Designed Cybersecurity

Harden Your Cell Phone

Posted: . Last updated: .
Tag: Phone, Grapheneos, Android, Privacy, Security

Introduction

Goals:

Google Pixel Phone

One goal of this article is to run GrapheneOS. The phones supported by GrapheneOS Releases are currently limited to Google Pixel devices.

Pick the newest Google Pixel Phone that is on the list of GrapheneOS supported devices and is in your price range.

GrapheneOS

GrapheneOS is a privacy and security focused mobile OS based on the Android Open Source Project (AOSP). GrapheneOS currently only supports Google Pixel devices, so this article assumes that you have a supported Google Pixel phone.

Follow the GrapheneOS Install Instructions. This article does not cover the OS installation procedure. After you complete the GrapheneOS install, return to this article for information and recommendations on app stores, specific applications, and configuration settings.

App Stores

This section covers app store options within GrapheneOS and their preferred order for obtaining apps.

GrapheneOS App Store

The GrapheneOS App Store is extremely limited and only contains GrapheneOS maintained apps (Camera, Messaging, PDF Viewer, Vanadium, …); Accrescent (a private and secure Android app store); and several core Android apps from Google for users that want to install them in a sandbox (Google Play Store, Google Play services, Android Auto, Markup).

Install:

Do NOT install the Google Play Store, Google Play services, or the other Google apps unless absolutely necessary for your use case.

Accrescent

Accrescent is an Android app store focused on security, privacy, and usability. Accrescent is still in alpha, and doesn’t contain many apps. However, it is implicitly recommended by GrapheneOS via their app store, and it is a convenient way to install and update several apps.

Install:

As more apps are added, prefer installing apps via Accrescent instead of the following methods.

However, links to the GitHub releases are also provided in case you want to use Obtainium instead of Accrescent, you want to download APK files for an offline backup, or you want to review the source code.

Obtainium

The Obtainium website, wiki, and GitHub repository cover how to use the Obtainium app to install, update, and receive release notifications for Android apps directly from their respective release pages on GitHub, GitLab, and other sources.

Install Obtainium directly from the project’s GitHub Releases page. Since we are using a newer Google Pixel device and are avoiding F-Droid packages, you want the app-arm64-v8a-release.apk.

Once Obtainium is installed and granted permission to install apps, you can Add App and either directly enter an app source URL, search various sources for the app, or use the link at the bottom of the panel to search supported crowdsourced app configurations. The following list will either specify searching the crowdsourced configurations or will provide a direct repository URL to enter into Obtainium.

Install:

For a regular email client, you have a choice depending on your personal preference and exact needs:

Thunderbird for Android is simpler and integrates nicely with Thunderbird desktop. FairEmail has additional features, but is more complicated and cluttered as a result.

If you want a terminal emulator with Bash and packages for various command-line tools, install the Termux app and some of its add-on apps.

Google Play Store

Some apps are only available from the Google Play Store.

Use Aurora to install:

F-Droid

The PrivSec article on F-Droid Security Issues and the Privacy Guides article on Obtaining Android Apps describe multiple problems with the F-Droid app store.

This article avoids using the F-Droid app store in any way.

Configuration

System Text-to-Speech

Text-to-Speech (TTS) support is required for turn-by-turn voice instructions in GPS navigation apps.

The following steps will temporarily grant the Google TTS app network permissions, download the data files for your selected voices, reduce the number of cases where the app will try to use the network, and then revoke the network (and all other) permissions. Once complete, you will have a completely offline TTS app.

Navigation App Text-to-Speech

Once the system is configured for Text-to-Speech (TTS), the GPS navigation apps must be configured to use the system’s TTS features.

Configure Organic Maps

Configure CoPilot GPS

Consistency and Usability

Termux

Termux Specific Examples

Producing Text-to-Speech (TTS) voice output:

termux-tts-speak "This is a test."

SSH and File Transfer to the Phone

On the Phone

On the phone, inside the Termux app:

Start the OpenSSH daemon (sshd). The daemon will listen on port 8022.

sv up sshd

Find the username you need to specify when connecting. The output will be something like u0_aNNN.

whoami

Find the phone’s IP address in GrapheneOS, or find the IP from the Termux command line.

ifconfig

See the next section on transferring files from a computer where you have a bigger screen and a keyboard.

After you have finished all of your remote sessions, stop the OpenSSH daemon.

sv down sshd

On the Computer

Connect to the phone with ssh (to port 8022) and enjoy a full screen and keyboard for configuring the environment. Replace the username and IP address with the values obtained from the phone.

ssh -p 8022 u0_aNNN@phone-ip

Use rsync over ssh (to port 8022) to transfer files. The following example synchronizes a music library under ~/Music to the Music folder on the phone. Adjust the source directory on the computer as appropriate. Replace the destination username and IP address with the values obtained from the phone.

rsync --archive --verbose --progress \
    --rsh="ssh -p 8022" \
    ~/Music/ \
    u0_aNNN@phone-ip:storage/shared/Music/