Smartphones

Which security measures do you take in your smartphone, Lain? If you use a different OS, a custom model or anything fancy like that, please share. This thread is, obviously, for those who have smartphones. If you have strong opinions against the existence of smartphones, this thread is clearly not appropriate for that discussion, take it somewhere else.

I have my phone (Galaxy S7 edge) without any Google apps or social media apps, I use everything via browser and in incognito mode with useragent changes. I have no problems with propertary apps but if I can avoid them I will. Not much aside from that.

>>846 I feel similarly, Lain. Still it feels uncomfortable to have so much bloat, i recently acquired a smartphone (this is in fact my first smartphone) and i'm not really sure how to remove all this bloat. I like knowing what i'm working with and it feels a little impossible.

>>847 Flash a custom ROM. I'm currently running ResurrectionRemix, which is based on LineageOS/AOSP. It only gives you the minimal stuff you need to make the phone work as a phone. You can also flash custom open sourced kernels if you need that much control. Without going into many details, my standard procedure is: > get phone, lol > unlock bootloader if necesary > flash custom recovery (I personally prefer TWRP and it's been ported to almost every popular phone model) > make a backup of current system and store it somewhere in case I feel like selling the phone someday > flash custom rom (personal preference is anything LineageOS based) > get F-Droid for open source apps > get Yalp store from F-Droid for closed source apps If you like the stock rom for certain features, you can search for debloated custom roms. Also, if you'd like an out-of-the-box debloated experience, I'd recommend you nexus phones. Motorolla phones often come almost completely debloated too. Search for the stuff I mentioned for your specific phone model and you'll get a nice pure android experience without any bullsoykaf. Happy modding, Lain.

>>849 Lineage without gapps is so comfy

Plan9

As far as I can see CopperheadOS is the best option for keeping your smartphone safe because it supports only Google devices, and Google devices have the longest update support. Since Google is a big ass company, vendors keep releasing security updates for third party firmwares needed for Android. Also, looks like they are developing CopperheadOS for themselves to use and they are pretty tight about security and privacy: - They do not recommend bootloader unlocked or root access; - F-droid is the default app center; - They do not plan to support app signature spoofing like most ROMs; - They have reported security and privacy breaches to Google. Never tried any OS other than CyanogenMod and Android, but they seem serious about subjects that actually matter for me.

Blackberry aims for high security, you cant even root their phones

My current phone is a Verizon Galaxy Note 4, which has pretty crappy custom OS support. It spergs whenever it has to run something like Lineage OS and doesn't let me do phone calls, so I have to stick with stock based custom roms. However, I removed all google apps, all funny looking bloaty stock apps, use (mostly) FOSS apps and I use a AFWall to block any non FOSS app. I need to remember to install Tor on my phone though. Also, what does lain think of this?: https://ollieparanoid.github.io/post/postmarketOS/

>>873 > you cant even root their phones That's not a security feature. That's "you don't own devices, you license them from us" type of bullsoykaf. Bad guys will chain a couple 0days and get whatever they need (if "lawful" manufacturer-provided means fail them for some mysterious reason) while you won't be able to tinker with your own device. >>845 Personal Tracking Devices are evil by design. GSM/UMTS/LTE chips do whatever base station or nearest IMSI catcher says. Some chips even have "remote debugging" capabilities. Secure phone is an oxymoron (unless the phone is powered down and all the batteries are taken out).

>>872 This is the one I use. It works great for me. Forced off a lot of obnoxious apps that were keeping me addicted to my phone and has forced me to treat just like that - a phone. I don't have e-mail or any kinds of sensitive data on it.

>>877 Did you even read the OP? If you don't like/don't have a smartphone or however you want to call it, this isn't the thread for you. Please go away.

>>877 Come from the assumption that lainchan is a tech savvy community. If a thread is about smartphone security, it's about using the tools available to do the best you can. As the OP post reads, this is not a thread for people against the concept of smartphones. There are infinite scenarions upon which you must use a smartphone. This thread is about doing the best you can with the tools you have, not about not using the tools because you feel like it.

