---
title: Android Übersicht
icon: simple/android
description: Android ist ein Open-Source-Betriebssystem mit starken Sicherheitsvorkehrungen, was es zu unserer ersten Wahl für Handys macht.
robots: nofollow, max-snippet:-1, max-image-preview:large
---

![Android Logo](../assets/img/android/android.svg){ align=right }

Das **Android Open-Source Project** ist ein sicheres mobiles Betriebssystem mit starkem [App-Sandboxing](https://source.android.com/security/app-sandbox), [Verified Boot](https://source.android.com/security/verifiedboot) (AVB) und einem robusten [Berechtigungskontrollsystem](https://developer.android.com/guide/topics/permissions/overview).

[:octicons-home-16:](https://source.android.com){ .card-link title=Homepage }
[:octicons-info-16:](https://source.android.com/docs){ .card-link title=Dokumentation}
[:octicons-code-16:](https://cs.android.com/android/platform/superproject/main){ .card-link title="Quellcode" }

[Unsere Android-Empfehlungen :material-arrow-right-drop-circle:](../android/index.md ""){.md-button.md-button--primary}

## Sicherheitsmaßnahmen

Zu den Schlüsselkomponenten des Android-Sicherheitsmodells gehören [Verified Boot](#verified-boot), [Firmware-Updates](#firmware-updates) und ein robustes [Berechtigungssystem](#android-permissions). Diese wichtigen Sicherheitsmaßnahmen bilden die Grundlage der Mindestkriterien für unsere Empfehlungen für [Mobiltelefone](../mobile-phones.md) und [Custom-Android-OS](../android/distributions.md).

### Verified Boot

[**Verified Boot**](https://source.android.com/security/verifiedboot) ist ein elementarer Bestandteil des Android-Sicherheitsmodells. Es bietet Schutz vor [Evil Maid Angriffen](https://en.wikipedia.org/wiki/Evil_maid_attack), Malware-Persistenz und stellt sicher, dass Sicherheitsupdates nicht durch [Rollback-Schutz](https://source.android.com/security/verifiedboot/verified-boot#rollback-protection) herbagestuft werden können.

Android 10 und höher hat sich von der Festplattenverschlüsselung hin zu einer flexibleren [dateibasierten Verschlüsselung](https://source.android.com/security/encryption/file-based) entwickelt. Deine Daten werden mit eindeutigen Verschlüsselungsschlüsseln verschlüsselt, während die Betriebssystemdateien unverschlüsselt bleiben.

Verified Boot stellt die Integrität der Betriebssystemdateien sicher und verhindert so, dass ein Angreifer mit physischem Zugriff das Gerät manipulieren oder Malware installieren kann. Für den unwahrscheinlichen Fall, dass Malware in der Lage ist, andere Teile des Systems auszunutzen und höhere Privilegien zu erlangen, verhindert Verified Boot Änderungen an der Systempartition und macht sie beim Neustart des Geräts rückgängig.

Leider sind die OEMs nur verpflichtet, Verified Boot auf ihrer Android-Distribution zu unterstützen. Nur wenige OEMs wie Google unterstützen die benutzerdefinierte AVB-Schlüsselregistrierung auf ihren Geräten. Außerdem unterstützen einige AOSP-Derivate wie LineageOS oder /e/ OS Verified Boot nicht, selbst auf Hardware mit Verified Boot-Unterstützung für Betriebssysteme von Drittanbietern. Wir empfehlen, dass du für Unterstützung checkst **bevor** du ein neues Gerät kaufst. AOSP Ableitungen, welche nicht den Verifizierten Boot unterstützen, werden **nicht** empfohlen.

Viele Erstausrüster (OEM) haben auch eine kaputte Implementierung vom Verifizierten Boot, welche du dir bewusst sein sollten neben entsprechendem Marketing. Zum Beispiel sind das Fairphone 3 und 4 Standardmäßig nicht sehr sicher [der Standard Bootloader vertraut dem öffentlichen AVB Schlüssel](https://forum.fairphone.com/t/bootloader-avb-keys-used-in-roms-for-fairphone-3-4/83448/11). Das bricht den Verifizierten Boot auf einem Standard Fairphone Gerät da, dass System auch alternative Android Betriebssysteme (wie /e/)[lädt ohne Warnung](https://source.android.com/security/verifiedboot/boot-flow#locked-devices-with-custom-root-of-trust) über modifizrte Betriebssystem Nutzung.

