# Mobile privacy **URL:** https://discuss.privacyguides.net/t/mobile-privacy/16446 **Category:** Questions **Created:** 2024-01-24T19:03:15Z **Posts:** 39 ## Post 1 by @pikacho — 2024-01-24T19:03:15Z Hi! I have only android devices (tablets, phones), no laptop or PC (it is inconvenient for me). So, can you please recommend the best must have solutions for better android privacy? Orbot, Signal, SimpleLogin, Proton suite, degoogled OS (via ADB) is enough? Or better use `crapmail.org` (for temporary use) and `altmails.com` alias services? Both free and don’t require any registration. Also there is `dropmail.me` disposable email service that provides forwarding, but it is not convenient (but you can use something like “directory” feature in SL for free (example: `mail@dropmail.me` = `mail-anything@anything.dropmail.me`)) --- ## Post 2 by @anon29374801 — 2024-01-24T19:11:48Z > [@pikacho](#): > > So, can you please recommend the best must have solutions for better android privacy? The number one thing you could do is switch to Google Pixel [devices that support Graphene OS](https://grapheneos.org/faq#supported-devices) For you that would be the Pixel 6 or better, preferably Pixel 8 for phone and the Pixel Tablet. --- ## Post 3 by @vergeOfNormy — 2024-01-24T20:31:46Z > [@Mobile privacy](https://discuss.privacyguides.net/t/mobile-privacy/16446/2): > > The number one thing you could do is switch to Google Pixel [devices that support Graphene OS](https://grapheneos.org/faq#supported-devices) For you that would be the Pixel 6 or better, preferably Pixel 8 for phone and the Pixel Tablet. Depending on your needs the Pixel #a models are less expensive… I recommending getting a lot of storage if you plan to be a power user. If you go down the Fdriod/FOSS rabbit hole, theres a lot of things you can do with grapheneOS that you cannot do with proprietary OSs. --- ## Post 4 by @Satoshi — 2024-01-25T02:35:12Z It’s gonna suck installing GrapheneOS without a laptop or PC :joy: --- ## Post 5 by @FlipSid — 2024-01-25T03:58:40Z No it wont. Installing was a breeze on my Pixel 7 Pro. Guess what I used? Moto G100 :slight_smile: Which is not a pc or laptop > **[GrapheneOS web installer](https://grapheneos.org/install/web#prerequisites)** > > Web-based installer for GrapheneOS, a security and privacy focused mobile OS with Android app compatibility. --- ## Post 6 by @pikacho — 2024-01-25T17:06:28Z > [@anon29374801](#): > > Google Pixel I don’t trust google at all. Even if it is good device, I still not believe that they have no hardware tracking capability (yeah, I am paranoid a little bit) > [@Satoshi](#): > > GrapheneOS without a laptop Not Graphene, but Lineage OS. Through TWRP. --- ## Post 7 by @exaCORE — 2024-01-25T17:09:46Z > [@pikacho](#): > > hardware tracking capability There is no evidence to support this. --- ## Post 8 by @anon29374801 — 2024-01-25T17:12:18Z > [@pikacho](#): > > I don’t trust google at all. While I disagree with your reasoning and strongly suggest you do some research I would never advocate for you to buy products you do not trust yourself. > [@pikacho](#): > > Not Graphene, but Lineage OS. Through TWRP. While LineageOS maybe a nice OS to keep an EOL phone going it [is not great for privacy or security.](https://www.kuketz-blog.de/lineageos-weder-sicher-noch-datenschutzfreundlich-custom-roms-teil4/) > Overall, LineageOS leaves neither a privacy-friendly nor really secure impression. This is mainly due to the following points: > > - Despite not using Google Play Services, LineageOS is closely linked to Google services > - Delayed delivery of (security) updates > - Older devices do not receive full security updates from proprietary components such as bootloaders or firmware > - No [Verified Boot support](https://source.android.com/docs/security/features/verifiedboot) > - The quality of LineageOS on a particular device is significantly influenced by the skills and dedication of the maintainer --- ## Post 9 by @pikacho — 2024-01-25T17:17:50Z > [@exaCORE](#): > > There is no evidence Agree, but as I said I am a little bit paranoid :sweat_smile: > [@anon29374801](#): > > closely