[OnePlus 3 & 3T Cross Device Development] MSe1969:
Security Hardening Features - Details

1. Pre-installed microG and F-Droid

same as the LineageOS for microG project

2. Pre-installed AuroraStore

works w/o having to enable the "unknown sources feature"

3. Extra control of sensor access for additionally installed user apps

Special access under app permissions

4. Cloudflare (instead of Google) default DNS

Cloudflare DNS has a better privacy policy than Google Public DNS and has DNS-over-TLS and DNS-over-HTTPS. In the deafult DNS settings (as fallback) and network diagnostics, the Cloudflare DNS adresses 1.1.1.1 and 1.0.0.1 are specified as defaults (instead of Google's 8.8.8.8 and 8.8.4.4)

5. Privacy-preferred default settings

When newly installed, the below settings are defaulted, different from standard LineageOS 17.1 (all settings can be changed at any time later):

Anonymous LineageOS statistics disabled (proposal during Setup)

The standard browsing app does not get the location runtime permission automatically assigned

Sensitive information is hidden on the lock screen

Camera app: Location tagging disabled by default

Further, when a lock screen protection is set (PIN, pattern, password), the Nfc, Hotspot and airplane mode tiles require authentication and cannot be set without

6. Optional blocking of Facebook- and Google-Tracking

Settings => Network & Internet (scroll down)

When activated, all outgoing connection attempts to Facebook servers will be suppressed.

Same applies to Google, but certain apps on an internal exception list will still be able to connect (AuroraStore, microG, or e.g. NewPipe, if installed)

7. Optional disable captive portal detection and to select Captive portal server URL provider

Settings => Network & Internet (scroll down)

When deactivated, the system will not ping a specific Google server any longer when establishing a WiFi connection to determine, whether a captive portal is being used. Further, the captive portal URL provider can be set (default is GrapheneOS and not Google; Settings - Network & Internet)

8. No submission of IMSI or phone number to Google when GPS is in use

GPS also works fine, if no SIM card is present, so there obviously is no benefit for the phone holder (different from other involved parties :rolleyes:) to provide this data . . .

9. Default hosts file with many blocked ad/tracking sites

The system's hosts file redirects a comprehensive list of URLs known to be adware, tracking, etc. to 127.0.0.1 (ipv4) and ::1 (ipv6)

10. Privacy-enhanced Bromite SystemWebView

Instead of the default Chromium System Webview component, the Bromite SystemWebView is used offering more privacy, more ad blocking and less Google tracking.

11. Bromite as shipped Browser

A chromium based browser with many privacy features.

12. Firewall UI

Settings => Privacy - Firewall

Lists all apps and allows to restrict Internet access per app in regards to WiFi, mobile network or VPN

This per-app feature is a standard feature in LineageOS, but the UI to show all apps is an Extra (taken from a topic in LineageOS's Gerrit - it may, or may not, become part of the official LineageOS one day)

13. Maximum password length increased to 64