Andy Burns, 2024-06-19 08:31:

> Arno Welzel wrote:
>
>> THe important thing is, that the app can not send data anywhere as it
>> has no internet access.
>
> I thought *all* android apps got INTERNET permission "for free" without
> having to ask?

No, this is not the case.

An app has to ask for the permission android.permission.INTERNET and
android.permission.ACCESS_NETWORK_STATE before it can connect to and
server on the network.

--
Arno Welzel
https://arnowelzel.de

Andrew, 2024-06-19 20:45:

[...]
> HeliBoard:
> 1. android.permission.READ_CONTACTS
> 2. android.permission.READ_USER_DICTIONARY
> 3. android.permission.RECEIVE_BOOT_COMPLETED
> 4. android.permission.VIBRATE
> 5. android.permission.WRITE_USER_DICTIONARY
> 6. helium314.keyboard.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
>
> OpenBoard:
> 1. android.permission.POST_NOTIFICATIONS
> 2. android.permission.READ_USER_DICTIONARY
> 3. android.permission.RECEIVE_BOOT_COMPLETED
> 4. android.permission.VIBRATE
> 5. android.permission.WRITE_USER_DICTIONARY
>
> Does anyone have a logical explanation of why this difference?

Heliboard supports a registered broadcast runtime reciever for Adroid 13
and above - see here:

<https://developer.android.google.cn/about/versions/13/features?hl=en#runtime-receivers>

Quote:

"To help make runtime receivers safer, Android 13 introduces the ability
for your app to specify whether a registered broadcast receiver should
be exported and visible to other apps on the device. On previous
versions of Android, any app on the device could send an unprotected
broadcast to a dynamically-registered receiver unless that receiver was
guarded by a signature permission."

--
Arno Welzel
https://arnowelzel.de

On 20/06/2024 10:14, Arno Welzel wrote:

> Andy Burns, 2024-06-19 08:31:
>
>> Arno Welzel wrote:
>>
>>> THe important thing is, that the app can not send data anywhere as it
>>> has no internet access.
>>
>> I thought *all* android apps got INTERNET permission "for free" without
>> having to ask?
>
> No, this is not the case.
>
> An app has to ask for the permission android.permission.INTERNET and
> android.permission.ACCESS_NETWORK_STATE before it can connect to and
> server on the network.

I don't remember being asked to grant internet access since about
Froyo/Gingerbread era

"Both the INTERNET and ACCESS_NETWORK_STATE permissions are normal
permissions, which means they're granted at install time and don't need
to be requested at runtime."

<https://developer.android.com/develop/connectivity/network-ops/connecting>

Arno,

>> How do you know it doesn't use Firebase ? (how did you figure that out
>> ?)
>
> Because I checked the code: <https://github.com/Helium314/HeliBoard>

Ah, yep, that would do it.

Alas, thats not something thats easy to automate.

>> But do I understand you correctly that if an app uses Firebase it doesn't
>> need the INTERNET permission (and/or alike) to be able "go online" ?
>
> No, but it needs to contain code to use Firebase.

??? I don't get that. Somehow you look to be disagreeing and agreeing with
me at the same time.

Simpler question: If an app uses Firebase it can go online, even though the
app doesn't request the INTERNET permission. Yes, or no ?

If "yes", any idea how it does that ? (curiosity speaking there)

> If you don't believe me,

Its not at all about me not believing you, its about my worry that a random
app can go online without my say-so.

In fact, its me believing you and wondering how I can spot an app which uses
that kind of circumvention of (denied) permissions.

Regards,
Rudy Wieser

Arno,

> The contacts permission is off by default in this app and is only needed
> when you enable "Suggest Contact names" in the "Text correction" settings.

"The contacts permission is off by default in this app" ?

That sounds like as if the app is managing its own permissions, and I *hope*
that that is not what you ment ...

But maybe you just mean that the permission will only actually be asked for
when it tries to access the contacts (and not when installing). But how
does that make a difference ? It still wants to access that contacts
data.

You know, my first thought was "WHY!". The tradeoff between not having to
enter a persons name myself (so the syntax checker can make an exception for
it) and the loss of privacy is a no-brainer to me.

> Before complaining about how insecure an app is you should first check it!

