Mon, 14 Oct 2019 23:33
CopperheadOS is a Linux-based mobile operating system with a focus on privacy and security. Itbuilds on the latest stable release of the Android Open Source Project (8.1.0) which is Androidwithout any Google apps and services.
This usage guide documents the user experience of the OS with a focus on how it compares to theAndroid operating system. Most security features are kept unintrusive without a user-facingimpact. See the technical overview fordocumentation on the security features rather than only changes to the user experience.
CopperheadOS can run Android apps unless they have a hard dependency on Google services. It shipswith the F-Droid app store to provide access to thousands of open source apps but it can also runmany apps from the Amazon Appstore and Google Play Store.
Since it doesn't include Google apps and services, CopperheadOS isn't limited by the requirementsimposed by Google for an operating system to be considered Android compatible. It disregards theconstraints required to actually be Android while still retaining the ability to run nearly allreal world Android apps not tied to Google. Android devices aren't permitted to ship many of thefeatures documented below like the Network permission toggle.
Permission modelApps run in an application sandbox with access to little more than their internal data andinterfaces explicitly exported to them from the base system and other apps. Most of theircapabilities need to be granted by the permission system. Permissions are divided into normalpermissions like the ability to set an alarm or start at boot and dangerous permissions that needto be explicitly granted by users.
CopperheadOS and stock Android use the same runtime permission model for apps targeting the modernAndroid platform. Dangerous permission groups (camera, contacts, microphone, etc.) are disabled bydefault and apps need to request them from the user as needed with the expectation that theyattempt to handle not getting the permissions. The dangerous permission groups can also be toggledvia Settings -> Apps & notifications -> App info -> App name -> Permissions and modern apps can beexpected to handle this and request the permissions again as needed. Dangerous permission groupscan also be audited / toggled by group instead of by app using Settings -> Apps & notifications ->App permissions.
For apps targeting old versions of the Android platform, stock Android grants all requesteddangerous permissions at install time. The dangerous permission groups can still be toggled offvia Settings -> Apps & notifications -> App info -> App name -> Permissions and provide empty datawhere possible rather than failing for compatibility. By contrast, CopperheadOS presents the userwith a menu where they can review and disable dangerous permission groups before the app is ableto run. The substantial difference is that stock Android doesn't give the user a chance to toggleoff permissions before the app is able to run. Installing it and toggling them off before manuallylaunching the app is not adequate as it's possible for it to be started before that.
Note that Android makes it possible for apps to get by without permissions in most cases. An appcan have the user pick a contact, take a picture, store / open a file in a storage provider, etc.without any permissions required. Be skeptical about the justification given by app developers fortheir permission usage. For example, many claim to need to read the phone state (Phone permissiongroup) to detect an active phone call but it's almost always a false justification as they couldbe using the standard audio focus mechanism.
Network permissionUnlike stock Android, CopperheadOS treats full network access as a user-facing permission with atoggle. For compatibility, it's enabled by default for apps targeting the modern Android platformunlike other runtime permissions.
There are many known cases of apps exporting interfaces to other apps for making limited networkrequests, so this toggle will become more useful when further isolation options are available. Forexample, web browsers almost all expose an interface allowing other apps to open URLs and choosenot to require either the INTERNET permission or explicit user consent before making the request.
Sensors permissionUnlike stock Android, CopperheadOS treats sensor access as a user-facing permission with a toggle.For compatibility, it's enabled by default for apps targeting the modern Android platform unlikeother runtime permissions. Stock Android only treats heartbeat sensor access as dangerous.
Unlike the Network toggle, apps aren't marked with an existing low-level permission when they makeuse of sensor access. CopperheadOS adds a new permission and treats all apps as requesting it sothere's a sensor permission toggle for every app.
Sensor access has been shown to provide the capability to perform locationtracking, inputlogging and crude audio recordingthat's still capable of recognizingspeechdespite the 200 Hz sampling limit enforced by the OS.
Background accessCopperheadOS adds special permissions for controlling access to data in the background in Settings-> Security -> Apps with background access.
This feature will become more strict in the future. It's an early implementation aimed at fleshingout the full set of functionality and working towards disabling access by default.
