The post body (note that it still has links to reddit):
The only way to prevent data from being abused is to prevent it from being collected in the first place.
— Soren Stoutner
You can prevent collection of all information by uninstalling Developer Applications that integrate the Braze Service.
— Braze, a notorious $urveillance company
You can’t see the invisible things being transmitted […] You can’t see it […], so it doesn’t bother you.
You either choose instant gratification and suffer the pernicious consequences, or you choose to protect yourself and your future.
People are literally destroying their lives on TikTok, Discord, Instagram, etc., for what, a dopamine high that lasts approximately sixty seconds. Then they return to the real world.
They lose their insurance claims, they miss nice jobs they were qualified for, they are denied loans and mortgages when they need them the most, they are denied access to credit facilities, they are denied health insurance, they have their political or administrative careers completely ruined courtesy a chat excerpt that was “leaked” to the press by an antagonistic party, they lose all their money to a well-orchestrated, multipronged, targeted identity-theft operation, they get murdered by the Camorra, they get vengefully eviscerated in a narcocracy, they get arrested and incarcerated for their activism in a police state, they lose custody of their precious children…
Your data footprint doesn’t matter to you, but it matters to a hundred thousand people out there.
They aren’t friendly people.
You can’t see the invisible things being transmitted […] Think of carbon monoxide. You can’t see it, you can’t smell it, but it will kill you in a matter of minutes.
— Moira
This post is adapted from this event which occurred last Black Friday. You would notice that I’ve steadily updated the list of requisite apps since then, even after the submission got archived. Henceforth, that list will be maintained here.
For the sake of concatenation, this was the announcement thread.
#First things first
If you like a sexy FOSS utility you see,
put a ring on itdonate to its altruistic developer!As I always write, a situation in which 1,000 people donate £5 is better than 2 people donating £1,000 within the same period. A great forest is made up of thousands of small trees, not three giant sequoias.
Of course, you can also donate vetted DeFi cryptocurrency.
If you really, honestly, frankly, truly, sincerely can’t make a pecuniary contribution, you have options.
#We are not ovine morons
“Hey there, weird nerd girl. What exactly is a tracker, and why the heck should I care?”
A tracker, contextually, is any blob or sloc that monitors and reports your activity in an app (and outside it) to a tertium quid, i.e., a third party.
Trackers are frequently classes of surveillant libraries or entire SDKs. Trackers can be components such as broadcast receivers, activities, and services. They can also be intents. These elicit responses from other apps (via inter-process communication) that listen to certain flags in their manifests. Permissions are consistently used to track.
There is absolutely no reason why your favourite clock app should have the
ACCESS_NETWORK_STATE,INTERNET,READ_EXTERNAL_STORAGE, andWRITE_EXTERNAL_STORAGEpermissions. For a clock app, those are definitely tracking permissions.Many, many, many apps also track you by regularly querying your clipboard and reading its contents. The
READ_CLIPBOARDpermission that permits this is a “hidden” one. It’s a declared AppOps permission that can’t be denied unless you have superuser privileges or use the Android Debug Bridge.“Hold up. My clipboard has been pawned?”
All your copypasta are belong to spyware.
ByteDance is dancing to the data bank with your credit card details.
“Holy macaroni!”
Trackers surveil the images you view in an app, how long you view them, the areas you tap in an app, the text you type in an app, the emoji you use, when the app is in the background or foreground, the amount you paid in an in-app purchase, your credit card numbers, your issuing merchant, your bank account, whether you’re stationary or in motion, images of the room you’re in, sounds and speech in your office, your current precise location coordinates and how they change per unit of time, persistent device identifiers like your Android ID and the SSAIDs of your smartphone’s apps, your carrier network, your network connection’s bitrate, your Wi-Fi BSSID, SSID, the RSSI, and all devices in your LAN, your Bluetooth MAC address and all devices in your PAN, other apps you’re concurrently interacting with, the apps you used in the last few days/weeks and your usage durations, the temperature of your environment, your carpal pulse, the sensitive documents, photos, videos, and songs stored in your device, the movie you’re streaming in another app, etc.