Are you teling me I must be a fullblown Java programmer before I'm allowed
to mention stuff I would never want to give the permission for ? I hope
not.

But if you think so - and with it effectivily forbidding me to open my
mouth - than I suggest you throw me into your killfile. 'Cause I've been
know to ask stuff - so I can learn from the answers and perhaps /one day/
become as knowledgeable as you and will be able to just look at some
sourcecode and figure out if its nefarious or not.

But at that time I will likely build my own apps instead. Much easier (ask
me how I know). :-)

Regards,
Rudy Wieser

Arno,

> An app has to ask for the permission android.permission.INTERNET and
> android.permission.ACCESS_NETWORK_STATE before it can connect
> to and server on the network.

Am I stil allowed to ask questions and learn from the answers ? If so :

Any reason why *two* permissions need to be enabled ? Whats the diference
between them ? What does the first do what the second doesn't and vise-verse
?

And yes, I did try to find information on both - and didn't find any
specific information on them (but instead other who where wondering the
same).

Regards,
Rudy Wieser

R.Wieser, 2024-06-20 16:26:

> Arno,
>
>>> How do you know it doesn't use Firebase ? (how did you figure that out
>>> ?)
>>
>> Because I checked the code: <https://github.com/Helium314/HeliBoard>
>
> Ah, yep, that would do it.
>
> Alas, thats not something thats easy to automate.
>
>>> But do I understand you correctly that if an app uses Firebase it doesn't
>>> need the INTERNET permission (and/or alike) to be able "go online" ?
>>
>> No, but it needs to contain code to use Firebase.
>
> ??? I don't get that. Somehow you look to be disagreeing and agreeing with
> me at the same time.

No - I just explained, that an app does need internet to use Firebase,
but still code, to use Firebase. So if you can not find code in the app
sources to use Firebase, then the app does not use it.

> Simpler question: If an app uses Firebase it can go online, even though the
> app doesn't request the INTERNET permission. Yes, or no ?

No. It can only use Firebase. Firebase is not "go online" but a
framework for authentication and using cloud storage:

<https://firebase.google.com/>

Yes "cloud" is usually also "online", but to any random server, but
Google servers which provide the infrastructure for Firebase.

Firebase can also provide Web hosting for apps, so the app itself does
not just run on the device but also includes parts hosted as web app on
a remote Firebase server.

--
Arno Welzel
https://arnowelzel.de

R.Wieser, 2024-06-20 16:53:

> Arno,
>
>> The contacts permission is off by default in this app and is only needed
>> when you enable "Suggest Contact names" in the "Text correction" settings.
>
> "The contacts permission is off by default in this app" ?

Yes, when you install the app, this permission will not be requested.
You *can* enable it, but it is activated by default.

> That sounds like as if the app is managing its own permissions, and I *hope*
> that that is not what you ment ...

An app *must* contain the permission request in the manifest, regardless
if it actually uses it or not. And Heliboard includes the *request* for
contact permission but will *not* ask to use it until you enable the
"Suggest Contact names" in the settings.

> But maybe you just mean that the permission will only actually be asked for
> when it tries to access the contacts (and not when installing). But how
> does that make a difference ? It still wants to access that contacts
> data.

It will only access contact data, when you enable the setting for it in
the app, otherwise not.

>> Before complaining about how insecure an app is you should first check it!
>
> Are you teling me I must be a fullblown Java programmer before I'm allowed
> to mention stuff I would never want to give the permission for ? I hope
> not.

No, you just see, what happens, if you let this permission disabled. If
the app still works without any error, it does not read contact data.

Also see the options in the app - "Suggest Contact names" is a good hint
what the permission for contact reading is used for. Better than just
assuming that the app does not respect your privacy just because of an
*optional* permission.

--
Arno Welzel
https://arnowelzel.de

Andy Burns, 2024-06-20 13:27:

> On 20/06/2024 10:14, Arno Welzel wrote:
[...]
>> An app has to ask for the permission android.permission.INTERNET and
>> android.permission.ACCESS_NETWORK_STATE before it can connect to and
>> server on the network.
>
> I don't remember being asked to grant internet access since about
> Froyo/Gingerbread era
>
> "Both the INTERNET and ACCESS_NETWORK_STATE permissions are normal
> permissions, which means they're granted at install time and don't need
> to be requested at runtime."
>
> <https://developer.android.com/develop/connectivity/network-ops/connecting>

I stand corrrected, yes, you're right. On current android versions, apps
don't have to ask for that permission, but you still need to add this in
the app manifest as developer, so people can check wether the app uses
network connections at all.

