How do you make android private

What if you root an android, have custom recovery twrp, but no ROMs exist for the phone? What can be done with root privileges to increase privacy?

>>32595 The basic needs: afwall and appops x. Firewall is a must >do a factory reset first >remove sim >turn off wifi >put bromite/afwall/appopsx/busybox into a usb >use usb otg and sideload them all >enable afwall, create rules that only allow bromite/etc. >enable afwall "prevent startup leak" and set all other options to use busybox. >the only busybox available options are meefik or busybox-ndk/magisk Now appops x >doesn't need root, if you have PC use adb >this prevents apps from clipboardlogging >this is required for android 4.0 up to 11.0. clipboardlogging is still on the run for any app >although you'd need to trigger it first as it is sometimes hidden by sneaky app developers >open malicious app, trigger clipboard by copying from their text box >open appops x again >look for the malicious app again >tick off "read clipboard" permission And you can use along with it appops rikka + shizuku (no root required), turn on clipboard notification, device usage so you'll know which apps were trying to abuse camera, recorder, clipboardlogging. (appops rikka had a bug though and won't show "read clipboard" option that's why i prefer appops x) Next will be debloating and others [!] caution needed. use debloater adb or disabler, this is optional >get other keyboard that's available on f-droid >disable your native keyboard dictionary, spell checker, anything you can find >disable tts, face unlock, dictionaries, email, native browser, native music player >install open source tts, email, via browser, retro player (github) >disable "sync" in settings>accounts or in the gallery app if you're lucky >remove or disable gms and all of google apps, perform a dalvik cache wipe afterwards >settings > location > turn off wifi/bluetooth scanning, turn off gps, turn off private dns >go to the "Phone dialer app" > threedots/settings > phone number lookup > turn off forward lookup (defaults to google even in aosp lineage builds) > turm off reverse lookup and people lookup. That one's a surprise right? >install opencontacts/qksms >disable messaging and phone dialer and test if opencontacts/qksms works fine by calling and msging yourself That's as far as I can remember. Feel free to add anything I've missed.

>>32596 Thanks

+1 for AfWall+. You can use OverrideDNS from XDA to set your preferred DNS resolvers. You can use PerformanceControl from F-Droid to freeze a lot of system apps and Google apps you don't need. AdAway from F-Droid is another option. And SecureEraser is nice if you care about wiping free space.

How is protonvpn?

>>32748 ProtonVPN works as advertised. It's pretty good for a free product. Likewise BitMask using free and no-signup RiseupVPN. Note that Mullvad has an F-Droid app now, and might be a nice alternative if you don't mind paying for it. I'd tend to place more trust in these VPNs than most, with Mullvad right at the top.

What are the best devices for hardening?

>>32964 probably pixel phones because you can run grapheneos. i'd recommend reading some of the things the lead dev Daniel Micay writes about security. some of it can come across as a bit apocalyptic, but he has some interesting insights and understanding his threat model will help you figure out what a hardened android OS can do for you. However, you should be aware that hardening phones tends to come at a privacy cost. I use graphene's chromium fork on my phone and it doesn't have nearly the amount of anti-tracking options that firefox has, but it is certainly the more secure of the two browsers.

>>32966 >pixel phones because you can run grapheneos considering phones that can only run lineageos: are some better than others or are they all the same?

>>33048 Unless you want to do things like remove the battery and the mic/camera, which are things you should absolutely do if you're worried about targeted surveillance, the answer is no. But not all "support" is equal; a handset with fewer bugs and more frequently updated builds is better.

>>33072 this. they have a wiki on each device where they tell you if the batteries were removable, for targeted surveillance, it is better to use replacnt or kalyx for easy mode. if lineage's fine to you but you can't find one, you might also want to look at mokee which also offers the same amount of privacy as lineage but on cheaper phones being supported and maintained. mokee roms are somewhat reliable knowing how china firewall works, maintainers had some deep knowledge in network privacy. >>33048 pixel phones are much more supported by developers since it's not a headache for device trees, kernels as they put them out to public, also getting updates faster. other phones mainly qualcomms ones would likely get the average custom rom but heavily rely on gsi/treble and private 'leaks' from CAF but still have lots of blobware. >>32966 i no longer believe in firefox, as i've tried klar and found that it phones home somewhere during start. vanadium has hardened malloc and other stuff so that's still better than having ff extensions do a client-side privacy enhancement when in reality it's all about server-side tracking. umatrix won't even do soykaf when tracking is shared by servers themselves.

