Network Connections¶
Here is a list of expected network connections for security/verification purposes.
Address key:
- ✅ - should not contain any of the following: personal information, device identifiers, or other persistent identifiers.
- ❌ - known to contain personal information or identifiers.
- ❓ - has not been sufficiently reviewed
Carrier Services¶Connections to a cellular carrier if/when a SIM is inserted.
Note: These connections are largely routed over the cellular interface and when routed over the Wi-Fi interface will bypass any used VPN even with `Block connections` enabled.
- Voice over LTE (VoLTE): An IPsec tunnel for making calls and sending SMS messages.
- Voice over Wi-Fi (VoWiFi): Like VoLTE, but routed over connected Wi-Fi networks. DivestOS does not support VoWiFi due to privacy concerns.
- Multimedia Messaging Service (MMS): Used to send & receive MMS messages such as picture messages or group SMS chats.
- Rich Communication Services (RCS): A modern replacement for SMS & MMS. DivestOS does not support RCS due to it being a fundamentally broken and proprietary replacement.
- Visual VoiceMail (VVM): Used to listen to & manage voicemail messages in the Phone app. Can be disabled: Phone > 3dot > Settings > Voicemail > Visual voicemail.
Domain Name System (DNS)¶when connecting to servers via a domain name
Purpose: Used to resolve domains to IP addresses when making connections to websites and services.
Notes:
- This is overridden by activated cellular/Wi-Fi network or by the user chosen 'Private DNS'.
- DivestOS 17.1 and higher offers thirteen presets for `Private DNS` since 2021/11/08, users are strongly recommended to take advantage of them.
Fallback: Quad9 - privacy policy
- ✅ 9.9.9.9
- ✅ 149.112.112.112
- ✅ 2620:fe::fe
- ✅ 2620:fe::9
Internet Connectivity Checks¶every connection change
Purpose: Used to determine if a given network interface truly has an Internet connection and if there is a captive portal which needs to be accepted by the user.
Notes:
- Can be disabled (14.1+) or changed (18.1+) in Settings.
- When a VPN is used, this connection is performed twice: once outside of the VPN and once through the VPN, even when `Block connections` is enabled.
- DivestOS 18.1 and higher offers nine presets for the `Internet Connectivity Check` server since 2023/01/23, users are strongly recommended to take advantage of them.
Default: Google - privacy policy
- ✅ http://connectivitycheck.gstatic.com/generate_204
- ✅ https://www.google.com/generate_204
- ✅ http://www.google.com/gen_204
- ✅ http://play.googleapis.com/generate_204
Optional: DivestOS - privacy policy
- ✅ http://divestos.org/generate_204
- ✅ https://divestos.org/generate_204
Network Time Protocol (NTP)¶on every boot, periodically afterwards, and additionally when actively using GPS
Purpose: Used to have an accurate system time.
Note: NTP is still polled even when `Set time automatically` is disabled in Settings. DivestOS 18.1+ builds after 2023/02/18 do not have this issue.
Default: volunteer pool - privacy policy
- ✅ 2.android.pool.ntp.org
Predicted Satellite Data Service (PSDS)¶when actively using GPS
Purpose: Used to speedup the process of acquiring a GPS lock.
Qualcomm devices
- ✅ https://{,xtra}path[1-9].izatcloud.net/xtra{,2,3grc}.bin
Broadcom devices such as Samsung Exynos, Google Tensor, and NVIDIA Tegra
- ✅ https://gllto.glpals.com/7day/v5/latest/lto2.dat
- ✅ https://gllto.glpals.com/rto/v1/latest/rto.dat
- ✅ https://gllto.glpals.com/rtistatus4.dat
Secure User Plane Location (SUPL)¶when actively using GPS
Purpose: Used to speedup the process of acquiring a GPS lock and to provide your location when placing a call to emergency services.
Notes:
- The carrier/SIM along with emergency calls can override this server.
- DivestOS 17.1 and higher can disable SUPL via Settings > Location > Force disable SUPL toggle since 2023/02/11.
- DivestOS 14.1 through 16.0 can disable SUPL by removing the `supl` APN type from the selected APN via Settings.
- This typically includes the IMSI with these requests... however thanks to @MSe1969, DivestOS has not done so since 2019/06/02.
- This typically is used with both MSA (server calculates location) and MSB (device calculates location) modes, however DivestOS has disabled the MSA mode of operation since 2018/08/08 due to privacy concerns.
