(untitled)

I need to install this for business reasons and am looking for the most sanitary way possible to do it. I've removed most personal data from my phone, but I need my contacts, SMS and Matrix client on it, and therefore must secure them. Here's what I've found so far: Shelter - Isolates apps in a work profile. It's a bit buggy but I know of no alternatives, so I plan to use it https://f-droid.org/en/packages/net.typeblog.shelter/ OpenContacts - I thought this could add an extra layer of protection to my contacts, but it requires internet access which opens up an unnecessary risk https://f-droid.org/en/packages/opencontacts.open.com.opencontacts/ Anyone have any suggestions? What else can I do in order to be able to use WhatsApp while handing Facebook the least access possible?

>>8520 You MUST at all costs compartmentalize your soykaf. Keep it all on separate work profiles, phones or whatever. As long as you don't mix in personal data with work data you'll be mostly fine. You could also virtualize android x86/ the whatsapp desktop client

>>8523 Unfortunately I don't see any way to have more than one work profile. My plan is to have WhatsApp in it and everything else outside. However the protection Shelter grants me feels too weak to run untrusted proprietary code. I am actually considering getting a cheap phone just for it, but that means I'll need another SIM card as well, which adds a monthly cost. Virtualizing Android x86 might be a good idea (better isolation than Shelter), but then I'm running untrusted code in my desktop instead, which is even worse. Also, I'm not sure how well Android works on FreeBSD/bhyve and how I'm supposed to use a SIM card with it.

Would be practical for you to install the app on a cheap, used android phone that has nothing else on it? This obviously won't work if you have many things that you are required to have installed, which you would want quarrantined. If you have root access, have you considered installing multiple mobile operating systems which can't know anything about each other? Another idea is to install it on a laptop or desktop running unix, where you can quarrantine it by forcing it to run on only underpriviledged users, emulating android if necessary. There may be some work to get a secure interface between it and your usual user account. Since android is on a linux kernel, which is unix, you might be able to get a terminal emulator, shell, and other unix utilities, set up such a quarrantine. (Is it obvious that I'm just a 'theory' guy? I have no idea how any of this would be implemented, except from scratch. What utilities are available, what the available utilities are called, etc.)

Do you need to get whatsapp push notifications or can you just check it a few times a day and be fine? If its the latter the simplest solution is probably just using a second android user account for your work soykaf. If there's a whatsapp desktop app thats probably easier to keep partitioned than the phone app so you could install the phone app on a secondary android user profile (trusting android to keep the user accounts adequately partitioned) and then use that partition to set up whatsapp do the SMS auth etc. and then pretty much exclusively use the desktop app.

>>8520 >I need to install this for business reasons and am looking for the most sanitary way possible to do it. No way, Android lets connecting your data with IMEI number, so someone is still able to connect the data with you, even though you don't have other things installed. The most secure way to do this is to buy a new phone only for the purpose of using compromised application, then selling it or even better, throwing it away, but they can still connect the data with you, by ultrasounds - other devices (for example your old phone) can emit these sounds to make sure that two devices are in the same room.

buy a cheap phone with a phone plan for $30/mo if in the US ,there are euro equivalent plans or otherwise. Then install the APK without google play, I cannot confirm the integrity of the file, but there are google play store downloaders that enable you to get the app without having the google on your android. alternatively use an android emulator on your work computer?

Android x86 in a VM is almost unusably slow in my experience but its probably the best compromise between convenience and privacy provided that you don't need to actually do much with the phone app beyond tether it to the whatsapp desktop client and respond to the occasional account security push notification. This may or may not be relevant to you but its good information to have: one of the few ways to get a Google account without providing a phone number is to make it through the android setup wizard thing that runs whenever you make a new user account. So on android x86 you don't have to sign in to any existing Google accounts you might have tied to your identity. You do however need a phone number to use Google voice, but that phone number does not need to be capable of receiving SMS, it need only not be tied to an existing Google voice number (idk if you can daisy chain Google voice numbers). In general the verify by voice option seems to be more permissive than the verify by SMS so always use that. At work do you have a handset with a private extension in your cube or something? If so you could use that to get a Google voice number on your fresh account and then use that number to register with whatsapp (I also don't know if whatsapp offers account verification over voice calls or if its just SMS). Out of curiousity, has anyone ever tried running android x86 on actual hardware? I ditched Google play services on my new phone and Im expecting this to eventually become a problem so I was thinking of running spyware android on an old laptop or something for situations like OP's (to avert the aforementioned performance issues that come with running it in a VM).

>>8538 I have great speeds on android x86 through KVM/QEMU. It's not as fast as real android but it's close. You can duel boot android x86 since it uses GRUB so go ahead

ran on x86 years ago worked can't share any juicy details wasn't into it

>>8524 Hey Lain not sure if you've solved your problem yet. WhatsApp works just fine on wifi. Get a burner sim or use yours just to register the number with whatsapp then run a tether from your main phone when you're away from wifi.. If you go the burner sim route you have one less correlation layer that can cross.