The garnered information is transmitted to both the developer utilizing the tracking library/framework, and the maintainer of the tracker. For example, when the Wikipedia app secretly monitors your activity, the packaged information is sent to the Wikimedia Foundation, Google, and Microsoft.
This information is very, very, very, very, very, very, very lucrative.
Very lucrative.
“So, you’re telling me scores of companies know about that one vore comic? I had a secure chat with my drug dealer on WhatsApp yesterday!”
Facepalm.jpgFBI document shows the Feds can get your “encrypted” WhatsApp data in real-time.
“Who buys the data that’s sent from the devices of oblivious people?”
It’s a data bazaar out there, dear.
Data brokers, data warehouses, the military, law enforcement, private detectives, espionage agencies, federal institutions, political action committees, courts, forensic laboratories, research corpora, advertising and marketing agencies, record labels, universities, churches, mosques, synagogues, restaurants, banks, financial institutions, hospitals, pharmaceutical monoliths like GlaxoSmithKline and Bayer, publishers, insurance companies, manufacturing companies, telecommunication companies, professional criminals, nosy individuals, etc.
In September 2021, the BBC’s Click programme aired a special episode during which it was revealed that the reporters (alongside a bunch of researchers) “obtained” raw data that showed the extent of extremist radicalization perpetuated via very popular gaming platforms. Minecraft, Roblox, and Call of Duty’s Warzone were implicated.
“Is this really true? Do you have any sources I can peruse?”
Sure. Read this. And this. Then this. And this. This, too.
So, you think Instagram surreptitiously activating your device’s camera to spy on you is some loony conspiracy theory? Think again!
Uncle Sam is that voyeuristic, perverted lecher who wants to feel up his niece.
Imagine paying to wiretap your home just to get the recipe for a canapé. 🤦🏽♀️
My first source explicated how Bluetooth triggers red flags. I wasn’t making up stuff in that write-up.
An Austrian advocate is pissed at Google for doing Googly things.
Oh, there are lots of articles for you to read here, though some of the recommendations are no longer suitable. For example, Brave is categorically proscribed, even as a gateway browser. Don’t be misled by disinformative marketing. Beware of the Nemean lion!
Also, the Startpage project is executively owned by a Californian data warehouse, System1. Be informed, so you don’t burn!
“But TikTok told me the data they collect is anonymized! I saw it in their pretty privacy policy. This shows that they care about me, and I’m definitely safe, right?”
When a shark swimming in coastal waters tells you it won’t chomp off your left leg, it’s all on you if you decide to stupidly trust it.
“Anonymized data” is a sardonic joke.
My grandma uninstalled TikTok yesterday. Here’s why.
This is TikTok ticking and talking—to remote servers.
#Be wary of granting “Draw over apps” (the
SYSTEM_ALERT_WINDOWpermission), Assist API, Accessibility, and Device Administrator privileges to applications!“This whole thing feels creepy as hell. How do apps determine my pulse?”
Sensors, sweetie. Sensors.
Your smartphone/tablet/smartwatch/smart band/mounted head display shipped with twelve or more of the following sensors:
❇️ Accelerometer
❇️ Light
❇️ Proximity
❇️ Ambient temperature
❇️ Gravimeter
❇️ Gyroscope
❇️ Rotation vector
❇️ Linear acceleration
❇️ Magnetometer (responsible for the simulated compass)
❇️ Orientation
❇️ Barometer
❇️ Hygrometer
❇️ Significant motion
❇️ Step detector
❇️ Step counter
❇️ Tilt detector
❇️ Wake gesture
❇️ Glance gesture
❇️ Pickup gesture
❇️ Stationary detect
❇️ Step detector wakeup
❇️ Fingerprint
❇️ GNSS (heterophemistically known as GPS)
❇️ Anterior and posterior cameras
❇️ Microphone
While holding your smartphone or wearing your smartwatch, every tiny oscillation of the device is detected by the accelerometer (at the very least). Akin to the case of the OS clipboard, many, many, many, many apps have unrestricted access to sensitive sensor data. Permissions are not required for such leaky access. The GNSS radio (the Network Location Provider and your IP address are classic ways apps detect your location if a radio fix is revoked), fingerprint sensor, camera, and microphone are notable exceptions.