linked to Google services It is cleaned with special patch ([hosts mod](https://gist.githubusercontent.com/unixb0y/4973fece2d5099bd53143a18a54318f3/raw/3254ebe6ebfcf1c9549d39999ed8f5e98e30e4da/hosts) to block all google domains) --- ## Post 10 by @Equinox — 2024-01-25T17:33:40Z Just wanted to add to the list that AdGuard recently launched their own [disposable mail service](https://adguard.com/en/adguard-temp-mail/overview.html). --- ## Post 11 by @pikacho — 2024-01-25T17:37:03Z > [@Equinox](#): > > AdGuard recently launched their own [disposable mail service](https://adguard.com/en/adguard-temp-mail/overview.html) Looks good. Will take a look :slight_smile: --- ## Post 12 by @sha123 — 2024-01-28T17:22:51Z > [@pikacho](#): > > I don’t trust google at all. Even if it is good device, I still not believe that they have no hardware tracking capability (yeah, I am paranoid a little bit) Pls focus on actual threats, not some hypothetical ones. Google Pixels are the most researched Android devices, because they are the reference and development devices for Android. All other mobile devices and the available OSes for them have partially serious security and privacy drawbacks, which are evident. Contrary to your conspiracy thinking about hardware tracking, which very likely would have been discovered by now and only used on super high-value targets and for sure not for mass tracking or on some privacy enthusiasts. --- ## Post 13 by @pikacho — 2024-01-28T18:09:26Z > [@sha123](#): > > Pls focus on actual threats, not some hypothetical ones I know, but this company not trustworthy for me. My solution is harden device via ADB (or flash Lineage OS) and avoid revealing real IMEI (not using any cellular data on phone). Instead I am using [Canta](https://f-droid.org/packages/org.samo_lego.canta/)with [Shizuku](https://shizuku.rikka.app/download/) to remove all bloatware, [This router](https://www.gl-inet.com/products/gl-e750/). (OpenWRT powered) that supports SMS to register where I need number and [this software](https://github.com/srlabs/blue-merle) to change unique information. I like giving [this](https://yopmail.com/) adresses (they are nearly permanent, to avoid hajack use their alias feature and unique username) for people I don’t trust. I can reply from it, even forward to real address if something important Yopmail have new domain every day, but if even that domains won’t work (AKA whitelist) you can use [this](https://smailpro.com/advanced) (temp Gmail or Outlook addresses, no registration) Also never reveal real email address (only alias) even for that things that I need constantly. I know that aliases can be blocked so in this situation user should contact alias provider support (they will contact website that blocking aliases and ask them to unblock). For SL [here is](https://simplelogin.io/docs/report-blocking-website/) official manual. This will help community not to have such issues in future. So if short: Use 4G mobile router to have cellular features with random data not to be traced, use only Singnal and Telegram (unfortunately many people use it and I can’t quit it), no voice calls, no SIM in phone --- ## Post 14 by @sha123 — 2024-01-28T18:41:08Z > [@pikacho](#): > > My solution is harden device via ADB (or flash Lineage OS) You can’t harden an OS via ADB in a meaningful way and LineageOS has quite a few security problems. > [@pikacho](#): > > I know, but this company not trustworthy for me. Most other smartphone hardware vendors are less trustworthy in terms of security practices, supply chain security and even privacy practices. --- ## Post 15 by @Sharply — 2024-01-28T18:45:07Z Since you’re not willing to get a Pixel, have you looked into [DivestOS](https://divestos.org/) and any of their supported devices? DivestOS is significantly more private and secure than LineageOS or most other Android OSes out there, and supports more than just Pixels. Like others have pointed out, LineageOS is far from ideal in terms of privacy and security, and I do believe an OS like Divest would be a better fit. I’m really cautious to recommend degoogling