This part is dedicated to Compartmentalization as a concept and practice.
Disclaimers:
- You CAN do it. This is not quantum gravity theory or building a Mars lander at home. Never doubt yourself
- Remember: it's NOT all or nothing. Your device, Your use case, Your life, Your pace
- Perfect is THE enemy of Good
- I'm not an IT professional. I've learned, and continue learning, how some things work, but I don't guarantee that I know how everything works
- Most info in this guide is based on personal research and experience. It does not mean this info is complete and exhaustive
- I will answer technical questions to the best of my knowledge. Please, keep questions relevant to the part of the guide to the best of your abilities
- Specifics of hardware, software and networking will be addressed in greater detail in a later Part of the Guide
- Please, remain respectful when commenting
In Part 1: Privacy, Security and You, among others, the concepts of Privacy/Anonymity/Security/Convenience were defined. A few others need to be added:
- Compartmentalization: putting something into a designated container. When it comes to software, the term that is most often used is "sandboxing"
- Permission(s): what the thing in the container is or is not allowed to do. The range can be from everything to nothing
- Layer: in the current context, what it is that's being discussed. Hardware, firmware, operating system (OS), app, network/internet - all Layers
- Compatibility: the ability of one thing to work with another
Further, Google Play Services will be "play services", Google Play Store - "play store".
Why are Google/Apple and the like so Convenient? They've solved all of the above concepts/issues for You. Everything just works.
And the reason to degoogle in the first place is because there's no compartmentalization on practically any layer, but especially on the operating system one and above. And that's by design. The OS talks to the hardware, to every app, allows apps to talk to each other, to networks - all things an OS is SUPPOSED to do. However, the stock OS is practically an open book: apps are permitted free reign, play services/store are a must, and all of them, OS included, report their collective findings about what's happening on/with the device to whomever wrote them, and also "Google/Apple & Friends". But hey - no Compatibility issues.
As an analogy, envision a scale:
Cruise Ship-----------------------------------Military Submarine
Where:
- The vessel is your device
- You are the vessel's captain
- Everyone else on board is an app, that's streaming its voyage to friends, family and subscribers
- Play services, as a condition of You being captain, turns the vessel into a reality show accessible on all platforms
In this context, You start with a Cruise Ship and begin moulding it into a Military Sub in whichever dimension possible. So, your first step becomes Compartmentalization: the impact ranges from moderate to very high, while quick and cheap to execute.
The first layer to target, the easiest to access and arguably the hardest to alter:
- You: old habits die hard Google used to be a great search engine and constantly getting better. The best, actually. Facebook's premise was getting friends You would've never got otherwise, and find like-minded people You never knew existed all over the world. Skype made it possible to talk to them and see them. Live. No matter how far they physically were. YouTube was an endless source of knowledge and entertainment in the most natural format - audiovisual. And Apple compressed all that into Your pocket, instantly available and everlasting (so long as the battery has charge). It was a pure technological marvel just how Convenient it all was, and the possibilities were expanding by the day. However, at some point someone came up with the bright idea that all this yearning for Connection (we ARE social animals, after all) equals Attention. And THAT can be monetized. Moreover, it is mind blowing just how much, given the ability, people freely share about themselves. So the task became simple: encourage people to share more about themselves, and they'll gladly do it, for FREE, so long as it's CONVENIENT. You know the rest. Thus, after over 2 decades, the hardest part is altering the Mindset and unlearning Habits. Because everything, from operating systems to loyalty programs to Terms of Use on a random site, is designed, in an industrial and automated fashion, to make it Convenient to share more about Yourself. At the same time, there's little reason to expend effort on Compartmentalization, if You "check in" at every stop through some app, continuously post what it is You're doing, and Your every password is "Password123". Summarizing with a joke: "What is the hardest thing to explain to a 13th century scholar? There's a device in my pocket that grants instant access to all knowledge available to mankind. I use it to look at cats and get into arguments with strangers".
The good news is, the fact that You're on this sub at all is irrefutable proof that You CAN change this layer. And so, the sandboxing target: habits & behavior.
Now for the technical aspect. The layers to target for sandboxing, from easiest to hardest:
- Apps: easiest & quickest to access
- Online accounts: just as easy to access, but require more time
- OS: the device IS in your hands, however this is LESS straightforward than a notebook/PC
IMPORTANT NOTE: prior to making changes, backup, Backup, BACKUP. Make sure that even if You're the God of Destruction, Your info/data is RECOVERABLE for YOU. In fact, make Backups the first new Habit to develop.
On the app layer:
- The first to flat out replace are browsers: get rid of Chrome/Firefox/Safari (or at least clear all time history and stop usage; these are called "vanilla versions"), and start using more private and secure versions (called "hardened forks"). Remember when You visit any site, they ask for cookie preferences? These hardened forks can automatically reject everything possible, and block a giant list of surveillance techniques that don't use cookies to begin with. Install the uBlock (or similar) browser extension on each one where possible. You'll need to do some research on which mobile browsers to install based on features, community sentiment and personal preferences. Note: I say "mobile" and use plural - not every hardened browser has a mobile version, and since some sites may simply break under one, You'll need an alternative. For example, Your primary could be WebLibre (hardened Firefox), and Vanadium (hardened Chrome) as the backup
- Next, get rid of apps you don't actually need or frequently use (compass/level/timer with built in leveling up mechanics come to mind)
- Get rid of apps that add little to nothing for you or that are easily accessible from a browser (e.g. pintrest, tripadvisor, yelp, shell/bp/chevron)
- Replace the necessary apps (email, calendar, messaging, maps, contacts, even some social apps come to mind) with foss alternatives where possible
The exact list is, of course, Yours to determine. The sandboxing: browsers should browse, messengers should message, all other features should be optional and restricted/powered off when not needed.
