Staying private when using Android

[ghanwani]

For those making the switch that care about privacy, you might find this useful.

How to stay private when using Android | Proton

Android is one of Google’s most important tools for collecting data on users. This guide will help you improve your privacy on Android devices.

protonmail.com

 

[maxjohnson2]

My recommendations if you use Android phone and want to limit the tracking:

Enable Private DNS

This is the easiest option and will only take 60 seconds of you time to perform and you don't have to install any apps or extensions.

DNS is domain name system, which is like a phone book for the internet. All the network queries on your devices go through a DNS server. Depends on the privacy policy, some DNS services may log your activities and use them for marketing purposes. Android version 9.0 and onward have a feature called Private DNS, which lets you manually set the DNS server for your Android device.

This is where Adguard DNS come in. Adguard DNS services block known ads and trackers servers. It is like ads blocking, except it work for the whole device, or the whole network if you set it as your router's DNS. If you don't want to use Adguard, there are other reliable DNS servers to use. It really come down to the privacy policy of the services and who you choose to trust.

Instruction:
The Private DNS setting is located in Settings -> Network & internet -> Advanced -> Private DNS.
Select the option "Private DNS provider hostname", and enter in the field: dns.adguard.com

The Private DNS feature uses DNS-over-TLS, so you can't just enter the regular IP address of the server, instead use the address: dns.adguard.com
If you decides to use any other DNS service, just remember to use their DNS-over-TLS address, not IP address.

For iOS users, give DNSCloak a try which serves the same function.

Unfortunately using Adguard DNS mean websites and content creators won't receive ads revenue. There are other ways to support them such as Brave Rewards, Patreon/Subscribestar, and regular donations. Maybe you don't want to deny ads revenue to websites you want support, then consider a different DNS service that doesn't block all ads, but you feel is more respectful of privacy than Google or your internet service provider. Some services like Comodo Secure DNS offer more features for a fee.

 

[kazmac]

Wow. Great thread. Thank you both!

 

[maxjohnson2]

I'm going to update instructions above with screenshots to make it easier to understand.

 

[nickdalzell1]

The best method is just to outright disable Google Play Services entirely, get rid of all Google apps and side-load alternatives such as K-9 Mail, Firefox, or Textra.

Google Play Services is the privacy killer--have you ever seen the permissions list and what it's capable of doing in the background? It's scary. Disabling it will net you a ton more battery out the gate. Performance also comes up quite a lot.

If you actually believe you'll achieve any measurable amount of privacy just using Private DNS or a VPN with Google still tracking your every move, you're only kidding yourselves.

 

[IowaLynn]

Android is Google and the OS shows you and gives more control. Especially now in 10.

looking at Location Services - System services. Should be first stop. For now Airdrop broadcasting you and new wide area is to me for the birds. Apple gives the illusion but wants to hide what is going on also.

 

[maxjohnson2]

The best method is just to outright disable Google Play Services entirely, get rid of all Google apps and side-load alternatives such as K-9 Mail, Firefox, or Textra.

Google Play Services is the privacy killer--have you ever seen the permissions list and what it's capable of doing in the background? It's scary. Disabling it will net you a ton more battery out the gate. Performance also comes up quite a lot.

If you actually believe you'll achieve any measurable amount of privacy just using Private DNS or a VPN with Google still tracking your every move, you're only kidding yourselves.

...

I just wanted to make some simple recommendations. People who are looking at using Android free of Google will find better info at XDA Developers, where there are smarter people than me who can go deep into it. It's just too complicated for the regular person and can make the phone impractical to use.

I do think disabling Play services is the big one. But you forgot that many apps and websites uses Google and Facebook services or tracker. Stop using Google apps and services only doesn't stop them from collecting your info. Probably at least half of the free apps (regardless of OS) uses some kind Google or Facebook services.

I bought a Pixel 3a to test out using Android without Google Play services. Right now LineageOS doesn't support the Pixel 3a, it seems Google keeps making the security tighter so it gets harder to use their latest Android version, and I'm too lazy to compile Android from source especially the latest version seems more complicated than the past.

Easiest way on stock firmware is to just disable the Google apps. So it took me a few hours to figure out which Google apps is required for the phone to function properly at all and which to dismiss. After this, there seems to be no more unsolicited connections to Google unless I request.