The powerful 'draw over other apps' special permission can be used to remain in the foreground. Itneeds to be explicitly granted by users in a more manual way than the usual dangerous permissionrequest dialog and a persistent notification is displayed while it's being used. It also can't beused to draw over the system ui to hide the persistent notification. It's outside of the scope ofthis feature as it's quite dangerous already and should only be granted to an app in exceptionalcircumstances just like accessibility services and device administrators.
ClipboardCopperheadOS disables access to the clipboard by apps in the background by default. This can beenabled per-app via Settings -> Security & location -> Apps with background access -> Accessclipboard in the background. For example, you may need to whitelist a clipboard manager.
Audio recordingInitiating audio recording in the background can be disabled per-app via Settings -> Security &location -> Apps with background access -> Record audio in the background. It isn't yet disabledby default but will be in the future.
For now, apps can still initiate audio recording in the foreground and continue in the backgroundeven with background audio recording disabled. The feature will eventually be improved to killapps with an open recording stream when they're sent to the background.
SensorsSensors access in the background can be disabled per-app via Settings -> Security & location ->Apps with background access -> Access sensors in the background. It isn't yet disabled by defaultbut will be in the future.
LocationLocation access in the background can be disabled per-app via Settings -> Security & location ->Apps with background access -> Access location in the background. It isn't yet disabled by defaultbut will be in the future.
Serial numberCopperheadOS requires that apps have the Phone permission group (read phone state) to access theserial number just like the IMEI on stock Android. Android is moving towards this but doesn't yetenforce it even for apps targeting Android Oreo.
Display over other appsUnlike stock Android, CopperheadOS doesn't permit any automatic grants of the special "Displayover other apps" permission. It needs to be very explicitly granted by users.
StorageApps have their own private storage directories and can share files with other apps using contentproviders. Apps can act as storage providers to provide structured requests to retrieve and storedata including for the shared storage directory. Direct scoped access can also be requested forthe shared storage directory (since 7.0). Unfortunately, many apps require the storage permissionsfor direct, full access to shared storage so it's unwise to store sensitive data there.
In the future, CopperheadOS will offer the ability to isolate shared storage rather than togglingaccess. Isolated shared storage will provide an app with a dedicated shared storage directoryaccessible only to themselves and the built-in file manager. Ideally, apps would already use theavailable tools to provide this kind of functionality on their own.
File managementThe built-in file manager for shared storage is recommended. It's available as the Files app onthe home screen and is also accessible via Settings -> Storage -> Files. Shared storage can beshown by enabling by "Show internal storage" in the app menu. It has proper integration withstorage providers (apps providing storage to other apps, with explicit user control) and externalstorage. It will also be the only app able to access isolated shared storage directories of otherapps once that feature is implemented.
LocationThe location icon is displayed in the status bar when an app is monitoring the device's location.
Settings -> Security & Location -> Location provides a global toggle to disable location detectionalong with a list of apps that have made recent location requests.
User profilesUser profiles offer isolated workspaces within the operating system.
Fully opening the notification tray will show an avatar for the main user profile. Touching itopens the menu for creating and switching between profiles. Further configuration is available via'More settings' which is a shortcut to Settings -> Users & accounts -> Users.
The special Guest profile is meant to be used as a scratch space with a quick shortcut in thenotification tray for deleting everything in the profile. It also offers the option to clear itwhen switching to it.
Apps cannot communicate or share data across user profiles. On Pixel phones, each user profile hasseparate disk encryption keys for all user data rather than there being a shared boot password. Aprofile also cannot record audio while another profile is active. By default, only the Owneraccount has access to phone calls and SMS. It can be enabled for other accounts via the usersettings menu on the owner account.
In addition to the baseline functionality, CopperheadOS exposes option to disallow audio recordingand to disallow installing apps in the user configuration menu for the owner account.
Force always on Tor / VPNIn Settings -> Network & Internet -> VPN, the gear icon next to installed VPN apps like Orbot(Tor) can be used to set one as an "Always-on VPN" to make it start automatically. However, it'salso necessary to toggle on "Block connections without VPN" to disallow connections being made ifthe VPN dies. This will be enabled by default for an "Always-on VPN" on CopperheadOS in the nearfuture.
