this post was submitted on 28 May 2024
46 points (91.1% liked)

Privacy

31833 readers
112 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
46
Pixel 8A and Grapheneos (lemm.ee)
submitted 5 months ago by [email protected] to c/[email protected]
68 comments fedilink hide all child comments
 

Hello guys. I recently acquired a Pixel 8A and it was Google stock os I bought it from a man locally all with cash I brought It home and I flashed grapheneos onto this phone.

What else needs to be done to anonymous this phone and make it a privacy phone and a spy free phone no tracking phone no interception phone and no monitored phone.

Any advice welcome!

Thanks.

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 1 points 5 months ago

(OP can ignore this comment)

I'm a bit upset that GrapheneOS does not follow OpenBSD: ignore any person hating it, ignore anyone who wants to interferes with project personnel and donations like usa is doing on Viet Nam like they are speaking for the Vietnamese, and don't care if the feature works "for you" or not, just going on code improvements & maximally free code. And do whatever Micay want to do. Accept donations from whatever company. There's so much dramas. But they already achieved over-detailed documentations. Focusing on unprivileged google play is the true path, since the demand on google play is much larger and other "private" apps repos are expected to work on the "privacy" people's phone.

Maybe because GrapheneOS haven't made any world-significant project that every companies depend on so that companies have to put so much money on the project.

[–] [email protected] 6 points 5 months ago* (last edited 5 months ago) (2 children)

Start with the basics. Use a VPN preferable a good one payed in crypto /XMR or cash. Use Foss apps only check out F-droid.

Also one that blocks malware and ads. If not use adguard.dns or other that filter traffic

Settings , disable 2-3 G if you always have access to 4-5 G .

Don't change add browsers use vanadium. No gapps obviously.

The more challenging is to just use it as WiFi phone without SIM.

[–] [email protected] 3 points 5 months ago (2 children)

Vanadium doesn't have good/any fingerprinting protection. Cromite or Mull would be better, Tor would be best.

[–] [email protected] 3 points 5 months ago* (last edited 5 months ago) (2 children)

Why would you use Chrome webview plus something else? You can't replace just pile on. Not a good idea. https://grapheneos.org/usage#web-browsing

[–] [email protected] 2 points 5 months ago

I read your source and am not convinced. While I do agree that piling on modifications is often fruitless and counterintuitive, Vanadium doesn't have the Fingerprinting protection necessary to create a crowd. At best it can create many islands of crowd for each physical device graphene supports, for each version of the software installed, and only assuming all other method of fingerprinting don't work (for some reason theoretically for the sake of this best case scenario). Read cromite's patch list to see some of the changes needed to produce basic anti-fingerprinting (still not good enough to create a crowd).

[–] [email protected] 2 points 5 months ago (1 children)

Dont use system webview as your default browser. Webview is used by apps, your browser can and should be changed if privacy is your goal. Vanadium may be hardened, but it lacks any fingerprinting protection.

[–] [email protected] 2 points 5 months ago (1 children)
  1. That makes no sense.
  2. Vanadium have a different approach than trying to block it , blend in instead.
  3. Gecko based browser have crap sandboxing
  4. Again if you have 1 problem adding 1 more makes 2 problems.
[–] [email protected] 1 points 5 months ago (1 children)

Your system webview is for in app usage. You aren't browsing the web using your system webview (generally). You can't blend into a crowd if you have no anti-fingerprinting. Firefox does this through RFP by normalizing settings between users, and on mobile there is partial support for screen size normalization through letterboxing. Vanadium isn't special, it is hardened chromium with some specific patches. You cannot form a crowd without special a lot of anti-fingerprint patching. See my other comment for details.

Firefox is missing per-site process isolation. This is theoretical an attack vector in the presence of multiple other major vulnerabilities. It has never been shown to be an attack vector in real world vulnerabilities. Don't call Firefox's sandboxing crap if you don't know why people have said that.

[–] [email protected] 2 points 5 months ago (1 children)

You can’t blend in with a crowd of vanadium users with the amount of data points given away by the browser. Your fingerprint will be decernable from other users. Without actual anti-fingerprinting, which theoretical can allow for a crowd only when fingerprinting of user browsers results in the same fingerprint ID, the best you can hope to do is thwart naive fingerprinting. Vanadium doesn’t have any anti-fingerprint built in, so the slightest differences between user can be used to easily fingerprint. Vanadium

Anti-fingerprinting? By blocking javascript which the half-hearted privacy users can never afford? hahahahaha. Even privacy projects spread dirty javascripts.

