Skip to main content


You remember #Apple scanning all images on your #mobile device?

If you have an #Android #phone, a new app that doesn't appear in your menu has been automatically and silently installed (or soon will be) by #Google. It is called #AndroidSystemSafetyCore and does exactly the same - scan all images on your device as well as all incoming ones (via messaging). The new spin is that it does so "to protect your #privacy".

You can uninstall this app safely via System -> Apps.

developers.google.com/android/…

This entry was edited (2 months ago)
in reply to jack

How do you know that it scans images?

Are there any traces collected, sources available or these are speculations? :blobcatthink:

in reply to Gytis Repečka

Sorry, it is rather well explained in Google documentation linked :blobcatfingerguns:
in reply to Gytis Repečka

@gytisrepecka thanks for posting this - it seems like this is an opt-in feature for adults and remains entirely on device.
in reply to AlexanderMars

@AlexanderMars @lostdoco @gytisrepecka kinda sounds like you didn't read it. Nothing to hide from yourself? If it's on the device only then what are you referring to?
in reply to I-baLL

Even for offline scanning I don't need or want such functionality, which potentially could feed other Google services in the future :blobcatjustright:
in reply to jack

@mayintoronto while deleting that, I spotted "android system intelligence" app and disabled that too 🙁
in reply to Deborah Hartmann Preuss, pcc

@deborahh @mayintoronto Likewise.
BTW: This guide explains more about it, and where to disable "Android System Intelligence":
androidauthority.com/android-s…
#Android

reshared this

in reply to Bhante Subharo

@sbb @deborahh @mayintoronto maybe I'm just naïve about this, but why the panic? android system intelligence isn't some evil spyware, it literally just provides Live Caption and a couple other things that work completely offline. i get the suspicion bc its google but this feels more reactionary than genuine concern
in reply to conor: conor edition

@mrconorae @sbb @mayintoronto I'm not techie enough to know what it is, but I'm disabling anything I suspect is gratuitous artificial *intelligence*. Perhaps it's badly named ... too bad. It's disabled now.
in reply to May Likes Toronto

@mayintoronto I decided to re-enable it but to make many permissions "ask each time" so I can see what it is doing.
in reply to Bhante Subharo

@sbb thanks - I've now re-enabled it, but disallowed some of the permissions.

Apso, by reading this I discovered "private compute services", which I've now disabled.

in reply to jack

Its time to renew my project to de-google my phone. Its hard since I'm still in the US and most good phone are in the EU.

any recommendation on a good phone to start with?

This entry was edited (2 months ago)

Claus Cramon Houmann reshared this.

in reply to Al

@mral It seems that #Murena and thus #Fairphone is available in the USA:

murena.com/america/products/sm…

I can't say that much about Murena and their (degoogled) OS, but I've been a happy Fairphone user for almost a decade now (both #degoogled and stock).

#CalyxOS is a good OS choice, check out their supported devices:

calyxos.org/docs/guide/device-…

#GrapheneOS looks pretty good, too - but it only runs on google's pixel (which admittedly is one of the most open phones around).

grapheneos.org/

reshared this

in reply to jack

@mral I bought my #Fairphone 4 from Murena; paired with #LineageOS , it's been a lovely experience so far!
in reply to jack

Thanks for this. Couldn't find it in my apps, but when I did a search in playstore, there it was, installed on my phone. Now uninstalled.

Sarah W reshared this.

in reply to Sarah W

@Sarahw
I just went straight to "Settings" > "Apps" scrolled down and found it. It even stated "notifications disabled" and "no permissions required".

Sleekit.

Binned.

in reply to Sarah W

It's a disgrace. Another insult is where Google is dismantling Fitbit with a vengeance, theyve gutted the app functionality and won't be launching any new Fitbit brand priducts going forward - so I'm going to start using another brand.
This entry was edited (1 month ago)
in reply to jack

Wait what? How could an argument possibly be made that this protects my privacy? An app that I don't get to find out has been installed, don't get to grant permission to access my photos that reports what I have on my phone? 😲
in reply to jack

@annekekassteele vooral een reminder om als de sodemieter werk te maken van een opensource OS (ook) op de foon. 😒
in reply to jack

I'm not a big Google fan but this doesn't look the same. It is a feature released in October to (e.g.) mask unsolicited dick pics in RCS chat., disabled by default. Obligatory your threat model != my threat model.

