As of 2022, approximately 70% of consumer phones are running the Android operating system. One of the main reasons for this scale in adoption is because of Android’s open license and a history of well-built mobile OS. Phone manufactures like this combination as it allows them to easily adopt Android to suit their needs. It also saves phone manufactures the effort involved in building a complete OS from scratch.

It’s not enough, though. Using Vanilla Android may not be the most pleasant experience unless it comes with services that can get things done. In most cases, an ecosystem of services that includes email, cloud storage, app store is built by Google on top of Android. Google provides many such free (as in price) services to users. Similarly, Google provides free (as in price) services and APIs to developers. They make videos, guides for developers to help them build better apps.

This relationship of Google with Android brings good and bad with it. Google allows people to use its services for free in exchange for data that is used to run its advertising business. This contradicts with the people’s right to privacy, but the same business model makes phone manufacturers happy, as they only need to focus on better hardware. For online services, they can pay a license fee to Google for each phone they sell with Google’s services preinstalled.

What is Google Play Services?

Google is the main contributor to the Android Open Source Project and primarily looks after its development. Decisions are often made in the direction that Google wishes Android to go. Over the years, many of the basic open source apps, such as Dialer, Messages, Camera, etc. have been replaced by proprietary software from Google. These apps often connect to Google’s services.

The Google Play Services package runs on user device and communicates with the Google Services Framework, a cloud based proprietary service. Google Play Services provides APIs (Application Programming Interfaces) that can be used by other Android apps. These APIs are free (as in price) and optional for developers to use, but they bring features like Push Notifications Service, Safety Net, Authentication, reCaptcha, which makes app development easy. This combination of Google Play Services and Google Services Framework is free to use for any developer, but for the users it comes at the cost of their privacy.

The Game of Convenience vs Privacy

Google Play Services is bad for someone looking for privacy in the digital space, and all of this has to do something with the way Google Services Framework operates. The Google Play Services is installed on millions of devices and collects massive amounts of data like device identifiers, apps installed, advertising ID etc. It’s because of this data collection that Google can provide free access to Google Play Services for developers.

Take, for example, the Push Notifications service API. It is used by many apps to show notifications reliably, like message alerts or a notification from your food delivery service. Now, most apps use this service to just show notifications, but it leads to leaking of metadata from your notifications to Google. Google can record when a notification is pushed to which phone at what time, etc. Some apps are so poorly designed in terms of privacy that their notifications even leak personal information to Google.

If you don’t like all the compromises with privacy and decide to get rid of the Google Services Framework, your device becomes your responsibility. Many apps use the Google’s service and some apps may start misbehaving. Most apps display a warning like *please enable Google Play Services*, but continue to work fine. Other apps like banking apps refuse to work completely if they don’t detect Google Play Services on your device.

There is no point in targeting the app developers, as they are using the resources available at their disposal to make a good app that works reliably. It saves app developers and companies a lot of work, but it gives Google a huge say over how the market will move. That’s where the problem lies. That being said, some applications like Signal focus on privacy and give fallback options to people that don’t have Google Play Services. It’s up to you what you’re ready to give up without Google services framework.

Privacy Meets Convenience — microG

Well, there is fortunately a way not to give Google all your data and still make apps and other features work. Meet microG, a free-as-in-freedom and open source implementation of the proprietary Google Play Services. Created by Marvin Wißfeld and developed since 2015, microG is a software framework that mimics Google services and solves a lot of problems of Android users that are either forced to use proprietary Google Play Services or are left in the dark.

For instance, microG generates an obfuscated identifier for your device that can be used to register with the Push Notifications service. So, you can enjoy notifications without Google knowing about your identity. You can see for yourself which data is shared with Google when you use Push Notifications with microG on /e/.

Many apps also use the Safety Net API under the assumption that it provides better security, which is not always the case. As of now, microG supports the majority of the Safety Net API features, and more are in the works.

microG Helps you Use some Google Services — not vice versa

MicroG makes every effort to minimize connections to Google servers, but this may not always be possible. Again, as an example, the Notifications service can’t work if your device does not connect to android.clients.google.com and mtalk.google.com. This means Google can record your IP address, when Notifications service is ON in microG, which has very limited or no impact on the user’s privacy. However, staying informed about the microG’s implementation will allow you to use it more effectively.

As of now, microG provides an experience that is very close to the pristine Google Play Services, although a few features remain in active development. Take a look at this table that outlines which services Google provides and if microG is compatible with it.

microG with /e/ OS

As microG is a free and open source project, you can check its codebase yourself or ask someone from the community to do it. This openness builds more trust in users compared to Google Play Services’ proprietary implementation, but microG does not make any money by itself. The /e/ Foundation, since 2020, is supporting microG by contributing resources and code. /e/ Foundation also supports the microG founder Marvin financially.

The /e/ OS allows signature spoofing of microG. It allows other apps use microG as they would use Google Play Services and let you enjoy microG’s privacy benefits. The /e/ OS cares about your security, and by default the OS does not allow all apps to spoof their signature.

Overall, microG gives you a great balance between privacy, app compatibility while also allowing apps to use Google Services Framework. In any case, the user has complete control over what microG is allowed to do and ultimately their data. If you are not interested in using some/all services from Google, you can turn off that service in microG. microG puts you back in control of your device and your data.

Read also: “microG — What you need to know. A conversation with its developer : Marvin Wißfeld”

We felt that if we stopped at the operating system, we were leaving many users without options for their emails and cloud storage, but to use proprietary solutions like Google Docs or Microsoft Office 365. So our efforts to bring people to a more privacy-friendly environment would be in vain. Here is where Murena cloud comes in.

Murena cloud is the new name of ecloud, with better services and an improved user experience.

It is your personal email account, your agenda and contacts, your drive on the cloud and your online office suite, all combined in one single service, simple to use. Murena cloud is powered by proven open-source software like NextCloud and OnlyOffice.

Last but not least, we have great features to keep your email address private like “Hide My Email”.

Murena cloud is built on the same privacy by design principles as /e/OS. We don’t scan your data, we don’t log your app usage, we don’t sell your data, we don’t use ads in our online services.

Murena cloud is seamlessly integrated with /e/OS so you can synchronize easily data from your cloud to your phone.

