Stop GMS Firebase Indexing from collecting all of the personal data

Question

When I was playing with settings on my Nokia 6.1 Plus running a stock ROM Android 10 with bootloader unlocked and rooted with Magisk v21+, I noticed that Firebase App Indexing that comes under Google Account Preferences was collecting all of my personal data. Of course, GMS was the culprit.

Here's the proof: This was the message that I received from the bank for the transaction that I made yesterday.

Every message that I sent and received had been collected in this given format. Also, many apps that use Firebase API sent these kinds of information.

I'm a guy who thinks about user privacy all-day, so I've used:

• Nuked_Script Magisk script that is used to disable trackers and ad services.
• AFWall+ for Firewall (root).
• Bouncer - Temporary App Permissions.
• AdAway for nullifying ads (root) - ads on Gmail, Twitter, Instagram still exist though
• Bromite webview and browser (Webview Switcher module).

When I turned the developer options off, Firebase App Indexing options also turned off (I mean hidden). So, does it mean that it stopped collecting my data? I still doubt that.

How can I stop this from happening?

P.S: I'm used to using Google Apps. But I don't want to give them such personal data.

Answer 1

You can add stronger measures , since your device is rooted

• First is Xprivacy Lua which does an excellent job of protecting your privacy and also Firebase Analytics amongst other trackers (XPrivacyLua needs EdXposed. For EdXposed installation on 10, see How to install EdXposed on Android 10 without triggering safety net)

• Next, download Warden App from F-droid or Izzy's repo. It is specifically aimed at killing trackers and loggers (with a few exceptions). You can selectively use the app to work on your apps or apps plus system.

By turning developer options off, you are only hiding what's happening w.r.t Firebase.

In addition, see answer here How can I make an Android app "forget" that it installed on my phone before?

Answer 2

as you are rooted why not to try old brute way: block all Firebase through /etc/hosts? I think that Firebase now is one of the hotest hole in mobile security.. this channel actively used not only for leaking personal data but also for C2 connections. yes, you should clearly understand that by this way you are blocking although debug and performance monitoring streams from your device..