Native debuggingSupport for native debugging features can be disabled by toggling off Settings -> Security &Location -> Enable native code debugging. It's left enabled by default like stock in order togenerate useful logs and crash dump information from crashes tied to bugs in native code.Disabling it will make the information generated by the 'Take bug report' feature nearly uselessfor crashes caused by native code but it will still produce useful information for uncaught Javaexceptions. There are currently no known app compatibility issues caused by disabling this, but itisn't compatible with some nasty tricks used by obfuscated apps to make themselves harder toinspect.
USB peripheralsCopperheadOS defaults to ignoring connected USB peripherals if the screen is locked. This can becontrolled in Settings -> Security & Location -> USB accessories. The options are:
Disallow new USB peripheralsAllow new USB peripherals when unlocked (default)Allow new USB peripherals (like stock Android)This option has no impact on the device acting as a USB peripheral itself when connected to acomputer. However, Android already defaults to charge only mode and requires explicit opt-in tothe device exposing itself as an MTP, PTP or MIDI device.
Camera on lockscreenCopperheadOS adds a toggle at Settings -> Security & Location -> Camera on lockscreen for reducinglockscreen attack surface by disallowing camera usage. It disables both the camera launch icon inthe lower right corner of the lockscreen and camera launch gestures while locked.
Quick Settings restrictionsCopperheadOS restricts usage of sensitive Quick Settings tiles while the screen is securely locked.
The following Quick Settings tiles have an unlocking requirement in stock Android:
CastLocationCopperheadOS extends this requirement to more tiles:
BluetoothNFC (not present as a tile in stock)Airplane modeWi-FiAuto-rotateData SaverHotspotCellular dataBatterySome tiles still have no unlocking requirement:
FlashlightNight LightInvert colorsDo not disturbWorkThe 'Flashlight' tile is quite useful from the lockscreen and adds minimal attack surface.
'Night Light' and 'Invert colors' are comparable to the brightness slider. They add minimal attacksurface and are easy to notice and toggle off. Similarly, 'Do not disturb' (DND) is comparable tothe volume rocker which works while locked and both are quite useful functionality to have there.The volume rocker already allows setting the 'Alarms only' DND mode too.
Android for Work isn't currently in scope for CopperheadOS hardening and the Work tile isn'tavailable when it's not in use, so it has been left as is. Android for Work isn't aimed atbusinesses deploying dedicated work devices but rather Bring Your Own Device (BYOD).
Wi-FiScanningMAC randomization is always enabled for Wi-Fi scanning. The Nexus 5X and Pixel phones have fairlyunique firmware support for scanning MAC randomization going above and beyond the usualimplementation.On most other devices, there are identifiers exposed by Wi-Fi scanning beyond the MAC address suchas the packet sequence number and assorted identifying information in the probe requests.
Wi-Fi scanning is never performed when Wi-Fi is disabled without explicitly enabling it in Settings-> Security & Location -> Location -> Scanning, unlike stock Android. The same thing applies toBluetooth.
Avoid using hidden APs (i.e. APs not broadcasting their SSID) since known hidden SSIDs end upbeing broadcast to find them again. SSIDs are not broadcast for standard non-hidden APs.
Privacy when associated with an Access Point (AP)The DHCP client uses the anonymity profile rather than sending a hostname so it doesn't compromisethe privacy offered by MAC randomization.
Unlike stock Android, CopperheadOS also provides MAC randomization when associated with an AP.This is currently exclusive to Pixel phones and can be toggled off in Settings -> Network &Internet -> Wi-Fi -> Wi-Fi preferences -> Randomize MAC address which will restore the hardwareMAC address when Wi-Fi is toggled off and on again.
LTE only modeIf you have a reliable LTE connection from your carrier, you can reduce attack surface bydisabling 2G / 3G connectivity in Settings -> Network & Internet -> Mobile network -> Preferrednetwork type. Traditional voice calls will only work in the LTE only mode if you have either anLTE connection and VoLTE (Voice over LTE) support or a Wi-Fi connection and VoWi-Fi (Voice overWi-Fi) support. VoLTE / VoWi-Fi on Pixel phones is expected to work on all carriers where it'ssupported on stock (T-Mobile, Rogers, Fido, etc.) other than Verizon. VoLTE / VoWi-Fi compatibilityis substantially worse on Nexus devices for now.