### Firmware-Updates

**Firmware-Updates** sind entscheidend für die Aufrechterhaltung der Sicherheit, und ohne sie ist dein Gerät nicht sicher. OEMs haben Unterstützungsvereinbarungen mit ihren Partnern, um die Closed-Sourced-Komponenten für einen begrenzten Zeitraum zur Verfügung zu stellen. Diese sind in den monatlichen [Android Security Bulletins](https://source.android.com/security/bulletin) beschrieben.

Da die Komponenten des Smartphones selber, wie Prozessor und Modem Technologie auf Quell geschlossenen Komponenten basiert, müssen Updates vom jeweiligen Hersteller bereitgestellt werden. Daher ist es sehr wichtig vor dem Kauf des Gerätes einen aktiven Support Zyklus festzustellen. [Qualcomm](https://qualcomm.com/news/releases/2020/12/qualcomm-and-google-announce-collaboration-extend-android-os-support-and) und [Samsung](https://news.samsung.com/us/samsung-galaxy-security-extending-updates-knox) unterstützen Ihre Geräte für 4 Jahre, während günstigere Produkte oft viel kürzere Support Zyklen haben. Mit der Einführung des [Pixel 6](https://support.google.com/pixelphone/answer/4457705), stellt Google Ihren eigene SoC her und Support diese für mindestens 5 Jahre. With the introduction of the Pixel 8 series, Google increased that support window to 7 years.

EOL devices which are no longer supported by the SoC manufacturer cannot receive firmware updates from OEM vendors or after market Android distributors. This means that security issues with those devices will remain unfixed.

Fairphone, for example, markets their Fairphone 4 device as receiving 6 years of support. However, the SoC (Qualcomm Snapdragon 750G on the Fairphone 4) has a considerably shorter EOL date. This means that firmware security updates from Qualcomm for the Fairphone 4 will end in September 2023, regardless of whether Fairphone continues to release software security updates.

### Android Permissions

[**Permissions on Android**](https://developer.android.com/guide/topics/permissions/overview) grant you control over what apps are allowed to access. Google regularly makes [improvements](https://developer.android.com/about/versions/11/privacy/permissions) on the permission system in each successive version. All apps you install are strictly [sandboxed](https://source.android.com/security/app-sandbox), therefore, there is no need to install any antivirus apps.

A smartphone with the latest version of Android will always be more secure than an old smartphone with an antivirus that you have paid for. It's better not to pay for antivirus software and to save money to buy a new smartphone such as a [Google Pixel](../mobile-phones.md#google-pixel).

Android 10:

- [Scoped Storage](https://developer.android.com/about/versions/10/privacy/changes#scoped-storage) gives you more control over your files and can limit what can [access external storage](https://developer.android.com/training/data-storage#permissions). Apps can have a specific directory in external storage as well as the ability to store specific types of media there.
- Tighter access on [device location](https://developer.android.com/about/versions/10/privacy/changes#app-access-device-location) by introducing the `ACCESS_BACKGROUND_LOCATION` permission. This prevents apps from accessing the location when running in the background without express permission from the user.

Android 11:

- [One-time permissions](https://developer.android.com/about/versions/11/privacy/permissions#one-time) which allows you to grant a permission to an app just once.
- [Auto-reset permissions](https://developer.android.com/about/versions/11/privacy/permissions#auto-reset), which resets [runtime permissions](https://developer.android.com/guide/topics/permissions/overview#runtime) that were granted when the app was opened.
- Granular permissions for accessing [phone number](https://developer.android.com/about/versions/11/privacy/permissions#phone-numbers) related features.

Android 12:

- A permission to grant only the [approximate location](https://developer.android.com/about/versions/12/behavior-changes-12#approximate-location).
- Auto-reset of [hibernated apps](https://developer.android.com/about/versions/12/behavior-changes-12#app-hibernation).
- [Data access auditing](https://developer.android.com/about/versions/12/behavior-changes-12#data-access-auditing) which makes it easier to determine what part of an app is performing a specific type of data access.

Android 13:

- A permission for [nearby Wi-Fi access](https://developer.android.com/about/versions/13/behavior-changes-13#nearby-wifi-devices-permission). The MAC addresses of nearby Wi-Fi access points were a popular way for apps to track a user's location.
- More [granular media permissions](https://developer.android.com/about/versions/13/behavior-changes-13#granular-media-permissions), meaning you can grant access to images, videos or audio files only.
- Background use of sensors now requires the [`BODY_SENSORS`](https://developer.android.com/about/versions/13/behavior-changes-13#body-sensors-background-permission) permission.

