The current state of smartphones

Most people own a smartphone. They are extremely useful tools, but they are also a nightmare for security and privacy. This guide will attempt to help you improve your security and privacy while using a smartphone, without losing useful functionality.

There are, mainly, three types of smartphone:

  • Android Devices
  • iOS Devices (the iPhone)
  • Dumb phones / brick phones / feature phones (KaiOS or custom)

Android

Android by default is the most customizable of the bunch. Different brands usually have their own software, and also ship Google apps. The most important one being Google Play Services. This application connects to Google to allow the Play Store to function, logging in with Google, and power most Google Apps. It also shares a lot of user data with Google.

The OS itself is open-source, and so is private. However, the added software increases the attack surface exponentially, and sends user data to the device’s manufacturer, Google, and often Meta (Facebook) and many others. The default launcher is usually close-source too.

To summarize: Android itself is open, but the added software (launcher, apps and features) are not. This is a major compromise for security and privacy.

iOS

The iPhone is entirely proprietary, which gives Apple a lot more control over the user’s device. This is a double-edged sword: Apple often limits third party trackers, but they do just as much tracking as Google does themselves.

Apple can also remotely lock devices, wipe them, and the user can’t replace the launcher and some default apps and services.

Overall, the iPhone is only slightly better for privacy than Android, by default, but the user has much less control over their own device. Also, because iOS is proprietary, it’s much harder to tell which data is being collected.

Feature Phones

There isn’t much to say about these. These devices are simple, and can be secure and somewhat private. The main issue with them is that they are only private because you do nothing on them. SMS messages are not encrypted nor are calls, so in a way, they’d be the worst for communicating.

Although the most secure / private option for a phone (as long as you’re okay with SMS not being encrypted at all), these are not an option for most people.

Threat model

The first step is to determine what your threat model is - how far you are willing to go.

For example, are you being targeted specifically? Is the government interested in you? Or are you only trying to cut off Big Tech from your data?

Write down who your targets are, to help you decide what to defend against. The further you go, the more convenience you must sacrifice.

Some ideas of things to do and explore

The simple route

Low threat model - Big Tech; Peace of mind; Not comfortable modifying your phone; Normal person

  • Remove unnecessary apps and delete their respective accounts.
  • Use strong and unique passwords: These are hard to remember, so use a password manager like KeePassDX or Nextcloud Passwords. There are more apps like these, but be sure to check that they encrypt your passwords, and are open-source.
  • Use open-source apps whenever possible. Fdroid, an alternate app store for Android, only has open software listed.
  • Move away from Google and Apple services, in favor of local solutions.
  • Switch away from Chrome. Both Brave and Firefox are good alternatives.
  • Avoid personal information on social media.
  • Use Matrix or Signal for private chats.

Advanced route

High threat model - Someone capable is after you; You value security and privacy a lot; You are a tinkerer, or willing to learn; Paranoid

  • Switch to a Pixel Phone (mainstream, easy to modify, kind of ironic since it’s a Google device).
  • Install GrapheneOS (More security) or CalyxOS (Easier to use) on your Pixel.
  • Stuck with any other phone? Try to install LineageOS on it. If supported, you will be better off with it, but avoid it if you can.
  • Avoid anything that requires Google services.
  • Communicate only through Matrix or XMPP.
  • …

There are many more things you can do, but I can’t help you with some of them, since this is as far as I’m willing to explore myself. It’s impossible to be 100% safe, but following these steps will certainly help you a lot already.

Reality check

You may find that you don’t fit into any of these routes perfectly, and instead, somewhere in between. I, for example, still need some Google services, and not everyone uses Matrix in my life. This is why privacy and security are a spectrum, not a yes or no value. For me, most of these steps are worth it, but having this blog, just by itself, is already increasing my attack surface.

You might want to make sacrifices to have nice things, and that’s okay. Start by doing something; pick anything from the lists. Then, you might want to continue, or find your own balance.

Open-source apps that I recommend

GrapheneOS

Earlier in the list, I mentioned switching to GrapheneOS as an advanced step.

Graphene is the AOSP (core Android) without Google services, and with only open software. It also has regular security patches and many security features are applied, making Android much safer. This is the best solution out there, but with no Google services, things like Android Auto, Google Maps, and many other apps like the Play Store itself would be unavailable.

This would not work for me - however - GrapheneOS has a very clever solution. The ability to run Google Play Services in a container.

If you are not used to the concept of virtual machines and containers, picture a smaller phone inside your own. This small phone is isolated and limited, and so, even if it is compromised, you don’t really lose anything of value.

For GrapheneOS, this means that you can still install the Play Store, and keep your private stuff separate. GrapeheneOS also has more advanced security features; and using the container, supports Quick Share, Android Auto, and most modern Google features.

You don’t have to enable these features if you don’t need them, obviously, but most people will benefit from them.

There is also a Web installer to easily install GrapheneOS on your device.

Nextcloud

At this point, you know about GrapheneOS, and how to keep your phone safe, however, you might miss all those Google features. Applications like Google Drive, Google Photos, Contacts, Calendar… the list goes on.

You may also want to sync your photos to some cloud that you can access on other devices and keep regular backups without thinking about them.

There would be no private solution to this, as “The cloud is just someone else’s computer”. But what if you own that computer?

I won’t get into too much detail in this post (I will discuss Nextcloud in a future post soon, and how to install it), but if you have a spare computer, or are willing to build yourself a home server (often cheaper than paying for Google One in the long run), you can install Nextcloud on it, and replace all Google services with it. You also get a lot more storage, and it’s easy to extend it if you need more.

Parting Thoughts

In conclusion

  • It’s impossible to be 100% private and secure. Choose your threat model and focus on it, one step at a time.
  • Switch to open-source apps and OSes whenever possible.
  • If you’re comfortable tinkering and own a Google Pixel device, install GrapheneOS, it’s easier than it seems.
  • If you can, use Nextcloud instead of Google services.

Stay safe out there.