Hello guys. I recently acquired a Pixel 8A and it was Google stock os I bought it from a man locally all with cash I brought It home and I flashed grapheneos onto this phone.

What else needs to be done to anonymous this phone and make it a privacy phone and a spy free phone no tracking phone no interception phone and no monitored phone.

Any advice welcome!

Thanks.

  • SomeLemmyUser@discuss.tchncs.de
    link
    fedilink
    arrow-up
    31
    arrow-down
    1
    ·
    edit-2
    6 months ago

    If you want to be sure you cant be tracked, monitored, spyed on, and calls can’t be intersepted:

    Don’t ever connect it to WiFi and don’t insert a sim card.

    Graphene or not, your ISP can still share your position or other meta data with government and stuff (in the us they can also be forced to not tell you) - in some countries they legally sell to third party’s, in some probably illegaly

    Calls are normally not encrypted so the os doesn’t matter as much if its the government who can force your ISP or if someone is skilled enough for a Man in the middle attack.

    Android is a highly complex system, it will never be 100% safe.

    If you just want to decrease spying by companies and less powerful people:

    Use neo store or fdroid (no google play or aurora) as all apps there are Foss

    Don’t install gapps or any other google services/packages

    Use shelter for less trusted apps

    Use netguard to block apps from accessing the internet

    Physically block your cameras

    If you want to be absolutely sure no one is recording audio: destroy mics with a needle and connect headset only when you need it

    To only use communication apps which are encrypted and you hold the keys should be not needed to be said: matrix, signal, element, xmpp are good, (telegram (normal chats), Facebook, WhatsApp etc is a no go)

    • TrickDacy@lemmy.world
      link
      fedilink
      arrow-up
      21
      ·
      6 months ago

      Don’t ever connect it to WiFi and don’t insert a sim card.

      So… don’t ever use the Internet?

      • jet@hackertalks.com
        link
        fedilink
        English
        arrow-up
        22
        ·
        6 months ago

        I think they are trying to illustrate the value of being explicit about your threat model.

        So if your threat is the network, you can’t use the network. Because the original poster is so vague about what their actual threat is, it could be as simple as use Firefox and an ad blocker, or don’t connect to the network ever for any reason…

      • SomeLemmyUser@discuss.tchncs.de
        link
        fedilink
        arrow-up
        10
        ·
        edit-2
        6 months ago

        Exactly. If you want to be 100℅ sure you don’t get tracked AT ALL you can’t use the internet.

        The second you connect metadata is gained by ISP and all the servers which get called. This can be enough to track you down for powerful entities like the government.

        If only your aunt may with a evening school IT course is your threat, a pin and graphene os is probably enough

        Also OP mentioned his sim card is registered on his real life name, so having that connected to cellphones is enough to track you if you have a warrant to force your internet service provider to share the information

            • TrickDacy@lemmy.world
              link
              fedilink
              arrow-up
              1
              ·
              5 months ago

              Ah yes if they don’t specify that they understand that the Internet exists they need to be told it does

              • SomeLemmyUser@discuss.tchncs.de
                link
                fedilink
                arrow-up
                1
                ·
                5 months ago

                “What else needs to be done to anonymous this phone and make it a privacy phone and a spy free phone no tracking phone no interception phone and no monitored phone.”

                • TrickDacy@lemmy.world
                  link
                  fedilink
                  arrow-up
                  1
                  ·
                  5 months ago

                  Obviously they meant to the best of their ability. An air gapped device is clearly not what they wanted. If they did they wouldn’t have asked.

    • SomeLemmyUser@discuss.tchncs.de
      link
      fedilink
      arrow-up
      7
      arrow-down
      3
      ·
      edit-2
      6 months ago

      Plus: its google/us hardware. They could always hide something in lower level software like drivers or bios.

      (Cant find the arricle i was thinking of, maybe false): It was recently discovered that snapdragons pinged their home server when turning on, which was not noticeable in android as it was on a deeper software level

  • jet@hackertalks.com
    link
    fedilink
    English
    arrow-up
    15
    ·
    edit-2
    6 months ago

    First off, and most importantly, it is not an anonymous phone.

    The phone is tied to your location, your identity with your cell phone carrier, the IMEI, the IMSI, many identifiers you will not be able to change. From a threat modeling perspective, you cannot be attached to a network without tracking, interception, and monitoring.

    You can use your phone in a way to minimize third-party tracking, and unnecessary data leakage. You did a good job by installing graphene OS.