You now comprehend how trivial it is for spyware to garner and transfer granular data about your heart rate.
Those data, sorted and catalogued by surveillant libraries and evil data scientists, find their way to your black information. Equifax and Acxiom know what I’m writing about.
One of the images of this post shows the TikTok app constantly querying sensor data.
Is the ambient magnetic flux necessary to show you [insert random TikTok
influenzainfluencer]'s latest video?Use CPU Info, SatStat, and Sensorz (IzzyOnDroid repository) to retrieve (real-time) sensor readouts. If you’re in the mood for edutainment, play around with phyphox. Trail Sense is also worth a dabble.
Your device’s gyroscope is snitching on you.
This is how evil bastards surveil and sell your sphygmic data to insurance companies.
We ain’t a gathering of gawky propeller heads who want to show off our nerdiness. We are everyday folks who are tired of the lies, $urveillance, and dissimulation. We rage against evil machines. We are here to protect your future!
#Is F-Droid a hot gynoid from some futuristic space opera?
“Um… what is this F-Droid thing anyway? You’re always writing about it.”
F-Droid is a catalogue of freedomware for Android and the Android Open Source Project. Unlike the lawless latrine that Google Play is, F-Droid emphasizes user privacy and security.
IzzyOnDroid is an alternative repository of F-Droid. Check out more about Izzy’s repo.
DivestOS Official maintains its alternative repository of F-Droid. It’s courtesy the impressive Divested Computing Group. At the time of writing, six of the seven apps in the DivestOS repository are also present in the default F-Droid repository.
Guardian Project maintains its alternative F-Droid repo.
F-Droid is a comprehensive collection. For instance, there is a safe replacement for evil Pokémon Go on (an alternative repository of) F-Droid.
TerranQuest is that replacement.
“Whatever. I’ll get my apps on Google Play despite what you wrote.”
This is what happens when you stubbornly get your apps on Google Play, even via Aurora Store.
“What’s the function of that huge Google Play Services app?”
It’s Orwell rolling in his grave.
“Someone told me there are open-source apps on Google Play!”
Ninety-nine percent of apps on Google Play have nettlesome ads (which are mostly served by Google’s evil AI slave DeepMind) which also steal and monetize your data, and/or Mephistophelean trackers that do the same despite their mendacious “privacy policies”.
When you buy Evernote Plus, Spotify Premium, or Discord Nitro, or subscribe to the Guardian, Washington Post, or New York Times news apps, their trackers don’t magically disappear from the apps. Instead, your Mastercard/Visa/XYZ details, along with other purchase data, are transmitted and sold to their business partners, data brokers, and federal institutions (especially law enforcement bodies). In other words, your payment data are turned into tracking vectors. The banal prepayment tracking proceeds as normal.
As I wrote in a comment many months ago:
proprietary bros have zero chill.
“This privacy thing is too much of a task. I’m off to the parlour to play Overwatch with my sister.”
Fun fact: Surveillance is an English noun derived from the French verb surveiller, which literally means overwatch.
Now you know.
Assertively reclaiming your data privacy isn’t easy. If it was, WhatsApp would’ve gone into MySpace’s level of obsolescence post-2014. Gamers (and others) would be on Matrix and Mumble servers, not Discord.
Here is a Roman aphorism to keep you going:
Nemo athleta sine sudore coronatur.
No athlete is crowned without sweat.
— Jerome, Epistulae
“Discord? Huh? What’s wrong with it? I’m OOTL on this one.”
Discord causes… discord. D’oh.
“Okay. I’m convinced that Google and Discord are really bad. How about Amazon? I’m thinking of buying a Ring camera for the front door.”
“Darn.”
