Dispatches / a short note
No internet still means yes
The push notifications, and in-app ads - sometimes they simply don't care even when you have disabled internet access in app info. Now you know why.
Content taken from https://t.me/AppManagerChannel/461
Why do certain apps have no internet permissions while they apparently connect to the internet?
They are using a separate provider application. This is true for a lot of applications that use FCM/UnifiedPush protocols to provide notifications (in which case they are either using Google Play Services or a UnifiedPush client). Large software vendors also do something similar: Gemini, for example, doesn’t have an internet permission because it does all the API calls via the Google app.
Why do certain apps connecting to the internet despite blocking its internet permission?
Again, they might be using a different provider. This is especially true for push notifications for the exact same reason above. This might actually be a good thing if it is solely used for push notifications as you do not miss out on the notifications even after blocking the internet connection. However, this also means telemetry may also be delivered via another app (e.g., Google Play Services). This is why these UID-backed firewall are often not enough (and as some of you know, I often criticize these firewall technology). An effective firewall would be the one that blocks the tracker URLs altogether: personalDNSfilter is one such tool, which is also very lightweight.
How about other firewall technologies?
The backend I have developed to enable this “permission overlay” can be utilized to add traditional ip-tables style blocking (requires root), net policy-based blocking (supported by Lineage OS), and VPN-based blocking. VPN-based blocking is probably unsuitable for App Manager, and even if it is implemented, we need to take into account my own criticisms about the VPNs: URL based blocking alongside regular app-specific blocking and support for actual VPN configurations or proxies.