--
Arno Welzel
https://arnowelzel.de

Arno,

>>>> But do I understand you correctly that if an app uses Firebase it
>>>> doesn't
>>>> need the INTERNET permission (and/or alike) to be able "go online" ?
>>>
>>> No, but it needs to contain code to use Firebase.
>>
>> ??? I don't get that. Somehow you look to be disagreeing and agreeing
>> with me at the same time.
>
> No - I just explained, that an app does need internet to use Firebase,

That was not what I was asking.

>> Simpler question: If an app uses Firebase it can go online, even though
>> the app doesn't request the INTERNET permission. Yes, or no ?
>
> No.

Thank you. That (circumvention of permissions) was all I was worried
about.

Regards,
Rudy Wieser

Arno,

> An app *must* contain the permission request in the manifest,
> regardless if it actually uses it or not.

I take that as "regardless if it *directly* uses it or not."

But do you recognise that way of doing stuff might be problematic ? If you
lend your phone to someone a friend or your kid(s) get a hold of it (wanting
to play a game perhaps) they might cause the permission to be asked for, and
than it won't be you answering the question.

Time will tell if my phone uses the same "late binding" mechanism. I hope
not though.

> It will only access contact data, when you enable the setting for it in
> the app, otherwise not.

:-) You talk as if you are smart enough, but at the same time you seem to
blindly trust an apps honesty in obeying a setting it manages it itself.
I don't.

.... and the phone-OS makers don't either, proven by the existence of an
OS-enforced "permissions firewall".

> Also see the options in the app - "Suggest Contact names" is a good
> hint what the permission for contact reading is used for.

You're sounding rather gullible there. :-(

They *tell you* that they will /just/ take the contact names, and leave
everything else (you know, phone numbers, adresses, etc.) alone, and you
believe them ? Again, I don't.

Its not about what they /tell you/ what they are going to do, its about
*whats possible* they could do.

Also, there is a reason why some phone OS-es offer you to provide apps
asking for such a permission a fake list.

> Better than just assuming that the app does not respect your privacy just
> because of an *optional* permission.

You sound like you will have no problem with handing off your wallet
(containing money, bank cards and passport) to a random stranger when he
asks for it.

What ? You would not trust a random stranger like that ? But you still
expect me to (blindly) trust a random app ? Really ?

Regards,
Rudy Wieser

Arno,

> I stand corrrected, yes, you're right. On current android versions, apps
> don't have to ask for that permission, but you still need to add this in
> the app manifest as developer, so people can check wether the app
> uses network connections at all.

Have you ever considered the possibility that all that has changed is the
popping up of the confirmation dialog for those particular permissions ?

IOW, if the permission request is NOT in the manifest its NOT given, but if
it is there its given without confirmation.

Hey, maybe you have knowledge and the tools to create a small testing app,
test it and tell us the results ?

I know that if I had (access to) both I would have already done that five
minutes ago.

Regards,
Rudy Wieser

Arno Welzel wrote on Thu, 20 Jun 2024 11:08:45 +0200 :

>> I agree it's crazy to do that every single time so I appreciate that you
>> explained that the beta version can pin the microphone to the toolbar.
>
> Just long-press microphone button in the toolbar, so it gets
> highlighted. Then it is "pinned" and will stay visible even when the
> toolbar is closed.

Thanks for responding to my issues, where I just pinned it and it works.
Now the microphone is pinned to HeliBoard KB just as it is to OpenBoard.

If the app does not use the Internet, how does it do the Speech-to-Text?

Android 13 Galaxy:
Settings > General Management > Text-to-speech > Preferred engine >
(o) Samsung TTS settings
(_) Speech Recognition and Synthesis from Google

The privacy question is whether either of those uses the Internet?
Does anyone know?

Arno Welzel wrote on Thu, 20 Jun 2024 17:59:35 +0200 :

> No. It can only use Firebase. Firebase is not "go online" but a
> framework for authentication and using cloud storage:
>
> <https://firebase.google.com/>

I am thoroughly confused what "Firebase" truly means, since it seems to be
one of those nice marketing words that Google marketing uses for too-many
things. So I think there are MULTIPLE things that Google calls "Firebase".

