocking of Facebook- and Google-Tracking

Settings => Network & Internet (scroll down)

When activated, all outgoing connection attempts to Facebook servers will be suppressed.

Same applies to Google, but certain apps on an internal exception list will still be able to connect (AuroraStore, microG, or e.g. NewPipe, if installed)

8. Optional disable captive portal detection

Settings => Network & Internet (scroll down)

When activated, the system will not ping a specific Google server any longer when establishing a WiFi connection to determine, whether a captive portal is being used.

9. No submission of IMSI or phone number to Google/Sony when GPS is in use

GPS also works fine, if no SIM card is present, so there obviously is no benefit for the phone holder (different from other involved parties :rolleyes:) to provide this data . . .

10. Default hosts file with many blocked ad/tracking sites

The system's hosts file redirects a comprehensive list of URLs known to be adware, tracking, etc. to 127.0.0.1 (ipv4) and ::1 (ipv6)

11. Privacy-enhanced Bromite SystemWebView

Instead of the default Chromium System Webview component, the Bromite SystemWebView is used offering more privacy, more ad blocking and less Google tracking.

12. Firewall UI

Settings => Security & Location - Firewall

Lists all apps and allows to restrict Internet access per app in regards to WiFi, mobile network or VPN

This per-app feature is a standard feature in LineageOS, but the UI to show all apps is an Extra (taken from a topic in LineageOS's Gerrit - it may, or may not, become part of the official LineageOS one day)

13. Maximum password length increased to 64

14. Additional restriction options for secondary users

- Disallow app installation option

- Disallow audio recording option