An app may request a permission for a specific feature it has. For example, any app that can scan QR codes will require the camera permission. Some apps can request more permissions than they need.

[Exodus](https://exodus-privacy.eu.org) can be useful when comparing apps that have similar purposes. If an app requires a lot of permissions and has a lot of advertising and analytics this is probably a bad sign. We recommend looking at the individual trackers and reading their descriptions rather than simply **counting the total** and assuming all items listed are equal.

<div class="admonition warning" markdown>
<p class="admonition-title">Warnung</p>

If an app is mostly a web-based service, the tracking may occur on the server side. [Facebook](https://reports.exodus-privacy.eu.org/en/reports/com.facebook.katana/latest) shows "no trackers" but certainly does track users' interests and behavior across the site. Apps may evade detection by not using standard code libraries produced by the advertising industry, though this is unlikely.

</div>

<div class="admonition note" markdown>
<p class="admonition-title">Anmerkung</p>

Datenschutzfreundliche Anwendungen wie [Bitwarden](https://reports.exodus-privacy.eu.org/en/reports/com.x8bit.bitwarden/latest) können einige Tracker wie [Google Firebase Analytics](https://reports.exodus-privacy.eu.org/en/trackers/49) anzeigen. Diese Bibliothek enthält [Firebase Cloud Messaging](https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging), das [Push-Benachrichtigungen](https://en.wikipedia.org/wiki/Push_technology) in Anwendungen bereitstellen kann. Dies [ist der Fall](https://fosstodon.org/@bitwarden/109636825700482007) bei Bitwarden. Das bedeutet nicht, dass Bitwarden alle von Google Firebase Analytics bereitgestellten Analysefunktionen nutzt.

</div>

## Datenschutz-Funktionen

### Benutzerprofile

Multiple **user profiles** can be found in :gear: **Settings** → **System** → **Users** and are the simplest way to isolate in Android.

With user profiles, you can impose restrictions on a specific profile, such as: making calls, using SMS, or installing apps. Each profile is encrypted using its own encryption key and cannot access the data of any other profiles. Even the device owner cannot view the data of other profiles without knowing their password. Multiple user profiles are a more secure method of isolation.

### Arbeits-Profil

[**Work Profiles**](https://support.google.com/work/android/answer/6191949) are another way to isolate individual apps and may be more convenient than separate user profiles.

A **device controller** app such as [Shelter](../android/general-apps.md#shelter) is required to create a Work Profile without an enterprise MDM, unless you're using a custom Android OS which includes one.

The work profile is dependent on a device controller to function. Features such as *File Shuttle* and *contact search blocking* or any kind of isolation features must be implemented by the controller. You must also fully trust the device controller app, as it has full access to your data inside the work profile.

This method is generally less secure than a secondary user profile; however, it does allow you the convenience of running apps in both the owner profile and work profile simultaneously.

### Private Space

**Private Space** is a feature introduced in Android 15 that adds another way of isolating individual apps. You can set up a private space in the owner profile by navigating to :gear: **Settings** → **Security & privacy** → **Private space**. Once set up, your private space resides at the bottom of the app drawer.

Like user profiles, a private space is encrypted using its own encryption key, and you have the option to set up a different unlock method. Like work profiles, you can use apps from both the owner profile and private space simultaneously. Apps launched from a private space are distinguished by an icon depicting a key within a shield.

Unlike work profiles, Private Space is a feature native to Android that does not require a third-party app to manage it. For this reason, we generally recommend using a private space over a work profile, though you can use a work profile alongside a private space.

### VPN Kill-Switch

Android 7 und höher unterstützt einen VPN-Kill-Switch, der ohne die Installation von Drittanbieter-Apps verfügbar ist. Diese Funktion kann Leaks verhindern, wenn die VPN-Verbindung unterbrochen wird. Du findest sie unter :gear: **Einstellungen** → **Netzwerk & Internet** → **VPN** → :gear: → **Verbindungen ohne VPN blockieren**.

### Global Toggles

Moderne Android-Geräte haben globale Schalter zum Deaktivieren von Bluetooth und Ortungsdiensten. Android 12 introduced toggles for the camera and microphone. When not in use, we recommend disabling these features. Apps cannot use disabled features (even if granted individual permissions) until re-enabled.

