Per one tech forum this week: “Google has quietly installed an app on all Android devices called ‘Android System SafetyCore’. It claims to be a ‘security’ application, but whilst running in the background, it collects call logs, contacts, location, your microphone, and much more making this application ‘spyware’ and a HUGE privacy concern. It is strongly advised to uninstall this program if you can. To do this, navigate to 'Settings’ > 'Apps’, then delete the application.”

  • @SavageCoconut@lemmy.world
    link
    fedilink
    English
    982 months ago

    Google says that SafetyCore “provides on-device infrastructure for securely and privately performing classification to help users detect unwanted content. Users control SafetyCore, and SafetyCore only classifies specific content when an app requests it through an optionally enabled feature.”

    GrapheneOS — an Android security developer — provides some comfort, that SafetyCore “doesn’t provide client-side scanning used to report things to Google or anyone else. It provides on-device machine learning models usable by applications to classify content as being spam, scams, malware, etc. This allows apps to check content locally without sharing it with a service and mark it with warnings for users.”

    But GrapheneOS also points out that “it’s unfortunate that it’s not open source and released as part of the Android Open Source Project and the models also aren’t open let alone open source… We’d have no problem with having local neural network features for users, but they’d have to be open source.” Which gets to transparency again.

    • @FauxLiving@lemmy.world
      link
      fedilink
      English
      92 months ago

      Graphene could easily allow for open source solutions to emulate the SafetyCore interface. Like how it handles Google’s location services.

      There’s plenty of open source libraries and models for running local AI, seems like this is something that could be easily replicated in the FOSS world.

    • @ad_on_is@lemm.eeOP
      link
      fedilink
      English
      302 months ago

      if there was something that could run android apps virtualized, I’d switch in a heartbeat

      • @bdonvr@thelemmy.club
        link
        fedilink
        English
        52 months ago

        Every one of them can, AFAIK. I have a second cheap used phone I picked up to play with Ubuntu Touch and it has a system called Waydroid for this. Not quite seamless and you’ll want to use native when possible but it does work.

        SailfishOS, PostmarketOS, Mobian, etc all also can use Waydroid or a similar thing

        • @ad_on_is@lemm.eeOP
          link
          fedilink
          English
          12 months ago

          not necessarily… I mean If they run under the same VM, I’d be fine with that as well…but having a sandboxed wrapper would for sure be nice.

    • @ilinamorato@lemmy.world
      link
      fedilink
      English
      24
      edit-2
      2 months ago

      The Firefox Phone should’ve been a real contender. I just want a browser in my pocket that takes good pictures and plays podcasts.

      • @StefanT@lemmy.world
        link
        fedilink
        English
        152 months ago

        Unfortunately Mozilla is going the enshittification route more and more. Or good in this case that the Firefox Phone did not take of.

      • @Ledericas@lemm.ee
        link
        fedilink
        English
        42 months ago

        too bad firefox is going through the way like google, they are updating thier privacy terms of usage.

        • @ilinamorato@lemmy.world
          link
          fedilink
          English
          32 months ago

          Yep. I’m furious at Mozilla right now. But when the Firefox Phone was in development, they were one of the web’s heroes.

          • @Ledericas@lemm.ee
            link
            fedilink
            English
            22 months ago

            it says its only for LLM? as long as they dont try to expand the “privacy” in any case i download alternatives to the browsers anyways.

    • @hector@sh.itjust.works
      link
      fedilink
      English
      312 months ago

      Thanks for the link, this is impressive because this really has all the trait of spyware; apparently it installs without asking for permission ?

      • @Ledericas@lemm.ee
        link
        fedilink
        English
        32 months ago

        yea i found it as soon as this article said it was on your phone spying on you, ALSO many people, like myself noticed the battery draining pretty fast too, this is probalby the cause, if it installs without your knowledge, i doubt the app is excluded from your "app battery usage logs to, like it doesnt show up how much power its using.

    • Lka1988
      link
      fedilink
      English
      62 months ago

      Thanks. Uninstalled and reported. Hopefully they’ll get the hint. I love my Android, but this is pushing me towards Graphene/Calyx.

        • Lka1988
          link
          fedilink
          English
          12 months ago

          Absolutely. It’ll be part of a future “Google play services” update.

    • @x4740N@lemm.ee
      link
      fedilink
      English
      12 months ago

      Apparently I’m a beta tester for it, don’t recall signing up for beta tests with it

  • @Armand1@lemmy.world
    link
    fedilink
    English
    57
    edit-2
    2 months ago

    For people who have not read the article:

    Forbes states that there is no indication that this app can or will “phone home”.

    Its stated use is for other apps to scan an image they have access to find out what kind of thing it is (known as "classification"). For example, to find out if the picture you’ve been sent is a dick-pick so the app can blur it.

    My understanding is that, if this is implemented correctly (a big ‘if’) this can be completely safe.

    Apps requesting classification could be limited to only classifying files that they already have access to. Remember that android has a concept of “scoped storage” nowadays that let you restrict folder access. If this is the case, well it’s no less safe than not having SafetyCore at all. It just saves you space as companies like Signal, WhatsApp etc. no longer need to train and ship their own machine learning models inside their apps, as it becomes a common library / API any app can use.