And while Murena cloud has been developed as an extension of /e/OS, this online suite can also be used without /e/OS, directly from your computer or another smartphone.

What will you find in Murena Cloud?

Your personal @murena.io email

With Murena cloud, you have your own personal email ID ending in @murena.io. We do not scan your emails or include ads anywhere.

Your murena.io email account is accessible directly in Murena smartphones, or via any email client, like Thunderbird, or from your web browser at https://murena.io

Every account comes with 1 GB of free storage space! We also have paid plans, from 20GB to 2TB if you need more storage space.

Your calendar and contacts

Your calendar enables you to create separate personal and professional schedules and set up meetings with different options. You can invite contacts, plan recurring events, share your calendar and more.

Saving your contacts on Murena Cloud enables you to synchronize them across all your devices.

A Murena cloud showing how much quota the user has, some photos and files

Your online drive in the cloud

Murena Cloud comes with a secured storage to access your pictures and videos, sync and backup files from your phone or conveniently share with anyone you want.

Your files are seamlessly synced and always available to you, on-the-go with your Murena smartphone or through the browser of your choice.

Your online office suite

Murena Cloud is also a powerful suite of online tools to create, edit and share documents, spreadsheets and even presentation slides.

Powered by OnlyOffice, it is compatible with MS Office formats and is a great alternative to Google Docs or Office 365.

Hide my email

“Hide My Email” is another feature that you can benefit from using murena.io. This is a mail alias, but used only to receive mails without disclosing your real email address. Briefly speaking, it is a random address added to a user.

As it is an alias, all mails sent to this mail alias will also get into the mailbox of a user.

The address can be found in this page of murena.io settings. Currently, there is one alias available, but in the future we plan to get more and users will be able to manage their aliases (to delete and renew them).

To know how to set up a Hide My Email settings, please read our documentation, or watch the the video on YouTube or Vimeo.

Start using Murena Cloud now

Your Murena Cloud account comes with 1 GB of free storage. Need more space? Our plans now start at 1.99€ per month for 20GB. Click here to find the plan that works best for you!

App Lounge is the second iteration of the application store embedded within /e/OS. It allows everyone to access millions of applications directly from their phone home screen.

It combines common Android apps, open source apps and even progressive web apps in one single repository. It is the only app store that does this today. Like with its predecessor, Apps, you don’t need to sign in to an account to download apps.

What are we talking about?

When we speak about applications, we can refer to 2 types of apps: native applications that can be either “commercial applications” or open source applications, and progressive web apps (PWA).

Commercial applications are the usual free or paid Android apps you can find in the Google Play store or alternative app stores like Aptoide or UpToDown. These applications cover your most common needs like banking, travel, productivity, etc…. Free native apps often include advertising. Both free and paid apps often come with embedded trackers to profile you and follow you around.

Open source apps are Android applications that are released with an open source license . You can find open source apps in an alternative store like F-droid.

Finally, progressive web app or PWA is a type of application delivered through the web. It is intended to work on any platform that uses a standards-compliant browser, including both desktop and mobile devices. It is free from proprietary software from Google or Apple as these apps aren’t native apps. Unlike a native application that will need to be downloaded on your phone, a PWA works with a shortcut, similar to a web bookmark that you can store on your home screen and they run seamlessly on /e/OS.

How does it work?

App Lounge, formerly called Apps, now provides these apps, native android apps and web apps into a single service. There is no need any longer to install several app stores if you want to install commercial applications, Open Source apps or Progressive Web Apps (PWA) on your phone.

With this evolution, you can now access millions of apps from different catalogues in one single store. Just open App Lounge and get ready to browse for your favorite apps.

These three types of apps are installed from different sources.

1. Commercial applications: It’s the main improvement in App Lounge. It now gets commercial applications directly from the Google Play Store, relying on the Google Play API. You can install different types of commercial apps from this source. All applications are now available within App Lounge: no more “this app is missing” request! You can also, from now, install purchased applications, under certain conditions (check below). The app list is shown depending on device architecture/hardware configuration and selected locale from the device. So users will be able to install the apps that are supported by their devices and preferred locale of the user.
2. Open Source applications: We continue to offer these applications within our store. The Open Source applications, coming from F-Droid, are currently delivered using the CleanAPK API. When it detects an application is available on both Google Play Store and F-Droid (based on the package name), we promote the Open Source version.
3. Progressive Web Apps (PWA): In addition to usual Android apps, we also offer to users the possibility to install PWAs in /e/OS, like any other application. We want to promote this new way to deliver applications, which reduces the dependency regarding the operating system it runs on. PWA are delivered through the CleanAPK API. Users will receive updates for all their applications. They will be notified when there are new updates available, and they will be downloaded and installed automatically in background.

Native Apps from the Google Play Store catalog without a Google account

It may seem counter intuitive for a deGoogled operating system to offer downloading apps from the Play store.

Well not really. The Play store is the widest catalog available. Distributing apps from the Play store ensures that applications are coming directly from the source and that they haven’t been tampered with.

As we want to offer users a way to access apps without tracking, we have an option to sign in to App Lounge Anonymously. With this option, we are able to offer access to commercial applications without requiring a personal Google account: it means no tracking! This option gives only access to the free catalog.

In case a user had purchased paid apps in a previous life with a Google Android phone, we also provide him/her the option to sign in with a Google Account. Please note: In order to purchase a paid app, users will need to use a Google account linked to another device that has Google Play installed.

Be informed regarding privacy

We kept one of the key feature from Apps: the Privacy Score.

In a blink of an eye, we decipher the app code for you: you can see which and how many trackers are in the app. It also documents the number of permissions the app requires to operate. With an easy to read scoring, you can see which apps are safe and which ones should be avoided.

Available on the search result and app detail pages, it still relies on Exodus Privacy data.

The Privacy Score is computed based on trackers and users permissions used for the app. The Privacy Score is a sum of Tracker score and Permission score.

Privacy Score = Trackers score + Permissions score

If the number of Tracker is higher than 5, then score for trackers is 0. Otherwise the score for trackers will be the value of (9 — Number of trackers).

• if number of trackers > 5 : 0
• if number of trackers < 5 : 9 — number of trackers

If the number of permissions is more than 9, then score for permissions is 0. Otherwise, the score for permissions will be the rounded value of an equation given below.