    Just be mindful of the applications you install on it, if you install sandbox Google apps, just realize Google will still have access to your location and push notifications etc.

    If your threat model truly includes not being observed, disable the cell phone part of the phone. Only use the phone via Wi-Fi. That’ll reduce a lot of the risk surface

    • Koolaid33@lemm.eeOP
      link
      fedilink
      arrow-up
      2
      arrow-down
      2
      ·
      6 months ago

      I have already inserted a sim card into this phone. The sim card is a kyc sim card. I want to do best I can without compromising my identity. My threat model does involve government interception and tracing, but it’s more about staying Safe with this phone whilst I’m possibly under surveillance. Local police entities. More so than government contractors / third parties. What is best VPN to use in this phone? I rely in the sim card in this phone so always keeping in aeroplane mode isn’t possible as this is my primary number and I need to have constant connection to it. In this case, what shall I do with this phone?

      • jet@hackertalks.com
        link
        fedilink
        English
        arrow-up
        9
        arrow-down
        1
        ·
        edit-2
        6 months ago

        https://www.privacyguides.org/en/vpn/

        Privacy guides is a great place to start. They have lots of advice on many things for your digital life.

        Running graphene OS is great. Just be deliberate about what apps you run. Use an encrypted messenger such as signal, or simple x, for your secure phone calls and messaging.

        Even if you used a SIM card, that you paid for in cash, with no KYC. You’re still not anonymous. If you use your SIM card at your house, the network operator will know that, and over a period of time will know where you live. Only so many people live there. They’ll know where you travel, they’ll know where you spend time, they’ll know when you make phone calls, and who you make phone calls too. That’s just the cost of being attached to the network

        So when people are telling you if the network is your threat, don’t attach to the network, they’re not being unreasonable. It just requires you to be clear about what your threats are

  • jet@hackertalks.com
    link
    fedilink
    English
    arrow-up
    8
    arrow-down
    1
    ·
    edit-2
    6 months ago

    I’m going to pivot this answer, to the more general: what’s good data hygiene for my phone?

    No specific threats, but what’s the easiest things I can do to regain as much privacy and autonomy as possible.

    Using graphene OS is great, good job.

    Using always on VPN, like mullvad.

    Set up a work profile, and install Google services inside the work profile, you can use shelter to do this. Then anything you need that requires Google, like Google maps, Uber, Lyft you can use it from that profile.

    Use a secure messenger like signal, or simple x, with your friend group. To prevent metadata and unencrypted cell phone calls from leaking

    I highly, highly, highly recommend you read privacy guides https://www.privacyguides.org/en/

    • jet@hackertalks.com
      link
      fedilink
      English
      arrow-up
      4
      ·
      edit-2
      6 months ago

      People keep talking about threat models, that’s an important exercise for everyone to do eventually. Figure out who your adversaries are what the downsides of them discovering information is and how much effort you’re willing to put into prevent that.

      For instance, keeping your phone private from snooping roommates fairly easy. Little bit of effort has good dividends

      Being a whistleblower, much more difficult, depending on who your adversary is they could use a lot of asymmetric resources. Boeing has a tendency for their whistleblowers to become suicidal, through some means. And if that was your scenario, you’d have to be very careful.

      But the biggest threat of all, the absolute worst threat you could ever face with technology, is a bored battle buddy working in signals intelligence… There is no law, there is no restraint, there is no safety… They will find your s***, and they will embarrass you.

  • LoveSausage@lemmy.ml
    link
    fedilink
    arrow-up
    7
    arrow-down
    1
    ·
    edit-2
    6 months ago

    Start with the basics. Use a VPN preferable a good one payed in crypto /XMR or cash. Use Foss apps only check out F-droid.

    Also one that blocks malware and ads. If not use adguard.dns or other that filter traffic

    Settings , disable 2-3 G if you always have access to 4-5 G .

    Don’t change add browsers use vanadium. No gapps obviously.

    The more challenging is to just use it as WiFi phone without SIM.

    • Lemongrab@lemmy.one
      link
      fedilink
      arrow-up
      3
      ·
      6 months ago

      Vanadium doesn’t have good/any fingerprinting protection. Cromite or Mull would be better, Tor would be best.

      • Jako301@feddit.de
        link
        fedilink
        arrow-up
        5
        ·
        6 months ago

        Vanadium is purposefully made this way. It tries to minimise profiling by making your actions noise in a big mass of users. That only works if you use the standard config without anything to discern you.

        Mull is the other extreme of this. They try to eliminate fingerprinting by reducing the amount of trackable things in your browser.

