Newbie questions..what have I accomplished?

oldrammy

Hi Folks, This forum has been a great resource and I have learned a lot and enjoyed the experience. That being said I am trying to figure out what I have accomplished, and what I have screwed up. :)
I purchased a Google Pixel 7a from Amazon wiped it and loaded Graphene on it. Then I swapped my SIM card from my iPhone and tested it out and it worked great. Big accomplishment for me as I have never done anything to a phone before. Then I loaded the three google pieces to be able to use the play store (framework, play services and play store). Installed the Proton app and Signal, and a few other apps Amazon Music and Arlo. Then I ran across the forum mentions of Michael Bazzell and ordered his book and bought it pdf. as well. And from what I can tell based on what I have read so far, I screwed up multiple times, as far as privacy is concerned.
My main concerns when I started down this road was stopping Apple or Microsoft or Google from all their data collection , but now realize there is much more than that going on.
As far as I can tell from Michael's book...I should have 1) Purchased my phone in cash 2) NOT used the same SIM card and phone number 3) NOT installed any of the Google items and the Amazon Music App and Arlo app as they are all connected to me.

So trying to figure out if that is a correct assessment so far? and would removing those Apps and services do anything at this point?
Thanks in advance!

Dumdum

oldrammy
https://www.privacyguides.org/en/basics/threat-modeling/

TLDR:

I should have 1) Purchased my phone in cash 2) NOT used the same SIM card and phone number 3) NOT installed any of the Google items and the Amazon Music App and Arlo app as they are all connected to me.

These are only concerns for people with high/particular threat models. I don't really know anything about Bazzell or his book, but I get the impression that it generally provides the most possible information for optimal/max privacy (for those who wish/need max privacy). Frankly this isn't necessary for most people as such high threat models typically aren't needed. Of course people can probably still use the book/PDF to leverage what information is actually appropriate for their threat model.

User2288

oldrammy
As @Dumdum very succinctly and accurately put, it depends on your threat model (what you need to hide).

Sim providers often get your personal info, so any phone (IMEI) you put that sim into then becomes associated with you. But that's not a big problem for the average person.

The consequence of installing apps like amazon on a profile with google play is that google play and other non-privacy-respecting apps on that profile can potentially discover your identity and link all their data on you together.

https://discuss.grapheneos.org/d/8985-new-grapheneos-user-adtech-mitigation/6

raccoondad

oldrammy You are always going to give some information to Google/Apple/Whoever just by using their phone,

I wouldn't worry about it too much depending on your opsec goals and threat model. Each to their own of course.

oldrammy

Thanks Dumdum. I will read through the link. It looks like an excellent resource.

Like you mentioned I am not one with a high/particular threat, just trying to cut down on all the privacy intrusions. I read an article by Ramiro Romani from Take Back Our Tech that started me down this rabbithole and it has been eye opening to say the least.

Xtreix

oldrammy

Another good source : https://privsec.dev/posts/knowledge/threat-modeling/

Most typical people don't want to be bothered by SMS/email spam and misleading, intrusive ads, the threat model doesn't have to be necessary complicated, but it does give you a better understanding of what you're doing, security and privacy without knowing what to protect and against whom doesn't make sense.

oldrammy

Xtreix security and privacy without knowing what to protect and against whom doesn't make sense.

Great point..thanks for the link.

oldrammy

I have read through the links and threads shared and very interesting stuff. Coming from corporate IT for 20+ years mostly Windows server, I have become quite fascinated in the mobile side of things...the tracking and data grabbing capability is rather stunning.. My poor wife's eyes will glaze over when I start rambling about this stuff lol...

Blastoidea

Just be aware that GrapheneOS will not save you from yourself.

Your behavior can do more to compromise both security and privacy than you would believe.

It all depends on (as the saying goes) what you are trying to protect, and from whom.

oldrammy

Blastoidea

Yes I can see that. That was kinda what started my original post..wondering if I had made my work of changing phones and installing GOS moot by adding the google stuff and the music app.
Based on my threat model reading the ARLO app was a worthy privacy concession at this point, as I live in a rural area and need to be able to keep tabs on my home when away.
As I continue to learn and develop my privacy plan, things might change. For instance there may be a better camera solution with an open systems app, or even an open systems app that would allow me to monitor the Arlo cameras etc.

All in all it's a very interesting rabbithole I am going down..thanks for everyone's assistance!