• if number of permissions > 9 : 0
• if number of permissions < 9 : 0.2 x ( (10 — number of permissions) / 2 )

The source code link of the Privacy Score calculation will be found at https://gitlab.e.foundation/e/os/apps/-/blob/main/app/src/main/java/foundation/e/apps/PrivacyInfoViewModel.kt

All the features users can expect from an application store

App Lounge provides all of them:

• Automatic update,
• Homepage with recommendations,
• Search feature to find the app you are looking for,
• App detail page with all the information regarding the app, including some privacy related ones.

What’s next?

App Lounge is already bringing great improvements in /e/OS but we don’t want to stop there. We plan to keep improving the service and make it more efficient and useful.

We thought you could be interested in some upcoming features:

Fetching Open Source applications from F-Droid (and get rid off CleanAPK)

With the same idea we had for commercial application, we are working on fetching Open Source applications directly “from the source”. One of the challenges will be to handle alternative F-Droid repositories, that are sometimes more up-to-date than the official one.

Delivering /e/OS default applications update

Delivering /e/OS default application updates via App Lounge would allow users to receive updates as soon as they are ready, without waiting for the next OS update.

No-Google mode

We are working on an App Lounge optional mode which would allow users to fetch only Open Source applications and PWAs. This would reduce the catalog size, but would give some peace of mind to people concerned by any network connections made to Google servers, even anonymized ones.

Improved Privacy Score

The current Privacy Score computation shows some limitations. We are looking into ways to improve its accuracy regarding the privacy compliance of an application.

Why can the size displayed in App Lounge and the one displayed in GPlay be different?

App size varies based on CPU architecture/Hardware configuration or Locale/Region and Google play has more dynamic feature as well. The Google Play Store API does not provide access to this data. That is why the app size displayed in App Lounge and the one display in Google Play can sometimes appear different.

Many thanks!

All those features would have been much more complicated to deliver without the wonderful Open Source community! We would like to give a special thanks to:

• The Aurora OSS project behind the well known Aurora Store. App Lounge is using their GPlay API library
• The Exodus Privacy project, for their continued efforts to provide data related to app trackers
• The /e/OS community, which helped us a lot and provided valuable feedback during the development of App Lounge

Advanced Privacy is a specific tool we have developed to limit your data exposure once you have installed third party apps.

When an application snoops in the background, it will use trackers to log your activity even if you are not using the app. It will also collect the IP address, so it can potentially link internet activity to a specific device and to a persona, and finally it will try to pinpoint your exact location.

Advanced Privacy lets you manage in app trackers, IP address and location. It’s available as a widget and within the operating system settings.

Trackers blockers

What are we talking about ?

A typical tracker consists of a software initiating requests from the device to send personal data to specific endpoints, or APIs which collect connections’ metadata while providing a service. The collection and aggregation of these data are used to track users’ activity and behavior.

Tracing a tracker means having a look at which applications (or system components) are connecting to which endpoints (when, how much data, which data, …).

How does it work

Trackers blockers detect and block trackers when they perform DNS (Domain Name System) requests. The DNS is the first step of an Internet request: it transforms the name of a service (for instance e.foundation), to its current real address on the internet (for instance: 157.90.154.178).

We build and maintain a list of all URLs used by trackers, merging Exodus list, Adaway list and a set of custom /e/OS rules. Adaway list is used to establish a list of domains to block, Exodus to identify those domains with a clean name. Then, the low level DNS service of /e/OS sends each requested URL to Advanced Privacy. Advanced Privacy then logs each request to URL in the trackers list, and blocks them if the user required to block trackers in Advanced Privacy settings.

Side effects

Some trackers URL could be mandatory to use services. In order to solve potential issues, we provide the ability to whitelist any tracker individually for any application.

There are more and more innovations around the DNS technology, like DoH (DNS Over HTTPS) or DoT (DNS Over TLS) which can bypass the low level DNS service of the system, and then be ignored by the trackers manager.

Hide My IP

What are we talking about ?

IP (Internet Protocol) addresses are the origin and destination addresses of the communications performed between clients and servers on the internet.

A smartphone device is practically never directly connected to internet, with “its” IP address. Its visible IP address on internet is the one actually attributed by the cellular provider, the one of the home internet connection, or the one of the current Wi-Fi hotspot. In each of these situations, the same IP address may be used by many users at a same time (using the Network Address Translation protocol — NAT) and many IP addresses may be used the same day by one device just because the user has moved.

IP addresses are the way to link the internet activity to an individual in the real world, for including for legal purposes. For example, leaving a comment on a forum:

• The forum’s hosting service has to store the IP address of who has posted the comment (for a legal period of time)
• The Internet Service Provider (ISP) has to store the IP address (also IMEI, cell ID) and to which customer it is linked (for a legal period of time)

In the end, the customer potentially becomes a well identified person.

Typical legal uses of the IP addresses:

• Find back an illegal torrent user,
• Find back authors of unappropriate contents on the web, …

IP addresses generally are very volatile in mobile use. In other situations, they can be very stable: many ISP provide a fixed IP address to their customers (home connection), so that an IP address can potentially become another user identifier. They are used in various cases like:

• Tracking users for profiling them and delivering ads
• Preventing identity theft: blocking connections to personal accounts from unexpected IP addresses,
• Restricting contents delivery based on Geographic information,
• Banning user for game server, or from Wikipedia, for instance, after vandalization,

Internet users use IP scrambling for years to bypass those strategies.

How does it work

Advanced Privacy is using an implementation of the Tor project. We extracted the core functionality from the Orbot application, and added a user interface on the top of it.

Tor directs Internet traffic through a free, worldwide, volunteer overlay network, consisting of more than seven thousand relays, to conceal a user’s location and usage from anyone performing network surveillance or traffic analysis. Wikipedia

When Hide My IP is activated, all the device’s internet traffic, or just the one of some selected app, is redirected through the Tor network. In the end, the user’s primary (and read) IP address is masked by a random IP address that belongs to the TOR network.

Side effects

The implementation of Orbot bridges all the devices’s Internet traffic through the Tor network. This was initially designed for VPN Services. That’s why Hide My IP appears as a VPN in /e/OS. We are working on another solution to route the devices’s traffic directly through Tor, to avoid this confusion.