Here is an F-Droid-only antiAmazon resource you might find useful. I will create (and regularly update) similar lists antagonizing Facebook, Google, Microsoft, etc.
It’s important to get your apps from the official F-Droid repository.
#Other F-Droid clients
Aurora Droid (for straightforward addition of alternative repositories)
G-Droid (recommended)
IzzyOnDroid is a lightweight client strictly for the IzzyOnDroid alternative F-Droid repository. It’s in Izzy’s repo, so you have to download (and update) it using Aurora Droid for instance.
#Is this better than Mardi Gras in the Big Easy? Where the beads at?
Definitely not, but it’s better than watching 🐍Mark Zuckerberg🐍 pretend to be a benefic human being.
#Starter apps
##Default F-Droid
App Manager (make sure you get this one!)
Logcat Reader or SysLog (if your device ain’t rooted, you have to grant them the
READ_LOGSmanifest permission via the terminal, otherwise they would give you access to only their process logs, not the entire systemlogcat)Permission Manager X (dank stuff this featherweight utility is—enriched via ADB commands or superuser privileges)
PermissionsManager (cursory admonition)
PrivacyBreacher (interprocess communication and system APIs reveal almost everything about your device…)
Privacy Helper (a pithy primer)
Net Monitor (read the caveat in the app’s description)
Vigilante, SafeDot, or Privacy Indicators
SuperFreezZ or Battery Tool (root required)
One (or more) of NetGuard, AFWall+ (root required), PCAPdroid (optional; use it for packet analysis and decryption), Blokada (read this first!), AdAway (root no longer required 🚀), personalDNSfilter, DNS66, I2P (garlic routing), TorServices (onion routing), InviZible Pro, Freenet mobile, Mullvad VPN, Shadowsocks FOSS, or SagerNet (Note: The
VPNServicecan be utilized by one app per session. Having root privileges allows you to combine some of these apps.)Shelter (≥Android 8/DivestOS 15 sans MiUI custom firmware) or Insular
Material Files or Ghost Commander
eSpeak or RHVoice (Text-To-Speech engine)
usageDirect and Open TimeLimit, TimeLimit.io, or Get Off Your Phone (hey there love, looks like you’ve played Freedoom for seven hours today!)
DetoxDroid (monochromatic detoxification; requires root or ADB authorization)
LibreOffice & OpenOffice document reader and Impress Remote or Techahashi
AnySoftKeyboard, FlorisBoard, or OpenBoard and Irregular Expressions (ensure it’s not set as your primary keyboard) and/or EweSticker (ensure it’s not set as your primary keyboard)
Privacy Browser (requires your device’s onboard WebView rendering engine), monocles browser (requires your device’s onboard WebView rendering engine), FOSS Browser(requires your device’s onboard WebView rendering engine), or Mull (Gecko-based) (ensure you perform the battery of hermeneutic tests suggested by this resource before actively using any of these browsers, so you understand the hidden privacy and security threats of HTML5 APIs, WebRTC, and the modern web!)
drip, log28, or Periodical and Fertility Test Analyzer App (strictly for us💄)
OpenContacts or Simple Contacts and Simple Dialer or Emerald Dialer (deliberately simplistic)
Call Counter, Prepaid Balance, Call Recorder, Schlikk Calls, Raise To Answer, and Share my number via QR code
Yet Another Call Blocker, NoPhoneSpam, Blacklist Blocker, or Silence (≥Android 10/DivestOS 17)
Jami, baresip, baresip+, or Linphone (VoIP/SIP user agents)
Silence (ciphertext) or Simple SMS Messenger (cleartext)
Easy-phone or BaldPhone (this has more features)
Hypatia (especially essential if your device is rooted)
Organic Maps or OsmAnd~ (note that Mapillary is a surveillant service and application now owned by Meta/Facebook) and Navit
RoadEagle (if you’re in 🇵🇱 Poland, 🇱🇹 Lithuania, or 🇱🇻 Latvia, enjoy surveillance-free live traffic news. More countries will be able to participate)
Infinity, Slide, RedReader, Stealth, Dawn, or NoSurf
F-Droid Build Status (use this to check whether an app is about to be added or updated in the default F-Droid repository)
##IzzyOnDroid
Metadata Remover (displays image metadata before excision)
ExifEraser (optional)
Codec Info (optional)
#Final counsel
A soupçon of apps on (default) F-Droid—like Wikipedia—have trackers, though this is properly disclosed in their descriptions.
