There is say that states when cats nap, they dream of plots to kill their "owners."
What about phones?
Ok, maybe phones are not planning on killing you, and should have grown out of their arsonistic phase, but that does not stop them from being up to no good. You see, they are always sending information about your location, what you are saying (Alexa and Siri, I am looking at both of you), what you have searched for or bought, and even pictures and videos (think taking a protored exam at home, but creepier). Bottom line is smart phones are little snitches: they compromise your privacy by design.
There are things that can be done to minimize the impact of this intentional data exfiltration both in a behavioral and technological level; that was the topic of the workshop "Practically Protecting Phone Privacy" we presented earlier today at the DEFCON 29's Crypto and Privacy village. I was going to write about it after we were finished, but after 4h of almost nonstop -- we just took 10min breaks every hour -- I was braindead. Understand I was up since 5pm checking and rechecking the slidedeck, the timing, and the demo. The latter did not happen because of network connectivity issues (we were doing this remote). Good thing we planned for that and had a set of screen captures -- phone, Android tools, etc -- to show the different steps. That does not make me happy since I bought 2 phones specifically for that part of the workshop, but, as one of the slides in our presentation says, we need to get out of our comfort zone.
We created a github repo to put the docs and links associated with this talk. It started as instructions to set phones up before the workshop but we plan on adding more stuff. As a result, it is a work in progress (the nicer term is living document).
Right now I still feel braindead (as my typos demonstrate) so it will take a while until I add something clever to this thread. Still, at least I would like to thank the folks at Crypto and Privacy village for having us and putting up with our troubles and shenanigans.