Hide My IP also reduces bandwidth and increases latency (like 200ms — 500ms). This is a side effect of the Tor network architecture and behavior. Each Internet request goes through many Tor relays through the Internet to reach the final server, and also to come back to the device. Wandering on the internet makes them anonymous, but it also takes some time.

Some Internet services can detect traffic coming from Tor, and block it. That’s why users may face some strange behaviors or non-working features while using Hide My IP.

Finally, some services are using the IP address to compute users location. The user experience may be affected using those services, considering they will use the Tor output node IP address, and not the real one from users, as the Tor output node may be located anywhere in the world.

Fake My Location

Smartphones provide technical tools to compute their geographical position, using satellite-based radio navigation systems such as GPS, Galileo…, or by mapping visible networks (cell network, Wi-Fi networks, …). This is a key feature of smartphones that provides users with the ability to use maps applications and services.

But it is also used to track users: to know where they live, which store they go to, in which area they work and so to have precise profiles to push targeted advertising to them. Some other digital services can also use the location to limit the functionality against the location of users.

How does it work

In Advanced Privacy, Fake my location takes advantage of existing low-level operating system features that we have connected to the Advanced Privacy User Interface to make it easy to use and hidden from applications. Fake my location bypasses the real location provided by the satellite radio navigation system or the network, and instead sends the one set by users to applications that are requiring location.

Side effects

After enabling Fake my location, users may face some unexpected behavior:

1. the Weather widget data will be based on the fake location, not the real one. A workaround could be to define manually a fake location, not so far away from the real one.
2. the navigation applications (MagicEarth, OsmAnd, Maps.ME, Waze…) will use the fake location. In order to users properly those applications, the users have to temporarily disable Fake my location.
3. We use Mapbox in order to display a map to the users while they play with location configuration. It will be detected as a tracker by the Tracker blocker feature. We are looking for an alternative.

Have you once felt the pity of not knowing what to do with your old phone and simply throwing it away or putting into a drawer? This is absolutely understandable. Nowadays, most phone manufacturers want you to buy a new device instead of maintaining the life of the one that you already own. As a result, according to giffgaf, one of the largest mobile network providers in the UK, almost a half (45%) of the UK, which is nearly 30 million people, keep old and working mobile phones. The economic weight of it all being estimated at more than £3.4 billion.

Replacing your 2 or 3-year-old phone also contributes to creating a mountain of electronic waste (or the so-called E-waste), and has a dramatic impact on our environment and health. Only 20% of this electronic devices are recycled and in 2018 only, nearly 50 million tonnes of E-waste were created worldwide.

Electronic gadgets are made of different materials such as copper, aluminum, iron, palladium, gold and so on. Without forgetting that many toxic chemicals are used during their production. Did you know that 7% of the world’s gold is estimated to be currently in the E-waste? And what is more interesting is that there are also some rare earth elements such as neodymium and cerium that are required to create a new smartphone.

It is obvious that the excessive E-waste caused by overproduction and planned obsolescence not only increases the pollution and impacts badly our health but also gets some rare materials much scarcer.

Understanding the system allows us to act to find solutions. And many interesting ideas have already been put into life. At governmental level, the Extended Producer Responsibility laws were adapted in order to put the responsibility on manufacturers to treat and dispose their post-consumer products, such as “Waste Electrical and Electronic Equipment Directive” adapted in Europe.

Where do we fit and how can we change this?

/e/OS is a “deGoogled” mobile operating system created by Gaël Duval, the founder of Mandrake Linux. This open source project aims to help everyone regain control of their personal data on their phones, with a system that is fully auditable and transparent. One of the key benefits of /e/OS is the compatibility with your favourite Android apps, accesible directly from /e/OS embedded App repository.

Instead of watching this from the sideline and do nothing, we are committed to act at our level. While our main goal is around data privacy, we at Murena are very concerned by this environmental disaster, and we want to contribute to stopping creating this E-waste.

For us, one of the best phone to choose from is the one that you already own!

With /e/OS, we support more than 240 smartphones and counting, we even support some phones released back in 2012!

One of our ambition is to be able to keep these older models relevant and secured.

Take the the Samsung Galaxy S9 and Samsung Galaxy S9+ for example:

These 2 phones don’t receive software updates any longer from their manufacturer and will most likely end up in drawers for many of us.

Well not only, we support both these phones with /e/OS but we are very pleased to announce the release of major upgrades for both devices. /e/OS is transitioning from AOSP 8 to AOSP 10 via a simple update. These 4-year-old phones will get additional support until 2023 at least. With this major upgrade, these phones will benefit from the latest security patches in addition to the latest /e/OS new features. More importantly, this is an OTA upgrade, which is not common in the world of alternative ROMs, with no data loss or need of a computer. We are currently evaluating to release the same upgrade for the 6-year-old Samsung Galaxy S7 and S7 Edge and the 5-year-old Samsung Galaxy S8.

As always, these upgrades are free of charge and will be available directly for all these phones via the usual software update.

We’re delighted to contribute to extend the life of these great phones a few more years.

How can you install /e/OS on your phone?

Nothing more simple, browse to our supported list and look for your phone.

To make things even simpler, we have also have an easy installer for some models, like the Samsung Galaxy S9+, S9, S8, S7 Edge and S7.

All you will need to do is installing the /e/OS easy installer on your computer, connect your phone via USB and follow the easy steps on screen.

What about other options?

/e/OS is also compatible with highly reparable phones like the Fairphone 4 or the Teracube 2e. These devices are great options in this fight against the E-waste: highly repairable hardware with long-lasting software.

Finally, if your phone is no longer usable, send it to recycling by putting attention to choose a company that does not transport waste to developing countries. Or before sending it to recycling, verify if your manufacturer offers take-back programs.

To conclude, we can all do a little something to limit E-waste. By adapting the three R’s rule (Reduce, Reuse, Recycle) in everyday life will guide our community to reduce earth pollution. We can change the future of our planet by reducing our own waste, by choosing ethically designed products and built-to-last electronics. That is why we believe that a smartphone must be easy-to-upgrade, easy-to-repair, long-lasting, less toxic and recyclable.

It is now well known that each action on the internet leaves its trace: our data is collected, sold for commercial and promotional purposes. One might think that there is no escape from it. Evidently, this situation violates our fundamental rights, especially our privacy and it must stop.