Currently I'm only running Lineage OS on my phone, but I don't like it. I have gapps installed, leave it running basically always. However something I've done for a while now is run AFWall and Greenify. AFWall is just a frontend to iptables, and only apps I allow have internet access, some only wifi. I greenify apps that I especially despise but leave on my phone because I still use them sometimes (Uber being a big one that gets greenify-ed) so that the can't run in the background at all. Though that honestly has more to do with privacy than security. >>872 Copperhead is really cool, and I would run it, except what all I want from a phone is a removable battery and SD card (though I could do without the SD card once I setup forwarding a port for mpd, then I'd just need data), of which the google phones offer neither. Instead I'd turn off the data and wifi unless I explicitly require them, run gapps-less, and primarily only use OSS. That would an acceptable secondary, since google is never going to embrace SD cards, or removable batteries.

>>886 Why don't you like Lineage? Also why the gapps if you're concerned about privacy?

Don't use one. If you need, best practices is probably the most ancient model supported by Cooperhead OS, without gapps and only apps from f-droid. Fine grain the permissions of each software and route everything through Tor.

>>909 >Cars thread! How do you make sure your car doesn't cost so much on maintenance? >"Don't use a car" This is not 4chan or facebook, you won't impress anyone for reading phrack articles, which is not to say that smartphone surveillance isn't a serious issue (or that phrack has bad articles). Just have a little respect for this community's intelligence, most people are aware of the downsides of using a smartphone, this thread is about what to do CONSIDERING those downsides. This is not a thread about whether smartphones should or shouldn't be used, it's a thread about making a smartphone safer than it is by default. Not having a car is cheaper than having one, but if you're in a car thread, don't be a dick.

Is it possible to fully encrypt an android?

>>913 Not sure what you mean by "fully", but Android has full disk encryption since version 7. And I believe it has memory encryption too (I'd recommend you to check that one), because it would be pointless loading data from the encrypted disk to an unencrypted memory. Once you enable disk encryption you must input your password on boot. CopperheadOS has forced disk encryption.

>>914 Copperhead also allows you to use different passwords for unlocking and decrypting so you aren't relying on a 4 digit pin if an attacker can get around the chip security. IIRC doing this manually is as simple as encrypting with a strong password and then using adb to change the unlock password, but it's nice that they make it easy for you.

>>864 this makes me want to buy a S4 and flash lineage os without gapps and use it as a secondary phone now lol

>>845 Your best bet is some kind of developer/nerd oriented device with a custom OS that you keep up to date. I personally use a Nexus 5 with Lineage OS. The Nexus phones have as many open source drivers as possible and they use Qualcomm ABoot, so at least the second bootloader is open source. IIRC the low level loader and bootROM are closed source. I just use the stock apps and a few things from FDroid on it and I keep as little personal information as possible on it. It's basically a glorified iPod for me, and I use it for calls and texts occasionally. The biggest issue is the unverifiable modem isolation. You basically have to keep your fingers crossed and hope that the cellular modem is forced to communicate through the SoC and that it can't access your devices and memory directly. Essentially, good isolation would mean that the modem has to go through the SoC, then kernel/abstraction layer to get access to mics and cameras and all that stuff. These hardware and software defenses can say no if the modem tries to access something it shouldn't. It has been proven on certain Samsung devices that the modem will circumvent these things and access stuff directly, which is unsafe. Anyways, my battery is going in my Nexus 5. I plan on getting a OnePlus 5 or maybe a 3T depending on what I feel my needs/wants are. But the first thing I'll do with the new phone is unlock the bootloader and install Lineage OS.

Easy thing to do is remove the face-facing camera. Don't see use for it and it can be used to steal your password (eye reflection was shown to work for real due to high camera resolution) & face for identity theft.

>>1038 I don't think that's a realistic use case, Lain. Stealing a password using a technique like this requires a lot of access to the target device, you can't just spambot in large scale, so for anyone to suffer from this type of attack, they'd need to be a target of a person or a group. Most of us are just miserable hikkikomoris a little too worried about privacy. Removing face-cam might be a good idea to preserve your iris from being scanned, which is something plausible. But don't expect targeted parties to steal your personal passwords, that takes time and effort, you have to be a valuable target.