    It could, of course, if implemented incorrectly, allow apps to snoop without asking for file access. I don’t know enough to say.

    Besides, you think that Google isn’t already scanning for things like CSAM? It’s been confirmed to be done on platforms like Google Photos well before SafetyCore was introduced, though I’ve not seen anything about it being done on devices yet (correct me if I’m wrong).

    • @ZILtoid1991@lemmy.world
      link
      fedilink
      English
      102 months ago

      Issue is, a certain cult (christian dominionists), with the help of many billionaires (including Muskrat) have installed a fucking dictator in the USA, who are doing their vow to “save every soul on Earth from hell”. If you get a porn ban, it’ll phone not only home, but directly to the FBI’s new “moral police” unit.

    • @lepinkainen@lemmy.world
      link
      fedilink
      English
      -3
      edit-2
      2 months ago

      This is EXACTLY what Apple tried to do with their on-device CSAM detection, it had a ridiculous amount of safeties to protect people’s privacy and still it got shouted down

      I’m interested in seeing what happens when Holy Google, for which most nerds have a blind spot, does the exact same thing

      EDIT: from looking at the downvotes, it really seems that Google can do no wrong 😆 And Apple is always the bad guy in lemmy

      • Lka1988
        link
        fedilink
        English
        14
        edit-2
        2 months ago

        I have 5 kids. I’m almost certain my photo library of 15 years has a few completely innocent pictures where a naked infant/toddler might be present. I do not have the time to search 10,000+ pics for material that could be taken completely out of context and reported to authorities without my knowledge. Plus, I have quite a few “intimate” photos of my wife in there as well.

        I refuse to consent to a corporation searching through my device on the basis of “well just in case”, as the ramifications of false positives can absolutely destroy someone’s life. The unfortunate truth is that “for your security” is a farce, and people who are actually stupid enough to intentionally create that kind of material are gonna find ways to do it regardless of what the law says.

        Scanning everyone’s devices is a gross overreach and, given the way I’ve seen Google and other large corporations handle reports of actually-offensive material (i.e. they do fuck-all), I have serious doubts over the effectiveness of this program.

      • @Modern_medicine_isnt@lemmy.world
        link
        fedilink
        English
        02 months ago

        Overall, I think this needs to be done by a neutral 3rd party. I just have no idea how such a 3rd party could stay neutral. Some with social media content moderation.

    • @kattfisk@lemmy.dbzer0.com
      link
      fedilink
      English
      252 months ago

      To quote the most salient post

      The app doesn’t provide client-side scanning used to report things to Google or anyone else. It provides on-device machine learning models usable by applications to classify content as being spam, scams, malware, etc. This allows apps to check content locally without sharing it with a service and mark it with warnings for users.

      Which is a sorely needed feature to tackle problems like SMS scams

      • @cley_faye@lemmy.world
        link
        fedilink
        English
        02 months ago

        You don’t need advanced scanning technology running on every device with access to every single bit of data you ever seen to detect scam. You need telco operator to stop forwarding forged messages headers and… that’s it. Cheap, efficient, zero risk related to invasion of privacy through a piece of software you did not need but was put there “for your own good”.

    • Spaniard
      link
      fedilink
      English
      72 months ago

      If the app did what op is claiming then the EU would have a field day fining google.

      • @teohhanhui@lemmy.world
        link
        fedilink
        English
        102 months ago

        Please, read the links. They are the security and privacy experts when it comes to Android. That’s their explanation of what this Android System SafetyCore actually is.

      • @loics2@lemm.ee
        link
        fedilink
        English
        42 months ago

        Have you even read the article you posted? It mentions these posts by GrapheneOS

  • @Ilovethebomb@lemm.ee
    link
    fedilink
    English
    262 months ago

    I’ve just given it the boot from my phone.

    It doesn’t appear to have been doing anything yet, but whatever.

    • @danciestlobster@lemm.ee
      link
      fedilink
      English
      82 months ago

      I also reported it as hostile and inappropriate. I am sure Google will do fuck all with that report but I enjoy being petty sometimes

    • @woobat@midwest.social
      link
      fedilink
      English
      32 months ago

      thank you for posting this. it’s not yet installed on my phone for some reason, but i will be checking this page every couple days to make sure it stays that way.

  • Lanske
    link
    fedilink
    English
    202 months ago

    Thnx for this, just uninstalled it, google are arseholes

  • @AWittyUsername@lemmy.world
    link
    fedilink
    English
    202 months ago

    Google says that SafetyCore “provides on-device infrastructure for securely and privately performing classification to help users detect unwanted content

    Cheers Google but I’m a capable adult, and able to do this myself.

  • @LotrOrc@lemmy.world
    link
    fedilink
    English
    162 months ago

    I just un-installed it

    Anyone know what Android System Intelligence does? Should that be un-installed as well?