Thankfully, there are many ways to improve your internet and smartphone usage in regards to privacy and sustainability! Yes, your data consumption and daily use has a huge impact and creates tons of CO2 emissions.

If we look back at this data collection research led by Professor Schmidt, Professor of Computer Science at Vanderbilt University, your smartphone (Android, iPhone…) sends to Google from 6 to 12 MB of profiling information per day. Imagine how much information this represents for 4 billion smartphones used daily across the globe, and how much electricity is needed to collect this information, transmit it over wifi and broadband to huge data centers all over the world.

In a few years, Internet traffic has boomed to require 10% of the world’s electricity and accounts for nearly 4% of the planet’s CO2 emissions. Briefly speaking, by limiting our internet traffic, by protecting our data, we consume less energy and thus we reduce drastically our CO2 emissions.

Without any further ado, we would like to share with you simple habits and tips to improve your privacy. Let’s discover what our team members use on their daily basis!

Meet in this conversation:

Alexandre and Vincent, our /e/ dev team members;

Jonathan, Android Tech lead;

Shenol, customer support specialist;

Mahbub, design team member,

Aude, product owner,

Romain, OS engineering manager;

Akhill, infrastructure team engineer;

Camille, customer support specialist;

Prajwal, webmaster;

Jo, a contributor;

Aayush, software engineer

Alexis, Chief Operating Officer

and Gaël Duval, /e/ Founder and project leader

Daily habits

We would like first of all to share with you some good habits that will allow you to use the internet with more safety. “Compartmentalize your life”, — says Camille. “Have multiple email address or phone number in order to separate your activities”. Romain and Mahbub also prefer not to use the same app, service or company for everything.

Another tip, which might already be well-known is to use a VPN on every device in order to hide which website your are visited to your ISP (it can actually increase the speed if the ISP slows down on purpose the speed of some specific activities like streaming). Make sure you choose a VPN service that doesn’t capture user logs. There are many VPN services out there, and the ones making the most amount of noise aren’t always the most mindful with your privacy.

It should become your reflex to deny cookies that are not indicated as essential on websites or use the button “Deny all” if available, adds Aude.

Moreover, Aayush recommends to disable advertisement personalization whenever possible.

“Use different container for shopping online”, Mahbub tells us, and read privacy policy, terms and condition for the sites, apps or services you are about to sign up for.

Google-related behavior

To use Google or not to use Google? That is the question.

Obviously, our recommendation would be no. But if you still need it for some reason, remember Jonathan’s tip while using Google to disable Google Assistant as well as other Google features regarding marketing, history, YouTube history. Whereas, Shenol prefers not to use Google account at all. Alexander uses Qwant maps instead of Google Maps on web browser.

Akhill underlines that if moving from Google, make sure you delete your account or log out from all apps. Otherwise, you might still be logged in on some service you use with your Google account.

Mahbub uses /e/OS devices and services “to stay safe from Google data logging tactics”.

How do you protect your smartphone?

All our team uses a privacy focused operating system on their phones, such as /e/OS, in order to prevent Google and the manufacturer of the phone to collect a lot of information about you.

Camille also advises you to put your SIM card on a spare phone and turn it on only when you need to use the SIM card, or if it’s not possible at least be in airplane mode and disable it only when you need your SIM card. (The ISP knows your location as long as your are connected to the network). Furthermore, being in airplane mode and using Wi-Fi instead of 4G/5G will increase your battery life a lot.

How do you protect your computer?

First and foremost, Gaël Duval finds it essential “to encrypt your hard drive on your PC, as well as encrypt your smartphone for storage”.

Camille uses Linux on computer (Ubuntu or Zorin OS for starters). It can be installed alongside Windows, in order to prevent Microsoft from collecting data and use an open-source operating system.

Always search for an open-source or at least privacy friendly alternative. There are more alternatives than you think (https://alternativeto.net/ can help).

What about the apps ?

To begin with, almost all our team members advise you to use open source apps as much as you can or privacy friendly apps on your phone or your computer, and never give useless permissions. When possible, don’t give your phone number to an app neither your phone contacts access. Romain also advises you to check regularly apps installed on your phone, and uninstall the one you are not using.

For messaging Jonathan and Camille choose Signal, Telegram and DeltaChat instead of WhatsApp or traditional phone call and SMS, in order to hide who you are talking to and what you say. Their habits are also shared by Gaël, who is, on the other hand, wondering whether the NSA would possibly be able to break Signal’s and possibly other’s instant messaging encryption algorithms.

“Use an app like Shelter to isolate some apps you know are “bad”. Of course, if you put a lot of apps or even all your apps there it looses its interest”, — Aude says.

Speaking of Facebook, that uses a large amount of your personal data for commercial purposes, Alexandre uses Facebook container on Firefox. Furthermore, Mahbub uses the web version of Facebook instead of the app if needed.

And last but not least, check the number of trackers built-in your apps (with a service like Exodus Privacy). Don’t forget that /e/OS reveals to its users the number of trackers present in the apps.

What about YouTube?

Romain uses NewPipe application to watch YouTube video in order to avoid to be tracked by their algorithm, and invited to watch another video. Alexandre underlines invidious that can be used instead of YouTube.

Which browser do you use?

Camille, Prajwal, Vincent, Alexandre and Jonathan prefer using a privacy focused web browser (such as Duckduckgo, Firefox or Brave) and advise you to increase the default level of protection to skip trackers. Romain also reminds us to use add blocker on your browser. For example, Alexandre uses TrackerControl.

Did you know that /e/OS is not only very protective of privacy, but it also comes with a mobile browser including an ad-blocker by default, so it is highly recommended!

What about the emails?

Use a privacy focused email provider such as ProtonMail or Tutanota, which can’t read your emails and offer anti-tracker protection. Gmail, Yahoo Mail or Hotmail are thus not recommended because your contents are read and analyzed systematically by those providers.

But remember that when you email a friend or relative using Gmail or Yahoo from a privacy focused email provider, your email has to be sent unencrypted in order for your friends or relatives to be able to read it.

You can go one step beyond encrypting your emails using a PGP key. PGP stands for Pretty Good Privacy and has became one of the best options out there for email and messaging encryption. By using a combination of a public key and a private key to encrypt and share your messages, only you and the recipients can read and access the content of the email or the message.

