Kurt999
I don't claim to be an expert but these are all just things I've picked up toying around for while. Here is how I'd go about hardening Android if GrapheneOS wasnt an option and would be happy to recieve any criticisms or corrections.
Android Approach :
If the goal is security while doing harm reduction for privacy then a Google Pixel with the Stock OS or Samsung Galaxy that has multiple years of updates promised is the only Android approach I'd vouch for.
When using Stock OS's you're already trusting Google and potentially another party so unless you have reasons to chose something else such as accessibility, specialized hardware or a niche feature chosing Pixel OS is going to be a good baseline for hardening.
Obviously go through your settings and do the basics, revoke unneccessary permissions, disable and uninstall unused apps, toggle off privacy invasive features in the Google services page and remain up to date as possible. I think this part is pretty self explanatory and doesnt need further clarification
Ensure app sources: For the most security you’re going to want to use the Play Store. SInce there is no sandboxed Google Play in this scenario people will likely want to turn to the Aurora Store. I would say this largely depends on what you’re achieving. Aurora Store I would not reccomend getting something sensitive like a banking app from there. There are security risk that people way smarter than I have pointed out here a dozen times. From what I understand while Google probably not link your activity when getting things from Aurora there could still be using a shadow profile of your activities from your device. Either way even if Aurora didnt have security flaws its a cat and mouse game of whether or not it works so I would place bets there if you’re concerned best you can do is use the Play Store in Private Space or a seperate Profile. There is also Accressent which is great in theory but gives limited information on what app you’re installing which isnt ideal. Part of privsec is making sure you know what you’re putting on your computer. Getting apps directly from the dev or if something is only available via an F-Droid Repo I would add it to obtainium also but you’re putting alot trust in that process. This is going vary for everyone.
Preface:
It is common practice to remove stock system apps and replace them with third party FOSS equivalents. I would reccomend against this as your bringing friction to usability and adding attack surface for supposed privacy. Simply put the app isnt even actually gone at best its disabled. If you still want to do this for some reason like having apps open links in a designated app such as youtube links for NewPipe then just make sure to revoke devices and disable USB debugging and developer options after you’re finished.
I want to combat the notion that DeGoogle = Privacy.
Don’t get me wrong Google is an ad company who leeches off your data and the incentive is always there to encroach more and more on your freedom but we can know that and simultenously acknowledge there is alot of fear mongering. Sure get rid of the invasive ones like Search, Maps, Gemini, YouTube etc, but also you must realize what the issue at hand is instead of relying on sensationalized versions of the truth.
As an example your biggest threat to your photos is uploading them unencrypted to the cloud and so your solution is to either use a trusted end to end encrypted solution such as Ente, or keep it local with account sync off. Which you can still achieve the latter with Google Photos. Google isn’t going to magically start grabbing your photos if you’ve disabled cloud sync.
Another example is Google Messages over something like the AOSP SMS app. What did removing Google out of the equatation actually achieve? You actually lost privacy by removing a form of encrypted communications. I am not going to say threat model because too many people say that ambigously without elaborating but don’t just default to assuming something is good or bad without verifying it against your needs.
If you’re worried about telemetry you can use DNS Blockers to mitigate them and tracking domains systemwide but you must understand that at the end of the day this is simply badness enumeration and that Google or whomever you’re concerned about can just transfer their tracking domains to first party domains where blocking may affect other important things. (Do note that GrapheneOS themselves has mentioned that telemetry is a small part of privacy threats
A small amount of uninvasive telemetry isn't the catastrophe people make it out to be and LOTS of open source software including Firefox has similar telemetry to macOS. You aren't avoiding all telemetry, etc. by using open source software, and it's a tiny aspect of privacy.
This where something like the Rethink App comes in and is going to be a major part of this setup for adblocking. Yes it’s imperfect and still going to be potentially leaky but this is better than nothing can be used as a good layered defense so atleast you’re not exposing yourself all the time and doesnt carry the same usability risks of the “degoogle” approach. You can use Wireguard configs to use a VPN and the firewall at the same time and can block domains for a specific app. However if you use something like DAITA from Mullvad then you have no choice but to use the official clients. I prefer this approach regardless as I rely on ProtonVPN free servers and a mismatch of timezone and IP address location can be used to fingerprint you which is a larger concern to me.
Enable Advanced Device Protections:
Going to Settings → Security & Privacy → Advanced Protection → and turn on Device protection
By doing this you will:
- Block spam calls and messages
- Reduce attack surface for cellular networks
- Block insecure web technologies in Chrome
- Enable theft deterance features
- Enable USB protections
- Protect from memory relate bugs
Probably not as well implemented as Graphene’s approach but still solid
Unfortunately this also will block installation of apps outside the Play Store or any other OEM store so if the security to usability trade off isnt worth it this feature isnt for you.
Use Chrome or Brave: Chrome especially with Advanced Device Protection (Android 16+) or the Google Advanced Protection Program is the next best secure by default browser after Vanadium.
Disable any form of signing into Google Account and usage data and utilitze all the per-site permissions. I prefer a block by default by approach. If you want to use something like YouTube or Reddit in the browser then considering using a web front end.
It’s also the webview of your phone so unless you’re willing to break the security model of Android you’re still using Chrome under the hood regardless whether its for your VPN, NewPipe or something else reliant on webview.
If you must have specifically browser based content blocking then Brave is your only option that doesnt fall too far behind chromium updates. Please avoid Firefox based browsers with exception of if you need Tor. Even with Tor I would not install it in the same profile.
Utilize Profiles or Equivalent:
For some godforesaken reason OEMs insist on implementing their secure folder or dual apps instead of just utilizing the already existing profile feature. You may not be able to completely save yourself from being profiled by Google or your OEM but at least don’t make easier for third parties to see what you apps you have installed. Compartmentalize according to limitations. Pixel OS/ AOSP lets you have up to 4 Profiles. Other OEMs have less.
Stay Official: If you’re insisting on "DeGoogling" I can really only suggest Motorola phones as nothing major seems to break when you disable Google Play Services and then replace the stock apps with trusted apps since thats your perogative. (For reasons I stated before I personally wouldn't go with this approach). Using a different alternative OS comes that doesnt lock the bootloader come with its own issues if you proceed to do so I would not be using this for anything sensitive. For an offline doomsday device or ephemeral usages or a glorified MP3 player it may be okay but I dont see a reason to lose security in the name of this. Only go for official “ROM”s avoid GSI’s at all costs.
Samsung Specific: I don’t use OneUI so I dont know any of the threats there other than the the added to attack surface of Samsung apps. However, one advantage I’d utilize is Samsung’s Shortcuts equivalent Routines. For auto disabling Wi-Fi and Bluetooth. Open Routines → Tap the + icon → Go to If → Tap Wi-Fi Network (Unfortunately, you will have to select each individual network) → Tap Disconnected → Done → go back and tap Then → Connections → Wi-Fi off → Save. You can also set it by Wi-Fi strength. The process for Bluetooth is similar and has the same drawbacks
OnePlus Specific: Its also worth noting that OnePlus devices on OxygenOS actually have the ability to disable network for apps for both Mobile and Wi-Fi without needing a third party app. I haven't owned a OnePlus device in years so I don't know how this would be workflow wise and have no idea whether it is as good as of implementation as on GrapheneOS.
Android regardless of distrubtion has Microphone and Cameras Toggles. I'd higly reccomend making that a part of your day to day work flow if you havent already even if you change nothing else this will be a good habit for your privacy without really changing much. If you’re willing to compromise with keeping developer options on then you can also utilitze the sensors toggle. Its very rigid on or off unfortunately but it is effective.