        It’s hard to say what really is the better option. You can’t completely eliminate fingerprinting, and the more you try, the more you will stick out of the masses.

        • Lemongrab@lemmy.one
          link
          fedilink
          arrow-up
          4
          ·
          edit-2
          6 months ago

          You can’t blend in with a crowd of vanadium users with the amount of data points given away by the browser. Your fingerprint will be decernable from other users. Without actual anti-fingerprinting, which theoretical can allow for a crowd only when fingerprinting of user browsers results in the same fingerprint ID, the best you can hope to do is thwart naive fingerprinting. Vanadium doesn’t have any anti-fingerprint built in, so the slightest differences between user can be used to easily fingerprint. Vanadium also has no strong method of in browser content blocking (eg an adblocker like uBlock) which is required on the modern web to remove JS tracking scripts (or straight allow and deny lists for specific web contents). Adblock is cyber security: https://www.ic3.gov/Media/Y2022/PSA221221

          Examples of metrics include, but are not limited to, the following: Timezone, system and browser fonts (often automatically fetched by websites as a remote font that is cached by the browser), language, screen metrics (DPI, height x width, refresh rate, pixel ratio), canvas, CSS fingerprint, useragent, browsing mode (standard/private), video autoplay policy, audio device fingerprinting, installed plugins, cookie policy, device theme, and of course IP.

          As a graphene OS vanadium user, assuming that the browser stays default, you would still have screen, audio, other hardware metrics, canvas (this one is a killer), IP, user agent (differences in installed versions of plugins and vanadium itself), timezone, remote Fonts, and others. Fingerprinting is an insane science which needs actual protection against to even begin hoping to create a crowd.

          See some more details below.

          Info on fingerprinting (about choosing a desktop browser but still relevant info): https://www.privacyguides.org/en/desktop-browsers

          Browser comparison: https://divestos.org/pages/browsers

          Fingerprinting test site: https://abrahamjuliot.github.io/creepjs/

        • Lemongrab@lemmy.one
          link
          fedilink
          arrow-up
          2
          ·
          6 months ago

          I read your source and am not convinced. While I do agree that piling on modifications is often fruitless and counterintuitive, Vanadium doesn’t have the Fingerprinting protection necessary to create a crowd. At best it can create many islands of crowd for each physical device graphene supports, for each version of the software installed, and only assuming all other method of fingerprinting don’t work (for some reason theoretically for the sake of this best case scenario). Read cromite’s patch list to see some of the changes needed to produce basic anti-fingerprinting (still not good enough to create a crowd).

        • Lemongrab@lemmy.one
          link
          fedilink
          arrow-up
          2
          ·
          6 months ago

          Dont use system webview as your default browser. Webview is used by apps, your browser can and should be changed if privacy is your goal. Vanadium may be hardened, but it lacks any fingerprinting protection.

          • LoveSausage@lemmy.ml
            link
            fedilink
            arrow-up
            2
            ·
            6 months ago
            1. That makes no sense.
            2. Vanadium have a different approach than trying to block it , blend in instead.
            3. Gecko based browser have crap sandboxing
            4. Again if you have 1 problem adding 1 more makes 2 problems.
            • Lemongrab@lemmy.one
              link
              fedilink
              arrow-up
              2
              arrow-down
              1
              ·
              6 months ago

              Your system webview is for in app usage. You aren’t browsing the web using your system webview (generally). You can’t blend into a crowd if you have no anti-fingerprinting. Firefox does this through RFP by normalizing settings between users, and on mobile there is partial support for screen size normalization through letterboxing. Vanadium isn’t special, it is hardened chromium with some specific patches. You cannot form a crowd without special a lot of anti-fingerprint patching. See my other comment for details.

              Firefox is missing per-site process isolation. This is theoretical an attack vector in the presence of multiple other major vulnerabilities. It has never been shown to be an attack vector in real world vulnerabilities. Don’t call Firefox’s sandboxing crap if you don’t know why people have said that.

              • scratchandgame@lemmy.ml
                link
                fedilink
                Tiếng Việt
                arrow-up
                2
                ·
                6 months ago

                You can’t blend in with a crowd of vanadium users with the amount of data points given away by the browser. Your fingerprint will be decernable from other users. Without actual anti-fingerprinting, which theoretical can allow for a crowd only when fingerprinting of user browsers results in the same fingerprint ID, the best you can hope to do is thwart naive fingerprinting. Vanadium doesn’t have any anti-fingerprint built in, so the slightest differences between user can be used to easily fingerprint. Vanadium

                Anti-fingerprinting? By blocking javascript which the half-hearted privacy users can never afford? hahahahaha. Even privacy projects spread dirty javascripts.