## Google-Dienste

If you are using a device with Google services—whether with the stock operating system or an operating system that safely sandboxes Google Play Services like GrapheneOS—there are a number of additional changes you can make to improve your privacy. We still recommend avoiding Google services entirely, or limiting Google Play Services to a specific user/work profile by combining a device controller like *Shelter* with GrapheneOS's Sandboxed Google Play.

### Advanced Protection Program

If you have a Google account we suggest enrolling in the [Advanced Protection Program](https://landing.google.com/advancedprotection). It is available at no cost to anyone with two or more hardware security keys with [FIDO](../basics/multi-factor-authentication.md#fido-fast-identity-online) support. Alternatively, you can use [passkeys](https://fidoalliance.org/passkeys).

The Advanced Protection Program provides enhanced threat monitoring and enables:

- Stricter two-factor authentication; e.g. that [FIDO](../basics/multi-factor-authentication.md#fido-fast-identity-online) **must** be used and disallows the use of [SMS OTPs](../basics/multi-factor-authentication.md#sms-or-email-mfa), [TOTP](../basics/multi-factor-authentication.md#time-based-one-time-password-totp) and [OAuth](../basics/account-creation.md#sign-in-with-oauth)
- Only Google and verified third-party apps can access account data
- Scanning of incoming emails on Gmail accounts for [phishing](https://en.wikipedia.org/wiki/Phishing#Email_phishing) attempts
- Stricter [safe browser scanning](https://google.com/chrome/privacy/whitepaper.html#malware) with Google Chrome
- Stricter recovery process for accounts with lost credentials

 If you use non-sandboxed Google Play Services (common on stock operating systems), the Advanced Protection Program also comes with [additional benefits](https://support.google.com/accounts/answer/9764949) such as:

- Not allowing app installation outside the Google Play Store, the OS vendor's app store, or via [`adb`](https://en.wikipedia.org/wiki/Android_Debug_Bridge)
- Mandatory automatic device scanning with [Play Protect](https://support.google.com/googleplay/answer/2812853?#zippy=%2Chow-malware-protection-works%2Chow-privacy-alerts-work)
- Warning you about unverified applications
- Enabling ARM's hardware-based [Memory Tagging Extension (MTE)](https://developer.arm.com/documentation/108035/0100/Introduction-to-the-Memory-Tagging-Extension) for supported apps, which lowers the likelihood of device exploits happening through memory corruption bugs

### Google Play System Updates

In the past, Android security updates had to be shipped by the operating system vendor. Android has become more modular beginning with Android 10, and Google can push security updates for **some** system components via the privileged Play Services.

If you have an EOL device shipped with Android 10 or above and are unable to run any of our recommended operating systems on your device, you are likely going to be better off sticking with your OEM Android installation (as opposed to an operating system not listed here such as LineageOS or /e/ OS). This will allow you to receive **some** security fixes from Google, while not violating the Android security model by using an insecure Android derivative and increasing your attack surface. We would still recommend upgrading to a supported device as soon as possible.

### Advertising ID

All devices with Google Play Services installed automatically generate an [advertising ID](https://support.google.com/googleplay/android-developer/answer/6048248) used for targeted advertising. Disable this feature to limit the data collected about you.

On Android distributions with [sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), go to :gear: **Settings** → **Apps** → **Sandboxed Google Play** → **Google Settings** → **All services** → **Ads**.

- [x] Select **Delete advertising ID**

On Android distributions with privileged Google Play Services (which includes the stock installation on most devices), the setting may be in one of several locations. Check

- :gear: **Settings** → **Google** → **Ads**
- :gear: **Settings** → **Privacy** → **Ads**

You will either be given the option to delete your advertising ID or to *Opt out of interest-based ads* (this varies between OEM distributions of Android). If presented with the option to delete the advertising ID, that is preferred. If not, then make sure to opt out and reset your advertising ID.

### SafetyNet und Play Integrity API

[SafetyNet](https://developer.android.com/training/safetynet/attestation) and the [Play Integrity APIs](https://developer.android.com/google/play/integrity) are generally used for [banking apps](https://grapheneos.org/usage#banking-apps). Many banking apps will work fine in GrapheneOS with sandboxed Play services, however some non-financial apps have their own crude anti-tampering mechanisms which might fail. GrapheneOS passes the `basicIntegrity` check, but not the certification check `ctsProfileMatch`. Devices with Android 8 or later have hardware attestation support which cannot be bypassed without leaked keys or serious vulnerabilities.

As for Google Wallet, we don't recommend this due to their [privacy policy](https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en), which states you must opt out if you don't want your credit rating and personal information shared with affiliate marketing services.
