Smartphone options for privacy

[cytg111]

I dont like being part of the big-data pool with all that follows, what options do I have or do I even have any? I am fed up with android, the usability aspect alone is killing me and the fact that I am handing over my data to ad serving/privacy invading entity Google makes me ready consider alternatives. I am thinking Apple is the same. What about an Ubuntu phone? Would that be an option?

 

[WelshBloke]

How much data are you wanting to withhold?

All cellphones are tracked to a certain extent (even dumbphones). 'They' will know your rough location and call log at a minimum.

 

[cytg111]

As much as possible. I must admit that much of concerns is based on assumptions, not knowledge.. So maybe I should start educating myself first.
I assume that
1. Tele carriers sell my data(position, device info, consumption of data/voice/sms).
2. Google/Apple collects "anonymous" user-experience data to further "enhance" the end user experience.
3. For data connections, my current IP is used as a means to geolocate.
4. Examples of apps listening in on you phone calls to deduce what kind of ad to sell you.
5. Purchases, again, what have I bought, when for how much and where.
6. Off topic, I am sure credit card companies/banking is doing the same, selling out info specific to the individual in order to gain an advertising edge.

So I am fedt up with advertising and the lengths the industry will go to to aquire my "big data", invading our collective privacy.

So I am thinking ubuntu-phone with a VPN is a place to start? Not perfect but a place to start.

Or is it futile?

 

[bononos]

I dont like being part of the big-data pool with all that follows, what options do I have or do I even have any? I am fed up with android, the usability aspect alone is killing me and the fact that I am handing over my data to ad serving/privacy invading entity Google makes me ready consider alternatives. I am thinking Apple is the same. What about an Ubuntu phone? Would that be an option?

If you root the phone, there xposed - xprivacy which is like a giant firewall. You can block apps from accessing your info like imei, imsi, serial hw number, google advertising number, internet access, etc besides the usual stuff like contacts/location, just a ton of stuff which people take for granted or assume that apps don't access them.

If your phone has a custom rom like CM, there could be built in privacy settings like CM's privacyguard or your vendor might have its own built in app.

 

[cytg111]

Excellent, I will look into those. Thanks.

 

[bononos]

As much as possible. I must admit that much of concerns is based on assumptions, not knowledge.. So maybe I should start educating myself first.
I assume that
1. Tele carriers sell my data(position, device info, consumption of data/voice/sms).
2. Google/Apple collects "anonymous" user-experience data to further "enhance" the end user experience.
3. For data connections, my current IP is used as a means to geolocate.
4. Examples of apps listening in on you phone calls to deduce what kind of ad to sell you.
5. Purchases, again, what have I bought, when for how much and where.
6. Off topic, I am sure credit card companies/banking is doing the same, selling out info specific to the individual in order to gain an advertising edge.
......

You should be able to turn off gps until you want to use it like for google apps or waze. Can't do much about ip address from your wifi or bts tower id unless you use a vpn. Beware that some vpn browser addons like (Hola) or apps (browsers) will actively hoover up your private data.

Use firefox since it supports extensions and from what I've seen, it doesn't keep your urls unlike other browsers like dolphin. Opera/Chrome is still probably better than tons of other browsers out there.

I doubt apps could listen in on your sms/calls just for advertising. The malware which snoop and collect passwords would probably be the ones to be worried about.

 

[WelshBloke]

Or is it futile?

Personally I think that it's futile to use a smartphone and expect your data not to be seen by the people who provide services on that smartphone.

Those services need access to the data to work.

So I suppose another way to ask my earlier question is "How smart do you want your smartphone to be?". The more you withhold the less it can do until you get down to the basic data that it needs to keep a connection to the cell tower.

You could certainly use an android phone with no Google services, a VPN and keep a close eye on what app permissions are sent allowed.

I'm not sure how much fun that would be, it certainly doesn't appeal to me.

I'm not too bothered about targeted or non targeted ads, they are both a waste of bandwidth as far as I'm concerned.
I use WhatsApp for messaging and that's end to end encrypted and not under the control of my phone manufacturer or cell provider.
I do use a VPN when off my home wifi and using public WiFi as that seems prudent.

 

[cytg111]

You should be able to turn off gps until you want to use it like for google apps or waze. Can't do much about ip address from your wifi or bts tower id unless you use a vpn. Beware that some vpn browser addons like (Hola) or apps (browsers) will actively hoover up your private data.

Use firefox since it supports extensions and from what I've seen, it doesn't keep your urls unlike other browsers like dolphin. Opera/Chrome is still probably better than tons of other browsers out there.

