mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-12 08:31:03 +01:00
Krzysztof kuhy Rudnicki
553c395cff
This was the last blocker on the Device Owner decision. Checked in the
web panel: "Aplikacja weryfikacyjna" is unconfigured, so no TOTP seed
exists for a wipe to destroy, and only "Wrazliwe" actions are gated --
"Logowanie" is unchecked, so plain login needs the password alone. The
registered SMS number lives on the SIM, which survives.
The browser-login approval tap is a Firebase push prompt
(FirebaseInstanceIdReceiver on the device). Push tokens are per-install,
so a reinstall re-registers; and if that ever misbehaved, SMS is still
the fallback.
Corrects the wipe checklist, which assumed TOTP secrets were "likely"
inside the KeePassDX database and treated the .kdbx as a seed backup.
Neither holds: the canonical .kdbx is on the PC, and there are no seeds.
Earlier advice in this session to fetch inFakt backup codes was likewise
for the OTP-app variant this account does not use.
What still does not survive is unchanged and unrelated to 2FA: the
banking pairing ("Usun powiazanie z telefonem") and the local app PIN,
re-paired via SMS like mBank.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JxNrcMDcizNB3XrrYpZF23
167 lines
7.4 KiB
Markdown
167 lines
7.4 KiB
Markdown
# Blocking YouTube on an unrooted Pixel 6a
|
|
|
|
Applied and verified 2026-08-09 on `23181JEGR08034` (Android 16, SDK 36).
|
|
No root, no Device Owner, no factory reset.
|
|
|
|
## What actually works: `pm uninstall --user 0`
|
|
|
|
Unregisters a package for one user while leaving the APK on the read-only
|
|
system image.
|
|
|
|
| Mechanism | Survives reboot? |
|
|
| --------------------------- | ----------------------------------------- |
|
|
| `pm suspend` | No — measured |
|
|
| `pm disable-user` | No — measured |
|
|
| `dpm setApplicationHidden` | Yes — but needs Device Owner, i.e. a wipe |
|
|
| **`pm uninstall --user 0`** | **Yes — measured, twice** |
|
|
|
|
Reversible with `pm install-existing --user 0 <pkg>`: no download, no data
|
|
loss, because the APK never left the device.
|
|
|
|
## Why focus_owner cannot do this job
|
|
|
|
`EnforcementRunner.installedThirdPartyPackages()` filters to packages without
|
|
`FLAG_SYSTEM`. YouTube ships at `/product/app/YouTube` **with** `FLAG_SYSTEM`,
|
|
so the Device Owner sweep would skip it — even after the factory reset. The
|
|
apps most worth blocking are preinstalled, which is exactly the set that sweep
|
|
excludes. Worth fixing there separately; it does not block anything today.
|
|
|
|
## Current state
|
|
|
|
Removed for user 0, all reboot-verified:
|
|
|
|
- `com.google.android.youtube`
|
|
- `com.google.android.apps.youtube.music`
|
|
- `com.android.chrome`
|
|
|
|
Driven by `phone_focus_mode/distraction_purge.sh` (`--list`, `--status`,
|
|
`--restore`). It re-checks each package with `dumpsys` after acting rather
|
|
than trusting the `pm` exit code, and exits non-zero if anything is still
|
|
installed — so a Play Store reinstall surfaces as a failure instead of a
|
|
silent no-op.
|
|
|
|
## Layer 2: uBlock Origin in Firefox
|
|
|
|
Independent of the VPN, and that is the point: stopping RethinkDNS does
|
|
**not** restore YouTube in Firefox. Verified by force-stopping
|
|
`com.celzero.bravedns` and loading youtube.com, which produced _"uBlock
|
|
Origin has prevented the following page from loading — `||youtube.com^` —
|
|
found in: My filters"_.
|
|
|
|
The filters, in uBlock's dashboard → **My filters**:
|
|
|
|
```
|
|
! YouTube block
|
|
||youtube.com^
|
|
||youtu.be^
|
|
||googlevideo.com^
|
|
||ytimg.com^
|
|
||youtube-nocookie.com^
|
|
||ggpht.com^
|
|
||yt3.ggpht.com^
|
|
||m.youtube.com^
|
|
```
|
|
|
|
Add them by writing that list to a file, pushing it to
|
|
`/sdcard/Download/`, triggering a media scan (`am broadcast -a
|
|
android.intent.action.MEDIA_SCANNER_SCAN_FILE -d file:///sdcard/...`,
|
|
or the picker will not see it), then using uBlock's **import** button.
|
|
Do NOT type them with `adb shell input text`: it silently strips `|` and
|
|
`^`, leaving bare domains that do not block. Press the checkmark to
|
|
apply, and confirm it greys out.
|
|
|
|
These live in the Firefox profile, so they are **not** captured by
|
|
`phone_backup.sh` and must be re-added by hand after a wipe.
|
|
|
|
The block page has a **Proceed** button — one tap. This layer raises the
|
|
cost of bypassing; it does not remove the bypass.
