Foreign travel burner

abacuspeanut

Hello everyone! I work in cyber security but haven't specifically worked with security of mobile devices or their operating systems. I'm looking to solicit advice about using a burner phone with Graphene as a burner while I'm abroad. My threat model includes a possible (not high likelihood, but certainly nonzero) threat of nation state actors attempting to collect data from me, but would not be in countries where such threats would have easy access to the countries' networks. I usually prefer open source products when they are suitable for my needs which is why I want to use Graphene, but I am coming from using iPhones as my daily driver for around 13 years so I don't know what I don't know. I primarily want to know what hardware is recommended, what configurations/settings are recommended/necessary given my threat model, and if there's any know common pitfalls with going this route besides the obvious (I am very familiar with using Linux PC OS's, bash scripting, low-level programming and such).

DeletedUser720

abacuspeanut which is why I want to use Graphene

That would be not the cheapest burner, $100 per used pixel 6a per travel.

Johnnyloans

abacuspeanut

Pixel 8 and up have MTE for more security.

settings > network > private dns set to off if using a VPN. This is needed to not have leaks outside of the vpn.

Physical sims are much more straightforward than esims. Some people, me, have esims set up in 2 minutes, others can't. (User error?)

If you must have a banking app instead of using a URL. List of compatible apps (not exhaustive):

https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/

There's info on how to set up esims and rcs. Sometimes there are more steps for certain users.
https://grapheneos.org/usage#rcs

Give yourself time before you travel so you can fix any issues. Double check taxi/ride-sharing apps work. Check if your authenticator apps will work. Check if the local public transportation apps work (can also search the app name in here to see any old(?) Info)

Get new apps to replace the outdated AOSP apps:
Gallery, contacts, calendar, files
Fossify makes several of these. Look around.

Set usb-c to charging only (no data)
Disable 2G

You can have airplane mode on with wifi and/or bluetooth on.

I'd watch a basics on android navigation/use if it was me first time using a mobile OS.
I think thats most of it...

If you set a duress password, never ever type it in again unless you want a wiped phone. Use the owner pin for authentication.

Goodluck have fun :)

MineralWater

I might have understood that wrong, but a burner phone is so to say not your private phone, but only a phone for vacation/holidays abroad?

Then I would simply use any cheap android phone and make a new Google account that will have zero data about you.

If national authority is coming after you, having a heavy secured phone will only make you more suspicious.

And if they can't get into your phones data, this might make it worse for you and they might keep you in jail for much longer.

So giving them a phone and password that has simply no personal data on it is probably in many scenarios the most secure you can do.

There is no law that one can't have a smartphone without any personal stuff on it. But depending on country there are lots of laws that can put you in trouble when you don't provide access to your phone.

Law enforcement etc is up to date with technology nowadays, you can't fool them with different profiles or something like that. Graphene can help to lock your data so that they can't access it, but it's not clever to do this.

The most secure is not having the data or information with you. If they want to look in your phone, let them.

abacuspeanut

MineralWater Thank you for taking the time to respond. To clarify my threat model, I am considering traveling to western Europe (Schengen area countries) for purely personal holiday and do not consider the authorities of said countries to be particular threats to my interests whose scrutiny I'd seek to evade. I should have probably clarified this initially, but I sort of intended this to be a personal project on threat mitigation and device hardening with a real world example of my own escapades, without exposing myself to unnecessary risk (of the non-cyber variety such as inability to check in with family/trusted friends or contact emergency services) while still maintaining maximum cyber security posture. I hadn't anticipated hostility from those countries to having a locked down phone with Graphene as a likelihood and was mostly looking for advice about where to looking for cellular plans, known obvious risks for hardware acquisition, device configurations etc. but if that's not the case I'd rather find out here than at customs! Much appreciated once again.

Johnnyloans

Also very few tap to pay apps work. If the financial org has tap to pay inside their app, maybe it'll work. (Some apps check for "security" via google play integrity API by comparing the OS name to Google's list of approved OSes)

You might see google play integrity API usage pop up and the app still works. (You can pick don't show me again for this app if you desire)

I think you can add tickets to google wallet.

The app curve works for tap to pay. There's a PayPal app for tap to pay.
These might be Germany only or EU only.

Enjoy the scenery!
If you're a USA resident, careful of what memes and messages your entire party has on their phones upon reentering.

Johnnyloans

Almost all people get esims to work without issue I'd say*

There are people that like to disable system apps or remove permissions from system apps on a clean install of GOS.