I doubt apps could listen in on your sms/calls just for advertising. The malware which snoop and collect passwords would probably be the ones to be worried about.

I have gps turned off by default.

http://www.computerworld.com/article/3079412/security/facebook-advertising-microphone-itbwcw.html

This is one reason why I dont use the facebook app. If I have to facebook (cause retarded friends) I use the browser. Oh yea, I wonder why facebook is retiring messaging from the browser and moving to the app. #¤%#1 .. not happening.

Firefox.. gotcha.

 

[cytg111]

Personally I think that it's futile to use a smartphone and expect your data not to be seen by the people who provide services on that smartphone.

- An Ubuntu phone would not negate some of this? Or is canonical sitting behind like another google / apple / facebook ?

So I suppose another way to ask my earlier question is "How smart do you want your smartphone to be?". The more you withhold the less it can do until you get down to the basic data that it needs to keep a connection to the cell tower.

- Phone, SMS, Browse, Tor browse and Signal. All I need and want .

You could certainly use an android phone with no Google services, a VPN and keep a close eye on what app permissions are sent allowed.
I'm not sure how much fun that would be, it certainly doesn't appeal to me.

For a 30% reduction in usability and a 300% gain in privacy. Ill take that, we are all different .

I'm not too bothered about targeted or non targeted ads, they are both a waste of bandwidth as far as I'm concerned.
I use WhatsApp for messaging and that's end to end encrypted and not under the control of my phone manufacturer or cell provider.
I do use a VPN when off my home wifi and using public WiFi as that seems prudent.

I loathe targeted ads. With a vengeance. We can debate Snowden, but when he says that not caring about privacy cause you got nothing to hide is like saying you dont care about freedom of speech cause you got nothing to say? He is 100% absolutely right!

 

[corkyg]

There is no such thing as complete privacy of any phone system. That is why voice scramblers exist. Any signal emitted can be intercepted.

If one must protect data stored in a phone, the best answer is encryption or removable memory.

 

[Commodus]

As much as possible. I must admit that much of concerns is based on assumptions, not knowledge.. So maybe I should start educating myself first.
I assume that
1. Tele carriers sell my data(position, device info, consumption of data/voice/sms).
2. Google/Apple collects "anonymous" user-experience data to further "enhance" the end user experience.
3. For data connections, my current IP is used as a means to geolocate.
4. Examples of apps listening in on you phone calls to deduce what kind of ad to sell you.
5. Purchases, again, what have I bought, when for how much and where.
6. Off topic, I am sure credit card companies/banking is doing the same, selling out info specific to the individual in order to gain an advertising edge.

So I am fedt up with advertising and the lengths the industry will go to to aquire my "big data", invading our collective privacy.

So I am thinking ubuntu-phone with a VPN is a place to start? Not perfect but a place to start.

Or is it futile?

One thing: don't conflate Apple and Google, as the two have fundamentally different approaches to privacy. Apple isn't perfect, but it's much more protective of privacy than Google is. It doesn't scan potentially identifying data; it explicitly asks for consent before collecting anonymized data; its photo-scanning AI is offline; it's easy to turn off location services. And no, Apple doesn't share iTunes purchase data with advertisers... heck, it got out of its iAd network this year.

Contrast how Apple handled mobile payments versus Google. When Google launched Wallet years ago, it designed the system so that Google would serve as a middleman -- theoretically, it could monitor data in between you and the store. Apple, on the other hand, designed Apple Pay so that it knows absolutely nothing about transactions. Android Pay does the same, so I shouldn't knock Google too much... but it did wait until Apple showed a better way.

There's also the question of taking a reasonable approach to privacy. At a certain point, it crosses the line from a reasonable expectation of privacy to shutting yourself off from the outside world. I'm reminded of Richard Stallman and his approach to free, open source software. He'll swear that he's a free spirit, but he's so dogmatic that he's more of a tech hermit... he's primarily defined by what he can't do.

 

[cytg111]

I am not going for complete privacy, i understand thats not possible. 70% maybe?

 

[Kazukian]

You can tighten up security on iPhones pretty easily, I kind of gave up,

 

[mdram]

https://www.silentcircle.com/products-and-solutions/devices/silent-os/

 

[Crono]

A custom, rooted Android ROM (anything close to AOSP on a device with good community support) with no GApps or Play Services, plus PMP or XPrivacy installed, as well as a firewall like AFWall+ enabled and configured. Install F-Droid and use APKMirror for alternative to Play Store and manual app installs. Install AdAway, and use Firefox with privacy control extensions (e.g. Ghostery, though you may not need it) and user agent spoofer. Disable scripting/use NoScript. Use a no logging VPN to encrypt your traffic.