In /e/OS and our default Mail app, we feature OpenKeychain so you can manage your PGP key and PGP keys from your friends and relatives and send and receive encrypted emails right from your phone.

Finally and in contrast, our ecloud also offers a fully integrated ecosystem with your individual mail account, your agenda, calendar, cloud storage for your files and backup and an online office suite respecting your data privacy.

Use disposable email address. “If you need to enter your email address somewhere just to have access to something but you know you won’t use the service later, use services that create a temporary email address (you can easily find a lot of them). This way you don’t have to share your real email address”, Camille claims.

Other tips?

“Check if one of your account has been compromised: https://monitor.firefox.com/ It’s more about security but it’s still important.”

“Don’t deal with the net giants. Delete your big techs accounts, don’t install their apps and don’t use their services as much as possible.” Camille.

Jo, one of our contributors, is mastering the full safety! His approach is as follows:

“Remove your laptop’s wifi/bluetooth chip. Remove the camera. Hide your phone’s camera. On the Xiaomi mi a1, you can pull the screen off a little bit because the paste is badly designed and put a sticker for the front camera and nobody will notice it. I also made an oval-shaped piece of paper that I can put on the back-camera”.

+ Bonus for the advanced users

Use artix to say “bye SystemD” and the smallest window manager ever: dwm.

Also, use vim for coding, not jetbrains’s IDEs that now ask for credentials.

Mahbub shares: “Use an app like Insular to create separate profiles for shopping, if you use Ecommerce apps, and do not use anything else in that container”.

To conclude,

Our /e/ team is working hard to bring to your phone privacy by design operation system in order to protect your data and the environment. In the end, our best privacy tip will be as follows: use /e/OS on your smartphone or get the Murena phone on our shop with preinstalled /e/OS, create your e.email and use ecloud that allows you to self-host your data and avoid trackers. Because your data is YOUR data!

We hope that some of our tips were useful and surprising for you at some point. Please, share with us your own tips in the comments and let’s discuss the ones shared above! Which ones do you already use and which ones you have discovered?

Additional references :

• https://digitalcontentnext.org/blog/2018/08/21/google-data-collection-research/
• Guillaume Pitron: “L’Enfer Numérique”

In the last couple of years, words like Data privacy and data piracy are making more and more the headlines. Private corporations and government agencies are actively snooping in our daily lives to know everything about us. Big tech and other corporations have flourished abusing and selling user data to the best offering.
Our smartphones, our daily companions, have become the best device to track us 24/7 as they know with precision where we are, with whom we communicate, what are we doing at any given time, etc… The combination of a handheld computer with a GPS, a camera and a microphone has created a great tracking device we keep next to use at all times.

If you think we are making this up to scare you, read on. In a new study led by the Trinity College of Dublin and the University of Edinburgh, researchers have confirmed in detail the massive amount of user personal data captured by standard smartphones at the operating system level.
So far many studies had focused on the massive data collection from apps, but none had really deep dive into leaks at the operating system level.
The study reveals that Samsung, Xiaomi, Huawei and Realme Android variants all transmit a huge amount of data to the OS developer (i.e. Samsung etc) but also to third-party parties that have pre-installed system apps (including Google, Microsoft, LinkedIn, Facebook). Even the most privacy-conscious users, unchecking options to share data and only following mandatory terms and conditions, will not be safe with those variants.
Thankfully, researchers confirmed that there are options to escape this massive data extraction. We were proud to read their confirmation that “/e/OS collects essentially no data and in that sense is by far the most private of the Android OS variants studied.”

What do we speak about when we refer to data collection via the Operating System?

This data collection is the Operating System can be articulated in 3 main areas as pictured in Figure 1:

• the phone unique identifiers like the IMEI, the phone serial number…
• the list of apps installed on your phone
• the interactions with the phone

The phone unique identifiers:

Every mobile phone comes with a set of unique identifiers to be able to isolate it from any other phone. There are several identifiers with every phone:

1- The IMEI or International Mobile Equipment Identity is a unique 15-digit code that uniquely identifies each GSM, UMTS or LTE mobile phone terminal. It is the combination of the phone brand, the phone model and variant. This identifier is normally not resettable.

2- The SIM IMSI or International Mobile Subscriber Identifier is another unique number that identifies your SIM card within your mobile network operator. It is basically the combination of your region, your carrier and your mobile subscription number.can help knowing the region and the carrier you are using. This number enables network operators use to identify a subscriber. This identifier is normally not resettable.

3- The hardware serial number which is a unique number identifying the hardware at the manufacturer. This identifier is normally not resettable.

4- The Google Advertising ID which a unique identifier that Google and advertisers or developers use to connect a profile with target advertising based on the user habits. This identifier is now resettable to supposedly enable any user to escape from microtargeting

These are not the only identifiers to fingerprint a user but they are the most common.

The study found in most cases, all those long lived identifiers (1, 2 and 3) are sent next to the user resettable identifier like the Google advertising ID, meaning that when a user resets is advertising profile, it doesn’t take long before this user will be re-linked back to the same device and an existing advertising profile.

Except for /e/OS, most of the Android variants tested in the study also collect advertising identifiers and contribute to this cross-linking and endless tracking.

The list of apps installed on the phone

The study found that Samsung, Xiaomi, Realme, Huawei and Google are collecting details of installed apps on each device. While it doesn’t seem that much of an issue to allow those companies to know that you have installed Whatsapp or Uber on your phone, it might be a different story once you install apps that can link you to a specific religious community, political activism, specific gender communities, etc… Especially as these listings can be combined with the phone identifiers to narrow down with precision who you are.

It doesn’t take long for a data broker to access these information and sell to governments agencies like highlighted in this article by Vice Media

The interactions with the phone (Telemetry)

Aside from /e/OS and LineageOS, all systems tested in this study log user interaction, including screens / activities viewed plus duration and time stamp, and logs the event that text is sent.

In some cases, researchers observed that default apps like LinkedIn, installed as a system app, also send telemetry to LinkedIn servers even despite no Microsoft or LinkedIn app was ever opened on the phone, and no request to send the data was observed.

