📲 "Hey, Get The (Android / iPhone) App!" -- 🔒 But Should You? 🤔

Thanks for following along (thanks to those sharing links to videos / tutorials).

Every company wants us to: "get the app"...

But is an app the RIGHT choice... for everything?

Should you REALLY get the app? (spoiler: NO. 😛)

Is the App:"Just trying to offer new features / help"? Or seeking new paths of access for information gathering? In most cases, there are no additional features on the app compared to the website.

(So why get the app? 🤔)

Should You "Get The App"?

Answer: depends.

We know various apps track us (numerous techniques).

SUMMARY: DO NOT GET THE APP

• Compared To Permissive Apps (asking for permission to SMS msgs), Privacy Can Be Moreso Improved In Browser

  ---

  
  Accessing Services Through Apps Adds Variables:
  

• Apps request access unnecessary to their main functions (beware: some apps even request permission to modify other permissions - allowing them to undo your changes)

• access to sensitive parts of the phone

  - microphone, camera, pictures, files, SMS text messages...

• Apps with microphone access communicate using hidden ultrasonic sounds

  - SmartTV's come with a microphone - television broadcasting may communicates with apps on your phone (using combined speakers and microphone access)

APP DANGER: ULTRASONIC TRACKING

Beware apps that request microphone access without actually "needing" microphone access (ulterior motives likely at play... from recording conversation, to ultrasonic tracking)

STORY: 234 Android Apps Requiring Microphone Access Were Identified To Be Listening For Ultrasonic Beacons Constantly, Without User Knowledge (Braunschweig University of Technology in Germany). READ THE STORY HERE

CONSIDER. . .

Tor, I2P, Lokinet, may be tools offering protective measures for privacy online...

But, have you considered the risk of coordinated ultrasound (tracking through methods humans are unable to detect via senses)?

Running Tor Browser (ie: with Javascript enabled) could be sending hidden tracking beacon communications to your Android phone apps (remember the ones asking for microphone permissions? 🤫), coordinating to compromise user anonymity.

TIP: Tor Browser On "Safest" Mode When Anonymity Is Key (if not, at least disable javascript where possible).

When To Get An App?

Consider a financial app (for example) may be designed with additional security features, vs normal web browser..

This is where an (isolated) App could be a better option (isolate app maximally)

Outside that, we should focus on finding privacy friendly FOSS alternatives, where we can.

Avoid Apps:

• That exist to collect permissive access for major corporations

• That offer website access (allowing you to control browser environment

• Where you cannot control app permissions

• Where a FOSS alternative is viable

Browser Risk

• MiTM (browser redirection, browser hijack (bettercap, BeEF toolkit).

• Not everyone will catch a browser attack in the act (ie: phishing)

• Not sandboxing leads to tracking (a 'sandbox' allows you to run something inside controlled environment space, separated from sensitive system files and hardware)

What To Install

• If Android / iPhone user, install only apps you really need (take advantage of transparent, FOSS licensed apps where possible to meet needs)
  

  Example: consider an open source internet radio app, instead of alternative music apps pushing for many permissive requirements

• Apps can be are our greatest privacy risk (some have access SMS txt messages, photos, calls, cameras - many sell your location data)

• If you have a dedicated PC you feel trustworthy, accessing personal services via this device can be ideal.

• try sandboxing for personal services (browsers offering this / Bubblewrap / Firejail)

  -allows you to choose if you wish to share your identity and other interests / browser history

SOLUTION: Old Smartphone / Tablet Device For App Isolation

• Install apps on old Android tablet / phone (as I have been doing last few yr for 'work' related apps)

  
  I have one Android I have used for recording video / photos.

  Another one is dedicated to apps I don't trust (isolating access, data from the app)
  

  This may be a potential solution for you if you have old smartphones with no sim card.

  TIP: Reset the phone to factory FIRST. This ensures no old data connects you to it.

  
  If using standard Google based Android, setup with a BRAND NEW gmail account, connected to nothing associated with you.
  
  (Android with Google asks for your gmail address to sync. By using the brand new gmail account, nothing connects back to you)
  
  For those able, another flashed Android OS is an option.

  ---

  SOLUTION: Separate Data Using Containers (Librewolf [Firefox Fork] Pictured)

Utilize built in containers inside a browser like Librewolf, a privacy focused browser based on Firefox:

Linux Users SOLUTION: Sandbox Browser Sessions With Firejail:

Run Firefox Inside Temp Dir (restricts access outside):

firejail --private firefox

Run Firefox With Dedicated Sandbox Directory:

firefox --private=/home/Justin/ffpersistent firefox

Changing habits (including apps with access) is among the most important steps to protecting ourselves online.

Share and Question Everything. Thoughts Welcome.

(original content Supported by sharing posts, video + coffee ☕ ❤️)
We know various apps track us (numerous techniques).