What are you trying to accomplish?
You capitalized spy, surveillance and hardened but I’m not aware of any specifics those words bring to the table when applied to phones.
this post was submitted on 04 May 2025
38 points (86.5% liked)
Privacy
37690 readers
1494 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
If you're serious about Android privacy, check out ReThink! It blocks everything by default and lets you control exactly which apps or IPs can connect. https://github.com/celzero/rethink-app
What settings are best to implement using rethinkdns is there a good setting / way to configure it. One you can recommend?
Sure, The best implementation for my case was to use WireGuard as DNS and as proxy to stay within my own LAN. Then I enabled the firewall to block everything except LAN network connections. This can be done by going to settings, universal, and enabling everything, then creating an IP rule for 192.168.1.0/24 (and/or network settings 'do not route private IPs'). You’ll see the logs/stats flood with connection requests. Create whitelists of your apps/stuff you trust from the log and allow only those. I’m certain this is a blunt way to do what I wish to have done, but I simply do not want anything to update or connect to anything besides my own self-hosted services and a couple of developers I trust.
if you're using CalyxOS it is not hardened.
Yep, even LineageOS + MicroG is more secure (providing you have custom keys + avb), but it definitely is more private than stock.
Hands down the most advanced and secure smartphone os is grapheneOS.
It only runs on pixel devices. App sandboxing, buffer overflow protection, separate users, optional sandboxed google play if you need it for banking apps, automatic reboot after a set time to re encrypt your filesystem, assigning permissions for app access to folders and the list goes on and on.
If you are looking for a hardened phone, I would consider trying GrapheneOS for a bit, see if it does what you are looking for. Uses SELinux and a seccomp-bpf policy for app sandboxing, as well as runs a hardened kernel with a hardened memory alloc. Great isolation approach, too, so that you can run apps on a 'completely different phone,' so to speak -- think of the isolation like a small version of the OS that can keep apps entirely separate. Finally, if desired (and needed for certain apps), you can sandbox all Google services so that they don't have direct access. It's is a different approach to, say, microG.
GrapheneOS is all about hardening. Security is solid.
VPN wise, Mullvad wireguard servers are also solid. You can do multihops, which help you obsfucate traffic to degree. They have also been playing around with packet shaping (if you use their app directly).
Sim cards can be swapped out if use a VoIP service like jmp.chat.