>>9223 also i forgot to add that pre-paid sim plans have a minimum recharge period: you can keep the number if you deposit a minimum amount in max time.

>>8524 Island for android. Use it.

>>8527 >If there's a whatsapp desktop app thats probably easier to keep partitioned than the phone app it's directly linked to your phone app, you need to have your phone online and logged in while you use it

>>8520 PSA - Do NOT use Shelter if you're planning to make TWRP backups - as of now, the app's work profiles WILL screw up your backups: https://github.com/TeamWin/Team-Win-Recovery-Project/issues/1373 If you have Shelter and you want to remove the work profiles, follow the uninstall procedure on the Shelter github, and then run these su commands to make sure the work profile is gone: https://www.reddit.com/r/LineageOS/comments/d2vvz4/does_work_profile_work_in_lineageos_16/ezzayac/ Currently waiting until TWRP devs fix this.

You can have what's app installed on a separate device but be connected to your original phone number. Might be able to avoid needing a second sim card this way. Although this would mean all the analytics collected through WhatsApp would still be linked to your phone number. But better than having the app on your phone going through all your messages.

You just run it in official android emulator with x86 image, pretty fast.

To hell with this crap. Even if there were a way to run WA 100% isolated and safe I wouldn't use it. If people want to contact me they can send me an e-mail or call me on the phone number they have. I'll give you back the equivalent cents off your phone plan's mileage. I don't understand what is it exactly that makes people stop talking to you if you don't join these stupid botnet apps. I don't want to work for employers who can't even be arsed to use an internal email or server instead of fuarrrking Facebook.

>>11626 > send me an e-mail From gmail address >call me on the phone number Plaintext unencrypted, costs ridiculous money which makes no sense when you already have an Internet connection, can be sniffed with $50 imsi catcher, police/tecos have full recordings and metadata logs they sell to everyone, your call recordings can be bought from darknet markets for under $100. >I don't want to work for employers who can't even be arsed to use an internal email or server instead of fuarrrking Facebook. Can you setup one and keep it functional for prolonged periods of time?

work profiles are false security why would scamsung give up such a juicy date mining opportunity

>>8520 Separate phone >>9820 Cross-profile data sharing is kaput on Android 10+. Only reason I'm on 9.

get lost in the data, if your important, you wouldnt be using whatsapp, if you are. lol.(Don't spill the soykaf.)

>>8520 if you're on android 10+ you can limit all contact/sms access into one app only and I think the default recently is that apps cannot read device identifiers anymore on 10+. Having gsf on your system though I think would grant some form API access for these apps to read identifiers. change your systemwebview to bromite webview. this eliminates device identifiers from leaking into the webview which most apps use for their webapps so they won't get much data for their crap. make sure webview's also cloned properly, doing this might break your webapps so do this when you've the time to spare making it work. shelter doesn't protect you from the clipboard access from work apps and personal space so you should use appopsx to block each app though you will need to install magisk in multiuser mode > user-independent to do it on work space, you might want to use magisk hide on whatsapp too. you can enable sensor quick tile on developer options to effectively block mic(except calls)/camera/gyro/etc for all apps. I think the option saves some battery life. disabler is a premium fork of icebox by rikka. although the interface is weird, you can use it to disable unwanted apps. don't forget to turn off work profile once it's not needed. I'm using afwall too although I don't advise on using one as it's a complete mess if you also use shelter.

>>9827 >shelter breaks twrp Oh I see now why my restoration broke. Good think my twrp fork doesn't wipe /data/media so my files were always there. >>9820 I think Island had google analytics or some tracker. Waiting for f-droid to recompile it clean. >>11968 >kaput on Android 10+ 9 also had similar issues. Just use the root file manager of your choice and access /storage/emulated/useridnumber The only problem with shelter is most apps installed in it would have denied permissions for storage and installing unknown apps which you have to enable first. >>8528 >IMEI Android 10 didn't have that issue anymore. You're fine unless if you have gsf core or use some vendor modified AOSP. >connect the data Wifi probes are enough for that pretty much like covid bluetooth tracing probes (wireless turning-on on its own to check/log devices by proximity). You can even run wifi pentest to view smartphone behavior and you'll see that most smartphones would at random intervals send short wifi probes with a different mac address for reasons only the oem/vendor knows but it's similar to how covid bluetooth works, it's also eerily using the same channel as the closest active router so they're phoning each other or something? Maybe it's the location accuracy thing that uses wifi/bluetooth and it's looking for gps coords which some wifi routers like to broadcast. If you did compartmentalize with another vanilla phone, that phone would have collected information on how strong/close the other device is, which routers it connected into with those stealth probes.