How much sence does it make to use tor on a phone with vanilla ROM?

There probanly will be a record of me opening the application (as the OS likely sends "app history" to some thid parties like Google or my phone manufacturer's company servers). What else sneaky mechanisms to track and identify user does a smartphone have that I dont know about? What should I look for when avoiding being tracked and minimize leqkage of provate data while still being able to use convenient services. How do I watch YouTube on a smartphone without google knowing exactly on what device I watched a video, on what exact geolocation spot and in what time...

>How do I watch YouTube on a smartphone without google knowing exactly on what device I watched a video, on what exact geolocation spot and in what time... this is all futile. if you're not using qubes you're bound to get tracked and worse of all android? don't joke. the android is capable of: >leaking clipboard copied / unfixed yet, any app can do it without extra permission >leaking sms immediately / firebase and otp API >leaking beacons / wifi beacons leak to your neighboring users, which have covid beacons and proximity APIs that allow for "enhanced geolocation" so without randomized mac you risk it regardless >sometimes glitchy when it would turn on your gps/data/wifi at random times >android/vpns/torbot don't really spoof your time zone, plus ISP has records of you connecting to the public list tor hops also >using tor triggers antifraud systems of several ads apps on your device (ads don't like fake clicks so they don't like it, even VPN can trigger it too), so don't try to tunnel all connections but really I don't recommend tor of all things over android >there's also an API that just lets them bypass the vpn/tunnel connection anyways (if you do not have a firewall app) even if you do the firewall app can also fail to run sometimes since it's bloated java program >youtube on tor is almost unreliable or impossible to explain, too many workarounds needed or simply you can use a invidious instance >secure dns actually now sends your useragent too (this is for certain browser-specific workarounds), though it's not like the apps you have won't phone your entire identity and useragent over clearweb under tor even if you managed to block them they will know your recent IP if they are running in background. blocking only forbids their internet access but not their/app's ability to view your current public IP which is why VPN for anonymity fails miserably these days. in fact anonymity is dead, especially more so if you do not own your device. for the real answer though, the only way for you to do it is (point of anonymity since you asked tor) in chronological order: >drive somewhere >buy new phone at a store and sim in cash (preferrably no cctv footage or identity linked) >sim must work without any sort of identification (some countries rule it) >find a way to top up the sim >install tor (at this point you do not care about privacy or custom roms since it is not linked to you at all) dataleak check: sim activation cellid location, pseudo account (for phone accounts), place of phone activation (leaked beacons on its own, you have no control over these) also why new phone instead of old? if you're buying from someone online there's a record of it somewhere online now it depends on where you stay at. the beacons will leak regardless (bluetooth announcements, wifi announcements, NB-IoT 4G, some wireless chip they somehow snuck in the phone like long range MEMS or something, audio content recognition or high pitch data announcements, cellid location announcements) so your location matters afterward you probably don't want it anywhere near you but also you probably don't want it near your existing personally-owned device that may also "talk in beacons" (damned these smart devices these days). and finally you must throw it all away. the longer you spend in the network/device/usage the longer you risk getting targeted. but still I dont get why people don't like to shut down theirr computers and leave them plugged in and worse connected to the internet, if most people just don't do that a lot of botnet ddos attacks won't happen anymore. the more you spend connected to the internet/tor and device running the more bits you leak. think in bits, but seriously anonymity is dead for the "hobbyist"

>>67444 Not op, wanted to follow up on your final points regarding staying plugged in. Generally overall I concur. However I wanted to ask about some 'what its' like: Core/librebooted devices VMs Generic Linux machines. Are there minor fluctuations to the equation if staying plugged in depending on your set up?

>>67312 >What else sneaky mechanisms to track and identify user does a smartphone have 1. There's a fuarrrking camera pointing at your face while you use it 2. There's a GPS telling your exact location (the GPS coordinates that don't change for 8 hours every night is your home address). 3. There's a long range radio that is always connected to at least one cell tower and you can't block it from exfiltrating data. That's a good start I think.

>>67312 On a smartphone: Install LineageOS. The only two "Google apps" on it by default are placeholders for Google Assistant that can be removed. To watch YouTube on a smartphone, use Newpipe.

>>70491 Libreboot is a build system for coreboot. It per default ships microcode now so the differentiation is minor at best. Coreboot is great for software freedom and sustainability but for security there's an issue: verifying the firmware. With coreboot, you're back to using non-digital ways for that. For security you might be better off trying to use some kind of verified boot with a good trust chain. For privacy you need security, generic Linux machines currently still need to catch up in that regard. With VMs you can close this gap, you could build on QubesOS for that. Don't forget to harden the VMs itself though. >>67312 Use GrapheneOS. It is like kicking dead whales down the beach to get a Google device, but it's incredibly convenient while not losing security. See also FAQ on grapheneos.org

>>70513 Thanks for the heads up, I think in the end I'll be going for either a core or libre boot device with qubes.

>>70531 Sounds like a good idea. Which device are you planning on using?

>>70532 Currently as placeholder I have some dell server tower with 2 xeons and 32 giggles of ram for self hosting. I am leaning to something such as the KGPE-D16. Thinking i2p, libre boot, mumble for normal person's and xmpp for the sophisticated. As well as a few other oddities.

>>67312 it makes zero "sence" the software shipped with a phone is what they call "value adds" in the industry, it means random garbage they coded in 5 minutes using newgrad college students to add checkboxes to their feature list while possessing no coherent design at all and even if you wanted to use that software normally it would just crash and bug every 5 minutes.

>>67312 Depends on your threat model. A bunch of other lainanons have long posted about different levels but figure out what you care about. Phones are from the ground up private. You can do things to improve that but it's up to your ability and care. Some recommendations I can make: Libretube, it's the most direct response to let you watch YouTube with a level of disconnection from Google. Your phone will still know and report whatever but you won't make a direct connection to Google to see whatever video. GrapheneOS, as others have pointed out the ROM you get on any android phone unless specifically degoogled will report back to them. Graphene is your best bet. Stop using your phone, if truly paranoid finding some other computing system if it really bothers you would be better. Whether you want to go librebooted thinkpad or tails on a public computer or whatever. I reiterate this is entirely based on your threat model and what you care about. Good luck.

It's worth using regardless, if it's what you got then it's better than using nothing. Tor Browser on Android is trash anyway, even with a private android distro.