This feature is not intended to improve the confidentiality of traditional calls and texts, butmay somewhat raise the bar for some forms of interception. It's not a substitute for end-to-endencrypted calls / texts or even transport layer encryption. LTE does provide basic networkauthentication / encryption but it's for the network itself. The intention of the LTE only featureis only hardening against remote exploitation by disabling an enormous amount of legacy code.
Network connection information / statisticsCopperheadOS prevents third party apps from obtaining detailed network information without anypermissions as they can on stock Android. The Net Monitor app is built into CopperheadOS and has aspecial exception from this rule. Network information can also be accessed via the Android DebugBridge shell. Third party apps can only access information that's made explicitly available viadocumented interfaces with permission controls and there's essentially no access to it right nowas valid use cases for it by third party apps not covered by Net Monitor haven't been presented.The only known examples of using the information in good faith haven't been correct, such as theattempts to implement a user-facing firewall via a VPN service rather than properly integrated viathe existing OS firewall infrastructure so that it actually works properly.
Default connections made by CopperheadOSNet Monitor can be used to monitor connections by the OS in addition to those done by apps. TheDownloadManager service will do HTTP / HTTPS downloads on behalf of third party apps and thoseshouldn't be confused with downloads triggered by the OS itself.
CopperheadOS makes connections to the outside world to test connectivity, detect captive portalsand download updates. No data varying per user / installation is sent in these connections. Therearen't analytics / telemetry in CopperheadOS.
The expected connections by CopperheadOS (including all base system apps) are the following:
The CopperheadOS Updater app fetches update metadata from https://SERVER/DEVICE-CHANNEL everyhour when connected to a permitted network for updates. The Nexus 5X and Nexus 6P uselegacy.copperhead.co (144.217.14.61) and Pixel phones use release.copperhead.co(144.217.14.110). These are currently hosted on OVH like the Copperhead site.F-Droid performs update checks for enabled repositories. By default, the standard F-Droidrepository and Copperhead repository are enabled. The Copperhead repository is hosted atfdroid.copperhead.co (142.44.162.254) on OVH.As with other devices with a Qualcomm baseband (which provides GPS), GPSalmanac updates from Qualcomm are downloadedfrom https://xtrapath1.izatcloud.net/xtra3grc.bin, https://xtrapath2.izatcloud.net/xtra3grc.bin orhttps://xtrapath3.izatcloud.net/xtra3grc.bin. CopperheadOS has modified all references to theseservers to use HTTPS rather than a mix of HTTP and HTTPS.Connectivity checks designed to mimic a web browser user agent are performed by using HTTP andHTTPS to fetch standard URLs generating an HTTP 204 status code. This is used to detect wheninternet connectivity is lost on a network, which triggers fallback to other available networksif possible. These checks are designed to detect and handle captive portals which substitutethe expected empty 204 response with their own web page. These need use a very common domain andURL in order to bypass whitelisting systems only permitting access to common domains / URLs so adomain like copperhead.co would be inadequate. CopperheadOS leaves these set to the standard fourURLs to blend into the crowd of billions of other Android devices with and without Google MobileServices performing the same empty GET requests:HTTPS: https://www.google.com/generate\_204HTTP: http://connectivitycheck.gstatic.com/generate\_204HTTP fallback: http://www.google.com/gen\_204HTTP other fallback: http://play.googleapis.com/generate\_204DNS connectivity and functionality testsDNS resolution for other connectionsThe connectivity checks are performed by both the OS itself and the hardened Chromium browser.
DNSUnlike stock Android, CopperheadOS uses Cloudflare's DNS servers for network connectivity testsand the default fallback when the network doesn't provide DNS servers. This decision is based onCloudflare providing a stellar privacypolicycompared to the decent one for GooglePublic DNS. Cloudflare DNS supports DNS-over-HTTPS and DNS-over-TLS so it will be possible to useit with Android's upcoming DNS-over-TLS support.
In practice, the default fallback is rarely used. DNS servers provided by the local network arepreferred for both mobile data and Wi-Fi, since it avoids trusting an additional party with theinformation. The local network and ISP can still obtain all of the information when using analternate DNS server. Hiding the information from them requires using a VPN to move the same trustto the VPN provider which is hopefully more worthy of that trust than the ISP. Even when usingDNS-over-HTTPS or DNS-over-TLS, tracking IP addresses leaks nearly as much information and evenHTTPS connections leak the hostname (unlike the path) so very little is truly being hidden bythose technologies.