Spoiler: You can use adb commands to disable these Google apps

Google services
pm uninstall -k --user 0 com.google.android.gms #Google Play Services
pm uninstall -k --user 0 com.google.android.gsf #Google Services Framework
pm uninstall -k --user 0 com.android.vending #Playstore
pm uninstall -k --user 0 com.google.android.googlequicksearchbox #Google app
pm clear com.google.android.gms
pm clear com.google.android.gsf
pm clear com.android.vending
pm clear com.google.android.googlequicksearchbox

Warning: For Android 11, on Google Pixel phones, it seems disabling "Google Play services" using this ADB command will crash the phone and require a factory reset to recover it. You can disable the app in the Settings instead. Google seems to want to bake in their services and make Android as hard as possible to use without.

Note: Disabling "Google Play services" turns off the over the air system update.

Communication apps
pm uninstall -k --user 0 com.google.android.contacts #Contacts
pm uninstall -k --user 0 com.google.android.dialer #Phone
pm uninstall -k --user 0 com.google.android.apps.messaging #Messaging

These apps may give Google your communication info, so I actually disable these and install the AOSP version of these apps. However these app relies on background service apps to function correctly, so not sure if that's another issue.

Necessary Google apps
Most of these apps are required for the phone to function properly.

com.google.android.apps.nexuslauncher #Pixel Launcher
com.google.android.webview #Display web content in apps, required for some web logins
android.autoinstalls.config.google.nexus
com.google.android.apps.enterprise.dmagent #enterprise
com.google.android.apps.safetyhub #Personal Safety
com.google.android.apps.work.oobconfig #Device setup
com.google.android.captiveportallogin #public login
com.google.android.carrier
com.google.android.carriersetup
com.google.android.configupdater
com.google.android.documentsui #File manager
com.google.android.documentsui.theme.pixel
com.google.android.euicc #Sim Manager
com.google.android.ext.services
com.google.android.ext.shared
com.google.android.factoryota
com.google.android.hardwareinfo
com.google.android.hiddenmenu
com.google.android.ims #Carrier services
com.google.android.inputmethod.latin #Gboard
com.google.android.markup #Screenshot editor
com.google.android.modulemetadata
com.google.android.networkstack
com.google.android.networkstack.permissionconfig
com.google.android.onetimeinitializer
com.google.android.overlay.googleconfig
com.google.android.overlay.googlewebview
com.google.android.overlay.pixelconfig2017
com.google.android.overlay.pixelconfig2018
com.google.android.overlay.pixelconfig2019midyear
com.google.android.overlay.permissioncontroller
com.google.android.overlay.pixelconfigcommon
com.google.android.packageinstaller
com.google.android.partnersetup
com.google.android.permissioncontroller
com.google.android.pixel.setupwizard
com.google.android.setupwizard
com.google.android.soundpicker
com.google.android.storagemanager
com.google.android.wfcactivation #Carrier config
com.google.euiccpixel #Sim Manager
com.google.omadm.trigger #OMA Device Management
com.google.RilConfigService
com.google.SSRestartDetector
com.google.android.grilservice

Unneeded apps
pm uninstall -k --user 0 com.android.chrome #Chrome
pm uninstall -k --user 0 com.android.hotwordenrollment.okgoogle
pm uninstall -k --user 0 com.android.hotwordenrollment.xgoogle
pm uninstall -k --user 0 com.google.android.GoogleCamera
pm uninstall -k --user 0 com.google.android.accessibility.soundamplifier
pm uninstall -k --user 0 com.google.android.apps.carrier.log
pm uninstall -k --user 0 com.google.android.apps.customization.pixel
pm uninstall -k --user 0 com.google.android.apps.diagnosticstool
pm uninstall -k --user 0 com.google.android.apps.docs
pm uninstall -k --user 0 com.google.android.apps.gcs #Connectivity Service
pm uninstall -k --user 0 com.google.android.apps.helprtc
pm uninstall -k --user 0 com.google.android.apps.maps
pm uninstall -k --user 0 com.google.android.apps.photos
pm uninstall -k --user 0 com.google.android.apps.pixelmigrate
pm uninstall -k --user 0 com.google.android.apps.scone #Connectivity Health Services
pm uninstall -k --user 0 com.google.android.apps.tips
pm uninstall -k --user 0 com.google.android.apps.turbo
pm uninstall -k --user 0 com.google.android.apps.wallpaper
pm uninstall -k --user 0 com.google.android.apps.wallpaper.nexus
pm uninstall -k --user 0 com.google.android.apps.wearables.maestro.companion
pm uninstall -k --user 0 com.google.android.apps.wellbeing
pm uninstall -k --user 0 com.google.android.as
pm uninstall -k --user 0 com.google.android.calculator
pm uninstall -k --user 0 com.google.android.calendar
pm uninstall -k --user 0 com.google.android.deskclock
pm uninstall -k --user 0 com.google.android.feedback
pm uninstall -k --user 0 com.google.android.gm #Gmail
pm uninstall -k --user 0 com.google.android.gms.location.history
pm uninstall -k --user 0 com.google.android.grilservice #?
pm uninstall -k --user 0 com.google.android.marvin.talkback
pm uninstall -k --user 0 com.google.android.music
pm uninstall -k --user 0 com.google.android.printservice.recommendation
pm uninstall -k --user 0 com.google.android.projection.gearhead #Android Auto
pm uninstall -k --user 0 com.google.android.settings.intelligence
pm uninstall -k --user 0 com.google.android.syncadapters.contacts #Google Contacts Sync
pm uninstall -k --user 0 com.google.android.tag #Tag Manager
pm uninstall -k --user 0 com.google.android.tts
pm uninstall -k --user 0 com.google.android.videos
pm uninstall -k --user 0 com.google.android.youtube
pm uninstall -k --user 0 com.google.ar.core
pm uninstall -k --user 0 com.google.audio.hearing.visualization.accessibility.scribe
pm uninstall -k --user 0 com.google.intelligence.sense
pm uninstall -k --user 0 com.google.vr.apps.ornament

