I cannot get a Pixel phone at the moment and installing GrapheneOS is a bit hard for me (plus it is useless as I cannot have a phone that supports it).
I got a new Samsung phone recently and I started debloating it using ADB. However since I cannot install a new OS anyway, I am stuck with Android/OneUI. I have deleted most Samsung/Google apps and stripped down to basics: phone, contacts, camera, settings, etc.
I cannot escape Google Play Services as most apps would break making the phone unusable. That said I registered a Google account using an alias and fake details to install apps, but I am afraid Google still tracks my downloads, app usage, device information, and possibly network information. I have downloaded some apps that I shortly uninstalled because upon researching they collect a lot of data that pose a risk to my privacy. By simply using Google this way have I already been compromised?
I am mostly using this phone to browse the internet as anonymously as possible without using Tor (too slow and gets flagged), and Pixel or GrapheneOS. I don’t plan on using it for communications or social media at all besides only Reddit (I don’t use Facebook or Instagram or other big names). I don’t have a sim card plugged in either. I connect to a home wifi that has many users. I am generally careful of what I share online.
I have switched to Proton Mail, Lumo AI, and Brave. I use VPN consistently on this phone to avoid my ISP/government seeing websites I browse. I use a password manager. I use the browser to access Reddit and other forums/websites only.
My threat model includes my ISP/government from seeing my activity. Am I doing enough? What other ways am I missing? Please share. How do I become as anonymous as possible without the usual recommendations? I’m a casual user trying to manage my digital privacy and security better.
That’s a good start. You can check out replacing the stock apps with privacy-respecting FOSS alternatives next since you’re clearly comfortable using ADB.
I’m sorry to tell you but it’s doing just that. Having the Google Mobile Services suite, i.e. Google Play Services & the Google Play Store on a device by default on a “stock” Android pretty much means they’re installed as privileged system apps; as in, they can & do get a lot of access to your information you simply can’t block without uninstalling them completely.
It depends on what you mean by “compromised” in context. If you mean “Google already having figured out who you are,” then maybe, maybe not. But if you mean “Google is already tracking you,” then the answer is yes because they track everything everyone does on every platform they control. Or do you mean someone else is aware of something about you? The answer will depend on what you actually consider as “compromised.”
A reputable & properly used VPN is usually more than enough to block one’s ISP from snooping in. You’re on good track with that one.
The goverment snooping in is another can of worms. Are you speaking of the goverment passively hoarding all of your data via ISP data colletion? Or are you worried about the NSA personally coming after you? Because the two are vastly different threat models. I’m not asking to mock, but for clarity; the clearer the threat you want to defend against, the more focused & effective methods of defense you can deploy without wasting resources.
Privacy is an active process, not an achievement. Today’s “enough” might be tomorrow’s “lacking.” The important thing is that you’re interested in these topics & willing to work for them over time. In the end, that will carry you far. Being in here & asking questions alone shows motivation.
As said by @user1, go look at the wiki & start there. And then search the forum on the things you’re most interested in. When you’ve got questions, ask them. The community is here to help. You got this.
Even with GrapheneOS you wouldn’t be anonymous if your mobile plan is tied to your identity, this includes giving out your real phone number to anyone. Bluetooth could be another way to uniquely identify phones. You won’t be very anonymous while browsing the internet either as it’s likely websites can fingerprint you fairly well. The Tor Browser could mitigate some of that but you’re better off using Whonix or Tails if you truly needed to maximize anonymity.
Unless you are a special target, using a decent VPN service is probably a great compromise for your situation if you’re finding that Tor is too annoying. Just don’t expect a high degree of anonymity with this setup.
You could use this phone without a google account. Do you have a lof of apps you need to use ?
I have a samsung phone with no google account (never had), I have install Fdroid for most apps, if one is not available, I use Aurora Store (install throught Fdroid) to fetch the app from google play store withou having to use the official playstore(or logged in).
Using this method, only one app was not working because when started it requested payment info verification through app store.
This method could be your next step to improve your privacy, dont use a samsung and google account.
PS: you will still be able to get playstore updates for google applications that are factory installed.
Government level threats are a whole other ballgame, so I’d like to ask if you are thinking of targeted government activity, or more-so general mass surveillance. I’d recommend reading some of the PG threat modelling and common threats. I also made an example threat modelling process which you could follow to see if your current actions meet your goals, and you could post areas you are uncertain of.