    • @starman2112@sh.itjust.works
      link
      fedilink
      English
      72 months ago

      Jesus Christ they’re like bed bugs

      Is it too much to ask that my phone only contain the shit that makes it work, and not anything else?

      • @A_Random_Idiot@lemmy.world
        link
        fedilink
        English
        4
        edit-2
        2 months ago

        Its a classic example of using “BUT THE CHILDREN” to be invasive dickheads.

        And it immediately reminds me of the story of the guy whose kid had a rash in the diaper area during covid, and the pediatrician requested pictures to remotely diagnose and treat, which google flagged as child pornography and called the cops on him, and banned/locked him out of everything (phone number, emails, pictures, etc etc) because he had everything on google.

        and no amount of the police, or even doctor, insisting the pictures were medical necessity and not child pornography would convince google to restore his acount or even let him recover his number/email/pictures/etc.

        • @starman2112@sh.itjust.works
          link
          fedilink
          English
          22 months ago

          The fact that Google refused to restore his account even after the police that they called said there was no child porn pisses me off to no end. They are officially allowed to close your account for no reason other than they don’t like you.

          • @A_Random_Idiot@lemmy.world
            link
            fedilink
            English
            4
            edit-2
            2 months ago

            not only refused to restore the account, but still insisted he was a pedophile producing child pornography despite the cops and doctors and every other authority involved insisting he wasnt, and that the images were medically necessary, and refuse to even give/let him get a backup of all his family pictures, emails, etc.

            and theres gonna be a lot more of it once this stupid invasive spyware rolls out and gets going.

            If our parents and grandparents photos were digitized, they’d all probably be labled child porn producers, because almost every parent/grandparent/etc has some picture of their newborn getting a sink bath or some other completely harmless, and otherwise normal photo.

            and I think its so they can artificially inflate their numbers. They arent doing shit to stop actual child exploitation, so they hammer hard on this shit so they can make a big show of “cracking down and stopping” it.

    • Kilgore Trout
      link
      fedilink
      English
      32 months ago

      You can safely uninstall System Intelligence if you don’t need it. My phone has worked fine without it in the past year.

  • @CaptKoala@lemmy.ml
    link
    fedilink
    English
    162 months ago

    Thanks for bringing this up, first I’ve heard of it. Not present on my GrapheneOS pixel, present on stock.

    I suppose I should encourage pixel owners to switch from stock to graphene, I know which decide I rather spend time using. GrapheneOS one of course.

    • @Flying_Hellfish@lemmy.world
      link
      fedilink
      English
      32 months ago

      I’ve looked into it.l briefly. Did you have any issues switching? I’m concerned about how some apps I need would function.

      • @praechaox@lemmy.dbzer0.com
        link
        fedilink
        English
        32 months ago

        I switched from a Samsung to a Pixel a couple years ago. I instantly installed GrapheneOS and have loved it ever since. It generally works perfectly normally with the huge background benefit of security and privacy. The only issues I have had is one of my banking apps doesn’t work (but the others work fine) and lack of RCS (but I’m sure it’s coming). In short, highly highly recommend. I will be sticking with GOS for the long term!

      • @CaptKoala@lemmy.ml
        link
        fedilink
        English
        32 months ago

        I did a fair amount of research before the switch to find alternatives to Google services, some I’ve replaced, others I felt were too much of a hassle for my phone usage.

        I’ve kept my original pixel stock, the hardest part about switching this one over was plugging it in and following the instructions.

        I’m hoping to get rid of my stock OS pixel soon, it would appear my bank hasn’t blocked it’s app on Graphene, unlike Uber.

        For the rest I’ll either buy a cheap af shitbox to use purely for banking and Uber (if it comes to that).

        If you’ve any other questions I’m happy to help find then answers with you, feel free to DM me.

    • @Ledericas@lemm.ee
      link
      fedilink
      English
      4
      edit-2
      2 months ago

      same here, i was wondering why my Op12r was draining like super fast, for a phone touthing 2+days battery(and im not even playing games or videos on it), yet it was draining as fast as an old pixel phone.

    • TheWaterGod
      link
      fedilink
      English
      42 months ago

      I’m curious about this. I’ve got a Pixel 6 and noticed that the battery started going to shit about a month or so ago? I couldn’t find an install date for SafetyCore, but it was listed in my apps. I’ve uninstalled it now. It’ll be interesting to see if that was causing it.

        • TheWaterGod
          link
          fedilink
          English
          22 months ago

          It doesn’t show in the app drawer, but I found it via the all apps in Settings.

          Go to the Settings App > Apps > “See all XX apps”. It’s called Android System SafetyCore, so it should be close to the top of the list. Tap on it and select Uninstall.

          • @werefreeatlast@lemmy.world
            link
            fedilink
            English
            12 months ago

            Well it looks like I don’t have it. Which is good, unless its hidden and unremovable. My battery app reports up to like 60% of power usage but nothing else. That means that some stupid app in the background is running down my battery for no good reason.

    • @TheTurner@lemm.ee
      link
      fedilink
      English
      32 months ago

      Now that you say that, my battery was draining fast the past couple of weeks. It would last maybe a day. It lasts 2 days again now.