How can I protect my privacy and security on Android?
Phil’s family is now using Android smartphones and tablets, and he wants to know what he can do to secure them
I take a great deal of trouble to keep the PCs in my household safe and secure. However, we now use a number of Android devices for browsing and emails, with banking to come. I haven’t got a clue as to how secure they are, or how to protect them, their contents and the transactions we use them for. Could you give some guidance, please? PhilYou are not alone! I could give you some instant advice about keeping your devices up to date, running anti-malware software and always using password protection, but as a matter of fact, I don’t do necessarily do any of those. There are lots of stories about the amount of Android malware in circulation, but I’ve never come across any. Perhaps the Android market will need a wakeup call in the form of a rampant virus – like, for example, the Sasser worm that hit Microsoft Windows XP in 2004 – to make us take it seriously.
It could happen because, like all software, Android has vulnerabilities. But it would need something worse than the flaw found recently in the Google browser bundled with Android until version 4.4, and therefore still in widespread use. This makes it prudent for businesses to install Android antimalware software, if only to defend against accusations of negligence or incompetence.
Unfortunately, the problem is that you probably don’t need a virus or hacking exploit to get private data, just “social engineering”. Users typically don’t read or don’t understand the permissions they are giving apps and websites, so just ask. Does a simple flashlight app need your location, and can it use your phone’s microphone and cameras? Sure, why not. Wait, how carefully did you check? Do you want to know what someone was saying about you on Facebook? Of course you do. Click here …
Basic protection
Use a password to protect access to your mobile devices, especially if they are frequently carried outside the house. It’s also a good idea to have a tracking service that enables the device to be wiped remotely, because once the bad guys have the hardware, it’s very hard to keep them out.Obviously you should have backups of all the personal data on your devices, including photos and emails. Back up and delete anything you don’t really need on your tablet or smartphone.
People tend to back everything up to online services (“the cloud”), sometimes without knowing it. However, you may be able to do it by plugging the device into a PC (where it should appear as an external hard drive), plugging an SD card into a PC, connecting the device to your home network, or using a program such as Sand Studio’s AirDroid. Any data in the cloud is outside your direct control, and – unless it’s encrypted – vulnerable.
Apps and permissions
Keep the number of apps as low as you can, and try to avoid giving them unnecessary permissions. Yes, I know this is impractical, but in a rational system, an app would never ask for a permission unless it needed it, and at that point, you are in the best position to decide if you want to grant it. If you’re going to let trivial apps access your location and your address book then you may as well give up.If you only download apps from Google Play, or the equivalent Apple or Microsoft store, then you will probably be pretty safe – though I’d avoid apps like Snapchat, Secret, Whisper etc. Otherwise, keep an eye open for dodgy-looking apps with names that are almost but not quite the ones you’re looking for. Also, be extra careful if you turn off this element of protection to install apps from alternative stores.
As when using Windows PCs, you should never accept files from strangers, or click on links in unsolicited emails or SMS messages. Their almost irresistible offers are the bait through which many malware operators snare their prey.
Beware of Wi-Fi
Cellular data is a finite and expensive resource based on erecting tens of thousands of phone masts and (usually) charging users over £100 per year. It’s therefore very tempting to use free Wi-Fi whenever it’s available. This is fine when the Wi-Fi service is trustworthy – eg your own – but you can’t trust public hotspots. As for your workplace, it may have trustworthy Wi-Fi, but it may also be monitoring network traffic.As with laptops, one solution is to use a VPN (virtual private network) that encrypts all your data to protect it from Wi-Fi snoopers. Android has a VPN client built in: see “VPN settings” on the wireless and networks page. Otherwise, try to use secure web addresses – ones that start with https:// etc.
Some phones may connect automatically to any handy Wi-Fi network, and if so, make sure this feature is turned off. Alas, even if you’re not connecting to random Wi-Fi networks, they may still be tracking you. This includes retailers who track your movements through their stores. Some people have even been tracked by London rubbish bins.
If you can do without Wi-Fi and Bluetooth when away from home, turn them off. If you must do mobile banking from a phone without a VPN connection, use your cellular phone connection instead.
Spread it around
The Android operating system has only one core function, which is to collect data about you and use it to deliver targeted advertisements. In order to use the Android name, phone suppliers are obliged to bundle it with Google software and services, including access to the Play store. The path of least resistance is to use all Google’s services, which is what it wants. For your further convenience, other companies may want to join in the fun, adding access to Facebook, Twitter, LinkedIn and other services to their apps. This creates the problem that if a single service is hacked, the bad guys may get access to a lot of your private data.So, don’t put all your eggs in one basket. You will help to protect your privacy and increase your security if you avoid the defaults and use alternative apps and/or services. This is true for Apple and Microsoft users, too.
Many of these alternatives are well known. For example, you can have your photos automatically uploaded to Dropbox and downloaded to your PC, and you can use an alternative app (eg K-9 Mail) or mail service (eg Outlook.com) instead of Gmail. Instead of Google’s browser, you can use Firefox or Dolphin etc. WhatsApp is good for messaging as it uses your phone number as your user identity, encrypts messages, and does not store messages on a server. There are loads of articles about alternatives to Google apps and services, which you can find by searching DuckDuckGo.
Tell lies
Security expert Bruce Schneier says “We have built systems that spy on people in exchange for services. Surveillance is the business model of the internet.” Since it’s now impossible to stop companies from spying on us, one alternative is to try to confuse them. For example, use several different names and birthdates, or search for and buy atypical things (presents for aged relatives, perhaps). Buy phones for cash, not on contracts. Use a VPN, or free anonymous proxy services.Today, it’s naive to think that knowing your mother’s maiden name and where you went to school etc provide any form a security – especially if you’re a famous actress with nude selfies on your mobile. It’s safer to tell a website that your first pet was called C2H6O or C12H22O11. These are easy to remember as alcohol or sugar, but hard to guess and impossible to research.
Source:http://www.theguardian.com/technology/blog/2014/sep/18/how-can-i-protect-my-privacy-and-security-on-android