security.googleblog.com/2024/1…
"...doesn’t allow Google access to the contents of your images, nor does Google know that nudity may have been detected"

This entry was edited (1 month ago)
in reply to jack

i'm confused why this is an issue, this seems to be very different from what apple tried to do? according to google's blog post it's just on-device to provide automatic content warnings in google messages, nothing's ever sent back to google
> All of this happens on-device to protect your privacy and keep end-to-end encrypted message content private to only sender and recipient. Sensitive Content Warnings doesn’t allow Google access to the contents of your images, nor does Google know that nudity may have been detected. This feature is opt-in for adults, managed via Android Settings, and is opt-out for users under 18 years of age
in reply to m04

@m04 Plus, it appears to only affect Google Messages (who uses that for anything?), not scanning the entire device?
@m04
in reply to Lars Marowsky-Brée 😷

We do for family stuff. Not ideal, but it's the only thing that everyone would agree to.
in reply to skribe

@skribe @larsmb i use google messages as my default sms app - i definitely prefer to use things like signal, discord, etc when possible! but for random things like texting someone to pick up something from craigslist or getting 2 factor auth codes it's unfortunately still a thing i have to use
although, i do use it through beeper, so i barely ever open the actual messages app - i find that makes the experience a lot nicer
in reply to m04

@m04 @skribe Sure, but as far as possibly compromising images are concerned, that seems unlikely.
in reply to jack

Hi @jack, not loving #Google at all (see my bio) but to be fair, there seems to be a substantial difference between this and what #Apple wanted to do: Google says none of the scanning results will ever leave your device, even positive ones. No law enforcement notification. No server-side collection. It seems to basically be an advanced local #spam filter for #RCS text messages.

BohwaZ reshared this.

in reply to Jan Penfrat

@ilumium On the other hand, Google is the company that started with the "don't be evil" motto. Not sure about trusting them (or any other big company).
in reply to Jan Penfrat

@ilumium I decompiled the apk to have a quick look and the app does have internet access.

It includes a binary library called "libtartarus" which seems to be an AI (references to TensorFlow).

It does also include telemetry (OpenCensus), so *some* data is transmitted to Google. There is also some logging to Google in the code, but can't say if it's enabled.

The code also does link the app with your Google Account…

I'm not an Android specialist so I can't tell what is sent exactly.

reshared this

in reply to Jan Penfrat

in reply to jack

nice. Glad I ditched the spyware ecosystem years ago and switched to iOS. (Apple btw never „scanned“. They wanted to, but that was not emotional enough for you, was it?)
in reply to jack

Thanks for that tip - yup, it was there & is now (ostensibly) gone; the real problem is going to be remembering to do this again every time the system updates, because even though I've switched off auto-updating, my phone clearly does it anyway...
Unknown parent

mastodon - Link to source
lebout2canap ⏚
@vega J’en parlais justement il n’y a pas longtemps, moi je suis sous postmarketOS, mais je connais deux personnes sous /e/OS, dont une sur Murena, et elle en sont tout à fait satisfaites, et si je voulais partir sur une base Android ça serait certainement de ce côté que j’irais.
@VEGA
in reply to jack

Thanks for this, this gave me the push to consider GrapheneOS this weekend. In the process of backing up everything right now.
in reply to jack

You remember Apple succumbing to public pressure and quietly never implementing it in the first place?

Edit: I’m gonna make a big addendum to this comment. While Apple *did* scrap plans for CSAM detection due to public pressure, they did implement an on-device mechanism for blurring “sensitive content.” A feature much like the one on Android in the original post here, although I’ve yet to find much transparency on the Android apps’ workings. This on-device functionality works like face detection, so if you’re okay with that there’s little reason to be alarmed.

This entry was edited (1 month ago)
in reply to Parade du Grotesque 💀

@ParadeGrotesque @CatHerder @blitzen „Android“ is enough, the list of apps starting with „Android“ isn't that long.

