Privacy

32165 readers

146 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

Safest way of using WeChat on Android? (lemmy.ca)

submitted 7 months ago by bionicjoey@lemmy.ca to c/privacy@lemmy.ml

81 comments fedilink hide all child comments

I live in Canada. My girlfriend is Chinese (also living in Canada), and while we are able to communicate via SMS, her mobile carrier isn't the best, and so there have often been issues for us with regular texting. She expressed a strong preference to use WeChat, at least as a backup option for when texting fails us. While I have some pretty significant reservations, it's not the hill I want to die on. So my question is: what can be done to use WeChat without compromising my whole phone? I'm okay with it if our conversations aren't private, but I'd like to know that I'm not giving unfettered access to all of my phone's systems and data to the CCP. What can be done to limit the reach of this ubiquitous app on my device?

you are viewing a single comment's thread
view the rest of the comments

[–] viking@infosec.pub 50 points 7 months ago* (last edited 7 months ago) (5 children)

I'm in China and have to use that piece of crap. So here's how I locked it down:

Root your phone with Magisk. There's no way around it.
Install Storage Isolation (https://play.google.com/store/apps/details?id=moe.shizuku.redirectstorage) and deny access to all folders.
Install ApOps (https://play.google.com/store/apps/details?id=rikka.appops) and set pretty much everything to deny or ignore (ignore means the app receives the information "permission granted", but no data is provided, in case some permissions are "mandatory"). If you intend to use wechat to exchange voice messages or make video calls/send photos, the "use microphone" and "use camera" functions would be required. In a similar fashion the location access if you intend to use the location sharing feature.
Be acutely aware that wechat is not encrypting messages, neither end to end nor in the server communicaton. Everything you say can (and probably will) be read and archived. Don't say anything confidential or critical there.

And yeah really, try to convince your ~~wife~~ girlfriend to use signal instead. Or hell, even whatsapp is miles ahead.

My wife is Chinese as well, so even after we leave here she'll be using wechat to stay in touch with family, no way around it, but using messengers more commonplace in other countries is definitely better. Personally I will move wechat to another phone once we're out. For now that's not feasible as it's too much integrated into every function of life here.

[–] umbrella@lemmy.ml 2 points 7 months ago (2 children)

+1 for signal but i doubt whatsapp is ahead at all

[–] viking@infosec.pub 14 points 7 months ago (2 children)

Whatsapp uses end to end encryption and is far from as intrusive as wechat.

[–] jet@hackertalks.com 4 points 7 months ago (1 children)

So they say, but its closed source, so its hard to verify.

[–] viking@infosec.pub 10 points 7 months ago

Nah it's rather easy to do and has been done by security experts. If your phone is a rooted android, you can do it yourself using PCAPdroid, it's basically a network logger that allows to install a trusted certificate as a local proxy and go man in the middle on yourself. That way you can decrypt the https traffic between your phone and the whatsapp server.

[–] umbrella@lemmy.ml 2 points 7 months ago (1 children)

whatsapp is certainly backdoored, its closed source and unverifiable.

[–] umami_wasbi@lemmy.ml 1 points 7 months ago (1 children)

then so does your claim, unverifiable

[–] umbrella@lemmy.ml 1 points 7 months ago* (last edited 7 months ago)

my claim is completely open, unlike whatsapp

[–] umami_wasbi@lemmy.ml 4 points 7 months ago (1 children)

At least Whaysapp have the content encrypted

[–] umbrella@lemmy.ml 0 points 7 months ago

its certainly backdoored

[–] EngineerGaming@feddit.nl 2 points 7 months ago (2 children)

Can it be used without a smartphone, like in an Android VM?

[–] bionicjoey@lemmy.ca 2 points 7 months ago

Yeah I was considering Waydroid but then I lose the ability to connect outside of my PC

[–] viking@infosec.pub 2 points 7 months ago

I guess it could be, but that kills the use case of being contactable by his GF on the fly.

[–] Ainz@lemmy.world 2 points 7 months ago (1 children)

Install Shizuku -> Doesn't require root
Install Island and use the built in work profile feature of your android device
Install AppOps and block most of the app with garbage data
Be happy without rooting your phone

[–] viking@infosec.pub 1 points 7 months ago

Yeah I've played around with it in the past, but having to re-establish the wireless adb was quite annoying. Plus I need root for AdAway already, I don't think that can be achieved via Shizuku, but that might not apply to the OP. I've tried island back in the beta stage and it wouldn't work on my phone, but I guess things have change since. Might give it another try.