Android 9.0 is adding support for overriding the default DNS servers with a DNS-over-TLS serverchosen by the user. However, as noted above this won't be able to hide much information from thelocal network and ISP. It has some value but is limited, particularly before there's some form ofencrypted SNI extension for TLS 1.3 to avoid leaking exact hostnames for HTTPS rather than onlyhaving imprecise reverse DNS lookups.
It's possible for apps implementing the VPN service feature to provide alternative DNS servers andit can be done without intercepting and routing network traffic like a real VPN. Some apps usethis to implement features like domain-based content filtering.
Authentication / encryptionUsing a strong passphrase is recommended. CopperheadOS extends the arbitrary default maximumpassphrase length from 16 characters to 64 characters.
Pattern unlock is strongly discouraged and may be turned into a hidden option in the future.
Fingerprint unlock acts as an extremely convenient secondary unlock mechanism. However, it opensup weaknesses compared to knowledge-based authentication. It's not usable after a reboot for thefirst unlock or after 48 hours and it doesn't reduce authentication or encryption security inthose cases. It has the important redeeming quality of making a strong passphrase as the mainunlock mechanism very convenient and the placement of the scanner can make it even more convenientthan swipe to unlock or even the no unlock mechanism option (i.e. power button only).
The long-term plan for CopperheadOS is to build upon fingerprint unlock by adding support forsetting an optional knowledge-based 2ndfactor. Once that's implemented, the onlyrecommended authentication setups will be the following, from strongest to weakest:
Strong passphraseStrong passphrase with fingerprint + PIN (or weaker passphrase) as a secondary unlock mechanismStrong passphrase with fingerprint as a secondary unlock mechanismUntil it's implemented, using a PIN or a weak passphrase instead of the second option can makesense. It's much weaker in the case where fingerprint unlock isn't available, i.e. after a rebootor the 48 hour timeout.
CopperheadOS supports randomizing the PIN entry layout via a toggle in Settings -> Security &Location -> Passwords -> Scramble PIN layout, which is disabled by default. This will apply tothe planned 2nd factor fingerprint unlock mechanism in addition to using a PIN as the main unlockmethod, which will be discouraged once there's a better option available.
Fingerprint unlock attemptsCopperheadOS disables fingerprint unlock after 5 failed attempts, unlike stock Android whichallows 20 attempts with 30 second delays after each 5 failed attempts.
You can use this to disable the fingerprint scanner by intentionally making invalid unlockingattempts. The device will vibrate on invalid unlocking attempts and will stop vibrating oncefingerprint unlock has been disabled.
Keyboard personalized suggestionsThe keyboard has the option of maintaining an internal database to improve suggestions based onpast input. It's entirely local and inaccessible to any other apps like all internal app data, butCopperheadOS disables it by default to avoid gathering persistent statistics about user input thatmay be valuable to an attacker that has compromised the device. It can be enabled again inSettings -> Languages & input -> Virtual keyboard -> CopperheadOS Keyboard -> Text correction ->Personalized suggestions, which is also accessible by holding the comma key on the keyboard andpressing CopperheadOS Keyboard Settings.
F-Droid repositoryThe CopperheadOS F-Droid repository is included in the default set. For reference:
Repository URL: https://fdroid.copperhead.co/repoRepository fingerprint: F0D4EB1193AD82FEB224BD1174B6FBD89A39D8ED988C9FFF2ADD0DCD1C4E271BIt's only intended to be useful to CopperheadOS users. Nothing from there is guaranteed to workelsewhere and issues on other operating systems should not be reported.
App recommendationsBuilt-in user-facing appsCopperheadOS includes most of the standard Android Open Source Project (AOSP) apps.