If you turn on Developer options, then Firebase will be an option in your
Android settings which contains a horrific amount of privacy-related things
about you such as every contact you interacted with and every location you
ever searched for in Google maps and every app you've used and when.

Android 13 Galaxy:
Settings > Google (Google Services) > Firebase App Indexing

Here is an example in Firebase App Indexing of all your map searches.
<https://i.postimg.cc/qR8zr72r/appindex01.jpg> All your Maps searches

But the Firebase App Index contains a LOT more very private information.
<https://i.postimg.cc/nhCCVxmB/mapsloctrack03.jpg>

For example, Firebase App Index contains a listing of every contact you've
interacted with and exactly when and for how long you interacted with them.

In that Firebase App Indexing loation is a horrifically scary collection of
extremely private information that wouldn't be so bad if it didn't
constantly "send update_index" to somewhere about once a month or so.
<https://i.postimg.cc/QtfJ59LP/firebase02.jpg> Firebase indexed app data

Where (or who) is that somewhere, I don't know, and every time I asked,
people tell me they never heard of this Firebase - and yet it exists.

In summary, I think the Google "Firebase" you looked up may not be the same
Google Services "Firebase App Indexing" that is on my phone and which
contains extremely private data which is uploaded periodically to somewhere
by an unknown-to-me process.

Andrew,

> So I think there are MULTIPLE things that Google calls "Firebase".

Too bad you only name one ... Or is it that the one you described is the
only one related to android ?

> Google Services "Firebase App Indexing" that is on my phone and which

gathers

> extremely private data which is uploaded periodically to somewhere
> by an unknown-to-me process.

Thanks for that.

It means (to me) that if I see an apk mentioning "Firebase" in its manifest
I should drop it (as the spyware it is) and walk away.

Regards,
Rudy Wieser

R.Wieser wrote on Fri, 21 Jun 2024 22:37:35 +0200 :

>> So I think there are MULTIPLE things that Google calls "Firebase".
>
> Too bad you only name one ... Or is it that the one you described is the
> only one related to android ?

One thing we have to remember is anyone who talks only about "Google
Firebase" (cloud services) without also talking about "Google Services
Firebase App Indexing (decidedly NOT cloud related), probably doesn't
understand either - which is - I think - the biggest problem here.

I too don't understand the difference.
But at least I'm aware that there is a difference.

Which is a good start but not good enough to explain it fully to anyone.

To your query about which apps have "Google Services Firebase App Indexing"
inside of them, there are many apps that link in "Google Services Firebase
App Indexing" but long ago I deleted every non-essential app that made use
of "Google Services Google Firebase App Indexing".

So they're not on my system.
They are certainly on your system though.

But not mine.
So they're going to show up in a screenshot of your device.

But not in a screenshot of mine.

Notice in the previous screenshot, for example, that the "Windy" weather
app used Google Services Firebase App Indexing - which is why I deleted it.
<https://i.postimg.cc/qR8zr72r/appindex01.jpg>

Notice in this screenshot from long ago on my phone, plenty more apps used
it, such as Google's quicksearchbox (which I then deleted) and Google TV
(which I then deleted) and T-Mobile (which I then deleted) and YouTube
(which I then deleted). I deleted every non-essential app that used Google
Services Google Firebase App Indexing - which I recommend others do too.
<https://i.postimg.cc/Fs8GDLfX/firebase01.jpg>

Notice even the venerable VLC video player app uses Google Services Google
Firebase App Indexing; so while I love VLC, I had to remove that app too
(and you'll notice the less-known Maderski Charging Indicator used it too).
<https://i.postimg.cc/QtfJ59LP/firebase02.jpg>

>> Google Services "Firebase App Indexing" that is on my phone and which
>> gathers extremely private data which is uploaded periodically to somewhere
>> by an unknown-to-me process.
>
> Thanks for that.

Long ago, when I first heard of it, I had uninstalled every non-essential
app that used Google Services Google Firebase App Indexing but some
packages are essential, such as Google Play Services, which, when I removed
it, it screwed things up so I had to add it back for the basic working of
the Android phone.
<https://i.postimg.cc/KvCkLccr/firebase03.jpg>

I agree we should have some way of telling if an app is going to use Google
Services Firebase App Indexing but I don't know how to tell that.

