# Android connectivity checks occur outside VPN tunnels **URL:** https://discuss.privacyguides.net/t/android-connectivity-checks-occur-outside-vpn-tunnels/20441 **Category:** Site Development **Tags:** completed **Created:** 2024-08-30T06:20:21Z **Posts:** 14 ## Post 1 by @anon48875053 — 2024-08-30T06:20:22Z [https://2722--glowing-salamander-8d7127.netlify.app/en/android/distributions/#grapheneos](https://2722--glowing-salamander-8d7127.netlify.app/en/android/distributions/#grapheneos) > GrapheneOS provides the option to switch back to connecting to Google’s servers for many of these background connections if you prefer, but it is far more robust/foolproof to use a [trusted VPN](https://2722--glowing-salamander-8d7127.netlify.app/en/vpn/) and enable Android’s native VPN [kill switch](https://2722--glowing-salamander-8d7127.netlify.app/en/os/android-overview/#vpn-killswitch) to hide information like this from adversaries on your network. Connectivity checks still happen outside the VPN tunnel, using the VPN alone will not cut it, one needs to also change connectivity checks to Google if they want to hide the fact that they’re using GrapheneOS. --- ## Post 2 by @jonah — 2024-08-30T06:24:08Z oh duh, of course. good catch --- ## Post 3 by @anon48875053 — 2024-08-30T07:16:37Z One more thing is that GrapheneOS enables **Always-on VPN** and **Block connections without VPN** by default. So the user doesn’t really have to enable or do anything. --- ## Post 4 by @redoomed1 — 2024-08-30T14:32:15Z > [@anon48875053](#): > > one needs to also change connectivity checks to Google if they want to hide the fact that they’re using GrapheneOS > [@anon48875053](#): > > **Always-on VPN** and **Block connections without VPN** by default. So the user doesn’t really have to enable or do anything I opened a PR to incorporate the feedback you provided in this thread: > > > List of changes proposed in this PR: > > - Correct the advice in the GrapheneOS r…ecommendation about hiding OS info from local network or ISP > - Relevant discussion: https://discuss.privacyguides.net/t/android-connectivity-checks-occur-outside-vpn-tunnels/20441 Please let me know if any wording should be changed. --- ## Post 5 by @anon48875053 — 2024-08-30T16:24:53Z You **need** to use a VPN and switch the connectivity checks to Standard (Google) if you want to hide the fact that you’re using GrapheneOS. Doing one while not doing the other is pointless. The killswitch part is also redundant when it comes to GrapheneOS because it’s enabled by default, like I said in my post above. --- ## Post 6 by @redoomed1 — 2024-08-30T16:35:44Z > [@anon48875053](#): > > Doing one while not doing the other is pointless. I can make the wording clearer to emphasize this. Thanks for pointing it out. > [@anon48875053](#): > > The killswitch part is also redundant when it comes to GrapheneOS because it’s enabled by default Yes, it is enabled by default. That’s why I changed the wording from > enable Android’s native VPN kill switch to > [keep] Android’s native VPN kill switch enabled ~~I don’t think it’s redundant though because people can turn off the kill switch for purposes like enabling Split Tunneling. And I’m not sure that people whose threat models call for hiding OS info from their network or ISP know to not disable the kill switch.~~ In the latest revision, I couldn’t find a clean way to fit in the note about the VPN kill switch, so I removed it. Here’s the latest version: > If you want to hide information like this from an adversary on your network or ISP, you **must** use a trusted VPN in addition to changing the connectivity check setting to **Standard (Google)**. It can be found in :gear: **Settings** → **Network & internet** → **Internet connectivity checks**. This option allows you to connect to Google’s servers for connectivity checks, which, alongside the usage of a VPN, helps you blend in with a larger pool of Android devices. --- ## Post 7 by @redoomed1 — 2024-08-30T17:05:40Z --- ## Post 8 by @anon48875053 — 2024-08-30T17:10:41Z You could change the wording to “blend in with billions of other Android devices," but that’s up to you. To me, “larger pool” sounds like there are multiple pools, which isn’t really the case, I can only think of two. --- ## Post 9 by @anon48875053 — 2024-08-30T17:17:45Z One more thing is that if one chooses to switch from GrapheneOS to Standard (Google), then they will make other people who are using the GrapheneOS option stand out more, so unless one needs to hide the fact that they’re using GrapheneOS, they should keep using GrapheneOS servers to help create a bigger pool and reduce the reliance on Google. --- ## Post 10 by @Rasta — 2024-08-30T17:25:12Z One other option on Graphene (not sure if its android or Graphene specific) is to disble connectivity checks entirely. I did that a few months ago and haven’t had any issues, i get notified by my DNS or VPN when they can’t connect. --- ## Post 11 by @anon48875053 — 2024-08-30T17:30:50Z You will still stand out because only GrapheneOS offers such option. Disabling connectivity checks also introduces some breakage. --- ## Post 12 by @Rasta — 2024-08-30T17:33:48Z I mean, anything other than Google will stand out so yeah. Just mentioning option 3 exists. As to breakages it can cause, do you have a link to somewhere I could read about those? I haven’t had any issues myself and would be interested in reading more on it. --- ## Post 13 by @redoomed1 — 2024-08-30T17:34:30Z > **[Connectivity check - GrapheneOS Discussion Forum](https://discuss.grapheneos.org/d/3079-connectivity-check/3)** > > GrapheneOS discussion forum > **[Disabling connectivity checks on GrapheneOS: Page 2 - GrapheneOS Discussion...](https://discuss.grapheneos.org/d/1839-disabling-connectivity-checks-on-grapheneos/29)** > > GrapheneOS discussion forum --- ## Post 14 by @Rasta — 2024-08-30T17:36:36Z Thanks. Captive portal issues, that explains why I haven’t had any issues yet. I’ll keep that in mind for when I’m connecting to guest wifi every now and then. --- ## Post 15 by @redoomed1 — 2024-10-17T23:45:53Z In Progress → Done --- ## Post 16 by @redoomed1 — 2024-10-17T23:46:10Z Closing thread since the PR [here](https://discuss.privacyguides.net/t/android-connectivity-checks-occur-outside-vpn-tunnels/20441/4) has been merged