                • Lemongrab@lemmy.one
                  link
                  fedilink
                  arrow-up
                  1
                  ·
                  6 months ago

                  Anti-fingerprinting isn’t as simple as blocking JavaScript. There are dozens of other parameters. You can fingerprint with pure CSS. When I say anti-fingerprinting is necessary for a crowd, I am referring to data normalization. Like Firefox’s Resistant Fingerprinting and letterboxing. I find most of RFP’s effects unobtrusive, but it always for a crowd to form in specialized cases. Only Tor browser and Mullvad can reasonably form a crowd.
                  I dont know what you mean by privacy projects spreading dirty JS. I recommend you read up on actual anti-fingerprinting techniques. Your knowledge of anti/fingerprinting seems limited. Basic anti-fingerprinting is necessary on the modern web, same thing with a content blocker. Security and privacy sometimes come at the cost of convenience, but not always.

    • Koolaid33@lemm.eeOP
      link
      fedilink
      arrow-up
      3
      ·
      6 months ago

      I have a sim card in this phone. The sim card is one I heavily rely on. I have disabled the option for disable 2G in sims is this good? Even without the LTE mode as my phone doesn’t seem to have this.

      I don’t have any crypto / XMR and in this case, shall I just set the DNS you recommended me without any VPN and just always use that? Thanks.

      • LoveSausage@lemmy.ml
        link
        fedilink
        arrow-up
        3
        ·
        6 months ago

        I used adguard.dns before now I have VPN that have DNS filter. Disabling 2-3g minimize attack surface but just a small thing use 3 g if you need it. You can use both private DNA in settings and a free VPN if you want.

        • Koolaid33@lemm.eeOP
          link
          fedilink
          arrow-up
          2
          ·
          6 months ago

          Are you recommending I change Preferred network type " to 3G? other options are 4G only 5G ( recommend ) 4G if I use that DNS with what VPN u recommend, and have allow 2g disable am I good?

          • LoveSausage@lemmy.ml
            link
            fedilink
            arrow-up
            4
            ·
            6 months ago

            It’s only an attack surface minimation , security is better on new generations. I use all since I am in the middle of nowhere. If you don’t need it disable it, otherwise let it be

        • Koolaid33@lemm.eeOP
          link
          fedilink
          arrow-up
          2
          ·
          6 months ago

          If I use adguard dns in my phone settings, what is best free VPN to use with it? Other than proton / Riseup?

  • krolden@lemmy.ml
    link
    fedilink
    arrow-up
    5
    arrow-down
    1
    ·
    6 months ago

    Its still being tracked even with gos. Just maybe Google isn’t tracking you.

  • RiQuY@lemm.ee
    link
    fedilink
    arrow-up
    3
    ·
    6 months ago

    For example, using Aurora Store and Obtanium instead of Google Play and avoid enabling Google Play Services.

  • The Hobbyist@lemmy.zip
    link
    fedilink
    arrow-up
    3
    arrow-down
    1
    ·
    edit-2
    6 months ago

    Congratulations on your first steps in GrapheneOS!

    In order to best help you and give relevant suggestions, we need more information of who you are trying to be private from.

    If your threat model is particularly sophisticated, it may be recommended that you do not use a sim card, or at least never when your phone is at home. Instead, exclusively rely on WiFi. It may also involve desoldering your microphone and camera and only make calls using an earpiece.

    These are not recommendations, but simply examples of how far one can go with respect to their threat model. If you would rather want to avoid “regular” spying by google, Facebook and the likes, you may be better off selecting a private DNS (for example Mullvad’s extended DNS which comes with social media filtering https://mullvad.net/en/help/dns-over-https-and-dns-over-tls ). You would need to make sure you do not install Google services (nor microg) and especially no google apps.

    Much more can be said, but we would need specific information about your case to provide better guidance.

    EDIT: I do not want to give the impression that GrapheneOS does not make a good job in improving your situation already. They do! But to do more you would need to justify it with your threat model, that’s what I’m getting at.