However, ANY app can add "Google Services Google Firebase App Indexing".
<https://medium.com/android-news/firebase-app-indexing-for-personal-content-getting-personal-content-into-search-c52bfe45b3ac>
<https://traversoft.com/2017/05/02/firebase-app-indexing/>

So we should be able to install any app (such as Facebook) that is known to
use Google Services Google Firebase App Indexing to look at the manifest.

> It means (to me) that if I see an apk mentioning "Firebase" in its manifest
> I should drop it (as the spyware it is) and walk away.

While I freely admit I don't know the difference between "Google Firebase"
and "Google Services Firebase App Indexing", I think they are different.

The reason I think that is when you dig into "Google Firebase", the cloud
inevitably shows up while with "Google Services Google Firebase App
Indexing", the cloud is explicitly not involved at all.

But there is too little data on the net for me to be able to truly
distinguish between those two (different?) firebases from Google.
<https://www.google.com/search?q=%22Google+Services%22+%22Firebase+App+Indexing>

The "Google Services Google Firebase App Indexing" seems to be a
data-collection that Google takes advantage up by uploading "statistics" to
Google Servers, as it says in these links that came up from that search.
<https://android.stackexchange.com/questions/213149/what-is-firebase-app-indexing-under-google-services-settings>
<https://developers.google.com/search/blog/2014/04/app-indexing-updates>
<https://www.lido.app/firebase/what-is-firebase-app-indexing>

Notice developers can collect your data between different platforms.

In summary, what we need is a definitive way to tell if an app has included
Google Services Google Firebase App Indexing in it, and, we need to figure
out the difference between Google Firebase cloud stuff and the very
different (it seems) Google Firebase App Indexing (which appears to be
cloud free but Google uploads "statistics" so it's still privacy invasive).

Arno Welzel wrote on Wed, 19 Jun 2024 08:25:01 +0200 :

> Since Helium keyboard does not use Firebase and also does not have
> internet access, this is not an issue.

That's a terribly misleading sentence, unfortunately; but I know you're
trying to help - so please take what I say below purely constructively.

That sentence is dangerous - because it's so non detailed as to be able to
be interpreted in two completely different ways - one good - the other bad.

I do not think anyone on this newsgroup understands the difference between
Google Firebase (cloud stuff) and Google Services Firebase App Indexing
(non cloud stuff); so your sentence above is meaningless until you can show
that you understand that they're completely different - and not having one
doesn't negate having the other.

Given that complexity, I outline three things we need to clarify in that
seemingly simple sentence above. :)

Based on the links I already provided to Rudy Wieser moments ago...

1. Firebase is (apparently) not the same as Firebase App Indexing.
One uses the cloud. The other does not use the cloud (AFAIK).
The one that does not use the cloud is called "Google Services
Firebase App Indexing" and it _does_ send "statistics" to Google!

2. I installed and used Helium HeliBoard and I subsequently checked
the Google Services Firebase App Indexing data location, which
you can only see if you turn Developer options on, and I did not
see anything in there from Helium - so even though you didn't
distinguish between Google Firebase (cloud related stuff) and
Google Services Firebase App Indexing (not related to the cloud),
I think that you're correct that Helium doesn't collect that data
(which then Google says it grabs "statistics" from).

3. However, notice that the fact that Helium Heliboard does not use
the Internet is meaningless because Google uses the Internet.

That is, an app that has no access to the Internet can use Google Services
Firebase App Indexing and while that app won't upload any of your private
data to the Internet, Google explicitly says it does grab "statistics".

See the links I just gave to Rudy Wieser which back up those three points.

Andrew,

> One thing we have to remember is anyone who talks only about "Google
> Firebase" (cloud services) without also talking about "Google Services
> Firebase App Indexing (decidedly NOT cloud related),

> I too don't understand the difference.But at least I'm aware that there is
> a difference.

