I prefer mild privacy with emphasis on convenience for my phone so I wanted to share my Android setup. By no means is this the most effective and hardened setup and you must always treat your phone as if you were being spied on if you don’t have absolute control over it. Even then, security vulnerabilities are still an issue.

This is a merely a beginners guide to those who may want to get their feet in the door with privacy or simply want to build a more private phone than the setup they already have. Running Android in the first place isn’t a good idea if you want to be truly away from prying eyes.

Open Source List:

F-Droid – App store for only Free and Open Source apps.

– App store for only Free and Open Source apps. Yalp Store – Download APKs directly from the Google Play Store. Good for those who don’t want to sign-in to the Play Store or lack Google Play Services.

– Download APKs directly from the Google Play Store. Good for those who don’t want to sign-in to the Play Store or lack Google Play Services. Shelter – Isolate apps into Shelter sandbox. (Auto) Freeze/Unfreeze capabilities. I like to create a static icon of each app that can auto unfreeze frozen apps when clicked on the home screen and use the freeze all apps icon readily available. Great for seldomly used apps that don’t need to run in the background like Venmo, banking, GoPro, proprietary security camera apps, Uber, etc.

– Isolate apps into Shelter sandbox. (Auto) Freeze/Unfreeze capabilities. I like to create a static icon of each app that can auto unfreeze frozen apps when clicked on the home screen and use the freeze all apps icon readily available. Great for seldomly used apps that don’t need to run in the background like Venmo, banking, GoPro, proprietary security camera apps, Uber, etc. NetGuard – VPN Firewall. Google Play Store version doesn’t allow the Ad Block using a hosts file feature so you can get the version with ad blocking from the official Github repo. You can also see logs to see which apps are using data in the background (Uses a bit more battery). Per app options include block all internet access, allow internet access or only allow internet access when screen is on (Customizable delay available).

– VPN Firewall. Google Play Store version doesn’t allow the Ad Block using a hosts file feature so you can get the version with ad blocking from the official Github repo. You can also see logs to see which apps are using data in the background (Uses a bit more battery). Per app options include block all internet access, allow internet access or only allow internet access when screen is on (Customizable delay available). K-9 Mail – You definitely want to keep your emails private and using closed source clients is risky. You don’t know if they can access your emails or not. K-9 Mail is a great email client to ensure your emails are safer than closed source apps. (K-9 Mail also has a fork with a material design on F-Droid).

– You definitely want to keep your emails private and using closed source clients is risky. You don’t know if they can access your emails or not. K-9 Mail is a great email client to ensure your emails are safer than closed source apps. (K-9 Mail also has a fork with a material design on F-Droid). AnySoftKeyboard – Your factory keyboard might have a keylogging capabilities and there is no way to know if it is transmitting data (Passwords, messages, private data, etc.). AnySoftKeyboard is an open source alternative that doesn’t submit any data and is one of the most customizable open source keyboards currently available.

– Your factory keyboard might have a keylogging capabilities and there is no way to know if it is transmitting data (Passwords, messages, private data, etc.). AnySoftKeyboard is an open source alternative that doesn’t submit any data and is one of the most customizable open source keyboards currently available. Firefox – Backup browser only when I need all my bookmarks and use sites that require a password. (I know I know, I should use a real password manager…). An excellent guide to create a more secure and private Firefox experience can be found at PrivacyTools.io.

– Backup browser only when I need all my bookmarks and use sites that require a password. (I know I know, I should use a real password manager…). An excellent guide to create a more secure and private Firefox experience can be found at PrivacyTools.io. Brave Browser – Blocks most ads and trackers. It is my main browser for surfing anything not requiring logins or bookmarks.

– Blocks most ads and trackers. It is my main browser for surfing anything not requiring logins or bookmarks. Firefox Klar Browser – An alternative to Brave as a daily browser and has user activity tracking disabled by default that Firefox Focus includes but lacks ad and tracker blocking features like Brave.

– An alternative to Brave as a daily browser and has user activity tracking disabled by default that Firefox Focus includes but lacks ad and tracker blocking features like Brave. Turtl – Open Source & Encrypted note taking app.

– Open Source & Encrypted note taking app. Vinyl Music Player – A lightweight and customizable music player app to play audio files.

– A lightweight and customizable music player app to play audio files. QKSMS – Excellent SMS app and highly customizable. (Personally still using Google Messages for the ability to send and read texts from my desktop browser. If anyone has a better recommendation to do that, please let me know.)

– Excellent SMS app and highly customizable. (Personally still using Google Messages for the ability to send and read texts from my desktop browser. If anyone has a better recommendation to do that, please let me know.) NewPipe – A direct replacement for Youtube that also allows you to download videos or as audio files, play in the background, SoundCloud integration, and much more.

​Tor on your Android:

Orbot – Tor network for your Android

– Tor network for your Android Orfox – Android Tor browser

– Android Tor browser orWall – Force selected applications through Orbot while preventing unchecked applications to have network access using iptables rules.



​If you are rooted:

XPrivacyLua – Instead of disabling permissions for apps, you can feed them fake data. It is the successor to the old XPrivacy. XPrivacyLua requires the installation of the Xposed Framework. Installation instructions can be found on the Github Repo README.

​Not Open Source List:

Package Disabler Pro (Paid) – Disable unwanted or infrequently used apps.

