Yes, we know: Google does mass surveillance.
Yes, we know: Google’s Sensorvault is the real Big Daddy.
Yes, we know: This is worrisome for our data protection rights.
Yes, we know: Google tracks all of our customers’ movements, through our Android phones and associated services.
Yes, we know: Google shares location data with law enforcement, based on a Geo-Fence warrant.
And finally, yes we know: you all want to get rid of Google apps from your Android smartphone for various reasons that we prefer not to mention. No doubt, all these reasons are just enough to find a way to remove Google.
But. can you really get rid of Google from your Android smartphone? And does it really serve privacy and security purposes? We don’t think so.
A degoogled phone is a smartphone, a cell phone that presumably runs Android and has all of Google’s own components removed.
Android the operating system consists of two major parts:
First of all, there are some downsides to degoogling your smartphone. The side effects range from all the conveniences you normally have on your phone to a completely false sense of privacy that comes from a degoogled phone.
There are many things that stop working after degoogling your smartphone. To get notifications, you need to download and set up a service, because notifications come from Google (so Google can read any notification content, creepy). To see the notifications, you have to enter the application, which makes notifications pretty useless. You only get basic functionality, which doesn’t necessarily mean privacy. These Google components give the user a very specific experience that they will now miss.
Many apps rely on Google services, meaning that many of them simply crashed or ran very slowly.
A degoogled phone needs a reboot from time to time because it becomes unbearably slow with apps like Telegram.
Despite all these efforts, since the phone itself is closed source, you can never be sure that it will completely disable telemetry (e.g. Samsung and Huawei), there might even be a special chip inside for this task.
The best option would be not to use a phone at all, which is the approach some people would like to take, but their current lifestyle unfortunately does not allow for that.
Quite simple, in 2 steps:
Google’s free Android ROMs are only released as “nightlies” for most devices as (more or less) unstable versions. A Nightly is when a computer compiles the day’s work into a version and distributes it to devices. You don’t have to update to every Nightly, and it’s not really recommended unless it fixes a burning issue with your current device. Examples include a broken camera or GPS being fixed. Note that this experience varies from device to device.
It’s also a strange feeling of freedom. Call it placebo or whatever you want, but that feeling of freedom is there in some form once everything is up and running.
This is a funny question, since we don’t know your tolerance for hacking systems or how angry you get when something doesn’t work. However, if you have a strong urge to use Android without Google Services, do so. Learn how to unlock your device’s bootloader, root it if you wish, and install F-Droid from the apk.
If you go back in time, you all know that the Android operating system was developed by Google to be used mainly for touchscreen devices, cell phones and tablets. The Android source code is published in an open source format to promote open standards for mobile devices. However, despite being published as “open” (AOSP), Android is still packaged with proprietary software when sold on phones. So what you’re trying to do is remove Google from…. Google. Does that make sense to you?
The basic communication apps like phone, messages, contacts, etc. are a part of AOSP, and all developed by… Google!
Most custom ROMs already come with pre-installed basic communication apps like phone, messaging and contacts apps, which are still Google components. So you are still using Google developed apps to communicate “privately”. Please remember the last time you were talking about a certain topic on the phone and minutes later Google displayed an ad banner with the exact same topic you were talking about on the phone. Surprised? You shouldn’t be: Google snoops into your phone conversations and then sends you commercials based on selected keywords. Yes, on your “degoogled” smartphone.
In many ROMs, these apps are part of the Android Open Source Project (AOSP) and were developed by Google. Thus, technically, you are still using a Google product. As a result, your degoogled phone is not as degoogled as you think.
Let’s face it, open source or not, how many of you have the ability to look for apk vulnerabilities? How many of you are pentesters? And yes, remote exploits are available for all these open source apps.
In every Android smartphone, phone, messages and contacts are included as APK files. Each installed application is vulnerable to several remote exploits used by both experienced hackers and (abused or not) law enforcement agencies. One of the methods is the so-called remote code injection. One clear example:
Pretty simple: you get privacy. Well, sort of.
