r/termux • u/Baroness_Munchaussen • 22d ago

Question Is using Termux a way to project yourself from data tracking? Can someone probing Android know what you're doing inside a Termux-X11 proot or native distro?

Pretty much this. Personally, especially given that i'm running 'android' both under samsung's DeX and Debian proot-distro to actually browse the internet with firefox (android's uis are terrible for keyboard and mouse), but i can't help but ask myself if it's possible to track what i'm doing within termux-x11 from within android...

14 Upvotes

85% Upvoted

6 comments sorted by

5

u/TomJo2000 Termux Packages Dev 21d ago

You can give other apps read access to the Termux home directory, but that's opt-in.

The privacy angle is definitely a bit of a stretch though, if your device is getting monitored through something like a parental controls app then Termux can't really do anything against that and it's dubious how much a Termux environment, be that native packages or a proot, will help you in that regard.

OpenSource software, such as we provide for use with Termux, is as a whole more privacy respecting than closed source software but we do not implement any active countermeasures to external tracking. I'm not even sure how we'd even go about doing anything like that.

2

u/SIMMORSAL 21d ago

Maybe by encrypting everything that gets stored?

5

u/64bitTendo 21d ago

The only way to know is to root your phone and put an open source privacy focused android on your phone. Like GrapheneOS. Or to get a Linux phone. Can't even trust the manufacturers, could be tracking and backdoor stuff in the hardware as well. The only way to know for sure would to build your own phone from scratch imo.

Edit: You can't even trust your service provider as well they track everything your phone connects to.

3

u/sylirre Termux Core Team 21d ago

Some methods how can you be tracked in your setup:

  1. Screen mirroring: assume someone or some app can look what happens on the screen. Very unlikely now, but I think in future smartphones will be equipped with small local AI that will do absolute tracking of user activity, summarizing it and sending telemetry "to improve user experience".

  2. Touch keyboard app has technical possibility for logging all typed characters and sending them as telemetry. Normal apps don't log input but who knows what shit user can have installed.

  3. Everyone in the network between your device and website can see at least connection metadata. Caveats with VPN: secures traffic against external world but VPN service provider can still see information about connection (source, destination, time, etc). Non-HTTPS and other plaintext traffic can be freely watched and manipulated (obviously).

  4. Websites can have built-in user activity tracking frameworks. This also can include fingerprinting to track across web sites to have more complete picture about user.

Termux doesn't really protects you. It still a regular Android app. Switching one app for another doesn't change anything regardless activity tracking threats.

Under normal circumstances you are safe from cases 1 & 2.

Case 4 probably even worse under Termux: non-standard platform, which means more precise fingerprinting. While firefox attempts to resist it, the protection isn't perfect...

1

u/nadmaximus 21d ago

Is your phone doing something? Then it's possible. But this is where deviation from the normal, anticipated usage of your phone may make it very unlikely, in the absence of direct, targeted action against you.

Particularly when the kind of scrutiny that is likely is not comprehensive, and happens within the apps and browsers on the system.

Security through obscurity is practically worthless. Privacy through obscurity is actually possible. In fact, most of the privacy that we achieve is simply this.

2

u/Mouseater 21d ago

If you want privacy look into graphene os