The study also found that some manufacturers like Xiaomi collective extensive telemetry even of your phone calls, logging with precision when the phone calls starts and ends.

This telemetry is then shared and stored all over the world as the researchers discovered: in Europe mainly in this case but also in Singapore and in the USA,

On every handset, apart from the /e/OS handset, Google collects a significant volume of data. The study highlights that the amount of data collected by Google can be up 10x that uploaded by the mobile OS developer. For manufacturers like Xiaomi, Huawei and Realme the volume rises to around 30x. All this data is captured despite “usage & diagnostics” options being disabled for Google services on all handsets.

We are pleased with the results of this study as validate our claims and ambition by showing that /e/OS captures doesn’t capture any data at all, no identifiers, no list of apps, no user telemetry.

While this study didn’t focus on all solutions available out there, like Graphene or CalyxOS, it is clear that aside from /e/OS, there is hardly any escape from this massive data collection with common phones.

How do we do it differently in /e/OS?

/e/OS isn’t just an Android version with no Google Services Installed. We go much beyond removing from the Android core all pieces of code that phone home to Google without the user active consent.

Compared to other Android variants, even the bare AOSP, we don’t use Google servers to check connectivity upon start-up, we don’t use Google NTP (Network Time Protocol) servers, we don’t use Google DNS (Domain Name System) default servers, and we don’t rely on Google geolocation services. This is also to ensure that your personal identifiers like your IMEI or phone number aren’t collected by simple requests without your consent. We want to ensure your data is safe all the way.

/e/OS is now available on 190 different phones. We keep adding newer device’s to /e/OS every week and upgrading existing ones too. The goal is to enable a large majority of people to escape from this massive data collection imposed onto them.

/e/OS can be downloaded for compatible phones free from the documentation site.
Phones with /e/OS pre-installed are available to purchase from the online shop.

The complete study, Android Mobile OS Snooping By Samsung, Xiaomi, Huawei and Realme Handsets, is available at this URL:

https://www.scss.tcd.ie/Doug.Leith/Android_privacy_report.pdf

Where can you help?

We are always looking for human and financial support to keep innovating and develop this alternative that is more than ever essential to safeguard one of our fundamental rights, privacy.

You can support /e/OS in many ways:

• Join our tribe and install /e/OS on your phone: https://doc.e.foundation/devices
• Purchase a phone with /e/OS pre-installed from our shop: https://esolutions.shop
• Join our community: https://community.e.foundation/
• Check job openings: https://doc.e.foundation/jobs
• Contribute financially: https://e.foundation/donate-2/

And spread the word to friends, family, colleagues!

“Your data is YOUR data”

As a mobile operating system publisher, joining an initiative like FairTEC felt very natural.

The FairTEC offer

With FairTEC, we aim to raise awareness for the structures that push for fairer and more sustainable practices within the electronics and telecommunications industry.

Our goal is to create a seamless platform that promotes solutions and services that incorporate the key principles of circular economy from the hardware to the operating system to the network to the business model.

End users can easily access the full solutions and services that FairTEC actors offer, a centralised proposition that will enable them to rent or buy a Fairphone under /e/ with a SIM card from the operator for their country.

The project manifesto

It has been established over and over again that digital technology’s impacts are vast and far reaching, affecting the environment, our societies and our everyday lives.

According to Statista, as of 2019, the average global e-waste generated per capita stood at 7.3 kilograms. This trend is expected to continue, with projections showing that by 2030, annual e-waste generation worldwide will have increased by approximately 30 percent.

It is estimated that digital technology is responsible for approximately 3.7% of global greenhouse gas emissions. With 1.4 billion smartphones sold each year and only 15% reused or recycled, smartphones are responsible for a significant portion of e-waste that is accumulating at staggering speed in landfills.

We believe that actors in the smartphone and telecommunications sector have a responsibility to offer solutions and services that can limit our environmental impact as well as encourage end-users to adopt new behaviours with regards to their use of electronics.

It was through this lens that FairTEC was created. We have decided to work together to offer credible and sustainable alternatives in order to create a paradigm shift.

For us, a more sustainable digital ecosystem means :

• Reducing the impact of smartphone production by focusing on modular and repairable designs that integrate ethically and responsibly sourced materials.
• Choosing a lighter and privacy-friendly operating system that does not store infinite amounts of data to profile users or sell advertising.
• Choosing a mobile subscription that supports you in transitioning to a healthier and more sustainable mobile usage.
• Choosing an economic model that favours longevity by renting your smartphone and having the support you need to keep it as long as possible.

You can read our full manifesto here.

The actors

FairTEC is a collective group of ethical European actors committed to digital sustainability. Each one, in their respective field, is doing their utmost to implement real change in the way we consume technology.

Fairphone, Commown, WEtell, TeleCoop, the Phone Co-op and /e/ are the founding members, but we look forward to welcoming new actors to keep extending the FairTEC offer to more users.

Why did /e/ get involved

As a mobile operating system publisher pushing for data sovereignty, joining an initiative like FairTEC felt very natural.

With this European alliance, we can now offer a whole set of credible options for the growing amount of people looking for a better and more sustainable digital world. It feels incredible to address nearly every step of the phone value-chain, from the material sourcing needed to produce the phone, all the way to the monthly mobile service bill.

Visit the FairTEC website: https://fairtec.io/en/

For more updates on the FairTEC project, follow their accounts on Twitter & Mastodon.

An /e/OS Generic System Image (GSI) has been a long standing request from /e/OS users. In this article, we’ll share details about the official /e/OS GSI, which will be released soon.

We assume that the reader has an average knowledge of technical terms, as there are some peppered across this blog post. It would not be possible to explain all the terms and definitions, though we have attempted to keep the narrative as simple as possible.

What is a GSI ?

Before we jump headlong into sharing details on the /e/OS GSI, let us first understand what a GSI or Generic System Image is.

The official definition for a GSI defines it as:

… a system image with adjusted configurations for Android devices. It’s considered a pure Android implementation with unmodified Android Open Source Project (AOSP) code that any Android device running Android 8.1 or higher can run successfully.

In layman terms, it means that a GSI is a slightly modified system image. It is made from the base Android source code. That being said there are considerable differences between a stock ROM and a GSI. Lets look at some of these.

