Privacy Tips?

graphie

Apart from using GrapheneOS, how do you improve privacy with your phone?

MarsTrue

graphie the consensus around here seems to be that if you trust graphene os you should also trust the toggles and therefore hardware solutions are unnecessary.

anyway back cameras seems at the bottom of the list when it comes to privacy risks. there's the front one, location, microphone and a plethora of other sensors that can give away your identity and whereabouts. check out this fun app to get an ideea of your phone capabilities

https://f-droid.org/packages/de.rwth_aachen.phyphox/

[deleted]

graphie don't use Google Play Services. Back up data locally. Don't store sensitive data on device.

graphie

MarsTrue For me GrapheneOS on a Pixel is a compromise. I had high hopes for the Pinephone with hardware kill-switches, unfortunately the software isn't where it needs to be for a daily driver. GrapheneOS is phenomenal, it's the proprietary blobs written to the hardware and separate from the OS that I don't trust.

Physically blocking cameras is the only way to be totally certain they're not spying on you, and being able to open and close them means not giving up their functionality. It also serves as protection from damage for the rear camera as well as from dust and finger smudges for both cameras so when you take that photo it comes out clear.

Of course there are other sensors which pose a risk to privacy, but there's no use in tossing the baby with the bath water. I appreciate the link though, that app looks fun to experiment with.

[deleted] Great list, thank you.

[deleted]

Restricting permissions of your apps. (Usability permissions, background data usage, and battery usage)
The data and battery restricting is just for me to control what is in use.
Ideally an anonymous carrier (xmp.chat/Cheogram or Silent.Link). The carrier will depend on how you plan to use the
phone because these two options can be restrictive. You'll have to choose whatever fits for you.
Limiting the apps you download. With fewer apps you will use the phone less and have a smaller footprint. At least I
find that is the case for me.
I keep airplane mode on all the time and only use wifi. Use an always on vpn and harden the browser you use. I am
planning on getting aGL.iNet router, connecting a vpn to it, then using Blue-merle or another IMEI anonymizer.
I don't give out my number. This way it will make it harder for law enforcement to get your number. If you don't give it
out to friends or family as well as not giving it out to sign up for things, you will likely be the only one to have it
along with your carrier. Your footprint is limited. So I use Signal or Briar (I don't have a use case for this yet, but I
would like to).
Emails like google, yahoo or whatever (zero privacy) emails I use on another device and it doesn't touch my pixel with
GOS. I use proton only for crypto authentications. Past that I don't feel there is a need for me to go with a secure
email since it won't give you the same level of privacy as messaging apps like Signal or Briar.
XMR for payments.
Be more minimalistic.

router99

[deleted] If you don't give it
out to friends or family

Do you just shun them or something?

[deleted]

graphie
Thank you!
I also had high hopes for Pinephone and Librem, but they just don't seem like they are where I would like them to be. Thankfully GOS satisfied what I was looking for and I am hoping they come out with their own phone. I would definitely be a buyer.

N1b

Best way to start is making a threat model. While privacy has a general definition, it will be different in detail for everyone (just like security and anonymity).

What you don't want to do is trying to reach "maximum possible privacy", this rabbit hole goes deep and ends in solitude and paranoia. Once you figured what's important to you, it's gonna be a much nicer journey. Personally I do prioritize privacy from big cooperations for example, but I'm willing to share many things with my friends and family. It's nice this way.

[deleted]

router99
No, notice I mentioned Signal and Briar. Two messaging platforms that don't require you to give out your phone number to start a connection with someone.

MarsTrue

router99 I managed to convince them to install yet another chat app (xmpp). your mileage may vary.

[deleted] that's a bit misleading. signal still requires your phone no but now you have the option to give out a username to your contacts.

your phone no is a very personal identifier often linked to your real identity, social circle and movement patterns. any company requiring it should be avoided and publicly mocked.

dln949

[deleted] Kyo, I"m interested in your thoughts on this:

I recently read - sorry, can't recall where - how Google, Apple, others are looking to integrate AI into devices. So, a person has such a device, and the AI is reading and analyzing all text messages, links, file and photo and video and audio attachments, browsing history, emails, etc - even what is being displayed on the screen. Much of this analysis results in the information being sent to those companies. The proffered justification is that this will enhance and improve the users' experience.