|
|
|
|
## What is NOT blocked
|
|
|
|
**Firefox (`org.mozilla.fenix`) is still installed and still reaches
|
|
youtube.com.** It is the only remaining browser after Chrome's removal.
|
|
|
|
Unlike the three packages above, Firefox is user-installed
|
|
(`/data/app/...`, no `FLAG_SYSTEM`), so `pm uninstall --user 0` would
|
|
**permanently delete it and its data** — no `install-existing` recovery, a
|
|
full reinstall from the Play Store. That asymmetry is why it was left alone
|
|
rather than swept up with the rest. Decide deliberately.
|
|
|
|
`com.google.android.webview` was checked and left in place: it is the system
|
|
WebView provider, so removing it would break in-app browsers everywhere.
|
|
Chrome and WebView are separate packages on this device, which is why
|
|
removing Chrome is safe.
|
|
|
|
## The web path, and why DNS is parked
|
|
|
|
Removing the app kills the recommendation feed, notifications and the
|
|
account-linked session — most of the pull. It does not stop typing
|
|
`youtube.com` into a browser.
|
|
|
|
Previously rejected approaches, from `focus_owner/docs/`:
|
|
|
|
- **Home-hosted DoT resolver.** Android's Private DNS fails _closed_, so PC
|
|
off = phone has no internet at all. Rejected: the phone must work with the
|
|
PC off.
|
|
- **Hosted DNS (NextDNS, AdGuard, ControlD).** No provider ingests the 185k
|
|
domain blocklist; free tiers fail _open_ past ~300k queries/month.
|
|
|
|
The remaining candidate is a **local-VPN content blocker** — an on-device
|
|
`VpnService` that filters without any network dependency, so it works with the
|
|
PC off and does not fail closed on network loss. Not yet scoped; the VPN slot
|
|
was going to be checked when the device disconnected. Note Android allows only
|
|
one active VPN at a time, so this would conflict with any real VPN.
|
|
|
|
## How strong this actually is
|
|
|
|
Measured, not assumed:
|
|
|
|
| Layer | Undo cost |
|
|
| ---------------- | ------------------------------------------------------------------------------------------------------------------- |
|
|
| App removal | **One tap.** Google Play shows a live **Install** button for YouTube (checked on device 2026-08-09; not installed). |
|
|
| RethinkDNS rules | A few taps — the VPN toggle in Settings or the quick-settings tile. |
|
|
| uBlock filters | **Proceed** on the block page, or disabling the extension. |
|
|
|
|
Nothing here is tamper-resistant, and nothing here can be: on an
|
|
unrooted device without Device Owner, no app can prevent the user
|
|
disabling a VPN or reinstalling from Play. The layers are independent —
|
|
undoing one does not undo the others — so the cost is "three separate
|
|
places" rather than one. That is the honest ceiling.
|
|
|
|
`DISALLOW_CONFIG_VPN` plus `setAlwaysOnVpnPackage(..., lockdown)` under
|
|
Device Owner is the only tier that removes the off switch, and it needs
|
|
the factory reset in `docs/device-owner-wipe-checklist.md`. See also the
|
|
FLAG_SYSTEM note above: `focus_owner` would need fixing before Device
|
|
Owner could touch YouTube at all.
|
|
|
|
Also note nothing re-asserts the purge automatically.
|
|
`phone-auto-sync.timer` is inactive and its `ExecStart` points at a path
|
|
that does not exist, so `distraction_purge.sh` is manual today.
|
|
|
|
## infakt, before any factory reset
|
|
|
|
Checked 2026-08-09 in the web panel and on the device, because infakt was
|
|
the one app whose loss would have blocked the Device Owner wipe.
|
|
|
|
- **2FA is SMS-only.** "Aplikacja weryfikacyjna" reads _Skonfiguruj_, i.e.
|
|
not configured, so **no TOTP seed exists** and a wipe cannot destroy
|
|
one. The registered number survives on the SIM.
|
|
- **"Logowanie" is unchecked** under _Akcje objęte weryfikacją_ — only
|
|
_Wrażliwe_ actions prompt. Plain login needs the password alone.
|
|
- The app uses Firebase push (`FirebaseInstanceIdReceiver`) for the
|
|
browser-login approval tap. Push tokens are per-install, so a reinstall
|
|
re-registers and prompts arrive at the new install.
|
|
|
|
So login is safe: reinstall, sign in with the password.
|
|
|
|
What does **not** survive: the banking pairing (_Usuń powiązanie z
|
|
telefonem_) and the local app PIN. Re-pair via SMS after the wipe.
|
|
|
|
Do not save anything on that settings page casually — it warns that
|
|
changing it logs out all current mobile sessions.
|
|
|
|
## Redoing this after a factory reset
|
|
|
|
The purge is per-user state and does not survive a wipe. Re-run
|
|
`./distraction_purge.sh` after re-enrolling the device.
|