Never trust toggles which claim to instantly stop these trackers from “phoning home”.
The developer who carefully selected the spyware library (and its classes), hardcoded relevant components (e.g. services), used tools to obfuscate the app’s DEX files to deter people like me from discovering and exposing embedded trackers, created userspace with the maintainer of the tracking library, and refused to remove the tracker when applying for inclusion on F-Droid, definitely isn’t idiotic enough to let you rain on his/her parade in one tap of a toggle.
Like the ubiquitous Do Not Track toggle and its header request, these sorts of toggles are completely useless.
For example, SQLiteViewer in default F-Droid still submits data to the developer’s servers when analytics and crash reporting have been toggled off, as per the Anti-features description.
Trust packet captures. Don’t trust I-made-it-very-easy-for-you-to-switch-off-my-tracker-because-I’m-an-idiot toggles.
Make sure you scan all the apps in your device with App Manager, especially after updates. This also applies to apps you download on default F-Droid. Don’t let sinuous developers play you for a fool!
Cave canem!
Wikiless is an open-source alternative front-end for accessing Wikipedia content privately, like what Nitter is to Twitter. Use the UntrackMe app to turn Wikipedia links to Wikiless ones.
Caught on a random subreddit: Here’s one of the monsters who destroy your privacy for money. He then tries to deny the whole thing moments later, which is typical of them.
In conclusion, this is a particularly intimate confession that shows why we should protect ourselves and our privacy.
The future is private.™ (My attempt at humour. 😂😂)
“All right, space lady. I get it now. It’s F-Droid all the way. Quick question, though: Do you have a boyfriend?”
You’re hitting on me right here in this thread. How audacious! ^blushes
#Hamster your data! 🐹
Postscript: Welcome to the first of many edits.
If you’re using Reddit’s official mobile app, Relay, Boost, or Bacon Reader, there are better options that don’t secretly monitor and monetize your activity. Added Infinity, Slide, RedReader, Stealth, Dawn, and NoSurf. Credit goes to u/tdmlr for the reminder. Snoo! 👽
Second redaction: Google’s constant scumbaggery, IoT surveillance, clipboard surveillance, sensor surveillance, and the
data-harvesting servicesocial network TikTok constitute this edit. Whatever you do, for the love of hardy tardigrades, avoid TikTok like a candidal infection. Awareness! 📢Third redaction: Girls, the German app Clue, the American app Eve, Flo, and My Calendar are all spyware. Eve in particular is bastardware. Steer clear of them like an ominous Pap smear! Added drip, log28, Periodical, and Fertility Test Analyzer App. Let’s keep our catamenial cycles away from that megalomaniacal pervert Mark Zuckerberg.
Also added usageDirect, Open TimeLimit, TimeLimit.io, Get Off Your Phone, Freedoom, DetoxDroid, Material Files, AnySoftKeyboard, FlorisBoard, OpenBoard, Irregular Expressions, Greentooth, BBS, BatteryBot Pro, Battery Tool, RoadEagle, and Navit. Aestival! 🏖️
Fourth redaction: Added an image about “techie” people fatuously accepting IoT $urveillance as the “new normal”. If you prefer to view this submission’s images in an external application, use ImgurViewer. Added an extremely vital tool to the browser segment. Mocha! ☕
Fifth redaction: Added a quotation by a certain Moira. Added indispensable information to the sensor section. Added CPU Info, SatStat, Sensorz, phyphox, and Trail Sense. Moved Privacy Indicators to the Default F-Droid category. Monitory! ⚠️
Sixth redaction: Added a link for donating to F-Droid Limited. Added log28 and SafeDot.