How does graphene Vanadium compare to bromite

>>33083 Vanadium >graphene kernel have hardened malloc which the app use >graphene exclusive Bromite >anonymity wise, does well to hide UA and limit fingerprints >focused on browser fingerprinting, with a dedicated page to showcase it Ungoogled Chromium mobile >sane defaults (download articles over wifi turned off, etc) >exposes your UA though

>>32596 Thank you

>get new phone do you need a google account to get into the phone settings to prepare the phone for flashing?

>>32595 I just use a LineageOS rom without gapps on my Xperia 10. Any apps that require gplay services just get run in the browser, ebay, banking etc. Battery life has been improved massively w/o gplay services, so I would recommend it just for that.

>>33689 Some phones want a sim card or network connection, most phones will let you skip signing in with Google, but it depends on the device. Sadly there is no list of these.

>>33704 I've yet to see an Android phone that requires a Google account or a SIM card to do basic Android stuff. I've accumulated 8 phones from 6 manufacturers. Maybe you're thinking of iOS?

>>33706 My Xperia 10 wanted either Sim card or wifi connection, it did let me skip the google account, maybe I am thinking iOS

>>33689 >do you need a google account to get into the phone settings to prepare the phone for flashing? No. You don't need any account, or even to be online, or ever to have been online, nor do you need wifi, nfc, gps, bluetooth, ir, a carrier, or a sim card. You only need a USB connection to an external device to get necessary data/software.

>>33706 Friend of mine handed me an Android for setup back in 19, I've found neither control nor indication to bypass, circumvent, skip or postpone the initial T.o.S. screen and the account setup. Sadly I can't say which model anymore. If you know the magic please do tell.

>>33689 >>33717 >>33704 The question is legit. The setting is called OEM unlocking, you have to reach it. Then to enable it some devices also ask for a code from the manufacturer, which often requires a registration on their website, some dont allow unlocking at all, it depends on device & brand. https://android.gadgethacks.com/how-to/list-phones-with-unlockable-bootloaders-0179751/

>>33723 This is true, but OEM unlocking usually doesn't require you to actually do anything from within android. On every phone I've had it's just been a matter of plugging it in to my PC, loading to the fastboot screen, then typing `fastboot oem unlock` or something.

>>33737 >OEM unlocking usually doesn't require you to actually do anything from within android It actually does on certain phones, maybe many by now, therefore it's good to know if the phone you're dealing with also forces you to have a google account, sim card, wifi, etc, before you can do anything

>>32595 GrapheneOS. https://grapheneos.org/ That's really it at this moment besides using a non-Android based phone. OpenBSD based phone when please.

>>33760 >GrapheneOS. What about >OEM unlocking from within Android >Google Account ? Seems both are required,correct? https://grapheneos.org/install >OEM unlocking needs to be enabled from within the operating system. >'Enable OEM unlocking' setting. This requires internet access on devices with Google Play services as part of Factory Reset Protection (FRP) for anti-theft protection. >Factory Reset Protection

>>33770 You ideally need a Google Pixel, as GrapheneOS is built around it. It'd be too hard for them to maintain multiple devices, so they just focus on Pixels. Technically it can work on other devices, except it's not officially supported and can be sketchy as fuarrrk. Also the security will not be as great as with the Pixel. It's more so for testing purposes. GrapheneOS itself is completely DeGoogled. And requires OEM unlocking, so not a Pixel from a carrier. And can be rooted but that defeats the purpose from a security aspect and I suggest against this highly. https://grapheneos.org/faq#supported-devices https://grapheneos.org/faq#security-and-privacy That being said, this is currently to my knowledge the most hardened ROM you can be using, especially because it's built around specific hardware (Pixels). In comparison to Linux phones, I'm not sure. I think it still surpasses them from a security stance at this time. I would highly like to see a phone based on OpenBSD, however app support will definitely be an issue for a while. But if done well, I'd use it over Graphene or Linux phones.