Oh yes, there seems to be a difference : the first being the back-end and
second the front-end. At least, if I maye take Googles own word for it :

https://firebase.google.com/firebase-and-gcp

[quote]
Firebase and Google Cloud share three products: Cloud Firestore, Cloud
Functions, and Cloud Storage. *These are the same products that exist in
Google Cloud, simply exposed for client-side developers via Firebase*. You
can access the same data from the server SDKs (Google Cloud) and the client
SDKs (Firebase), so your frontend and backend teams can work in concert.
[/quote]

(bolding mine)

Regards,
Rudy Wieser

Andrew,

> 3. However, notice that the fact that Helium Heliboard does not use
> the Internet is meaningless because Google uses the Internet.

As you said it yourself, "that's a terribly misleading sentence".

You might want to explain what, to you, that "google" in the above sentence
is, and how it "uses the Internet" without given permission to - and
ofcourse how that that "google" gets hold of data generated by other apps*

Yes, I can make an (educated) guess or two to what you might mean there, but
I rather hear it from you.

* an OS sandboxing apps is a thing. And on my phone an app can access files
it created itself, but not other apps files - simply by denying it
READ/WRITE_EXTERNAL_STORAGE permissions.

hint: not everyone thinks that his lifes enjoyment is directly dependant on
having something like "google play store" installed.

And again: be carefull when you post pertinent stuff like "Firebase App
Indexing (decidedly NOT cloud related)" as you do not really seem to
understand the issue yourself - as you mentioned it, you have no idea where
the "Firebase Indexing Service" is sending its data to, other than 'to
google'.

"Firebase cloud services" is definitily Google, though for some reason you
discarded it (without an explanation) as a possibility of being the target
if your phones uploading. I still have no idea why.

Regards,
Rudy Wieser

R.Wieser wrote on Sat, 22 Jun 2024 08:39:14 +0200 :

> Oh yes, there seems to be a difference : the first being the back-end and
> second the front-end. At least, if I maye take Googles own word for it :
>
> https://firebase.google.com/firebase-and-gcp

Thank you for noticing that there's a difference between "Google Firebase"
and "Google Services Firebase App Indexing", where I read what you quoted
and that seems to be the former but not the latter.

While I will freely admit to not knowing what either one truly is, I don't
think one is just the back end of the other - simply because the whole
purpose of "Google Services Firebase App Indexing" is for the app to get
its data in the users' search results ON THE PHONE (as far as I can tell),
while the whole purpose of "Google Firebase" is for the app to link in
access to Google's cloud.

As far as I can tell, those are two completely different endeavors.

The fact that they're likely completely different things with similar names
is why I've said that anyone talking about one without mentioning the other
almost certainly doesn't know what either does.

The issue at hand, as I see it, is that the "Google Services Firebase App
Indexing" saves extremely personal data ON THE PHONE which then Google
clearly says they will sample intermittently for statistics.
<https://medium.com/android-news/firebase-app-indexing-for-personal-content-getting-personal-content-into-search-c52bfe45b3ac>
"A note about privacy: The personal content index only exists
on the user's device. None of the user's personal content is
uploaded to Google servers and it only remains on the device
while the app is installed. However, aggregated statistics
about apps' usage of App Indexing and other system health
information may be uploaded to Google servers."

Notice that means it doesn't matter one bit if an application has no
Internet access... Because Google does.

Anyway, we're far from the topic of the Helium keyboard so I opened a
separate thread with your links and mine to help understand it better.
*Why do so many people confuse Firebase & Firebase App Indexing?*
<https://www.novabbs.com/computers/article-flat.php?id=53667&group=comp.mobile.android#53667>

R.Wieser wrote on Sat, 22 Jun 2024 09:18:15 +0200 :

>> 3. However, notice that the fact that Helium Heliboard does not use
>> the Internet is meaningless because Google uses the Internet.
>
> As you said it yourself, "that's a terribly misleading sentence".
>
> You might want to explain what, to you, that "google" in the above sentence
> is, and how it "uses the Internet" without given permission to - and
> ofcourse how that that "google" gets hold of data generated by other apps*
>
> Yes, I can make an (educated) guess or two to what you might mean there, but
> I rather hear it from you.
>
> * an OS sandboxing apps is a thing. And on my phone an app can access files
> it created itself, but not other apps files - simply by denying it
> READ/WRITE_EXTERNAL_STORAGE permissions.
>
> hint: not everyone thinks that his lifes enjoyment is directly dependant on
> having something like "google play store" installed.
>
> And again: be carefull when you post pertinent stuff like "Firebase App
> Indexing (decidedly NOT cloud related)" as you do not really seem to
> understand the issue yourself - as you mentioned it, you have no idea where
> the "Firebase Indexing Service" is sending its data to, other than 'to
> google'.
>
> "Firebase cloud services" is definitily Google, though for some reason you
> discarded it (without an explanation) as a possibility of being the target
> if your phones uploading. I still have no idea why.