You may need something like NOGAPPS as a substitute for Google location services. There are apps that won't run properly if you go the full non-Google route. You can also monitor network usage with an app like Network Log, and spoof GPS, mac address, etc with modules on Xposed. Ignore all the ones that do it for Pokemon Go.

I do some of the above (it's a pain in the butt if you want to go full tin foil) just to keep potential rogue apps from leeching my data; though I do stay away from obvious malware targets like wallpaper apps, I also don't like stuff like games leaking my contact info or other details about me, and it's hard to keep that from happening without at least better permissions controls and a firewall. It's also beneficial for managing data if you aren't on an unlimited plan: some apps I limit to work only on WiFi, and others I give no access to at all (a lot of utility apps and games really shouldn't be using data, but they do). Running a barebones variant of AOSP on a low end device also improves performance and battery life. Google has gotten better with Play Services, but it can still eat up resources in the background.

You could get an Ubuntu phone or install the OS on one of the handful of devices that support it, but keep in mind it's a Canonical product just as Android is a Google product. I don't suspect either of them of doing anything nefarious (nor do I rule it out) just be aware of it. Also, it doesn't seem to be very polished at this point, nor is there a real guarantee they continue the project. Mozilla just recently killed Firefox OS.

You can also disable or strip out much of the apps, services, and UI of AOSP and run Linux on top of or alongside Android on pretty much any Android device with at least root access, if it's Linux you want.

And if you are leaning more toward security and not (just) privacy, you may want to look at one of the companies like Silent Circle or Copperhead doing secure versions of Android that get updated, or just get a Nexus/Pixel and de-Google it yourself. Again, it depends on who you want to trust.

Keep in mind most of what I suggested doesn't really help "usability", depending on what you mean by that. There's a risk of trading away security for privacy, too: if you root and have an unlocked bootloader, you have to be careful about the apps you install and also have to carefully control physical access to your phone (e.g. don't go plugging it into random chargers in public places, which you may want to avoid doing anyway).

 

[Oyeve]

Here's your secure network:

 

[core2slow]

You're better off using a dumbphone circa 2002. I think it's cute and all to try and circumvent big brother with mainstream devices and software (let's face it, if it's been discussed here there's a good chance that it's been compromised one way or another) so I wouldn't put too much faith in that. Govt agencies do contract 3rd party firm for data extraction (ever heard of Palantir?) so it's not always the first party (FB, Apple, Google, etc) who are doing the data mining, and these firms will sell their "big data" to the highest bidder. You either go off-grid completely or get a dumbphone if privacy is paramount to you. I wouldn't trust the silentOS or any 3rd party apps that promise safe keeping of user data.

 

[cytg111]

A custom, rooted Android ROM (anything close to AOSP on a device with good community support) with no GApps or Play Services, plus PMP or XPrivacy installed, as well as a firewall like AFWall+ enabled and configured. Install F-Droid and use APKMirror for alternative to Play Store and manual app installs. Install AdAway, and use Firefox with privacy control extensions (e.g. Ghostery, though you may not need it) and user agent spoofer. Disable scripting/use NoScript. Use a no logging VPN to encrypt your traffic.
...
Keep in mind most of what I suggested doesn't really help "usability", depending on what you mean by that. There's a risk of trading away security for privacy, too: if you root and have an unlocked bootloader, you have to be careful about the apps you install and also have to carefully control physical access to your phone (e.g. don't go plugging it into random chargers in public places, which you may want to avoid doing anyway).

I have used cyanogenmod before with delight, two things keep me from doing it again, 1. the ms deal and 2. as you point out, rooting is like opening the door, theres pros and cons.

There is no such thing as complete privacy of any phone system. That is why voice scramblers exist. Any signal emitted can be intercepted.
If one must protect data stored in a phone, the best answer is encryption or removable memory.

I am under no such illusion, I am not trying to evade NSA I am trying to restrict megacorporations from raping my privacy.

 

[cytg111]

You're better off using a dumbphone circa 2002. I think it's cute and all to try and circumvent big brother with mainstream devices and software (let's face it, if it's been discussed here there's a good chance that it's been compromised one way or another) so I wouldn't put too much faith in that. Govt agencies do contract 3rd party firm for data extraction (ever heard of Palantir?) so it's not always the first party (FB, Apple, Google, etc) who are doing the data mining, and these firms will sell their "big data" to the highest bidder. You either go off-grid completely or get a dumbphone if privacy is paramount to you. I wouldn't trust the silentOS or any 3rd party apps that promise safe keeping of user data.