>>33743 It's been a while so I could be misremembering. I definitely don't remember having to sign in to google on my oneplus phone (this would have been a hassle for me, so I probably would remember it). It's possible that I had to click a thing in developer settings and forgot about it though, and you're right that different phones have different requirements. I specifically buy carrier unlocked dev-friendly phones to avoid this bullshit so my experience is not representative of phones in general.

>>33789 >In comparison to Linux phones, I'm not sure. I think it still surpasses them from a security stance at this time. For sure. Linux phones, specifically postmarketOS, do have the benefit of the hardened alpine kernel, which isn't so different (in terms of compiled-in security features) from the AOSP kernel. However, you're still essentially running homebrew and it's lacking android's containerization. From my understanding linux phone security model is basically the same as linux desktop, for better or worse.

>>33689 It depends. Most phones have OEM locked bootloaders. Most postpaid ISP phones like an Verizon Pixel can't(?) be unlocked for some reason (or maybe you can now). Stuffs like Xperia - some of them are hard to unlock. Blackberry is almost impossible to unlock. Xiaomi - you need online activation and turning on gps, etc which I think is so it can collect as much soykaf possible before getting cut out of the botnet because being botnet perhaps was their revenue(?) Oneplus had been known to be very lenient with boot unlocking and have built-in root. Most Nokia devices have yet to be unlocked at all. I think the modern Pixels now needs some kind of online agreement to be able to customize it. Check search term "xda mydevicename" and see if it had been unlocked. Do this before planning to buy a certain phone, sometimes you will need to downgrade. Sometimes you just need to enable Developer Options and you can flash immediately after purchase, some of them require unlock days or unlock codes like Sonys and Xiaomis. If your device is boot unlockable, check search term "twrp mydevicename". And the rest is easy.

Does anyone have experience using Replicant? I had used it a few years back, but found it pretty underwhelming performance-wise

> you even don't have drivers for your harware > take care increase privacy

What about a google-less android, like pure vanilla is it feasible to download a rom and install it on a cellphone?

>>34489 Yes that's what lineageos is pretty much.

>>34491 Kinda yeah nah. It's got most of the Google ripped out or optional, but it's not completely degoogled. As of 2019, DNS defaults to 8.8.8.8, captive portals check for connectivitycheck.gstatic.com, A-GPS uses supl.google.com which sends your IMEI to them, and app basic browser capability uses AOSP Webview which is FOSS but isn't degoogled [1]. There's a privacy-focused LineageOS fork called /e/ that I think is degoogled, but I don't know enough about it to recommend. Do research, I've heard negative rumors. There's also GrapheneOS which is security focused but has a far more limited list of supported devices (basically just Google Pixels, ironically, but is the hardware a privacy concern? I doubt it). I don't know how degoogled it is. https://grapheneos.org/#never-google-services LineageOS is like GNU/Linux; it's all about hacking/customizing but people falsely assume it's also about privacy and security. They aren't. t. using LineageOS [1] https://www.reddit.com/r/degoogle/comments/cldohl/how_to_degoogle_lineageos_in_2019/

>>34345 The problem with Replicant is slow development. >current release based on Android 6 >upcoming release based on Android 9 >>34494 The devs of /e/ also seemed unaware of these flaws in LineageOS and even made other mistakes. Most things are now fixed but not everything. https://infosec-handbook.eu/blog/e-foundation-final-look/

>>34548 >link Ahh, I remember seeing that when it was published (How could I forget?) Thanks for that.

>>32595 What about for a Android x86 box? (Or Bliss OS I guess) I'm trying to make my roommate get rid of his Echo bullshit. LibreElec is great and all but Kodi has its shortcomings and he won't stop throwing a bitchfit about them. I want to turn one of my old junk PCs into a de-googled Android HTPC to run native Android apps like NewPipe/Vanced, Netflix, etc and use ATV Launcher to make it look like Android TV. Then I can basically just run Kodi off of that for everything else. A lot of the Android x86 builds are built off Lineage but they crammed the Google soykaf back into it. I heard recently that Bliss OS apparently has a version without Google Services soykaf, but it's also apparently more unstable. I'm just not sure where to even begin.