It's there and it's freaking me out: Google, pushing something I didn't ask for, and not even telling me is no way to go. Next phone will be a Huawei one without Android!

in reply to Cat Herder 💔 🗽 🇺🇲

@CatHerder @DelilahTech @blitzen

for anyone, not just people i am replying to:

what i did was go to the Google Play store and search for Android SafetyCore

when it found the app in the store, i was given the "uninstall' option

that was how i located and removed it - search did not help -
i'm sure there are other ways! but this was easiest for me and maybe others too

in reply to Court Cantrell will not comply

@courtcan @CatHerder @DelilahTech @blitzen

this happened to my friend - no sign of it in the search or in the app store, as of about 3pm CST today. (i did my search and removal several hours ago..)

i have no clue what's up with this.

anyway, i hope people are able to find it and remove it

in reply to jack

@blitzen

Or the explanation is simply that Google has removed word don't from their old slogan "Don't be evil"

No smiley needed.

in reply to jack

This is misinformation. If you read what Google actually wrote, it only notifies the user of nudity. Google specifically say that it doesn't notify them.

Of course Google might be lying, but there is no evidence here of any new risk.

BohwaZ reshared this.

in reply to jack

Wow. I pride myself on understanding euphemism, technobabble and bullshit but I can't get any useful information out of what they've published there.
@welshpixie
in reply to jack

Welcome to my FUD list.

To cite Google (via the page you linked):

Sensitive Content Warnings is an optional feature that blurs images that may contain nudity before viewing, and then prompts with a “speed bump” that contains help-finding resources and options, including to view the content. When the feature is enabled, and an image that may contain nudity is about to be sent or forwarded, it also provides a speed bump to remind users of the risks of sending nude imagery and preventing accidental shares.

All of this happens on-device to protect your privacy and keep end-to-end encrypted message content private to only sender and recipient. Sensitive Content Warnings doesn’t allow Google access to the contents of your images, nor does Google know that nudity may have been detected. This feature is opt-in for adults, managed via Android Settings, and is opt-out for users under 18 years of age. Sensitive Content Warnings will be rolling out to Android 9+ devices including Android Go devices with Google Messages in the coming months.

in reply to jack

well apart from the 0.1% that use android without any google middleware , the "real" android
in reply to jack

It makes me discover android system intelligence...
Another crap that google installs without authorisation.
in reply to jack

Thanks for the tip, my wife's phone had it too (Pixel 7a).
in reply to jack

Do you have a link for the actual details about this, the Google dev pages don't mention anything about this
@catsalad
in reply to jack

Hi, Jack, I don't see a documentation confirming what you said. There is some informations about nude pics (which means that , indeed, pics send via Messages are scanned - but only there) and doesn't say more than "all processes are local to the phone".Could you provide more specific documentations about your post ?
in reply to jack

@noodlemaz thank you! I had nothing something 'funny' a few days ago. It looked like something was installing but quickly the screen changed. It was this! And it's not featured on the Google Play manager. I only found it on the Settings app. 🤬🤬🤬
in reply to jack

To those who are curious about the app and can't find the proper documentation I found this video explainer. youtube.com/watch?v=1rdlTveD8F…

I understand some people may feel the pic blurring is useful for them but in the privacy community Google does not have a good rep & is known for sneaking new features into Android to get more of your private info. It may not seem bad now but new capabilities could be added later without warning.

in reply to jack

As a case in point the comment before mentioned looking into the APK and found internet access permissions that could very well be used to access more personal data at some point, like sending pictures you send and receive to Google, just like Apple wanted to do. Mission Creep is very common with Google and other tech companies that feed on your personal info.
in reply to jack

@projektionsyta Apple never did scan all images, it was suggested but Apple did not release the function due to hard criticism.
in reply to jack

@jack

You are a gentleman & a scholar for disseminating the dark arts of New Nerd Order as set forth in its foundation text 'Malware Malefecarum'.

THANK YOU!

Happily, Google's CovertApps boobytrap is no match for my obsolete Android, which doesn't support any of this Cambridge Five nonsense.

Knackered tech gazumps corporate cannibal, HUZZAH!

@jack
in reply to jack

Someone linked and screenshotted this post, so now there are two disjoint sets of replies.

