iPhone/Android hardening

legreteco

If there was no GrapheneOS, how would you harden your iPhone/Android security wise?

KBExit

legreteco does jailbreaking still exist? I'd start there.

Carrousel7956

KBExit jailbreaking would be detrimental for iOS security.

NoahRaketic

legreteco On iOS, there's "Lockdown Mode" which adds some security hardening, mainly by restricting features. https://support.apple.com/en-us/105120

On stock Android, mostly just minimizing the number of additional apps installed, and limiting permissions as far as possible (same goes for on iOS). There's Advanced Data Protection, which makes your Google account more secure, but that also prevents your stock Android device from installing apps outside of the Play Store when enabled, so I'm not sure it's worth it.

KBExit

Carrousel7956 wouldn't you be able to jailbreak the phone and be able to thoroughly remove unnecessary connections and strip apps back from being invasive?
My last iPhone was the 4s so I don't know.

raccoondad

KBExit wouldn't you be able to jailbreak the phone and be able to thoroughly remove unnecessary connections and strip apps back from being invasive?

That'd an awful idea on an OS security level, rather than just stripping connections entirely by not giving it connectivity (outside of cellular maybe)

Regardless this isn't how security works, you will make your device more vulnerable not less. Punching a hole through your wall because you think people are inside them doesn't fix your house

Carrousel7956

KBExit Even if it did allow blocking connections, the question was about security.

how would you harden your iPhone/Android security wise?

userofgos

KBExit wouldn't you be able to jailbreak the phone

Jailbreaking iPhones require finding and exploiting vulnerabilities (typically zero-day vulns) and hoping they stay unpatched, and also chaining multiple exploits together to maintain persistence. That in itself should tell you that, as raccoondad mentioned is punching a hole in the OS, which leads to a breakdown in security.

phonenotworking

Moving to as many open source apps as possible, insted of apple default apps, for example phone app, also I would move to brave browser and harden it, like disable JIT, of course advanced data protection, making sure to update, also getting the latest iPhone would be good because of MTE.

ElliesSurviving

KBExit does jailbreaking still exist? I'd start there

jailbreaking iOS has been dead for years and even if it were possible it completely breaks the iPhones security model

in general if you want a hardened iOS device, use a newer model (preferably an iPhone 17 model or Air due to the new MTE), use advanced data protection for iCloud, and enable lockdown mode if the tradeoffs arent an issue for you (some may not like the tradeoffs for reducing the attack surface with lockdown mode but for as someone who has used it before i dont mind it and many probably wont)

for android im not 100% sure as i spent most time caring about iOS internals, but GrapheneOS is basically the only real way to go for security, but no matter your device dont root it and other alternate OS' which arent GrapheneOS arent worth it

ElliesSurviving

KBExit wouldn't you be able to jailbreak the phone and be able to thoroughly remove unnecessary connections and strip apps back from being invasive?

thats not how it works, jailbreaking takes down many essential security features (even basic ones like AMFI) and allows arbitary code execution, its about as secure as using android without selinux. and plus you woukdnt be able to do a whole lot as the root filesystem is verified every boot since iOS 15, if modified it will revert to the latest system snapshot, if that snapshot doesnt exist on iOS 13-14 it would just mount the modified root filesystem, but on iOS 15+ it will refuse to boot without a completely intact root filesystem and untouched snapshot

Johnnyloans

KBExit is going to get replies for months 💀

KBExit

Lol I don't mind it.
I just remember jailbreaking my phone in middle / high school and I made a bunch of custom code to get my phone working the way I want it to.
I haven't gotten back to the iPhone when I got the Google Nexus 6P. It's been OnePlus and Pixels for me from there.

I like being corrected where I am wrong. This is how you learn and grow :)

userofgos

KBExit I just remember jailbreaking my phone in middle / high school

Haha I did the same.

KBExit I like being corrected where I am wrong. This is how you learn and grow :)

Exactly!

Kurt999

As the OP mentioned Android also, I don't feel I'm derailing if I ask what would u do with stock android to make it more private and/or secure?

Sandworm7183

legreteco

The approach is largely based on how far you're willing to take it

A properly configured supervised iPhone + Lockdown Mode will get you pretty far. I personally love this configuration with Apple Configurator and iMazing Profile Editor for privsec and reduced distractions

Android is a bit more of a difficult conversation however It depends on priorities. If there is no GrapheneOS I dont think Android would be my first consideration at all. There is alot of incosistencies about Android that are annoying normally but that Im willing to overlook on GrapheneOS. If there is no GrapheneOS that also means no Vanadium or sandboxed Google Play so there would be siginificantly more compromises.

If your goal is security then Pixels with the stock OS would still dominate in this department followed by Samsungs.

Bixby Routines would allow you to set auto-wifi and bluetooth toggles but you're dealing with OneUI and its bloat.

Pixels are generally going to be first to major updates and security patches. Chrome is very difficult to harden on Android as there is no easy way to set a local policies like you can iOS and Brave doesnt really serve the same purpose as vanadium

Carrousel7956

Sandworm7183 There is alot of incosistencies about Android that are annoying normally but that Im willing to overlook on GrapheneOS.

Could you provide examples?

