My lawyer told me to get Signal for communications, however, if im using a regular phone (particularly, I have an S26 Ultra) should I expect any privacy?
Even if Signal is supposed to be open source and overall great for privacy, what’s the point if the phone has all sorts of bloatware with closed source elements on it? Not to mention it may have stuff hardware wise spying on you. Should I assume that anything I type or talk on a call is potentially being stored and sent somewhere even if through Signal?
I should have done more research before buying the phone as I thought I could format it and install GrapheneOS which apparently it’s a must to get any privacy.
In this context, is there anything I can do to have private conversations? I cannot buy another phone at the moment. Someone mentioned there “Android debloater”. I will look into that. I am as well going to use some open souce keyboard on the Play Store such as Simple Keyboard or FUTO. I need to look into GrapheneOS long term, to also avoid when Google starts screwing up with apps next year:
As far as IP, im not using a VPN. Theoretically if Signal works as intended, even if ISP knows im using Signal, there would be nothing to find as we would be either talking or using temporary chats with no backups enabled.
But for now it is what it is and would need to improve this setting as much as possible.
Depending on your situation and without knowing your restrictions, but if you must use signal to communicate let’s say with your lawyer and you know that you have bloatware which might spy you on.
You could encrypt your messages, then send it as is to your lawyer and give the keys to decrypt the messages in real life to the lawyer. Never storing the keys in phone and having it on the paper
This might be far fetched but I wanted to share this idea incase it could help you
Not sure how this would work in practice, the idea is to have a fluent conversation. I was looking at SimpleX which can work from a laptop, however I cannot find a way to have temporary messages that self-delete faster than 1-week which is kind of ridiculous. Signal allows 30 seconds which is great, but you are forced to have your conversations run through a phone. Even if you install it on the safest laptop ever, any chats are also sent to your phone, at least for these 30 seconds, assuming they are properly permanently deleted.
Changing to an open-source keyboard is already a good step. Debloating is too. Remember that in Signal’s settings you can toggle the option to ask your keyboard not to do typing learning from the things you type into Signal. You could enable that too.
I’d say one of the most critical permissions is the “Draw over other apps” permission in this situation. That one allows apps to see which part of the screen you’re touching. And since your keyboard is in a standard place with a standard configuration… Any app with that permission could see what you type in real time even if you have another app open. Are they doing that? That’s another question. But do you want to take that chance? That’s your call. I personally wouldn’t.
I’m not sure where it’s located in the Samsung variants of Android, but you should definitely find it somewhere in the settings. I’d recommend reviewing that permission from every single app that doesn’t absolutely need it (basically none actually do). Remember to check the system apps too since Samsung & Google have their bloatware partially installed as system apps, which could also have the permission to draw over other apps.
Other than that, being stuck on a “stock” Android is pretty much a privacy nightmare in general.
I mean disappearing messages from both ends, and as far as I can tell, I cannot find an option to enable it faster than 1 week. This means it would take an entire week for the messages to be deleted. I think it can be set to 1 day but only for you end. I don’t get it.
As far as the Saumsung account, the Samsung stuff I use is for Fingerprint storage thing, and Samsung Health to monitor my walking activity. Im sure there are better options but I was lazy when setting things up. As far as Google, I need to be on a YouTube account sometimes, so im not sure how I would do this if I delete the entire Google thing. I also like some apps that are on the Google Store. It’s really hard to really get full privacy in phones.
I have a really old Samsung phone, not sure if I could use this one for a privacy friendly OS? I remember reading something about LineageOS or something. Is this not good like Graphene? I could use the older phone for privacy stuff and leave the modern phone for the rest.
Signal, WhatsApp, telegram or whatever that uses phone number is not safe at all. In Germany the authorities have access to your provider sms messages. Signal uses sms to verify/login to your account. If you have access to the provider sms messages and know the phone number used to login, you have access to the account.
Any communication program that doesn’t use sms to verify access is safer.
for deleting messages, maybe you have to delete the messages manually in SimpleX
There is another app called Skred from switserland. No phone numbers, see if they have auto-message deleting.
I have enabled registration lock but im not sure if I get how it works. It means that if someone attempts to register the number they cannot do it without this password?
But there’s something about this 7 day block thing here:
How do I manage or change the registration lock option?
Enabling a registration lock triggers a 7-day inactivity timer if your number is registered on another device.
On a registered and active version of Signal on your phone, go to Signal Settings > Account> to enable or disable.
When does the registration lock expire?
Registration Lock expires after 7 days of inactivity.
After 7 days of inactivity, a new PIN can be created. The old PIN and information associated with it are no longer available.
What does this 7 day thing even even mean?
I see two ways someone could have access to your Signal account:
You lose your SIM card, and they successfully register it in another phone. This means that they know the registration lock I assume (thats the point). But whats the point with the 7 day timer here? what inactivity?
You lose your phone because you stop using it (possible if prepaid SIM card phone that requires to be charged every x months to keep it active, sometimes it has happened to me that I forgot to rechard a prepaid card and lost the phone number) and then this number becomes availible again eventually and someone registers a Signal account with that same phone. If th 7 day inactivity thing means what I think it means then it would be useless since more than 7 days would have passed since you lost the phone number.
Honestly using phone numbers is so incredibly dumb for privacy. We should just need a strong password and that’s about it. It almost makes you think all these “enter your phone here bro” apps are gov plants software or something.
Are these 2 step verifications turned on by default? What percentage of these people have it turned on? LinkedIn also uses sms by default to verify you.
> Account> to enable or disable.