Aurora store is Playstore mirror/frontend that currently work. Some Android apps relies on GSF (Google services framework) to function at all, such as Camera, I think GSF is benign. Many apps also require Google Play services. You just have to choose what to give up. Some apps like Signal requires Google Play services to activate, but works without it otherwise.

 

[nickdalzell1]

Unfortunately they locked down location services where you can't turn off everything. If you try taking the location off completely it says "Google Play Services is a location provider for this phone, check settings under app settings" and it redirects you to the permissions page of Google Play Services, which won't let you turn location permission off. If you do a search on how deep that particular app goes, it's scary.

I don't Pokemon Go or the like but all my apps work perfectly fine. None depend on Google:

1. American Express Serve: works
2. Little Caeser's: Works
3. Browser/contacts/phone/base apps: works fine
4. Maps: Works but tries to tell you to turn on Play Services, click outside that error and it works fine

Granted this is only tested on some cheap old tablets running 2.3 Gingerbread to 4.1 Jelly Bean, and a Samsung tablet running 7.1 Nougat, and a Galaxy S5 running 6.0 Marshmallow, and a Galaxy Note 2 on 4.4 Kitkat, but disabling everything Google doesn't harm anything I can notice. Camera and Messaging works, older versions of Facebook work (I hate the bloated newer versions) and Facebook Messenger works fine. I pull up the mobile Youtube in Samsung Internet (which works on non-samsung phones too) and no ads for it. Plays videos just fine.

Overall performance and battery life are much improved without Google Play. I use Aptoide or SlideMe (older phones) or F-Droid.

Now, I stopped using Android after version 9. I prefer old versions when I play around. After they put SafetyNet in place, the idea of rooting suddenly sucked. It's not even possible to root my Nexus 6 running Nougat without that stupid "Your phone is insecure and won't boot" screen popping up. I can custom ROM so long as I lose root though.

 

[maxjohnson2]

Google now allow flashing AOSP (vanilla Android with no Google services) from the web browser. No need to compile from source. It has to be one of the newer Pixel devices with bootloader that can be unlocked (meaning no Pixel sold by carriers). Just enable USB debugging on the Pixel, then go to flash.android.com. The website guides you through the procedure. It said you need a Chrome or Edge browser, but that means Chromium works too.

Also for people who want to update or restore Google factory firmware from the web browser, there's a link for that too: pixelrepair.withgoogle.com

Note that so far, these are only available in the US.

 

[giornall]

Most of the VPNs have adapted versions to both iOS and Android, but of course, you can look for some reviews that mention VPNs that are best for Android? Personally, I use Surfshark on my iPhone 8, but my dad uses it on his Android since we have a shared account, and it works just as well.

 

[j2048b]

In all honesty im not so sure there is something like a vpn, or "safe" email that isnt tracked, once u read a few articles i read recently

A dark web tycoon pleads guilty. But how was he caught?

I mean IF and since they went as far as they did, nothing is truly "safe"

 

[ghanwani]

A VPN is a Virtual Private Network. VPNs do help for both privacy and for security. But as the saying goes in the cybersecurity field goes, "There is no such things as 100% security". One of the most secure options is Proton Mail because it is not subject to the privacy laws of other countries and it also uses a high level of encryption to secure the data for the users who use their service. However, again, there is no such things as 100% security.

The makers of protonmail also have protonvpn. I don't use a VPN, though.