2

Technology users are faced with a challenge: Allowing our tech devices to work without them invading our privacy.

Obviously choosing products carefully is a critical step. Unfortunately, the two main players in the smartphone space, Google and Apple, are well known for their questionable data collection and harvesting practices.

LineageOS and /e/OS are up-and-coming providers of privacy-friendly smartphone operating systems. Until they become more commonplace, I thought it would be worthwhile to create a compendium of internet hosts to which Android connects by default.

To do this, I let an Android device run for 5 hours and captured all packets trying to leave the device.

The Android device was configured never to share contact data, calendar data, task data, map data, location data, or any history of any kind. It also was configured to not transmit or receive email at all. The internet search function of the launcher was removed. Furthermore, Google Chrome and the Google's Android Assistant were both disabled, as were all the various "Google Play" apps (such as Google Play Books, Google Play Games, Google Play Movies & TV, Google Play Music / YouTube, Google Play Newsstand) except for the Play store. Within the Google Play store, automatically checking for new app versions was disabled. Finally, a non-Google keyboard was installed and set as the default.

Even after doing all this, within just 5 hours of the phone sitting without being used, the Android device attempted to connect to all the following Google-owned hosts:

history.google.com
mtalk.google.com
alt1-mtalk.google.com
alt2-mtalk.google.com
alt3-mtalk.google.com
alt4-mtalk.google.com
alt5-mtalk.google.com
alt6-mtalk.google.com
alt7-mtalk.google.com
alt8-mtalk.google.com
android.clients.google.com
www.google.com
android.googleapis.com
play.googleapis.com
cloudconfig.googleapis.com
connectivitycheck.gstatic.com
footprints-pa.googleapis.com
mobilemaps.googleapis.com
people-pa.googleapis.com
www.googleapis.com
www.googletagmanager.com
play-lh.googleusercontent.com
smtp.gmail.com

What is the purpose of each of these hosts, and why are so many connections still being attempted given that almost everything Google-related is supposed to be disabled on the device?

Note that I don't expect a single answerer to know the purpose of every host listed, but hopefully we can work together to use this QA to create a quality reference resource.

2

I don't know the purpose of all hosts, but here is what I know:

connectivitycheck.gstatic.com

On this host typically only the URL https://connectivitycheck.gstatic.com/generate_204 is used. It is used by the Android device to determine if there is Internet access or not.

android.clients.google.com

Primarily this host serves Google Play Store for all sorts of queries, e.g. search for apps, periodical device registration, ...

history.google.com

The purpose of this host is not quite clear. The used service is called "history recording" and the server responds if it should be enabled or not. Potentially this is the host for the Google location history recording?

play.googleapis.com

Obviously this API is used by Google Play Store. For example if an app should be downloaded this server is used (besides some other servers).

android.googleapis.com

As far as I know this server is used for authentication purposes and for Google push notifications.

www.googleapis.com

Used by various Google services such as Google Calendar, Drive, Chat, Hangouts, User Location, Android Video ...

Inspect the traffic on your own

If you are interested in more details and have a rooted spare device I recommend to you to install Xposed + TrustMeAlready plugin (this disables SSL/TLS server check for every app - hence makes SSL/TLS totally insecure therefore don't use this on a regular device). Then install an HTTPS intercepting proxy such as Fiddler/Mitmproxy/Charles, ... on your PC and configure your PC as proxy in Wifi settings. Afterwards you can see all the data transmitted by your device.

4
  • Thank you Robert! That's a great start. The one that you write about that I find most curious of those is history.google.com, as it doesn't seem like a call should be needed when history collection is disabled. Jan 27 at 8:29
  • @StevenPenny The only alternative I know would Frida/Objection and it's anti TLS pinning scripts. But for using that you need to attach specifically to each process which can get complicated when it comes to Google processes as you have to handle multiple at the same time. And 2 years is not that old. It has some known problems with obfuscated apps that use OKHTTP pinning but that is nothing you can be fixed in a universal anti pinning plugin.
    – Robert
    Oct 19 at 19:53
  • I mean you posted this recommendation pretty recently - have you actually used TrustMeAlready recently, or was it something you used a while back, and are not sure of the current effectiveness of the tool? Oct 19 at 20:01
  • @StevenPenny I used it just a few weeks ago on an Android 11 device. Therefore I can verify that it still works.
    – Robert
    Oct 19 at 20:23
1

@Robert has already given an answer to several addresses. I will just add my 2 cents for the following:

OK, so basically the idea is the following: your system makes one connection to Google servers, specifying some kind of AndroidID to be recognized.

On the other side, every apps that use GCM has a server part somewhere, that also makes a connection to the Google servers, specifying an app identifier. Then, when one event is to be sent to you, it is send to the Google servers with your AndroidID, allowing the server to thus relay it to you.

The idea behind that is to have only one open connection on your phone, instead of one per app, allowing for much greater battery life. The cost is privacy, because that means all messages are going through Google servers. App can work a bit around this by having either encrypted messages content or minimal amount of information inside. But at the very least Google will have the following information: you have received a message from this app at this given time.

Note that GCM is deprecated. Considered the web address only for FCM now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.