[OnePlus 7T Pro (Regular & McLaren) ROMs & Dev.] MSe1969:
Security Hardening Features - Details

1. Pre-installed microG

same as the LineageOS for microG project

2. Pre-installed AuroraStore and AuroraDroid

works w/o having to enable the "unknown sources feature"

3. Extra control of sensor access for additionally installed user apps

Special access under app permissions

4. Cloudflare (instead of Google) default DNS

Cloudflare DNS has a better privacy policy than Google Public DNS and has DNS-over-TLS and DNS-over-HTTPS. In the deafult DNS settings (as fallback) and network diagnostics, the Cloudflare DNS adresses 1.1.1.1 and 1.0.0.1 are specified as defaults (instead of Google's 8.8.8.8 and 8.8.4.4)

5. Privacy-preferred default settings

When newly installed, the below settings are defaulted, different from standard LineageOS 17.1 (all settings can be changed at any time later - credits go to the GrapheneOS project):

Anonymous LineageOS statistics disabled (proposal during Setup)

The standard browsing app does not get the location runtime permission automatically assigned

Sensitive information is hidden on the lock screen

Camera app: Location tagging disabled by default

Further, when a lock screen protection is set (PIN, pattern, password), the Nfc, Hotspot and airplane mode tiles require authentication and cannot be set without

6. Optional blocking of Facebook- and Google-Tracking

Settings => Network & Internet (scroll down)

When activated, outgoing connection attempts to Facebook servers and to Google servers will be suppressed. Certain apps on an internal exception list will still be able to connect (e.g. AuroraStore, microG, or NewPipe, if installed)

7. Optional disable captive portal detection and to select Captive portal server URL provider

Settings => Network & Internet (scroll down)

When deactivated, the system will not ping a specific Google server any longer when establishing a WiFi connection to determine, whether a captive portal is being used. Further, the captive portal URL provider can be set (default is GrapheneOS and not Google; Settings - Network & Internet)

8. No submission of IMSI or phone number to Google when GPS is in use

GPS also works fine, if no SIM card is present, so there obviously is no benefit for the phone holder (different from other involved parties :rolleyes:) to provide this data . . .

9. Default hosts file with many blocked ad/tracking sites

The system's hosts file redirects a comprehensive list of URLs known to be adware, tracking, etc. to 127.0.0.1 (ipv4) and ::1 (ipv6)

10. Privacy-enhanced Bromite SystemWebView

Instead of the default Chromium System Webview component, the Bromite SystemWebView is used offering more privacy, more ad blocking and less Google tracking.

11. Bromite as shipped Browser

A chromium based browser with many privacy features.

12. Firewall UI

Settings => Privacy - Firewall

Lists all apps and allows to restrict Internet access per app in regards to WiFi, mobile network or VPN

This per-app feature is a standard feature in LineageOS, but the UI to show all apps is an Extra (taken from a topic in LineageOS's Gerrit - it may, or may not, become part of the official LineageOS one day)

13. Maximum password length increased to 64

14. Debloated from Oneplus blobs for Soter and IFAA

Unnecessary privacy intrusive vendor blobs are not included in the build

15. Hardened bionic lib and constified JNI method tables

This has been taken over from GrapheneOS

16. Option to only use fingerprint unlock for apps and not for the device

An option in the fingerprint settings, also taken from GrapheneOS

17. Optional timeout for Bluetooth and WLAN connections

See respective settings, also a GrapheneOS feature

18. Per connection WiFi randomization option

A further GrapheneOS feature - improved randomization to make tracking more difficult.