[–] [email protected] 1 points 5 months ago (1 children)

Anti-fingerprinting isn't as simple as blocking JavaScript. There are dozens of other parameters. You can fingerprint with pure CSS. When I say anti-fingerprinting is necessary for a crowd, I am referring to data normalization. Like Firefox's Resistant Fingerprinting and letterboxing. I find most of RFP's effects unobtrusive, but it always for a crowd to form in specialized cases. Only Tor browser and Mullvad can reasonably form a crowd.
I dont know what you mean by privacy projects spreading dirty JS. I recommend you read up on actual anti-fingerprinting techniques. Your knowledge of anti/fingerprinting seems limited. Basic anti-fingerprinting is necessary on the modern web, same thing with a content blocker. Security and privacy sometimes come at the cost of convenience, but not always.

[–] [email protected] 1 points 5 months ago

I dont know what you mean by privacy projects spreading dirty JS

They are using js in their websites

[–] [email protected] 5 points 5 months ago (1 children)

Vanadium is purposefully made this way. It tries to minimise profiling by making your actions noise in a big mass of users. That only works if you use the standard config without anything to discern you.

Mull is the other extreme of this. They try to eliminate fingerprinting by reducing the amount of trackable things in your browser.

It's hard to say what really is the better option. You can't completely eliminate fingerprinting, and the more you try, the more you will stick out of the masses.

[–] [email protected] 4 points 5 months ago* (last edited 5 months ago)

You can't blend in with a crowd of vanadium users with the amount of data points given away by the browser. Your fingerprint will be decernable from other users. Without actual anti-fingerprinting, which theoretical can allow for a crowd only when fingerprinting of user browsers results in the same fingerprint ID, the best you can hope to do is thwart naive fingerprinting. Vanadium doesn't have any anti-fingerprint built in, so the slightest differences between user can be used to easily fingerprint. Vanadium also has no strong method of in browser content blocking (eg an adblocker like uBlock) which is required on the modern web to remove JS tracking scripts (or straight allow and deny lists for specific web contents). Adblock is cyber security: https://www.ic3.gov/Media/Y2022/PSA221221

Examples of metrics include, but are not limited to, the following: Timezone, system and browser fonts (often automatically fetched by websites as a remote font that is cached by the browser), language, screen metrics (DPI, height x width, refresh rate, pixel ratio), canvas, CSS fingerprint, useragent, browsing mode (standard/private), video autoplay policy, audio device fingerprinting, installed plugins, cookie policy, device theme, and of course IP.

As a graphene OS vanadium user, assuming that the browser stays default, you would still have screen, audio, other hardware metrics, canvas (this one is a killer), IP, user agent (differences in installed versions of plugins and vanadium itself), timezone, remote Fonts, and others. Fingerprinting is an insane science which needs actual protection against to even begin hoping to create a crowd.

See some more details below.

Info on fingerprinting (about choosing a desktop browser but still relevant info): https://www.privacyguides.org/en/desktop-browsers

Browser comparison: https://divestos.org/pages/browsers

Fingerprinting test site: https://abrahamjuliot.github.io/creepjs/

[–] [email protected] 3 points 5 months ago (1 children)

I have a sim card in this phone. The sim card is one I heavily rely on. I have disabled the option for disable 2G in sims is this good? Even without the LTE mode as my phone doesn't seem to have this.

I don't have any crypto / XMR and in this case, shall I just set the DNS you recommended me without any VPN and just always use that? Thanks.

[–] [email protected] 3 points 5 months ago (2 children)

I used adguard.dns before now I have VPN that have DNS filter. Disabling 2-3g minimize attack surface but just a small thing use 3 g if you need it. You can use both private DNA in settings and a free VPN if you want.

[–] [email protected] 2 points 5 months ago (1 children)

Are you recommending I change Preferred network type " to 3G? other options are 4G only 5G ( recommend ) 4G if I use that DNS with what VPN u recommend, and have allow 2g disable am I good?

[–] [email protected] 4 points 5 months ago (2 children)

It's only an attack surface minimation , security is better on new generations. I use all since I am in the middle of nowhere. If you don't need it disable it, otherwise let it be

[–] [email protected] 2 points 5 months ago

Its preferred network type 3g and allow 2g disable and I use dns.adguard.com am I good now mate?

[–] [email protected] 2 points 5 months ago

I have the DNS set to the one you said and the preferred network type set to 3g and the VPN calyx VPN, am I good now?

[–] [email protected] 2 points 5 months ago (1 children)

If I use adguard dns in my phone settings, what is best free VPN to use with it? Other than proton / Riseup?

[–] [email protected] 2 points 5 months ago (1 children)

Proton riseup and calyx comes to mind.

[–] [email protected] 2 points 5 months ago

I had to put dns.adguard.com and my preferred network is 3g with Allow 2g disable is this good always? And Riseup vpn

[–] [email protected] 5 points 5 months ago

I use TrackerControl (f-droid).

It's an app that can turn off entirely internet access to an app or granurarly tweak which domains can comunicate with.

load more comments
view more: next ›