with ADB, as thanks to [Project Mainline](https://www.androidauthority.com/project-mainline-art-android-12-1202045/), a lot of system updates are now done through Google Play Services. Missing out on updates like this will reduce your security pretty heavily unfortunately. Like @sha123 said as well, debloating with ADB also just can’t magically harden an OS or fix all privacy and security issues of an OS. --- ## Post 16 by @pikacho — 2024-01-28T19:22:36Z > [@sha123](#): > > Most other smartphone hardware vendors I know but [this](https://github.com/seanpm2001/Why-you-should-stop-using-Google-Pixel) and [this](https://github.com/seanpm2001/Why-you-should-stop-using-VirusTotal) articles (there are many more articles about that, but these are the most short ones) and [this hosts](https://gist.githubusercontent.com/unixb0y/4973fece2d5099bd53143a18a54318f3/raw/3254ebe6ebfcf1c9549d39999ed8f5e98e30e4da/hosts) file you are more safe than without it. > [@Sharply](#): > > have you looked into [DivestOS](https://divestos.org/) and any of their supported devices Just looked. Good one. I will dig into that. > [@Sharply](#): > > lot of system updates are now done through Google Play Services What are they updating? I don’t use any google software. Also there is [Obtanium](https://github.com/ImranR98/Obtainium) to make updates easier. --- ## Post 17 by @sha123 — 2024-01-28T19:52:20Z > [@pikacho](#): > > I know but [this](https://github.com/seanpm2001/Why-you-should-stop-using-Google-Pixel) and [this](https://github.com/seanpm2001/Why-you-should-stop-using-VirusTotal) articles (there are many more articles about that, but these are the most short ones) What is this nonsense? --- ## Post 18 by @Sharply — 2024-01-28T20:18:40Z > What are they updating? I don’t use any google software. You can read [this](https://www.esper.io/blog/what-is-project-mainline) for more info and details about Mainline, but it’s updating important system components. These are just taken care of by system updates on other OSes like Graphene, Divest, and Lineage, but on stock Android, they’re covered by Google Play. Not getting these updates can leave you pretty vulnerable. > Also there is [Obtanium](https://github.com/ImranR98/Obtainium) to make updates easier. You can’t update them with Obtainium unfortunately, the only way to on Stock Android that I’m aware of is through Google Play. --- ## Post 19 by @exaCORE — 2024-01-28T22:20:47Z > [@pikacho](#): > > Just looked. Good one. I will dig into that. DOS is literally recommended by PG… --- ## Post 20 by @dngray — 2024-01-29T02:53:44Z > [@sha123](#): > > What is this nonsense? It’s exactly that. None of the sources this user provided supported their argument. > [@vergeOfNormy](#): > > If you go down the Fdriod/FOSS rabbit hole, theres a lot of things you can do with grapheneOS that you cannot do with proprietary OSs. Keep in mind also [more of the Pixel](https://source.android.com/docs/security/features/trusty) is actually open source than on some other handsets > Trusty is being provided to its partners as a reliable and free open source alternative for their Trusted Execution Environment. Trusty offers a level of transparency that is just not possible with closed source systems. > [@pikacho](#): > > I don’t trust google at all. Even if it is good device, I still not believe that they have no hardware tracking capability So basically a threat model based on FUD okay. > [@pikacho](#): > > It is cleaned with special patch ([hosts mod](https://gist.githubusercontent.com/unixb0y/4973fece2d5099bd53143a18a54318f3/raw/3254ebe6ebfcf1c9549d39999ed8f5e98e30e4da/hosts) to block all google domains) Meanwhile you do nothing about other 99999 companies far worse than google. This is why the whole degoogle movement leads to a weirdo threat model that makes no sense whatsoever because of the hyperfocusing on a single company. The question really is how far do you take it, originally degoogling literally referred to just getting rid of gmail and using an alternative search engine, that made sense as those things **are** primarily funded through adsense etc. As usual