The following apps are actively developed as part of AOSP and receive both bug fixes and newfeatures. Using these apps rather than third party ones is highly recommended:
CalculatorClockContactsFilesLauncherPhoneSettingsThe following apps are no longer actively developed as part of AOSP and only receive importantsecurity fixes. These apps will keep working indefinitely since Android is backwards compatiblebut they won't receive new features or overhauls. These are candidates for replacement down theroad, but the replacements need to be a good fit for CopperheadOS:
CameraEmailGalleryMusicSearch (launcher icon is removed in CopperheadOS, but it's included for compatibility)Some of the AOSP apps have been replaced in CopperheadOS:
Calendar -> Etar (maintained derivative of the backend-agnostic AOSP Calendar app, can be usedwith any service exposing a calendar backend via an app)Browser -> Chromium (hardened browser developed by CopperheadOS based on Chromium, see thesection on browsing)Messaging -> Silence (replaced to provide end-to-end SMS encryption)CopperheadOS also includes some additional built-in apps. These apps are included to providefunctionality missing in AOSP compared to stock Android or in the case of Net Monitor because itcan't work if it's not integrated with the OS due to CopperheadOS privacyenhancements.
F-Droid: app repositories and updatesOffline Calendar: local calendar storage backend as an alternative to cloud-based backendsNet Monitor: monitoring network connectionsPDF Viewer: hardened PDF viewer developed alongside CopperheadOSRed shiftOn Pixels, use Settings -> Display -> Night Light instead of a third party app requiring a grantof the special "Display over other apps" permission.
MessagingRecommended messaging app preference list:
Conversations + OMEMOSignal to communicate with Signal users and for encrypted callsSilence encrypted SMS to communicate with Android users without data connectionsOther apps with end-to-end encryption if you can't convince contacts to installone of the above (Wire, WhatsApp, etc.)Apps with transport encryption without end-to-end encryptionUnencrypted SMS or apps without transport encryptionConversationsThe recommended messaging client is Conversations. It's an XMPP client interoperable with otherXMPP clients and servers. It supports end-to-end encryption via robust cryptography (OMEMO) basedon the Signal protocol along with OTR and PGP for backwards compatibility with lesser clients.It's one of very few apps with efficient push messaging without needing Google Cloud Messaging(GCM). It also supports end-to-end encrypted group chat.
Conversations has an official XMPP server with all of the necessary extensions for fullfunctionality. It costs 8 EUR / year after the 6 month free trial. Using the official server tosupport the project is recommended, but there are otheroptions without a subscription fee. We don'tcurrently have a recommendation about which ones to prefer, beyond sticking to those with supportfor every XEP other than XEP-0357 (which is for GCM, rather than the standard push mechanism).
SignalSignal has full support for all features on CopperheadOS including voice and video calls but itisn't optimized for low impact on battery life like Conversations. Copperhead used to have a forkcalled Noise removing the hard dependency on Google Play Services, which then became a rebrandedbuild until full backups were supported to migrate away from it.
The official website releases of Signal can be installed from theirsite but this requires temporarily enabling installing apps fromyour browser (it still requires consent each time). Signal will check for updates to itself andnotify about them but it can't support the option of automatic upgrades. The upgrades need to beinstalled by hand and require enabling app installs from Signal (it still requires consent eachtime).
SilenceCopperheadOS replaces the AOSP Messaging app with Silence to provide support for encrypted SMS. Itisn't really recommended to prefer it over data-based encrypted messaging apps, but rather to makeuse of it for communicating with contacts without data connections, or for all messaging if youdon't have a data connection yourself. It makes sense to leave it as the default SMS app even ifyou're using an app like Noise able to act as the default SMS client.
WhatsAppWhatsApp works on CopperheadOS, but it isn't currently available in a convenient way. The best wayto use it is probably installing the Amazon Appstore as an apk and then installing it from there,so that you have updates for it along with the Appstore which will update itself.
We might consider trying to convince Facebook to either host an F-Droid repository or permitredistribution of it.
YouTubeUse the NewPipe app from F-Droid if you want more functionality than the mobile site.
MapsSimple, fast and highly usableThe all around best option for basic map and navigation functionality ismaps.me but it has some privacy and security issues.
The com.github.axet.maps fork is available in the standard F-Droid repository with the ads,binaries, etc. stripped out.
The official maps.me apk is available on their site and the Play Storeversion works perfectly well on CopperheadOS too.
The main issue with it is that there's no way to have it use internal app storage instead of usingshared storage for internal app data like settings and map downloads. The data is exposed to otherapps with storage access and could be tampered with or simply watched for location information. Itmight be something that the fork would be willing to address. Feel free to encourage both projectsto take a more secure approach or at least offer it as an option.