Was actually contemplating on going retro with a

https://en.wikipedia.org/wiki/Nokia_3310

And dualwield some kind of phablet locked down with linux and only data over a VPN.

That is until I had to park my car in the city! Now I *need* an android / iphone / msphone, cause I *need* to use an app like parkman to pay for parking fees. I HATE it. We are getting gobbled up by this **** cause noone in office understands wtf is going on what they're handing over to bigcorps. No vision.
I would actually buy a NSA branded smart phone if they would promise to keep megacorps out of my business.

 

[lxskllr]

I rooted, and removed google from my phone as well as many samsung features. My primary security/privacy programs are afwall, adaway, autostarts, and firefox/addons.

Every cell phone is a tracking device. Smartphones can be tracked more closely, but they're all pretty easy to track. If it wasn't for work, I probably wouldn't have a phone, but mine's locked down to near dumbphone levels.

 

[Crono]

Was actually contemplating on going retro with a

https://en.wikipedia.org/wiki/Nokia_3310

And dualwield some kind of phablet locked down with linux and only data over a VPN.

That is until I had to park my car in the city! Now I *need* an android / iphone / msphone, cause I *need* to use an app like parkman to pay for parking fees. I HATE it. We are getting gobbled up by this **** cause noone in office understands wtf is going on what they're handing over to bigcorps. No vision.
I would actually buy a NSA branded smart phone if they would promise to keep megacorps out of my business.

I actually was planning on doing dual wield recently, but the tablet I picked up was unsuitable (kept running out of internal storage, even after moving everything I could to external), so I'm waiting for a good Nexus 7 successor to use with my hotspot. I have a feature phone that is a $20 card-sized phone off Amazon. Really neat as an emergency backup, since it uses very little power and I can charge it ~30 times off a 10,000 mAh battery, or pick up a small solar panel to keep it juiced in an extended power outage situation (Sandy was the last time that happened here).

T-Mobile is seemingly the only one keeping around the GSM bands that classic Nokia-type candybar or even newer feature phones use. I'm sure eventually it will be very difficult to use them on any of the networks here in the U.S.

 

[cytg111]

Really neat as an emergency backup, since it uses very little power and I can charge it 15-20 times off a 10,000 mAh battery, or pick up a small solar panel to keep it juiced in an extended power outage situation (Sandy was the last time that happened here).

- That is another great point! Older generation of phones had battery life like no tomorrow(...) and a small solar panel would be enough to keep it juiced.

 

[bononos]

Personally I think that it's futile to use a smartphone and expect your data not to be seen by the people who provide services on that smartphone.
........

Thats defeatist talk. Theres a fight going on with the FCC trying to enact better privacy laws on broadband internet.

The idiot GWB back in 2002 appointed corporate friendly hacks to run govt departments who reduced or drew back from sensible regulations. Michael Powell headed the FCC which ruled that internet providers and mobile carriers could be allowed to snoop on broadband data (like Verizon's http tracking in the link below) unlike phone lines which were protected under law so carriers can't eavesdrop on people's calls.
https://www.cnet.com/how-to/how-to-opt-out-of-verizon-supercookie-tracking-program/

Buying a non-contract phone from a decent brand I think would ensure that that phones don't come packaged with rootkit monitoring software like Carrier IQ which can spy on user http data. Chinese phones are notorious for their spy-adware.
https://www.cnet.com/news/android-researcher-carrier-iq-diagnostic-tool-really-a-rootkit-spy/

I still use google playstore but I make sure to only install reputable apps and then use a combination of privacyguard and xprivacy. But even if you don't have privacyguard/xposed-xprivacy, Android 6.0 and above should allow you to manually set permissions when you run an app since the permissions are not automatically granted at installation anymore (I think its similar to how Apple handles app permissions).

 

[Commodus]

Me, I just couldn't live that ultra clamped-down mobile life. Yeah, get the unlocked phone (or any iPhone) if you want to avoid Carrier IQ. Don't sign into services you don't care for. But the notion that it's all over the moment someone signs into Google or shares their location? It starts to get claustrophobic after that. At a certain point you have to live your life, not live in fear.

 

[Kazukian]

The next round of changes will be AI, and that will involve massive amounts of personal data.