we recommend people read the terms and conditions of the actual product they’re using regardless of where it comes from. Lastly `hosts.txt` should not be used for blocking anything that is not, and [was not it’s purpose](https://en.wikipedia.org/wiki/Hosts_(file)). Editing that file usually requires root, which means whatever you use to edit it, you need to be sure doesn’t have [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation) vulnerabilities that can be used to edit other files. Also as Android is an immutable OS, this file is on your system partition ie in `/system/etc/hosts` which means it won’t be persistent if you’re doing [dm-verity checks](https://source.android.com/docs/security/features/verifiedboot/dm-verity) on boot. So in an effort to “degoogle” you’ve made the whole security model of your handset a fair bit weaker. Remember not gaining root, is a bit part of what keeps the [SELinux](https://source.android.com/docs/security/features/selinux) policies intact and sandboxing your apps. Google goes to a lot of effort to make sure things don’t run as root, unless absolutely necessary, in fact there is only about 6 processes that [run as root](https://source.android.com/docs/security/overview/implement#process-isolate). > - Devices should run the minimum necessary code as root. Where possible, use a regular Android process rather than a root process. The ICS Galaxy Nexus has only six root processes: vold, inetd, zygote, tf\_daemon, ueventd, and init. If a process must run as root on a device, document the process in an AOSP feature request so it can be publicly reviewed. --- ## Post 21 by @pikacho — 2024-01-29T22:32:13Z > [@dngray](#): > > `/system/etc/hosts` Not here. You can use something like [this](https://f-droid.org/en/packages/com.celzero.bravedns/) or [this](https://f-droid.org/en/packages/org.jak_linux.dns66/) solutions. Root really can make your security more weak. Personally I setup that hosts file on my Mudi router, so I don’t need to modify system partition via root. Also if someone runs Adguard home on Mudi (as plugin) or similar router I strongly recommend to install [this](https://phishing.army/download/phishing_army_blocklist_extended.txt) blocklist that will block phishing ([info](https://phishing.army) about it). > [@dngray](#): > > you do nothing about other 99999 companies far worse than google I blocked fully Meta, Google, Twitter and Microsoft servers (domains and IPs). Also I blocked some crap similar to booking[dot]com. > [@dngray](#): > > **are** primarily funded through adsense etc. This also blocked via Adguard Home on my Mudi and by adblock extension in my browser. --- ## Post 22 by @dngray — 2024-01-30T04:22:12Z > [@pikacho](#): > > Not here. You can use something like [this](https://f-droid.org/en/packages/com.celzero.bravedns/) or [this](https://f-droid.org/en/packages/org.jak_linux.dns66/) solutions. Root really can make your security more weak. Does that use your VPN slot though? > [@pikacho](#): > > Personally I setup that hosts file on my Mudi router, so I don’t need to modify system partition via root. That’s not really ideal when you’re not at home. > [@pikacho](#): > > blocked fully Meta, Google, Twitter and Microsoft servers I wonder how anything that uses GCP or Azure works then, or are you okay with half the internet not working. In any case there’s still plenty of smaller companies that are not household names, that nobody really talks about. --- ## Post 23 by @pikacho — 2024-01-30T07:09:08Z > [@dngray](#): > > Does that use your VPN slot though? Yes, that’s on of cons > [@dngray](#): > > That’s not really ideal when you’re not at home. I never connect to anything without Mudi. Firstly, I simply can use free Proton VPN plan to have VPN on many devices, secondly Mudi has some software that spoof my IMEI and MAC which will make me more anonymous. > [@dngray](#): > > half the internet not working Luckily, only few websites. As I see most websites working fine. Only reCAPTCHA not loading :sweat_smile: --- ## Post 24 by @dngray — 2024-01-30T11:18:44Z > [@pikacho](#): > > Mudi has some software that spoof