The problem is that when everyone is talking about stuff they don't know
much about (including me), then everything any one person says tends to
confuse any other person - because they're not starting from the same
knowledge level.

To solve that fundamental problem...

I opened a separate thread to get to the bottom of both Google Firebase
(cloud stuff) and Google Services Firebase App Indexing (search stuff).

*Why do so many people confuse Firebase & Firebase App Indexing?*
<https://www.novabbs.com/computers/article-flat.php?id=53667&group=comp.mobile.android#53667>

Andrew, 2024-06-21 20:32:

> Arno Welzel wrote on Thu, 20 Jun 2024 11:08:45 +0200 :
>
>>> I agree it's crazy to do that every single time so I appreciate that you
>>> explained that the beta version can pin the microphone to the toolbar.
>>
>> Just long-press microphone button in the toolbar, so it gets
>> highlighted. Then it is "pinned" and will stay visible even when the
>> toolbar is closed.
>
> Thanks for responding to my issues, where I just pinned it and it works.
> Now the microphone is pinned to HeliBoard KB just as it is to OpenBoard.
>
> If the app does not use the Internet, how does it do the Speech-to-Text?
>
> Android 13 Galaxy:
> Settings > General Management > Text-to-speech > Preferred engine >
> (o) Samsung TTS settings
> (_) Speech Recognition and Synthesis from Google
>
> The privacy question is whether either of those uses the Internet?
> Does anyone know?

It depends on the device. Newer devices have a "TPU" which can handle
speech recognition offline. However older devices may not be as powerful
to do this and always rely on a server.

Simple test: enable airplane mode to disable any kind of network
connection and see, if speech recognition still works. In my case, on a
Google Pixel 6a, this is the case - Google speech recognition even works
without any active network connection at all.

--
Arno Welzel
https://arnowelzel.de

Andrew, 2024-06-21 22:13:

> Arno Welzel wrote on Thu, 20 Jun 2024 17:59:35 +0200 :
>
>> No. It can only use Firebase. Firebase is not "go online" but a
>> framework for authentication and using cloud storage:
>>
>> <https://firebase.google.com/>
>
> I am thoroughly confused what "Firebase" truly means, since it seems to be
> one of those nice marketing words that Google marketing uses for too-many
> things. So I think there are MULTIPLE things that Google calls "Firebase".

See here:

<https://firebase.google.com/docs/projects/learn-more?hl=en>

--
Arno Welzel
https://arnowelzel.de

Andrew, 2024-06-22 02:34:

> Arno Welzel wrote on Wed, 19 Jun 2024 08:25:01 +0200 :
>
>> Since Helium keyboard does not use Firebase and also does not have
>> internet access, this is not an issue.
>
> That's a terribly misleading sentence, unfortunately; but I know you're
> trying to help - so please take what I say below purely constructively.
>
> That sentence is dangerous - because it's so non detailed as to be able to
> be interpreted in two completely different ways - one good - the other bad.
>
> I do not think anyone on this newsgroup understands the difference between
> Google Firebase (cloud stuff) and Google Services Firebase App Indexing
> (non cloud stuff); so your sentence above is meaningless until you can show
> that you understand that they're completely different - and not having one
> doesn't negate having the other.

Which does not matter, since Helium keyboard does not use Firebase, no
matter what it is.

[...]
> 1. Firebase is (apparently) not the same as Firebase App Indexing.

Firebase App Indexing is a part of Firebase but no longer the
recommended way by Google:

<https://firebase.google.com/docs/app-indexing?hl=en>

> One uses the cloud. The other does not use the cloud (AFAIK).
> The one that does not use the cloud is called "Google Services
> Firebase App Indexing" and it _does_ send "statistics" to Google!

Firebase itself *is* "the cloud" - for example to provide storage,
messaging or analytics using Google cloud services. It depends on the
application if it does use these features.