    • Koolaid33@lemm.eeOP
      link
      fedilink
      arrow-up
      2
      arrow-down
      1
      ·
      6 months ago

      I have already inserted a sim card into this phone. The sim card is a kyc sim card. I want to do best I can without compromising my identity. My threat model does involve government interception and tracing, but it’s more about staying Safe with this phone whilst I’m possibly under surveillance. Local police entities. More so than government contractors / third parties. What is best VPN to use in this phone? I rely in the sim card in this phone so always keeping in aeroplane mode isn’t possible as this is my primary number and I need to have constant connection to it. In this case, what shall I do with this phone?

      • SomeLemmyUser@discuss.tchncs.de
        link
        fedilink
        arrow-up
        8
        ·
        6 months ago

        To be honest, if kyc means what I think it does (I am not from the states) so that your provider knows your real identity, this phone with this sim will not be private, especially not when constantly connected to cell service.

        With a warrant the local police could force your provider to tell them to which cell phone tower you are connected to, effectively giving them live position data. They can also read all unencrypted trafic this way (calls, SMS, telegram, http traffic etc.)

        If your thread level is the police, you already f’d up, sry :/

          • SomeLemmyUser@discuss.tchncs.de
            link
            fedilink
            arrow-up
            3
            ·
            edit-2
            6 months ago

            You always need to ask: which data do you want to protect.

            If its position data and calls: nothing, it really doesn’t matter what phone you use if the connection is not secure.

            If its communication via messenger like matrix: you are already quite good protected with graphene os and matrix from a safe source.

            If its Trojans from the police: don’t download any software/apps/services that are not open source and widely reputable. (Most rich western states can probably still get full control if they want to because of zerodays)

            If you want privacy for calls: get a simcard without your name/Iban/PayPal/creditcard etc attached to it in any way (prepaid with cash), Reset the phone, drive somewhere where you don’t work or live with phone off Insert simcard and turn on phone. Wait Turn off phone and disable sim card Use only WiFi until you really need sim service (best not at your home or work).

            If you want to protect data on phone: don’t have biometric login (you can be forced to put your finger on the sensor, you can’t be forced to type in a password as easily)

            Netguard, shelter, only FOSS software, regular updates, no cloud, no google is never a bad idea, also only communicate via safe encrypted protocols (matrix, xmpp, pgp, https, etc., NOT WhatsApp, Facebook, unencrypted mail, http, SMS, calls)

            EDIT: people here mentioned that graphene has a build in firewall, which you can use instead of netguard. I have netguard running though as I know the interface and options, have separate profiles for shelter and normal and don’t use a VPN anyway.

  • scratchandgame@lemmy.ml
    link
    fedilink
    Tiếng Việt
    arrow-up
    1
    ·
    6 months ago

    (OP can ignore this comment)

    I’m a bit upset that GrapheneOS does not follow OpenBSD: ignore any person hating it, ignore anyone who wants to interferes with project personnel and donations like usa is doing on Viet Nam like they are speaking for the Vietnamese, and don’t care if the feature works “for you” or not, just going on code improvements & maximally free code. And do whatever Micay want to do. Accept donations from whatever company. There’s so much dramas. But they already achieved over-detailed documentations. Focusing on unprivileged google play is the true path, since the demand on google play is much larger and other “private” apps repos are expected to work on the “privacy” people’s phone.

    Maybe because GrapheneOS haven’t made any world-significant project that every companies depend on so that companies have to put so much money on the project.

        • scratchandgame@lemmy.ml
          link
          fedilink
          Tiếng Việt
          arrow-up
          1
          ·
          6 months ago

          I’m upset that GrapheneOS does not follow OpenBSD: ignore people likes you and work on any feature they want. On the 90s, the NetBSD core team expelled Theo de Raadt and revoked his access on the code which others could. On 2020s, you, not any core of GrapheneOS, trying to expell Micay from GrapheneOS’s project leader role. Like what cia is doing to Viet Nam and China.

            • scratchandgame@lemmy.ml
              link
              fedilink
              Tiếng Việt
              arrow-up
              1
              ·
              6 months ago

              Laugh on your “basic decency and criticism”.

              then such projects/forks should be abolished to the valley of death

              It seems these guys failed to abolish OpenBSD to death so they find an easier target: GrapheneOS. In fact, both project accept “inputs, basic decency and criticism”. OpenBSD have a friendly connection with FreeBSD. But the os is make for their developers, and they can ignore whatever wideopenbsd or isopenbsdsecure without having problem, they can have the user to read man pages without having problems. On the linux world drama is caused by having user to read faq themselves, and Micay failed to ignore the dramas.

              Same for any such individuals like Micay who believe in witch hunting, cultism and silencing people.

              Micay is just dumb when he stepped down for your pleasure.