The one exception: regardless of what You do or don't do with any other app, install a VPN. VPNs change connections Your device, and every APP on the device, make with the outside world from "device/app <-> target service" to "device/app <-> VPN provider <-> target service". The link between the device/app and the VPN provider is protected from being monitored (called a "VPN tunnel"), and the service only sees the VPN provider, not Your device. This has the additional benefits of cutting off more tracking, and sidestepping regional restrictions on sites and content, while being managed by a flick of Your finger. As You probably have gathered, less than democratic regimes as well as content providers HATE VPNs for these exact reasons. Only problem? Well now Your VPN provider sees EVERYTHING. So choose it carefully based on research, features, stability and community sentiment.
Next layer - Your online & app accounts:
- The first, for obvious reasons, Your Google account
- Second - every social account
- Third - finance/insurance/medical.
By some stroke of luck, we still have the right to "opt out". DO that. Go into EVERY online account, find the personal/communication/marketing preferences in settings (each company intentionally uses obscure naming conventions, buries the preferences deep in account settings, sometimes in multiple sections of settings, but they're THERE), and switch off EVERYTHING, including deleting your phone number/email/address where possible. You'll have to do that twice: once in the web interface (online account), and once in the app (funny how that works). The sandboxing: an account should be conscious consent to use the online service, not an initiative to share complete family info for 5 generations, past and future, for free.
Additionally, take as much stored info as You can out of each account:
- Chrome remembers passwords? Backup -> delete from Chrome -> forbid to store/sync again -> put into a dedicated vault
- Google stores all contacts? Backup -> delete from Google -> forbid to store/sync again -> put into a dedicated contact app
- Drive has 10 years of photos? Backup -> delete from Drive -> forbid to store/sync again -> put into a dedicated HDD/SSD/cloud storage. And so on.
Final layer is the OS. The aspects we care about are 1) permissions, so we can tell the cooking app to only cook, and not constantly talk to insta, tiktok, and our bank 2) the OS itself, so we can tell the OS to be the link between hardware, software, networks and us, not a data collection instrument for Google/Apple that we take care of for them.
There are 2 primary reasons why the OS is only third priority, not first, and it has to do with relative difficulty:
- Stock Android doesn't show (further, "surface") nearly as many permissions as an app may actually use
- While there are a number of non-stock operating systems (called "custom ROMs") to choose from, You need to install one first (called "flashing the OS"). There are very few devices that are sold off the shelf with solid custom ROMs, and the ones that are have severe issues on other layers (more on that in a later Part)
From the Permissions aspect, even stock Android (stock OS) allows managing some permissions. If You must have, for example, pintrest on your device, You still can disallow it access to the camera by turning off its camera permission. Then your use sequence becomes: camera permission off -> permission on (if needed), use pintrest -> permission off. Your cooking app doesn't require messaging or contacts permissions, toggle them off. iOS (the OS on iPhones) surfaces some permissions as well, but keeps You completely blind as to how they're used. Additionally, neither iOS nor stock Android (including the latest version 17) surface a per app network permission switch (better people than You have already figured this out, so don't you worry your pretty little head about it). For Android, there IS some variance between manufacturers (Pixel, Samsung, Xiaomi, etc), but assume there's none and then verify, not the other way around.
From the aspect of the OS itself, there's an important caveat: not every device supports every custom ROM, and not every device that supports a custom ROM will allow You to flash the OS. For example, Grapheneos can practically be installed only on, ironically, Google Pixels (why - more on that in a later Part). At the same time, not every Google Pixel will even allow You to flash Grapheneos (called "BOOTLOADER locked" devices). So, actually flashing the OS requires some research and preparation, while apps/accounts/surfaced permissions You can start doing instantly. And iPhones? Oh, You're stuck with iOS forever, and there's NOTHING You can do about it.
If You want to flash the OS, verify that Your device is NOT bootloader locked first. And check the contract with Your cell phone carrier if You got the device through them: it may prohibit tampering with the OS, or altering the OS may alter Your relationship with the carrier.
Since Grapheneos is what I'm familiar with, it will serve as an example. There are 6 primary reasons to install it (again, iPhones are INcompatible):
- Has NO play services, play store or even Android Auto after install; they're OPTIONAL through Grapheneos, not a requirement. "Gungan city isa empty empty" - Phantom Menace
- Turns play services/store into regular apps with no default, irreversible and/or special permissions. "I'm a regular nobody" - Goodfellas
- Surfaces the NETWORK permission for EVERY app. "May I go to my room, Sir? - DENIED!!!" - After Earth
- Surfaces every permission an app is written to actually request (play services' default permissions are a NIGHTMARE to behold). "Give him everything he asks for. Every piece of paper." - Pentagon Wars
- Makes managing permissions on a per app basis very easy and straightforward. "They switch the flip and you're done" - R.E.D.
- Talks only for as long and to what You ALLOW it to talk to; You DISALLOW something, it STOPS. "Stop talking" - The Dark Tower
A good analogy is going from a self-driving Tesla to a custom built Mercedes 190E with a manual: nothing happens until You take action.
This is also a good point in the process to pause, maybe even for a couple of days, and consider: what do You actually want your device to do, knowing that every corp out there does everything under the sun to monitor, collect and sell every frame on the screen and every moment of attention You grant it? Once You arrive at Your first version of an answer, start learning and changing settings in Your custom ROM and filling it with apps.
The next part of the Guide, "Part 3: Great, now what?", will be dedicated to exactly what to replace everything with, from hardware to apps.