Sandworm7183

Carrousel7956

Mainly things I'm thinking of are stuff that are seriously missing within AOSP/Pixel OS but are present in OEM skins

Icon themeing only applies to the homescreen which means its an utterly useless feature as I generally keep my homescreen setup with no apps and rely on the app drawer and recents menu. The fact that iOS is better in this department is hilarious. So much for being the OS for customization. I prefer one uniform monochrome icon setup as it helps me focus on what I actually need to do on my phone

There is no way to adjust the intensity of grayscale while the intensity of other color filters exists. This is unfortunate because I want to simply desaturate how intense the colors of a phone while still being able to see them. The way I've worked around this by setting the color filter to protanomly and gaining back some of the lost redness by using night shift mode but a a user shouldnt have to do this

Parental controls blocking are annoyingly trivial to bypass DNS or App based solutions are not going to suffice when browsers themselves can also resolve DNS. I dont know what the solution is here except for maybe some sort of systemwide URL blocklist that can be a part of AOSP

Carrousel7956

Sandworm7183 Icon themeing only applies to the homescreen which means its an utterly useless feature as I generally keep my homescreen setup with no apps and rely on the app drawer and recents menu. The fact that iOS is better in this department is hilarious. So much for being the OS for customization. I prefer one uniform monochrome icon setup as it helps me focus on what I actually need to do on my phone

Good point. Minor nitpick but true. Doesn't bother me a lot but they should definitely fix that.

Edit: wait isn't that only on default stock launcher? I was thinking of app icon when you swipe up the app. Not sure if that has custom icons apply. If the issue can be solved with installing an app I can't really complain. All my iOS issues are unfixable.

Sandworm7183 There is no way to adjust the intensity of grayscale while the intensity of other color filters exists. This is unfortunate because I want to simply desaturate how intense the colors of a phone while still being able to see them. The way I've worked around this by setting the color filter to protanomly and gaining back some of the lost redness by using night shift mode but a a user shouldnt have to do this

Seems pretty niche to consider one phone over another for it but you do you.

Sandworm7183 Parental controls blocking are annoyingly trivial to bypass DNS or App based solutions are not going to suffice when browsers themselves can also resolve DNS. I dont know what the solution is here except for maybe some sort of systemwide URL blocklist that can be a part of AOSP

This is honestly the biggest missing feature from android and even iOS. On iOS it's implemented poorly and easily bypassed(heard they are updating it next update so hopefully there's a fix)

On GrapheneOS that sucks but hopefully we will get MDM which can be the most effective. It's the only effective solution on iOS (Apple Configurator).

iOS has much larger software experience problems imo though. Coming from a lifelong iPhone user until Grapheneos. I find the software a great improvement.

lack of back button is genuine evil incarnate.
can't customize home screen launcher.
clock alarms often doesn't work
default apps arent as well implemented as android. Can't change a lot of them which seems anti-competitive. I'm talking about picking which apps open and stuff like messaging app, not the default apps that come with the OS. Apple might get a win there. Apple notes is awesome.
password manager integration is worse at autofilling and detection.

Sandworm7183

Carrousel7956

Carrousel7956 Edit: wait isn't that only on default stock launcher? I was thinking of app icon when you swipe up the app. Not sure if that has custom icons apply. If the issue can be solved with installing an app I can't really complain. All my iOS issues are unfixable.

I dont use third party launchers as I feel they add attack surface to something that is very little gain and on top of that it still doesnt fix the fact the icon themes arent applied system-wide. It just allows you to have it the app drawer instead of just the homescreen. Plus this is kind of another issue I have with android as ecosystem where thinking a third party app is the solution to the UX problems

Carrousel7956 Seems pretty niche to consider one phone over another for it but you do you.

Just because its niche for others doesnt mean it doesnt matter. All things considered privacy is also niche and yet here we all are. I think people have become too accustomed to oversaturated displays which fuels people's smartphone addiction but once you experience natural colors and revert back its actually quite nauseating. Although to clarify it wouldnt make choose one phone over another. My goal is to carry multiple phones. Whether I like or not the bar is in hell when it comes to security which means whenever I interact with normal people who have no idea what any this stuff is I need iMessage and FaceTime to have basic E2EE since it will forever confuse me how the poulous willing download a mind control app like TikTok but are reluctant to have Signal

Carrousel7956 On GrapheneOS that sucks but hopefully we will get MDM which can be the most effective. It's the only effective solution on iOS (Apple Configurator).

Apple configurator has been a life saver and desperately want an android equivalent as

Carrousel7956 iOS has much larger software experience problems imo though. Coming from a lifelong iPhone user until Grapheneos. I find the software a great improvement.

I have my own criticism of iOS that annoy me but I just use those restrictions to my advantage I cant necessarily apply that logic to android

My criticisms of iOS

The force usage of an account just to download apps is just an excuse for apple to profile you. Even the playstore lets you delete app download history while Apple doesnt. If they dont want sideloading they should atleast implement a way to download free apps from the appstore without signing in.
You can't make lockdown exceptions for third party browsers
The App Library is the most disorganized implementation of an app drawer that I've ever seen so I just default to searching

Carrousel7956 lack of back button is genuine evil incarnate.

Could you elaborate on this? This may be a difference in usage because I dont ever see this affecting me day to day yet its a common criticism of iOS.

password manager integration is worse at autofilling and detection

I use bitwarden and autofill uses accessibility permission on android which is I find risky while iOS has some sort of dedicated integration for 3rd party autofill am I missing something here?