Fallback: Google - privacy policy
- ❌ tls://supl.google.com:727X - Includes MCC and MNC.
Updater¶default weekly
Purpose: Used to check for and download system updates.
Note: Can be disabled in Settings > Updater.
DivestOS - privacy policy
- ✅ https://divestos.org/updater.php?base=$BASE&device=$DEVICE&inc=$BUILD_ID
- ✅ https://divestos.org/mirror.php?base=$BASE&file=$FILE
- ✅ https://divestos.org/builds/$BASE/$DEVICE/divested-$VERSION-$DATE-dos-$DEVICE(-$INCREMENTAL).zip
Remote Keystore Provisioning¶when the pool runs low
Purpose: Used by some apps for hardware backed keystore attestation. Brief overview here.
Notes:
- This is primarily only used on modern Google Pixel devices (4+).
- DivestOS would like to offer a proxy for this service, however does not currently have the available resources to do so.
Google - privacy policy
- ❓ https://remoteprovisioning.googleapis.com
App Link Verification¶
Purpose: When installing an app that has defined links it wants the system to open it with by default, the system will contact the server of each declared domain to verify if it has permission to do so.
Note: Can be disabled by revoking `Network` permission to the `Intent Filter Verification Service` system app, however you will have to approve opener links manually then.
F-Droid Repositories¶default daily
Purpose: Used to browse, install, and update apps.
Note: Can be disabled in F-Droid > Settings.
- ✅ https://f-droid.org/repo/ - privacy policy
- ✅ https://divestos.org/fdroid/official/ - privacy policy
- ✅ https://divestos.org/fdroid/webview/ - removed in 2023-02 update - privacy policy
- ✅ https://divestos.org/fdroid/unofficial/ - default disabled - privacy policy
- ✅ https://guardianproject.info/fdroid/ - default disabled - privacy policy
- ✅ https://apt.izzysoft.de/fdroid/ - default disabled - privacy policy
- ✅ https://fdroid.bromite.org/fdroid/ - default disabled - privacy policy
Mull¶
Mull disables a lot of the typical requests that official/vanilla Firefox makes, however still does depend on various services as noted below.
Mozilla - privacy policy
- ✅ https://content-signature-2.cdn.mozilla.net - Used for signing/verification of all other requests.
- ✅ https://firefox.settings.services.mozilla.com - Used for altering various browser settings on demand and to apply monkeypatches for critical issues.
- ❓ https://firefox-settings-attachments.cdn.mozilla.net - Used for miscellaneous databases.
- ✅ https://shavar.services.mozilla.com - Used for various databases and primary indexes.
- ✅ https://tracking-protection.cdn.mozilla.net - Used for Enhanced Tracking Protection (ETP) blocklists.
- ✅ https://addons.mozilla.org - Used for add-on browsing.
- ❓ https://blocked.cdn.mozilla.net - Used for add-on revocation checks and for reporting abusive add-ons.
- ✅ https://services.addons.mozilla.org - Used for add-on downloads.
- ✅ https://versioncheck.addons.mozilla.org - Used to determine if installed add-ons need updating. Includes CPU type.
Additionals
- ❓ https://duckduckgo.com - Default search engine - privacy policy - Can be changed via Settings > Search.
- ✅ Auto completion for a chosen search engine is performed by default. Can be disabled via Settings > Search > Show search suggestions.
- ✅ Online Certificate Status Protocol (OCSP) servers may be queried to determine certificate revocation status when certificate stapling isn't used or to confirm a CRLite match.
Mulch¶
Mulch disables the majority of the typical Chromium requests and has no explicit telemetry.
Google - privacy policy
- ❓ https://update.googleapis.com - Used for altering various browser settings and to check for newer internal databases and extensions. Includes CPU type, amount of RAM, and major OS version.
- ✅ http://edgedl.gvt1.com - Used to download internal databases and extensions.
- ✅ https://translate.googleapis.com - Used to download a language mapping/index. Likely an unused leftover that needs to be removed.
- ✅ appassets.androidplatform.net - DNS request only - Used by the WebView widget when accessing local resources.
Hypatia¶not pre-installed, not automatic
Purpose: Used to download and update malware signature databases.
DivestOS - privacy policy
- ✅ https://divested.dev/MalwareScannerSignatures/*.h*b.gz