Hello guys. I recently acquired a Pixel 8A and it was Google stock os I bought it from a man locally all with cash I brought It home and I flashed grapheneos onto this phone.
What else needs to be done to anonymous this phone and make it a privacy phone and a spy free phone no tracking phone no interception phone and no monitored phone.
Any advice welcome!
Thanks.
Start with the basics. Use a VPN preferable a good one payed in crypto /XMR or cash. Use Foss apps only check out F-droid.
Also one that blocks malware and ads. If not use adguard.dns or other that filter traffic
Settings , disable 2-3 G if you always have access to 4-5 G .
Don’t change add browsers use vanadium. No gapps obviously.
The more challenging is to just use it as WiFi phone without SIM.
Vanadium doesn’t have good/any fingerprinting protection. Cromite or Mull would be better, Tor would be best.
Why would you use Chrome webview plus something else? You can’t replace just pile on. Not a good idea. https://grapheneos.org/usage#web-browsing
Dont use system webview as your default browser. Webview is used by apps, your browser can and should be changed if privacy is your goal. Vanadium may be hardened, but it lacks any fingerprinting protection.
Vanadium is purposefully made this way. It tries to minimise profiling by making your actions noise in a big mass of users. That only works if you use the standard config without anything to discern you.
Mull is the other extreme of this. They try to eliminate fingerprinting by reducing the amount of trackable things in your browser.
It’s hard to say what really is the better option. You can’t completely eliminate fingerprinting, and the more you try, the more you will stick out of the masses.
You can’t blend in with a crowd of vanadium users with the amount of data points given away by the browser. Your fingerprint will be decernable from other users. Without actual anti-fingerprinting, which theoretical can allow for a crowd only when fingerprinting of user browsers results in the same fingerprint ID, the best you can hope to do is thwart naive fingerprinting. Vanadium doesn’t have any anti-fingerprint built in, so the slightest differences between user can be used to easily fingerprint. Vanadium also has no strong method of in browser content blocking (eg an adblocker like uBlock) which is required on the modern web to remove JS tracking scripts (or straight allow and deny lists for specific web contents). Adblock is cyber security: https://www.ic3.gov/Media/Y2022/PSA221221
Examples of metrics include, but are not limited to, the following: Timezone, system and browser fonts (often automatically fetched by websites as a remote font that is cached by the browser), language, screen metrics (DPI, height x width, refresh rate, pixel ratio), canvas, CSS fingerprint, useragent, browsing mode (standard/private), video autoplay policy, audio device fingerprinting, installed plugins, cookie policy, device theme, and of course IP.
As a graphene OS vanadium user, assuming that the browser stays default, you would still have screen, audio, other hardware metrics, canvas (this one is a killer), IP, user agent (differences in installed versions of plugins and vanadium itself), timezone, remote Fonts, and others. Fingerprinting is an insane science which needs actual protection against to even begin hoping to create a crowd.
See some more details below.
Info on fingerprinting (about choosing a desktop browser but still relevant info): https://www.privacyguides.org/en/desktop-browsers
Browser comparison: https://divestos.org/pages/browsers
Fingerprinting test site: https://abrahamjuliot.github.io/creepjs/
I have a sim card in this phone. The sim card is one I heavily rely on. I have disabled the option for disable 2G in sims is this good? Even without the LTE mode as my phone doesn’t seem to have this.
I don’t have any crypto / XMR and in this case, shall I just set the DNS you recommended me without any VPN and just always use that? Thanks.
I used adguard.dns before now I have VPN that have DNS filter. Disabling 2-3g minimize attack surface but just a small thing use 3 g if you need it. You can use both private DNA in settings and a free VPN if you want.
Are you recommending I change Preferred network type " to 3G? other options are 4G only 5G ( recommend ) 4G if I use that DNS with what VPN u recommend, and have allow 2g disable am I good?
I use TrackerControl (f-droid).
It’s an app that can turn off entirely internet access to an app or granurarly tweak which domains can comunicate with.
I’m going to pivot this answer, to the more general: what’s good data hygiene for my phone?
No specific threats, but what’s the easiest things I can do to regain as much privacy and autonomy as possible.
Using graphene OS is great, good job.
Using always on VPN, like mullvad.
Set up a work profile, and install Google services inside the work profile, you can use shelter to do this. Then anything you need that requires Google, like Google maps, Uber, Lyft you can use it from that profile.
Use a secure messenger like signal, or simple x, with your friend group. To prevent metadata and unencrypted cell phone calls from leaking
I highly, highly, highly recommend you read privacy guides https://www.privacyguides.org/en/
People keep talking about threat models, that’s an important exercise for everyone to do eventually. Figure out who your adversaries are what the downsides of them discovering information is and how much effort you’re willing to put into prevent that.
For instance, keeping your phone private from snooping roommates fairly easy. Little bit of effort has good dividends
Being a whistleblower, much more difficult, depending on who your adversary is they could use a lot of asymmetric resources. Boeing has a tendency for their whistleblowers to become suicidal, through some means. And if that was your scenario, you’d have to be very careful.
But the biggest threat of all, the absolute worst threat you could ever face with technology, is a bored battle buddy working in signals intelligence… There is no law, there is no restraint, there is no safety… They will find your s***, and they will embarrass you.
If you want to be sure you cant be tracked, monitored, spyed on, and calls can’t be intersepted:
Don’t ever connect it to WiFi and don’t insert a sim card.
Graphene or not, your ISP can still share your position or other meta data with government and stuff (in the us they can also be forced to not tell you) - in some countries they legally sell to third party’s, in some probably illegaly
Calls are normally not encrypted so the os doesn’t matter as much if its the government who can force your ISP or if someone is skilled enough for a Man in the middle attack.
Android is a highly complex system, it will never be 100% safe.
If you just want to decrease spying by companies and less powerful people:
Use neo store or fdroid (no google play or aurora) as all apps there are Foss
Don’t install gapps or any other google services/packages
Use shelter for less trusted apps
Use netguard to block apps from accessing the internet
Physically block your cameras
If you want to be absolutely sure no one is recording audio: destroy mics with a needle and connect headset only when you need it
To only use communication apps which are encrypted and you hold the keys should be not needed to be said: matrix, signal, element, xmpp are good, (telegram (normal chats), Facebook, WhatsApp etc is a no go)
Don’t ever connect it to WiFi and don’t insert a sim card.
So… don’t ever use the Internet?
I think they are trying to illustrate the value of being explicit about your threat model.
So if your threat is the network, you can’t use the network. Because the original poster is so vague about what their actual threat is, it could be as simple as use Firefox and an ad blocker, or don’t connect to the network ever for any reason…
Plus: its google/us hardware. They could always hide something in lower level software like drivers or bios.
(Cant find the arricle i was thinking of, maybe false): It was recently discovered that snapdragons pinged their home server when turning on, which was not noticeable in android as it was on a deeper software level