Just leaving the link here in case anybody wants to get at the other set of replies:

partyon.xyz/@nullagent/1139660…

Unknown parent

mastodon - Link to source
d@nny mc²
@ics @agatha apple only changed course after severe massive public pushback and they set a precedent for governments mandating client-side scanning to circumvent e2ee so i don't know that i would frame it like apple was never going to do it anyway. they stopped because we mobilized
Unknown parent

@agatha Oh, and Apple never did that, they announced that they are considering and then killed it after their users clearly said "no, we don't want it"
Unknown parent

mastodon - Link to source
d@nny mc²
@ics @agatha this was the part i was really glad they backed off from
Unknown parent

mastodon - Link to source
d@nny mc²
@ics @agatha no i was right and it's actually worse—it was scanning messages for "nudity" and then sending a warning to their parent as part of parental control settings. apple knew what they were doing; see their justification for it here apple.com/child-safety/pdf/Exp…
Unknown parent

mastodon - Link to source
d@nny mc²
@ics @agatha ok i will find receipts because i'm pretty sure about this but at this point will assume i misremembered. thanks
This entry was edited (1 month ago)
Unknown parent

@hipsterelectron @agatha No, it was about data that was to be stored on iCloud (including, yes, "Apple Messages in the iCloud", which you can switch off at any time)
Unknown parent

mastodon - Link to source
d@nny mc²
@agatha @ics the thing apple was trying to do was scan every image sent through imessage. if they were also doing it for icloud, fine, but that wasn't what people mobilized against
in reply to jack

See grapheneos.social/@GrapheneOS/….


The functionality provided by Google's new Android System SafetyCore app available through the Play Store is covered here:

security.googleblog.com/2024/1…

Neither this app or the Google Messages app using it are part of GrapheneOS and neither will be, but GrapheneOS users can choose to install and use both. Google Messages still works without the new app.


Unknown parent

@agatha @hipsterelectron :metathis: - there are tons of features within Parental Controls that are definitely there to protect the children.
Unknown parent

mastodon - Link to source
d@nny mc²
@agatha @ics the parental control part is a really bad precedent is all imo, and sending a notification to the parent means it's not fully "on device" in the way google's new addition is (which does not notify anyone else). the content of the notification is unspecified too which makes me antsy
Unknown parent

mastodon - Link to source
d@nny mc²

@agatha @ics also here grapheneos.social/@GrapheneOS/…


The functionality provided by Google's new Android System SafetyCore app available through the Play Store is covered here:

security.googleblog.com/2024/1…

Neither this app or the Google Messages app using it are part of GrapheneOS and neither will be, but GrapheneOS users can choose to install and use both. Google Messages still works without the new app.


Ivy [_gay] Mae reshared this.

in reply to jack

grapheneos.social/@GrapheneOS/…


The functionality provided by Google's new Android System SafetyCore app available through the Play Store is covered here:

security.googleblog.com/2024/1…

Neither this app or the Google Messages app using it are part of GrapheneOS and neither will be, but GrapheneOS users can choose to install and use both. Google Messages still works without the new app.


in reply to jack

what this does is: local powered KI detector for spam and nudity.
grapheneos.social/@GrapheneOS/…


The app doesn't provide client-side scanning used to report things to Google or anyone else. It provides on-device machine learning models usable by applications to classify content as being spam, scams, malware, etc. This allows apps to check content locally without sharing it with a service and mark it with warnings for users.

in reply to d@nny mc²

@hipsterelectron @agatha @ics interesting, I had boosted the original fear post about this, glad to know the full story. This is what I get for not looking into something first :neofox_woozy:
in reply to jack

Does my banking app still work after disabling this? 🙃
in reply to jack

That is actually a rather poor description of what it does. Basically, the app is one that prevents dick pics.

It scans incoming images, and if it thinks they're nudes, then it shows a content warning message along with the blurred image. Additionally, it scans outgoing images and if it thinks they're nudes, it gives you the option to not send them.

However, all this scanning is done entirely on your own device, it doesn't send anything anywhere.

in reply to jack

[citation needed]

Do you mind linking to a source for these allegations? I know that Google is (in part) horrible when it comes to privacy, so I'm not saying it can't be, but I find this post a bit light on details or evidence.

in reply to jack

I'm finding folks saying this is happening, but not with any breakdown or evidence of the process.

Is there a geekier write-up, given that the Google writeup is decidedly slanted?

in reply to jack

Yep, found it and uninstalled it. I don't think it was there the last time I checked that list a few days ago. There was no notification it was being installed.
in reply to jack

The first thing I install on a phone is fdroid.
The second thing is Netguard (that I set to block *everythnig*).
Then I install my apps from Fdroid.
in reply to jack

I already had them, I can't believe it.
I went to Settings > Apps > ⋮ Show system apps and removed them.
I just hope they don't install themselves again.
This entry was edited (1 month ago)
in reply to jack

Do you have any links explaining a bit more what it does?
Because neither the page on Playstore nor your link explains what it does...
I just uninstalled it but I'd like to know more
in reply to jack