But not the kind of privacy you expect. And not 100% privacy at all.
Most importantly, you don’t get any additional security. And that should be the main concern for you. Because privacy does not equal security.
When you start installing apps, the privacy of a degoogled phone is terminated. Therefore:
If you get a degoogled phone and load standard apps there like Waze, Yelp, Uber, you will be tracked by Google again.
What about open source apps downloaded from places other than Google Play? Almost every app has at least a few trackers. Not just Google trackers, but trackers that send at least some analytics back to the developer. And yes, that’s data you don’t want to share with anyone.
With Exodus you can check all Google Play apps trackers online. We did it for you, for some notorious safe apps that are used day after day by security obsessed users it turns out that almost all apps have at least one tracker:
Many users of degoogled phones believe that their phone’s privacy is guaranteed simply because the phone has no identity. A degoogled phone is set to have a fake Google ID so that the phone never needs to be identified, even if apps and information are sent to Google’s Firebase servers, they won’t have your real identity. Well, this approach is completely wrong, because there is one thing missing: as you all know, every cell phone has at least one other unique ID besides the Google ID: the IMEI. And yes, the phone is still connected to Google, even with a fake ID. Google can get a fingerprint of the device and we will know which apps are loaded from Google Play. Google will not know your f-Droid apps.
Zero security. Nothing. Nada.
Because privacy does not equal security. A degoogled phone is the same as any Google phone in terms of security. Your degoogled phone has the same vulnerabilities regarding remote exploits, viruses, spyware, etc. as any other Android phone. Removing Google does not add any extra layer of security.
However, Google is not the main concern when it comes to phone security, but government spyware, which does not care about degoogled phones: these phones can be tracked like any other cell phone, without distinction. And yes, a degoogled phone can be monitored, tapped and abused just like any other cell phone.
Zero security means:
De-googled smartphones are still vulnerable to geofence
A geofence search warrant (also known as a geofence warrant) is a search warrant issued by a court that allows law enforcement to search a database to find all active mobile devices within a specified geofence area. Courts have issued geofence search warrants to law enforcement agencies to obtain information from databases such as Google’s Sensorvault, which collects users’ historical geo-location data via GPS records.
A geofence search warrant does not work for future geo-location data, nor does it work for real-time geo-location data.
Shortly before 5 p.m. on May 20, 2019, an armed man entered a bank in Midlothian, Virginia, forced an employee to open a safe and fled with $195,000. Security footage showed the man holding a cellphone to his ear just before the robbery – a detail that prompted police to try a surveillance technique that is becoming increasingly popular with U.S. law enforcement.
When authorities had not yet identified the suspect several weeks after the robbery, an officer obtained a search warrant for the Google location data of all cell phones that had been near the Call Federal Credit Union bank during the robbery. From a list of 19 accounts, investigators were able to narrow their search to a 24-year-old Richmond man named Okello Chatrie, whom they eventually charged with armed robbery.
The demand for Google data, known as a geofence warrant, is a way for law enforcement to leverage the company’s collection of massive amounts of information about its customers. The warrants allow police to track just about anyone who uses an Android device or a company app – such as Google Maps or Gmail – to a specific location over a period of time. As more police use such warrants, the method is raising concerns among privacy advocates, who say the government is collecting information from people in violation of the Fourth Amendment, which protects against unreasonable searches.
Based on real-life stories like the one above, Android users think that removing Google components from their Android phones will make those phones “invisible” to Google. And thus invisible to law enforcement. A very wrong conclusion.
Here’s why: Geofence warrants are usually not issued for Google location data (only) for one simple reason: not everyone uses an Android phone. If this is the case, a robber using a dumb phone or an iPhone will easily escape, which is not the case.
Police use what they call a “cell dump“. A “cell dump” is the sharing of identifying information by a cell tower operator that can be used to identify where a particular person was at a particular time. When cell phone users move, their devices connect to nearby cell towers to maintain a strong signal even when the phone is not actively in use. In this way, law enforcement has access to the geolocation of every cell phone, not just the geolocation of Android phones.