Functionality richOsmAnd (OpenStreetMap Automated Navigation Directions) can be installed from F-Droid and providesmap viewing and mobile navigation. It has the killer feature of optional support for downloadingthe OpenStreetMap database for chosen regions. In addition to the obvious advantage of not havinga dependency on an internet connection, offline mapping offers more privacy. It's recommended touse the offline mode if you have enough storage space to spare. Note that it's important toconfigure OsmAnd to use the internal storage directory: go into the menu, then Settings, Generalsettings, select the "Data storage folder" option, select the edit button and set it to the"Internal application memory" option.
Note that OsmAnd sends the semi-persistent ANDROID_ID to their server on connections. ANDROID_IDwill become less identifying in future CopperheadOS releases by default and further user controlwill be offered, but it reflects poorly on OsmAnd.
Google mapsIf you really need Google Maps, you can use their web application. It's not as nice as the mobileapp but the core functionality other than turn-by-turn navigation is there.
UberUse https://m.uber.com/ instead of the Android app. Open it with Chromiumand select 'Add to Home screen' from the menu. Unlike most sites, the Uber web app is set up toact as a standalone app when added to the home screen rather than the launcher only acting as abookmark and opening a Chromium tab. The map isn't enabled by default since the web app is aimedat the niche of users with low bandwidth but it can be enabled.
ChromecastVLC supports casting to Chromecast devices, so support within the OS provided by Play Servicesisn't required.
Installing apps from the Play StoreThe Yalp Store app on F-Droid can be used to install apps from the Play Store. Before using it toinstall an app, press the menu button, press Settings and enable the toggle for 'Download tointernal storage' to make sure Yalp doesn't download apps to shared storage where other apps withstorage access could potentially tamper with them before installation. Yalp will still demand theStorage permission even though it isn't required though.
It's not clear how Google feels about the Yalp Store app so we don't recommend using your ownaccount credentials unless it's a throwaway account. Stick to the Yalp Store credentials. If youneed apps that you've purchased, consider using F-Droid's support for swapping apps betweendevices to get them from a trusted device with the Play Store. Note that many paid apps use DRMwhich won't work without Play Services.
Many apps from the Play Store use Google Play Services, but lots of those will still work fine onCopperheadOS. Some functionality like push notifications may not be available if the apps don'timplement fallbacks for systems without Play Services included in the OS.
Be careful when installing apps from the Play Store and granting permissions to them since overallthey're a lot less trustworthy than the apps in the F-Droid repositories enabled by default onCopperheadOS. There are apps in F-Droid with serious privacy and security issues but there aren'tany known cases of malicious apps and they tend to be a lot more respectful of privacy with mostof the major deviations from that marked in the F-Droid entries for those apps.
Verified bootCopperheadOS only supports devices with verified boot support. The hardware verifies authenticityand integrity of firmware and the core operating system on every boot. The core operating systemverifies the entire rest of the operating system, providing full verified boot for the OS. Everyinstallation is guaranteed to be bit-for-bit identical at a storage level, otherwise it wouldn'twork. Updating the OS updates it to a pristine installation of a new release.
A fresh installation or an incremental update shipping only changes to blocks provide exactly thesame result. If any block fails to verify, the OS has error correction data to attempt to fix theissue before verifying the fixed block again. If the corruption cannot be fixed, an error will bedisplayed and it will reboot.
An attacker that has successfully gained root access via an exploit chain cannot simply modifyany of the OS partitions. They would need to have an exploit for the verified boot process toexploit it as it reads their altered data which is an extremely high bar. This greatly raises thebar for privileged persistence. An attacker is forced to persist as an unprivileged third partyapp, requiring exploitation of the OS via an unpatched vulnerability to gain back control. Factoryresets wipe userdata, guaranteeing that an attacker loses persistence unless they have a verifiedboot bypass. OS updates have a high chance of breaking any attempt to exploit the OS again too.
On the Pixel 2 and later, rollback protection is provided for the OS. This prevents an attackerwith root access from downgrading the OS to a previous version of the OS as a way to roll it backto a version where they have working exploits for verified boot, etc. The Pixel 2 and later alsoprovide substantially better enforcement of the CopperheadOS public key.
Verified boot is primarily about preventing attacker persistence, but it also greatly raises thecost of tampering with a device based on physical access. This is especially true for the Pixel 2.
For more technical details, see the documentation on verified boot.