Thann you d'or thé tips. I've got it and uninstalled it.
in reply to jack

This is fake news. This app does not do CSAM scanning.
You guys uninstall your phone apps based on a post, without any evidence, on social media? 😄
in reply to jack

As long as it happens on the device only (and that’s what Google claims) that’s ok. However, I have little trust in Google never changing it mind and sending the photos to their servers to analyze. I also don’t have a trust in them never sending metadata (this is something they didn’t mention at all – I don’t know if they do it or not). Why would they know how often I send and receive nudes?
in reply to Mateusz 🏳️‍🌈

@aemstuz No, client-side scanning is not OK.

tuta.com/blog/eu-client-side-s…

in reply to jack

It is. What happens with the result of scanning can be not ok.
in reply to jack

Just to be sure, this only happens on googlified os? What about ones such as /e/ ?
in reply to Zoidberg For President

Yes, only "real" google. Graphene, Calyx, /e/OS, Lineage in general and anything with microG instead of GApps should be save.
This entry was edited (1 month ago)
in reply to jack

I don't have it installed. I am curious if the people getting it auto installed live in certain jurisdictions like the UK that have passed these underage censorship laws and this is how Google plans to comply.
in reply to jack

while the incorrect explanation of what the app does plus the framing of the post raises my skepticism by quite a bit, I'm surprised that you didn't provide a Google Play link to the app which will give most people an easily accessible uninstall button.

Anyways, here's the app on the Google Play store if somebody wants to see if the app is installed on their device and if they want to uninstall it:

play.google.com/store/apps/det…

in reply to jack

Thank you. Uninstalling it was easier than I thought it would be.
in reply to jack

LOL at the sheeple still using stock Android, I use LineageOS and--WTF??

Kidding, of course, but yeah, can confirm that the app installs itself on LineageOS too, at least when you have the Google apps/play store installed. A decision I'm coming to regret.

Uninstalled. it.Looking forward to having to keep checking every week in perpetuity to see if it's reinstalled itself.

in reply to jack

Uninstalled. Not sure how it was installed in the first place, having rejected Google updates...
in reply to jack

where did you get this information? The only info I could find was this here: androidauthority.com/google-me…

Where the explanation isn't about privacy really..

in reply to jack

Someone in my Discord server pointed me to this toot, and I can confirm this was silently installed on my phone. At least it's easy to remove, but how many times will they try to reinstall it?
in reply to jack

@isotopp store link is

play.google.com/store/apps/det…

Won't turn up in search in the phone because of default settings.

Hope that helps

@Kris
in reply to jack

OMG what a mess of a post..
DO NOT uninstall this app, unless you want to lose signature verification of APKs and open yourself to malicious app sideloading.
The SystemSafetyCore has NOTHING to do with CSAM scanning or anything similar to Apple's photo verification proposal. The proposed image scanning (on-device only) is being added to the Google Messages app itself, not to any system service apps.
Just a heads up - do not uninstall apps just because someone on the internet told you so.
in reply to jack

the stated purpose (following the links) seems reasonable enough, but:

1. unacceptable to install silently
2. Google is not trustworthy enough for me to believe that usage would not change in future.

in reply to jack

The page you refer to does not detail what the APK does.

All Google is saying is "Android System SafetyCore (com.google.android.safetycore) is an Android system component that provides privacy-preserving on-device user protection infrastructure for app"

What are your sources to what this APK actually does?

in reply to MeaTLoTioN

Only if it is degoogled and you did not install google's original GApps and play store.
This entry was edited (1 month ago)
in reply to jack

Danke! Komme mir immer so naiv vor, weil ich bei solchen Dinge immer denke das müsste doch vom Gesetzgeber her verboten sein ....
Na ja, naiv halt 😅
Konnte ich unter "Alle Apps" finden und deinstallieren 👍
in reply to jack

I don't believe this is an issue for GrapheneOS users.
in reply to jack

I've bookmarked this because I fully expect it to be reinstalled without my permission at some point
in reply to jack

Ugh. Their "reason" for invading your privacy:

*and it says it was supposed to be opt-in, but there it was on my phone so...

in reply to jack

#Apple #mobile #Android #phone #Google #AndroidSystemSafetyCore #privacy
Found on my Samsung, but I'd like to know more before uninstalling.

Can anybody explain better, please?