>>872 Cool project. The people that run it are dick heads to their community from what I saw.

>>846 How can I spoof my android useragent? Also, has anyone here ever tried kali nethunter? I would like to try, but I don't have a nexus phone.

Xposed Framework & moduals. UnifiedNLP location provider. (Deactivate google tracking) Lucky Patcher, patch everything! FDROID app store.

pretty much an blackberry classic with latest BB10 OS. Although i don't use phones that much but i have one just in case and it can run Android applications too. I can use Signal with Blackberry

>>1275 Oh yea if you want a smartphone that has a removable battery you should look into Motorola G5, not the plus because that one has a non removable battery.

There's any open source client for WhatsApp? To summarize this thread: >put tape on cameras >TWRP >ResurrectionRemix (or other LineageOS fork, no gapps) >disable geolocation >Xposed Framework (moduals) >UnifiedNLP >Lucky Patcher >install F-DROID >FaceSlim >Mozilla Focus >Yalp for gstore apps >check software privileges There's also a youtube client on F-DROID, can1t remember it's name. If anyone knows some whatsapp client, please write it down.

>go to some soykafty second hand phone tech seller or high street resaler >tell them you need a bunch of cheap phones for work and to take on holiday >even better if you can get someone to buy it for you >pay cash >leave >prepaid sims only >keep them for six months then trade them in at a difderent shop in a different city >cash or exchange only If you are going to dumb or ayylegal things with a phone and you don't want it to be directly connected to you, burners are a must. The othet option is joblots on ebay and you just take the risk that most of them won't work properly. Smart phones are tok much of a risk and leak waaay to much fuarrrking data so don't take the risk unless you want to experiance the taste tax funded SI boot when they kick your door down for wrongthink phone posting on chinese smug female databases.

I do a delivery job that requires my location to be known and tracked at all times I am logged in. I need to access it quick as Im bombing around so no unock code either. So none I guess. I jst keep it strapped to my arm so it doesnt smash in the road so theres that.

>>1278 I've been using lineageOS+Gapps but going to switch to this and take privacy a bit more seriously going to try BARIA from F-DROID to back up apps, I'll post results for anyone interested >>1284 sounds fuarrrking awful, if you want to try and change things it will probably be pretty hard, but joining a union may be a good start

>>1278 There aren't any open source clients for WhatsApp. They use a propetary modified version of the XMPP protocol for the app.

>>1278 The youtube client you are referring to is Newpipe. With the app, you can play videos in the background as well as download them.

>>1289 I wouldn't trust Lineage with anything, i think for security & privacy you are better of running AOSP

>>1292 Why wouldn't you? Lineage is open source too and you can audit the security if you want. It has a error reporting tool but it's completely removable too.

>>1293 because it is a false sense of security and LineageOS has been called out multiple times for incorrectly using Android security patches. Also phones that aren't officially supported anymore don't get any driver updates from like qualcomm. The entire Android ecosystem is trash and won't be resolved anytime soon sadly.

>>1271 Use IceCat/Firefox and download some addon to spoof it. Nearly all addons that work on Firefox desktop work on mobile.

Lets say SWIM is on the run across the United States, in a state far away from where they were last seen. What model of phone should this person get, where should they get it, and what should they do software-wise to mitigate tracking and keep them anonymous?

>>1297 What's your threat level? Private person? Corp? Police? Alphabet soup? NSA ? If the latter you are better of without one.

>>1296 Thanks, Lain!

I have a Samsung Galaxy S2. I run a Linage OS based ROM on it without any google apps and bloat. I get my software from F-Droid mostly. I don't have any social media apps too so it is very minimal.

>>849 I got a phone supposedly OEM, but it came with bootloader unlocking not allowed. It really is like kicking dead whales down the beach not being able to jump off of stock.