(Paid) – Disable unwanted or infrequently used apps. GSAM Battery Monitor or BetterBatteryStats (Paid*) – Monitor which apps are using battery and wakelocks. (I forgot why but I am using GSAM if anyone cares. Tried BBS but switched back to GSAM. After tweaking my phone so much, I forget things).

*The XDA version of BBS is free.

or (Paid*) – Monitor which apps are using battery and wakelocks. (I forgot why but I am using GSAM if anyone cares. Tried BBS but switched back to GSAM. After tweaking my phone so much, I forget things). *The XDA version of BBS is free. Tasker – Good app for automation and can automatically turn off WiFi, Location, Bluetooth, etc. or run apps if needed to help secure your phone and make your day-to-day life easier.

Settings:

Disable unnecessary apps

Disable unnecessary permissions for active AND disabled apps

Disable Nearby device scanning

Disable Lock Screen shortcuts

Disable Background Data Usage for apps

Disable showing notification content on Lockscreen



Enable Lockscreen and have it protected

Disable Fingerprint Reader



Disable automatic cloud backups

Use long direction lock pattern instead of pin (Using pin code could leave visible fingerprints)

Encrypt your SD Card

Utilize encrypted communication when possible (Signal)

Use a reputable VPN (OpenVPN for Android) – Will not work with NetGuard

Enable Secure Startup to require passcode to startup phone (Pre Operating System)

Disable Background Activity for apps

Turn off screen after X time (In case you leave your screen on)

Optimize battery usage for apps

Location Accuracy to GPS only

Disable Find My Device

Enable App Permission Monitor (Notifies you and logs history of which apps used what permissions)

Disable Make Passwords Visible

Enable Auto-Update Security Policies (WiFi and Mobile Networks)

Disable USB Debugging

Change USB Cable Plugged mode to Charge Only mode until MTP is needed (Extra precautionary measure)

Go through your Google account settings and disable as much as possible (Search History, Personalized Ads, Location History, etc.)

Use a privacy respecting search engine instead of Google (DuckDuckGo)

Get a privacy filter for your phone screen

Use 2 Factor Authentication

Some features and settings may not be available to all Android users.

I am using a Samsung Galaxy S8 and using the Samsung Secure Folder for social apps that may need to run in the background to receive notifications (social media and chat apps). Secure Folder is Closed Source and owned by Samsung so definitely not best privacy-wise but I figured having the 2nd sandbox, alongside Shelter, would be good to have so I can easily move files and pictures in and out. Shelter currently lacks the capability to grab files from the main unsandboxed part of Android but that may change with a future release.

Running a fully open source ROM with XPrivacyLua would make things much more private but WiFi calling is a feature that I need due to the 1 bar of cell phone reception that Verizon gives me at my home.

Operating Systems:

For those who want something better in terms of privacy, look into replacing your stock ROM with an open source operating system like SailfishOS.

Rattlesnake OS, which spawned after Copperhead OS fell apart, looks interesting but it is still in its infancy. The Rattlesnake OS developer made a note that it isn’t a true successor to Copperhead OS because it lacks the security hardening features and created it to have another privacy conscious OS on his phone. Here is a Reddit comment from /u/Vys9kH9msf (Rattlesnake OS Developer):

RattlesnakeOS dev here. Please note that this is not really the successor to CopperheadOS, as it is not created by the original dev (Daniel Micay) and doesn’t have any of the security hardening features that were implemented by him. I needed an OS to install on my phone after CopperheadOS fell apart, so this was my solution. Also worth noting is that there are no public binaries of RattlesnakeOS to download and install and instead uses a tool, rattlesnakeos-stack, that provisions all of the AWS infrastructure needed to automatically build your own RattlesnakeOS on a regular basis. RattlesnakeOS is stock AOSP with a few additional features: verified boot with your own keys, OTA updates, latest Chromium (webview + browser) with patches from Bromite for ad blocking/enhanced privacy, F-Droid (with privileged extension), and no Google apps.

LineageOS is also an alternative, but there have been some concerns raised by /u/DanielMiay (Copperhead OS Developer) on Reddit:

It significantly weakens the SELinux policies, rolls back mitigations for device porting / compatibility, disables verified boot, lacks proper update security including rollback protection, adds substantial attack surface like FFmpeg alongside libstagefright, etc. They merge in huge amounts of questionable, alpha quality code from the Code Aurora Forum repositories too. Many devices (including Nexus and Pixel phones) also don’t get their full firmware updates shipped by LineageOS. It’s unrealistically expected that users will flash the firmware and vendor partitions on their own each month and of course that’s another incompatibility with verified boot and a locked bootloader.

If you’ve used it, you’re probably aware the endless churn and bugs which strongly reflects on the security since bugs are often exploitable. You don’t want to be using nightly builds / snapshots of software in production if you’re security conscious.

If you want something decently secure, use the stock OS or AOSP on a Pixel. The only real alternative is buying an iPhone. Verified boot and proper update security (i.e. offline signing keys, rollback protection) are standard and should be expected, but other issues like attack surface (i.e. not bundling in every sketchy codec under the sun, etc.) and SELinux policy strength matter too.

Phones:

For a full out-of-the-box privacy focused phone, the Librem 5 is an option but the release date has been pushed back to April 2019.



Miscellaneous Articles:

Article from 2003 about how often phone carriers hand over data to law enforcement. A bit outdated.​

Retention periods for the major phone carriers.​

MVNO Carriers use towers from the major carriers so you can see which company towers you are actually using and who is really handling your data.