my IMEI and MAC which will make me more anonymous. Unless you’re regularly changing the SIM and buying that also in a way that doesn’t lead back to you, I can’t really see that doing a lot. The SIM still has an ICCID that can’t be changed. It’s also not really gaining much anyway, as it’s not like the service provider can penetrate anything in the application layer or higher. If you used the Tor Browser they wouldn’t know much more/or less other than you’re using an internet connection to push some encrypted data. --- ## Post 25 by @pikacho — 2024-01-30T11:39:51Z > [@dngray](#): > > Unless you’re regularly changing the SIM By default IMEI in blue merle plugin switches only if SIM changes. I don’t need this type of configuration to even swap SIMs. This feature necessary to prevent another provider from registering me in logs if I am travelling for example. The main purpose of my Mudi is have VPN even on those devices that can’t have VPN setup on them (for example smart watch etc) and control traffic via firewall to reject everything that I don’t need now. For example block port 80 to force everything work only via HTTPS (it can be troublesome but I did not get much problems because of it) > [@dngray](#): > > If you used the Tor Browser I know. But I don’t want my ISP or even government know that I am using Tor. So OBFS4 moat + VPN on router to prevent DPI find out that that is Tor connection. --- ## Post 26 by @dngray — 2024-01-30T12:07:51Z > [@pikacho](#): > > This feature necessary to prevent another provider from registering me in logs if I am travelling for example. That’s fair I suppose, but they wouldn’t need to track you via IMEI when they can just track by the SIM. Unless you’re also going to the expense/extent of anonymously purchasing the SIM cards. > [@pikacho](#): > > The main purpose of my Mudi is have VPN even on those devices that can’t have VPN setup on them Fair usecase. > [@pikacho](#): > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/dngray/48/21_2.png) dngray: > > > If you used the Tor Browser > > I know. But I don’t want my ISP or even government know that I am using Tor. So OBFS4 moat + VPN on router to prevent DPI find out that that is Tor connection. That I suppose is a good idea, depending on where you are. --- ## Post 27 by @pikacho — 2024-01-30T12:18:37Z > [@dngray](#): > > they can just track by the SIM If I am abroad I just purchase temporary SIM (roaming is expensive btw). So this is really important not to link my real SIM with temporary one. --- ## Post 28 by @Sand — 2024-01-30T19:48:18Z > [@pikacho](#): > > Orbot, Signal, SimpleLogin, Proton suite, degoogled OS (via ADB) is enough I recommend you not to use Signal. Maybe it will sound mad but it requires phone number. Telegram support anonymous number (only ans login, it is **not** real number) and usage only username. Here is link (not clickable not to be an ad): ``` https://fragment.com/numbers ``` Signal [wants to add usernames](https://community.signalusers.org/t/public-username-testing-staging-environment/56866) but it will also ask for phone number. Personally I recommend following: - Never reveal phone number. Period. - Never reveal real mail - Never reveal real information about yourself About Signal. As I read, you are using router that supports SMS receive/forward so for you Signal probably will not be a problem. But keep in mind that it requires phone number and using Amazon services wich will probably make you less private (IP revealing to not really private corporation) Also, there is [an incident with Twilio](https://support.signal.org/hc/en-us/articles/4850133017242-Twilio-Incident-What-Signal-Users-Need-to-Know) that affected Signal. Twilio also owns Authy which has a lot of privacy issues. Instead use Wire (Signal protocol, but registration via Email) or Telegram via anonymous phone number (keep in mind that you must **not** send anything private in Telegram unless you’re using secret chat) --- ## Post 29 by @anon29374801 — 2024-01-30T20:10:48Z > [@Sand](#): > > I recommend you not to use Signal. Maybe it will sound mad but it requires phone