Regarding /e/, a GSI is an easy way for users or developers to test /e/OS on potentially any recent Android smartphone with an unlockable bootloader.

The difference between GSI and Stock ROMs

(Note: These differences are specific to the /e/OS GSI. There might be exceptions on other GSI but that is not in the scope of this article.)

What is Project Treble?

One term that crops up when the subject of GSI is mentioned is Project Treble. Previously whenever a new Android Operating System came along, phone manufacturers had to wait for the chipset vendors like Qualcomm to update the code for the internal hardware. This could take months or even years. By then a new Android Operating System could be available.

To address this problem Google came out with an innovative idea: separate the Operating System code from the device hardware code. This, in a sentence, is the idea behind Project Treble. Now every time an OS update comes along, the device manufacturers do not have to wait for the hardware component code to be upgraded. They are free to push the new Operating System to the end user.

In general we consider devices which came after 2018 and with Oreo or higher as the initial Operating System, are Project Treble- compatible. There could be exceptions to this rule. Let us see what more requirements need to be met.

System requirements for a GSI

To be able to install a GSI a device should meet certain requirements.

The device:

• should be Project Treble- compatible
• should have an unlockable bootloader
• should have been launched with Oreo or a newer OS version
• was upgraded to Oreo and modified to be Project Treble compatible
• does not have Xposed framework, SuperSu or Magisk
• has the stock ROM working on it

The list and variables goes on as technical minds modify and tweak older devices to make them compatible, but we will not go into those details here.

All about /e/’s GSI

Now lets talk about the subject of this article, the /e/OS GSI. To say that we are introducing the /e/OS GSI would be factually incorrect. The /e/ development team had done some preliminary work on this way back in 2019. You may have read this post on the forum. After some initial work on an /e/ GSI we had to stop. The reason behind the pausing of the development, was lack of dedicated resources for the task.

We are pleased to announce that the /e/ team resumed building GSIs, based on the work of PHHusson and AndyCGYan. Thanks to these efforts, we are now releasing the official /e/OS GSI.

What the /e/OS GSI is not

At this point we would again want to remind the readers of the following points:

• The GSI is not to be used on a daily driver device
• Not all hardware components would work on it. For example the bluetooth or camera may not work with the GSI on a particular device
• Do not expect all software applications to work
• There will be no OTA updates for the /e/OS GSI at present
• Use it only for testing purpose …to get a feel of how /e/OS works

User checklist before installing a GSI

• Check if your device bootloader can be unlocked
• Check if your device is Project Treble ready
• You can check this by installing a third party app called “Treble Info”

• The app should tell you if your device is Treble compatible. If your device is not treble compatible, then you won’t be able to install a GSI
• Under the section “Required Image” please note the image name to download
• Under “Dynamic Partitions” check if you require fastboot

How to get your hands on an /e/ GSI

We have added the following resources on our documentation site to help you:

• Guide to understanding GSI
• Installation guide with download links

Feedback and comments

As always we look forward to your constructive comments and suggestions. You can comment in this thread or share them with us at support@e.email.

For more updates on the project, follow us on Twitter & Mastodon!

Today is the 18th edition of Safer Internet Day with actions taking place right across the globe.

This day has become a global landmark event to raise awareness and expose risks around online issues and promote best practices for a safe online experience for all.

As the Covid-19 pandemic has made apparent, society as a whole is more connected than ever. We use the internet for everything from education to buying our groceries.

According to recent studies, smartphones have become the go to device to access the internet, taking the lead over desktops and other devices.

What was previously a battle for browser ad blockers has shifted to blocking trackers and data collection on our smartphones. This is especially true as internet connections aren’t only happening via browsers anymore but also through the apps we use in so many aspects of our lives.

At an OS level, conventional smartphones log all your doings and whereabouts. This includes sensor data (barometric pressure, accelerometer, gyroscope), tracking usage of third-party Android apps and ads, voice commands, precise activity-based location data such as if you are walking or driving as well as your use of proprietary apps and services.

It is a known fact that these apps and services can track this data even if location is disabled, if the phone is offline or if you do not have an account to these services. This puts you and your personal data in a tight spot.

People know that data is collected but they are not always aware of what that truly means for them.

In the mainstream marketing industry however, they definitely do.

“Where you are is as important as who you are. We look to understand who a person is based on where they’ve been and where they’re going in order to influence what they’re going to do next. […] How can you start to look at these behaviors [location data] that are happening in the real world and maybe leverage some technology to allow you to make sense of who these people are?”

That quote is from a marketing strategies webinar from 2017, and the practice has been rapidly evolving ever since.

The New York Times was already investigating on this pressing issue back in 2018.

“Location information can reveal some of the most intimate details of a person’s life — whether you’ve visited a psychiatrist, whether you went to an A.A. meeting, who you might date,” said Senator Ron Wyden, Democrat of Oregon, who has proposed bills to limit the collection and sale of such data, which are largely unregulated in the United States.

This situation has to change.

At /e/ we want to do our part to make the internet a safer place for all users.

We strive to share all information about /e/OS with full transparency. Our goal is give each user a choice and control over how they use and protect their smartphone and data.

The apps we choose to install on our devices are a crucial point that will determine how safe we can feel in our everyday activities.

Our /e/OS App Installer helps you evaluate which apps are safe and which ones you are best off avoiding. With the help of the Exodus Privacy database, /e/ can decipher app code for you: you can see which and how many trackers are in each app. It also lists the permissions the app requires to operate.

One of our objectives for this year is developing our Privacy Center app to raise user awareness as well as help them gain more control on trackers on their smartphones and generally improve their data privacy management. It will present information about trackers and permissions as well as gives users the options to improve their privacy by setting up alerts, disabling app features and setting up custom geo-location.

73% of internet connections are made from a smartphone. A safer internet starts with a safer environment to browse, communicate, share and shop.

If that sounds like something for you, head over to our Twitter account. We are hosting a giveaway with our partner, Fairphone and you could win a Fairphone 3+ with /e/OS, or a number of other privacy-friendly prizes.

Today, /e/ OS runs seamlessly on more than 100 devices and can be downloaded for free. For people looking for a ready to go solution, we also offer pre-installed phones.

Follow us on social media:

Twitter: https://twitter.com/e_mydata

Mastodon: https://mastodon.social/@e_mydata