And yes, de-geolocated Android smartphones are susceptible to cell dump techniques, just like any other phone. There is no difference and no real privacy, not to mention security.
De-Googled Smartphones Proven Weaknesses in Geolocation Procedures:
Geofence warrants are usually used within the US because Google is an American company that has to respond to all warrants and orders from US authorities in a very short time, not to mention its direct involvement in several NSA projects. The situation is quite different when it comes to foreign law enforcement agencies, which could be (and usually are) refused by Google when asked to disclose the geo-location of a person located outside the US borders, simply because foreign law enforcement agencies have no authority over Google in this matter.
For this reason, foreign law enforcement, military, and homeland security agencies use a different method to obtain the geolocation of specific cell phones: They contact wireless carriers directly, who must comply with local court orders and warrants to obtain geolocation data for a specific cell phone in a specific time period. Some law enforcement agencies may also conduct a “cell dump” directly.
People like the idea of not being constantly monitored and controlled by Google. So some people think that your freedom and privacy is violated by Google. We’re not going to debate whether that’s true or not. The fact is that if you give up Google’s conveniences, you’ll be Google-free, but you’ll have to put up with a lot of annoyances…. and in the end, you’re dependent on someone anyway… a third party to provide you with your apps. Who is this third party?
Without intending to be Google advocates: Google is a well-known and decent (so we think!) American company. The alternatives: well, relying on Apple… same stuff…. maybe even worse. Or rely on the manufacturer firmware and circuitry of the actual hardware.
In this digital age, there is no escape. Internet companies, the cell phone company, your utility companies, your banks, your tax office, your government, the cameras on your street, your own car…. all follow you, record you, know where you are, how much you spend, where, when, with whom….
So you have to be smart about the information you share, when, how, with whom…:Google becomes the least of the problems.
At this point we will not talk about legal limitations that Geofence Warrants have, but about technical limitations.
Thus, a Geofence Warrant based ONLY on Google-enabled phones has several serious limitations:
We have no idea why the US authorities are only asking Google to hand over geo-location data, given that Apple’s market share in the US is 52% (2021). Adding non-Google smartphones and dumb phones, the percentage for Google phones subject to geofence warrants is quite low.
“Privacy” is not the same as “security”
There is some confusion between information privacy and information security. Just because information is private does not necessarily mean it is secure.
In a world where consumers are aware that personal information is collected for financial gain, but the security of that information is almost an afterthought, a data breach can ruin a company’s reputation and financial reports.
The weekly reports of data breaches have made data privacy and cybersecurity the talk of the town, but people don’t realize there is a difference between the two concepts.
Communication has always been the most significant part and invention of human beings. With the advancement in technology and science, interaction between people is easy. We can connect with people sitting thousands of miles away with one touch through phone calls, emails and messages. Privacy in communications has become a mass issue since people learned about mass government surveillance and data retention by giants like Google. Since some people do not appreciate the values of privacy because they have “nothing to hide”, there is only one major concern left in communication: security.
Immune to geolocation methods
With the exception of XStealth and X-ONE, all XCell Stealth Phones are Google-free cell phones (feature phones), so there are no Google location tracking issues.
XStealth Lite and XStealth accordingly have true GSM location spoofing capabilities, along with location tracking alerts that keep you safe.
At users request, XStealth can be delivered as Google-free Android phones, which is only recommended for US buyers for the reasons mentioned above. However, removing Google components reduces system stability and does not make the phone immune to other types of location tracking described above.
We have always rejected user requests for caller ID spoofing solutions. Once the phone is out in the wild, it exposes the user to many security threats. Read the full article for an overview.
What is the point of changing your phone number and, more importantly, what protection does it give you? Is this the right way to protect yourself? Read this article
The first 4G stealth phone with an unprecedented feature: XTerminator which allow OTA attacks against IMSI Catchers. Read more