Added LibreOffice & OpenOffice document reader. Read and modify documents in any ODF (screeds [ODT], spreadsheets [ODS], or slideshows [ODP] authored via LibreOffice or OpenOffice). Print those documents with CUPS Printing and a compatible printer. Moderately manipulate Microsoft’s straitjacketed Office formats. View PDFs and images. Also added Impress Remote for interacting with your presentations. Productivity! 📎
Seventh redaction: Moved SafeDot to the Default F-Droid category. It arrived swiftly, Aravind Chowdary dearie. Added Techahashi. Added Simple SMS Messenger.
Truecaller is truly bastardware. The maintainers of the app (and service) share the discriminatory data of your carrier networks, contacts, call logs, intimate conversations, texts, sexts, and external actions with Amazon, Huawei, Facebook, AppsFlyer, Twitter, Google, etc., and sell the same to Lea, USIC, and hundreds of individuals and corporations—without remorse. There are ethical options; no more excuses. Added Yet Another Call Blocker, NoPhoneSpam (useful post-Marshmallow), Blacklist Blocker (also filter texts), Silence (minimalist), OpenContacts, Simple Contacts, Simple Dialer, Share my number via QR code, Schlikk Calls, Call Recorder, Raise To Answer (sensors…), Call Counter, Prepaid Balance, Jami, baresip, baresip+, and Linphone. Loquacity! ☎️
Eighth redaction: Hey there. Did you see a black cat today? Was it a black dog? What dog breed was it? Was it a black pug, a black dachshund, or a black terrier? Not sure? Read here!
The Fediverse is expanding after the ActivityPub Big Bang of January 2018. Is there a Reddit alternative in the Fediverse? There is! Bet you didn’t expect that. Lemmy is that alternative. It’s decentralized, with a variety of related servers — instances — federating to yield a consistent experience. Lemmy does not depend on Scamazon (Amazon) and Goolag (Google) software and infrastructure, unlike Reddit. When (not if) I delete my sole account, leaving Reddit, my mission will definitely be continued there. I added lemmur, the primal Lemmy client.
Use Logcat Reader or SysLog to peek at and keep au fait with what’s going on underneath the bonnet of your smart device. Added a paramount caveat to Blokada. Added Emerald Dialer and F-Droid Forum. For my sensorially impaired beloved friends, I added TalkBack, which is a necessity.
Say, isn’t that a black dog barking at you? What’s its pedigree? Instead of consulting the dog’s dinner that is Goolag, enjoy Identify Dog Breeds. Use it to distinguish more than thirteen canine types this Friday. I wouldn’t advise you to walk under that ladder. Paraskavedekatriaphobia! 1️⃣3️⃣
Ninth redaction: Added a monitory paragraph about the BBC “obtaining” “anonymized” data for a Click report.
Added a caution concerning the optional Mapillary service promoted by OsmAnd~. Block Mapillary on the hosts level, and turn off all in-app Mapillary “enhancements”.
Added IzzyOnDroid app as one of the F-Droid clients. It handles only the eponymous repository.
Added SysInfo and Codec Info to the IzzyOnDroid category.
Added Ghost Commander. Added Easy-phone and BaldPhone. Added EweSticker and Print. With Print, you can, well, print documents and photos stored in any accessible directory in your device, or whatever’s on your screen as long as you have a compatible print service and printer set up.
Added AirGuard. “Good” Apple strikes again! Using something similar to the
Contact TracingExposure Notification framework, Apple tracks your device as it moves around. Quietly. Read the app’s description to find out what this is all about, and why Bluetooth is a perfect vector for surveillance.Added Padland and Fluffyboard for workplace, domestic, and amical collaboration. Amor! ❤️
Tenth redaction: Added a warning concerning WhatsApp. Replaced Foxy Droid with Droid-ify. Added FOSS Browser and Doodle. Added a paragraph about deceptive toggles. Added a little information about the Wikiless project. Pyrotechnics! 🎆
Holy comment length, Batman!