> 2. I installed and used Helium HeliBoard and I subsequently checked
> the Google Services Firebase App Indexing data location, which
> you can only see if you turn Developer options on, and I did not
> see anything in there from Helium - so even though you didn't
> distinguish between Google Firebase (cloud related stuff) and
> Google Services Firebase App Indexing (not related to the cloud),
> I think that you're correct that Helium doesn't collect that data
> (which then Google says it grabs "statistics" from).

Heliboard does not use anything connected to Firebase!

> 3. However, notice that the fact that Helium Heliboard does not use
> the Internet is meaningless because Google uses the Internet.

No, this is not meaningless, because without Internet acces *and*
without Firebase the app can not send data anywhere.

And again, if you don't trust my answers, check the source code of the
for yourself and/or build your own version based on that code or ask
someone you trust to assist you with that:

<https://github.com/Helium314/HeliBoard>

--
Arno Welzel
https://arnowelzel.de

R.Wieser, 2024-06-21 11:14:

> Arno,
>
>> An app *must* contain the permission request in the manifest,
>> regardless if it actually uses it or not.
>
> I take that as "regardless if it *directly* uses it or not."

There is no "direct use". Either an app does use an system API which
requires a permission or not. The only way it changed over the years is,
that most permissions have to be granted by the user when first used
while in older versions of Android all permissions in the application
manifest got granted automatically.

> But do you recognise that way of doing stuff might be problematic ? If you
> lend your phone to someone a friend or your kid(s) get a hold of it (wanting
> to play a game perhaps) they might cause the permission to be asked for, and
> than it won't be you answering the question.
>
> Time will tell if my phone uses the same "late binding" mechanism. I hope
> not though.

"Late binding" is required for *all* permissions in newer Android
versions. I am not sure when Google changed this, but as far I remember,
Android 6 introduced that.

>> It will only access contact data, when you enable the setting for it in
>> the app, otherwise not.
>
> :-) You talk as if you are smart enough, but at the same time you seem to
> blindly trust an apps honesty in obeying a setting it manages it itself.
> I don't.

I don't either - but I can read and understand source code:

<https://github.com/Helium314/HeliBoard>

And yes, I also develop Android software myself:

<https://github.com/arnowelzel/periodical>

<https://f-droid.org/de/packages/de.arnowelzel.android.periodical/>

<https://play.google.com/store/apps/details?id=de.arnowelzel.android.periodical>

[...]
>> Also see the options in the app - "Suggest Contact names" is a good
>> hint what the permission for contact reading is used for.
>
> You're sounding rather gullible there. :-(
>
> They *tell you* that they will /just/ take the contact names, and leave
> everything else (you know, phone numbers, adresses, etc.) alone, and you
> believe them ? Again, I don't.

Who is "they"?

Heliboard is not sold by a company but provided by a bunch of
contributors (at the moment 26 - see
<https://github.com/Helium314/HeliBoard/graphs/contributors>) who spend
their free time to maintain a keyboard app you can use for free.

So you believe all these guys work on that app to spy on you?

Then don't use the app or better don't use smartphones at all - and yes,
I am really serious!

> Its not about what they /tell you/ what they are going to do, its about
> *whats possible* they could do.

Yes - everything is possible! Even if an app has *no* permissions at all
it still can be harmful since there may be a security bug in Android
which a malicous app can exploit. And yes, I am really serious! See
<https://en.wikipedia.org/wiki/Stagefright_(bug)> about the
"Stagefright" bug which could be exploited just by displaying images.

At some point you have to decide if you trust a system or not. And if
you do not trust a system, then don't use it.

> Also, there is a reason why some phone OS-es offer you to provide apps
> asking for such a permission a fake list.

Which does not solve the issue, that you still have to trust the OS that
it works as intended.

>> Better than just assuming that the app does not respect your privacy just
>> because of an *optional* permission.
>
> You sound like you will have no problem with handing off your wallet
> (containing money, bank cards and passport) to a random stranger when he
> asks for it.

No, I have no problem trusting an open source app I can check of myself.

> What ? You would not trust a random stranger like that ? But you still
> expect me to (blindly) trust a random app ? Really ?

No I don't expect anything except not being paranoid and trying to
understand *why* I told you that about Heliboard.

--
Arno Welzel
https://arnowelzel.de