[OnePlus 7T Pro (Regular & McLaren) ROMs & Dev.] MSe1969:
Security Hardening Features - Details​

1. Pre-installed microG

same as the LineageOS for microG project

2. Pre-installed AuroraStore and AuroraDroid

works w/o having to enable the "unknown sources feature"

3. Extra control of sensor access for additionally installed user apps

Special access under app permissions

4. Cloudflare (instead of Google) default DNS

Cloudflare DNS has a better privacy policy than Google Public DNS and has DNS-over-TLS and DNS-over-HTTPS. In the deafult DNS settings (as fallback) and network diagnostics, the Cloudflare DNS adresses 1.1.1.1 and 1.0.0.1 are specified as defaults (instead of Google's 8.8.8.8 and 8.8.4.4)

5. Privacy-preferred default settings

When newly installed, the below settings are defaulted, different from standard LineageOS 17.1 (all settings can be changed at any time later - credits go to the GrapheneOS project):

Anonymous LineageOS statistics disabled (proposal during Setup)

The standard browsing app does not get the location runtime permission automatically assigned

Sensitive information is hidden on the lock screen

Further, when a lock screen protection is set (PIN, pattern, password), the Nfc, Hotspot and airplane mode and many further tiles require authentication and cannot be set without

6. Optional blocking of Facebook- and Google-Tracking

Settings => Network & Internet (scroll down)

When activated, outgoing connection attempts to Facebook servers and to Google servers will be suppressed. Certain apps on an internal exception list will still be able to connect (e.g. AuroraStore, microG, or NewPipe, if installed)

7. Optional disable captive portal detection and to select Captive portal server URL provider

Settings => Network & Internet (scroll down)

When deactivated, the system will not ping a specific Google server any longer when establishing a WiFi connection to determine, whether a captive portal is being used. Further, the captive portal URL provider can be set (default is GrapheneOS and not Google; Settings - Network & Internet)

8. No submission of IMSI or phone number to Google when GPS is in use

GPS also works fine, if no SIM card is present, so there obviously is no benefit for the phone holder (different from other involved parties :rolleyes:) to provide this data . . .

9. Default hosts file with many blocked ad/tracking sites

The system's hosts file redirects a comprehensive list of URLs known to be adware, tracking, etc. to 127.0.0.1 (ipv4) and ::1 (ipv6) - this option can be switched off under Settings - Security

10. Privacy-enhanced Mulch SystemWebView

Instead of the default Chromium System Webview component, the Mulch System Webview (from DivestOS) is used offering more privacy, more ad blocking and less Google tracking.

11. Bromite as shipped Browser

A chromium based browser with many privacy features.

12. Maximum password length increased to 64

14. Debloated from Oneplus blobs for Soter and Google hotword recognition

Unnecessary privacy intrusive vendor blobs are not included in the build

15. Hardened bionic lib and constified JNI method tables

This has been taken over from GrapheneOS

16. Option to only use fingerprint unlock for apps and not for the device

An option in the fingerprint settings, also taken from GrapheneOS

17. Optional timeout for Bluetooth and WLAN connections

See respective settings, also a GrapheneOS feature

18. Optional reboot timeout

See respective settings, also a GrapheneOS feature

19. Per connection WiFi randomization option

A further GrapheneOS feature - improved randomization to make tracking more difficult.

20. Ability to disable user-installed apps

Ported from GrapheneOS - this feature normally only applies to system apps.

21. Port of GrapheneOS' Scoped storage functionality

See original documentation