I am assuming that Graphene would either block this or give the user a toggle to completely block it. But as you know, we have to communicate with people who do not use Graphene. So..... It looks like the way things are heading, I can be very careful with my use of my Graphene Pixel, and I can use an app like Signal to communicate with someone, but if that person has a phone that allows AI to view and capture what is being displayed on the screen when he reads his Signal messages I send him, then aren't all my efforts at privacy seriously harmed?

I've often wondered in general how much privacy and anonymity and secrecy I can achieve given that I'm limited by what is being done on the recipients' devices I communicate with. I've never seen this question addressed anywhere, the discussions are always only about what happens on my device, as if that's all that matters.

Blastoidea

[deleted]
Briar eats battery running in the background.

[deleted]

MarsTrue
It actually isn't misleading. The discussion was about giving out phone numbers to friends and family, not to the chat service. Which, you can use a VOIP number and not worry, along with signal now making you unsearchable and being able to hide your number and use a username.

[deleted]

MarsTrue
My original post wasn't implying I use those chat services without a number. I was only mentioning them to identify what messaging platform I personally use.

N1b

dln949 not an expert but I'd assume Google would put any AI feature into their proprietary apps with privileged access to protect their code and bully everyone into using their Play Services.

Therefore you'll be fine by using GOS without Sandboxed Play Services (or maybe even with them, if the Sandbox is enough for your threat model or GOS comes up with new features mitigating privacy invasions). Let's see what happens, but I wouldn't worry about it too much. With GOS you'll likely always be in control of your device and OS, not the other way around.

As for our peers who use AI phones, couldn't they have the "feature" already to spy on your data via screen capturing? I don't know, but it's a good assumption that everything you share over the internet will be public data 10 years from now, that's what I expect and align my behavior with.

[deleted]

dln949
I'm no expert either. I know there are some apps that have the capability to toggle screen capture access on and off. Signal has a feature that blocks screenshots within the app. Located Account/Settings > Privacy > Screen Security. Unfortunately, a lot of what we do can be all for not. It takes one trip up. The AI concern could potentially be mitigated with settings like anti-screen capturing capabilities. However the person you are communicating with needs to know to toggle it on. If the person never goes into their privacy settings to do this then it is a risk for you. I would take it as data is potentially being leaked (in the AI capture threat we are discussing).

What I do is tell people they can communicate with me through Signal. I have gotten my family and some friends switched over. If they don't want to switch other, that is fine. I have an older (outdated) device that I use FB and email on that I can communicate with them with. It is an old Apple device that is already compromised, so any unsecure communication I do goes through there.

Do the best you can and help other people willing to switch do the same, as long as they are receptive.

dln949

N1b Right.

Just to be clear, my concern in my question lies with what is happening on the non-Graphene device of the other person I'm communicating with. If that person has this AI beast active on his device and it is reading everything I send to that person, isn't that a blow against my privacy, no matter how careful I am with what I do on my own device?

[deleted]

Blastoidea
Correct, but otherwise is a pretty solid communication method for certain things.

mmmm

[deleted] Don't store sensitive data on device.

People often say this. But how good is that advice, realistically? Even seemingly innocent data is likely sensitive. Storing state secrets is potentially not a good idea, but also perhaps sometimes necessary, and likely why a user may choose GrapheneOS in the first place.

Sure, don’t send sensitive data over a chat messenger.

I would rather advance in how to mitigate and / or understand the risks if applicable- than a blanket ‘don’t do it’. I mean, where is safe to store data then? A GrapheneOS device is certainly more secure than most desktop machines. In a securely locked profile that perhaps you only access when air gapped, I can’t think of a more secure easily accessible device for digital data.