>>1297 the safest would be to buy a burner dumbphone with cash, then destroy it when you no longer need it

So, lains, what phones and cell carriers do you recommend? I'm interested in flashing a custom ROM onto my phone, which is damn near impossible with samsung and AT&T infesting it. I need a new one soon anyway. I'm mostly interested in this from a 'prevent corporate data mining' perspective, not an OPSEC perspective, since I would never trust a phone to be safe from a three-letter-agency.

>>1664 CopperheadOS is the only answer if you want something that is secure out of the box it also doesn't come with Google store.

>>1664 LineageOS is nice, update and it doesn't come with Gapps.

>>1670 >>1673 was more talking about phone hardware and carriers, not OSes.

>>1674 Pixel if you want a smartphone, so you can install copperheadOS on it and have decent security. The rest of the phones are utter soykaf if you want some hardware security. https://copperhead.co/android/docs/devices Or you can buy a iphone and have decent hardware security too ( better than Pixel ) for carriers i don't know.

>>1664 I recommend you to get only international versions of the phones, since they don't come with any of the bullsoykaf carriers usually add. Get them through import companies or import them yourself if you can.

>>1685 >The rest of the phones are utter soykaf The pixel's pretty expensive anon, and it rarely goes on sale. You can get unlocked versions of pretty much every smart phone on the market. They're usually marketed as the developer/pure android/international version (see >>1686). It won't be carrier subsidized but you are free to flash the bootloader/recovery partition and load a custom os. Idk what you mean by hardware security, but I can't imagine Google's in house phone is going to be better across the board than a similarly customized Motorola or LG. I will admit that I don't know dick about gsm modem isolation, manufacturer back doors, etc. My argument is that your cell phone is never safe from motivated cops, so don't use one at all if that's your concern. If you just want to keep the Google botnet at bay, then the cheapest phone that will let you run a non-gapps os will do.

>>1687 They are better than your average cheap smartphone, your looking at secure boot ( that you can verify ), driver support for Linux 4.4, Trusted Execution Environment ( to hold your encryption keys ), PXN for kernel hardening, and Pixel line uses FBE ( file based encryption ) instead of FDE. For one you should read : https://copperhead.co/android/docs/devices Custom soykaf is just going to hurt if you want decent security, that means no rooting, no custom bootloader, no custom OS that doesn't provide secure boot. Otherwise it's Iphone or Blackberry keyone.

I used to have a one plus two that was encrypted rooted riced and honestly pretty fuarrrking great cause I put in the time to fix it up. Then I dropped it in a pool. Now I use an xperia the cheapest one they had. I haven't done anything to it because I didn't have the time but this thing is like kicking dead whales down the beach. It's got AVG auto installed and it does absolutely nothing but take up space. Also I have a few apps and 4 pdf's and its so full of bloat that it cant download updates. I'm gonna root it and probably put copperhead on it and encrypt it.

>>1692 Fair enough. When it comes to phones, I've always been more concerned with privacy than security. I definitely had some blind spots and your link helped. If you don't mind explaining, I'm still a bit unclear on what kinds of attacks are mitigated by the technologies you mentioned. I don't expect the fbi at my door any time soon, and I don't keep anything on my phone that I can't afford to lose. Most of the security I use is at the app level, and is more to prevent snooping/data collection than outright data theft. If we assume that attacks requiring physical access to my phone are a negligible concern, what would I gain from using copperhead instead of lineageos or similar.

>>845 Nothing fancy. I've got a cheap android phone with encryption turned on and a pretty long password. For ease of use I've set up fingerprint unlocking as well. It's a compromise, but I feel it's okay since I need to input the full password once a day and every time I restart the phone (like when crossing borders perhaps).

>>1720 that kinda makes encryption useless... I have a long password to decrypt the phone on start and a 4-number pin when the screen is locked

>>1721 Seems about as safe as your solution? It stops casual thieves, border control and some law enforcement. Remember, I have to input the full password once a day and every time the device is restarted.

>>1722 sorry, I read it wrong

>>915 Also look up SnooperStopper in F-Droid. It allows you to do the same thing in other roms.