number. Telegram support anonymous number (only ans login, it is **not** real number) and usage only username. Even if you do not like Signal, you should consider one of the other [encrypted messengers](https://www.privacyguides.org/en/real-time-communication/) instead of Telegram. While the secret chats are E2EE [Telegram communications may be exposed in channels, groups, and chats.](https://www.eff.org/deeplinks/2022/03/telegram-harm-reduction-users-russia-and-ukraine) > [@Sand](#): > > Personally I recommend following: > > - Never reveal phone number. Period. > - Never reveal real mail > - Never reveal real information about yourself Ahh yes, never reveal any information about yourself, so simple…How is this not the only thing in the recommendation page? :roll_eyes: --- ## Post 30 by @pinkandwhite — 2024-01-30T23:16:53Z I genuinely don’t understand the snowden larpers who recommend Telegram. it _screams_ of a confused and nonsensical threat model if it exists. This may be harsh but if anyone criticises Signal solely on the phone number req, but says zero about metadata (which most other messengers are worse on), they’re just spreading bs – like, telegram doesn’t even have e2ee across all chats, let alone protecting metadata in any way like sealed sender is designed to do. Even a matrix chat would be better at that point (just kidding, state resets exist lol) --- ## Post 31 by @pikacho — 2024-01-30T23:30:54Z > [@pinkandwhite](#): > > I genuinely don’t understand the snowden larpers who recommend Telegram. it _screams_ of a confused and nonsensical threat model if it exists. Me too. Signal for now is one of the most trustworthy app which is fully open source and doesn’t have any commercial crap. > [@pinkandwhite](#): > > the phone number req For now the only issue with Signal is that I can’t hide my number from other users. But it seems they working on solving this. --- ## Post 32 by @exaCORE — 2024-01-30T23:55:26Z > [@pinkandwhite](#): > > (just kidding, state resets exist lol) Isn’t that only an issue for very large rooms where huge numbers of people use the [matrix.org](http://matrix.org) homeserver? --- ## Post 33 by @pinkandwhite — 2024-01-31T04:21:20Z yeah pretty much; if you’re just using it for direct messages, all you’ll run into is `failed to decrypt message` randomly --- ## Post 34 by @dngray — 2024-01-31T04:39:20Z Have been using it a lot these days that’s pretty rare to the point where I can’t remember when it last happened. --- ## Post 35 by @pinkandwhite — 2024-01-31T04:40:28Z I’m in an encrypted group chat with like 10 people active, it happens like once a week for me LOL --- ## Post 36 by @exaCORE — 2024-01-31T05:04:54Z > [@dngray](#): > > Have been using it a lot these days that’s pretty rare to the point where I can’t remember when it last happened I haven’t seen it in a while either --- ## Post 37 by @skg574 — 2024-02-13T15:56:26Z Do you have Termux installed? If so, look into proot-distro and set up a proot linux desktop within Termux. I did write a basic bash script some time ago that automates a proot debian XFCE install with libre office, vscode, firefox, and other utils. I think I posted it to r/termux. Anyway, proot-distro isnt that difficult. --- ## Post 38 by @November — 2024-02-13T17:01:20Z > [@skg574](#): > > If so, look into proot-distro Oh, I was looking for something like that. Can you share more information? > [@skg574](#): > > basic bash script Can you share it? Hope this will make everything easier :slight_smile: > [@skg574](#): > > proot-distro isnt that difficult I know that, but I never thought about installing it. 125/8 will be enough memory? --- ## Post 39 by @skg574 — 2024-02-14T23:39:25Z Yes, that is enough memory. It works well as a laptop replacement for basic things, but you won’t be 3d rendering or anything like that. I don’t think I am allowed to post a link, but if you send me an email to my username here at [codamail.com](http://codamail.com), I’ll pass it on to you. There are some caveats to proot, mainly that web browser and vscode sandboxes need to be disabled, which my script does, that reduces your security.