Smartphone security on a budget: four apps to try on Android and iPhone
From instant messaging and email to browsing and downloading apps, most of your activity – as you probably already knew – is monitored and tracked.
That may be benign – communications being intercepted by the companies that own those apps, with the full knowledge of their users – but last year’s NSA revelations have done much to raise awareness of unwanted digital surveillance.
Oh, and let’s not forget the ever-present threat of nosy hackers. But there’s also a counter culture of developers making apps that aim to protect you against this snooping: a mini-boom in secure communications.
Caveat: the apps that follow claim to be “secure”, but actually achieving complete security is a risky business – as the last year has shown. Even so, there are apps available that at least provide an above average level of security for your mobile communications.
Alongside my picks, I asked Sony developer and part-time hacker Russell Newman (@smlehbleh) to give his expert opinion on each.
Obscuracam (Android, free)
Whilst most secure photo apps focus on password protecting your treasured gallery of memories, Obscuracam comes at photo privacy from a different angle.
It may or may not surprise some that pictures you take with your smartphone are tagged with identifying data. Aside from the make and model number of your phone, your exact location when the snap was taken is usually in the photo too.
When you share a picture on Twitter, in other words, you also may be sharing some very private information. What Obscuracam does is wipe the photo clean of anything identifying before posting it to your desired social network.
Whilst some smartphones offer the ability to remove geotagging for your photos, this is usually hidden in the setting’s menu and it will apply to all photos. If you want to only remove any identifying data from individual photos, then Obscuracam gives you that option too.
You can also pixelate automatically detected faces in both video and pictures. Although, the video function doesn’t work very well if the clip is fast-moving.
The app itself looks a bit dated, but it works exactly as advertised. I used the app on a recently taken photo and uploaded it to a website that lets you see where pictures have been taken using their geotag data – and the website found nothing.
The entire photo wiping process took no longer than 10 seconds. The ease of finding out where a photo was taken shows the importance of removing that identifying data too.
“The automatic face detection and pixelation feature is a no-brainer use, but it will only auto-detect people looking directly at the camera. Also, unlike Google’s street view, vehicle registration plates and door numbers are not automatically pixelated, which means its down to the user to spot these potential risks,” says Newman.
“Removal of location metadata from photos is a good privacy feature, however, any social networking apps which are granted access to the phone’s GPS could re-introduce new location metadata into any uploaded images.”
Cryptocat (iPhone, free)
The burner phone of instant messaging, Cryptocat lets you drop in and out of group or one-to-one conversations with strangers or friends without a single character recorded. There’s no sign up process, nothing is stored on your phone and you’re not required to submit any identifying information to use it.
I chose this app because it’s significantly easier to use than its competitors. Similar services likeXabber or ChatSecure need a decent level of technical knowhow and the patience of someone with a decent level of technical knowhow to get them to work.
Cryptocat has the retro look and feel of early noughties chat rooms, a concept it’s clearly based on. Conversations are created by making up a chatroom name, which you then share with friends – preferably not over a less-secure communication service. They can then join by entering the chatroom name in the search field of the app.
Cryptocat uses the Off The Record (OTR) protocol to encrypt its messages. Essentially, every message is uniquely encrypted. So any method of decryption can’t be used on two separate messages. It’s also impossible to tell who sent what messages since they aren’t digitally signed.
“Cryptocat provides a unique level of encryption because only the end users have the decryption keys, and not the server,” says Newman. “While eavesdropping parties cannot decrypt the messages in a reasonable timeframe, they can detect that the message is encrypted and where it came from, which might attract unwanted attention to the sender.”
MyKolab – (various, £6.36 a month)
Secure email for mobile is anything but straightforward. For a start, there’s only a handful of secure mail services available, and most don’t have a mobile option – let alone a user-friendly app.
After spending a couple of frustrated afternoons fiddling with the RiseUp andNeomailbox email clients, I settled on the relatively easy to use MyKolab.
MyKolab does what its competitors don’t do and that’s utilise Microsoft’s old ActiveSync functionality on your smartphone (available on most platforms apart from iPhone). What this means is that you can sync all of your emails and contacts from your MyKolab desktop email to your mobile.
MyKolab is a Swiss product, the mecca of privacy and neutrality: the hope being that it won’t be strong-armed into submission by governments, as Lavabit and Silent Mail were last year.
There is risk, however. Whilst the method of sending emails back and forth through the Perfect Forwarding Secrecy protocol protects the email from being intercepted, and any identifying information is stripped from the email header, the actual emails stored on its Zurich-based server aren’t encrypted.
Essentially that means MyKolab can read your emails if it wants to. It explains that it doesn’t encrypt the data stored on its server because even if it did, it would still hold your password and encryption key anyway, so there’s no point pretending that it can’t with pointless encryption. You have to love that Swiss directness.
“The MyKolab email software suite justifies its claims for email privacy by holding all of their customers data within Switzerland. Unfortunately, in doing so, they give up the ability to have worldwide data centres like Google and other mainstream email providers,” says Newman.
“This could limit the service’s capability for delivering data to worldwide customers at the speed and responsiveness people may expect from mainstream email providers.”
F-Droid (Android, free)
F-droid is the marketplace for all things secure on Android: it is the place where those in theknow go to get the apps you (mostly) won’t see in the Google Play store.
Founded in 2010, F-Droid is a registered not-for-profit volunteer organisation run by 45 people, existing solely as a software repository for free and open source Android apps – complete with a rule that they cannot have any “anti-features” like tracking or advertising.
F-Droid itself doesn’t require setup or any sort of registration or your email address: you simply install and start browsing apps. It isn’t available to download from the Google Play Store, but you can download it directly from its website.
F-Droid isn’t as slick or accomplished as its mainstream rival app stores, but it does has some very useful features. For example, you can select which version of each app to install, rather than being forced to install the latest version.
So, if you’ve read that the latest version of an app is causing issues for other users, you can avoid it all together. So far, thousands of apps have been featured in its store.
Whilst it doesn’t have some of the slickest big budget apps available, it does have lots of useful apps like driving feedback and firewall apps that you know are secure and have been vetted (unlike, for example, the recent Virus Shield app, a nonfunctional anti-virus app uploaded to Google Play in what its developer described as a “foolish mistake”).
“While F-Droid’s anonymous access to open source android software is a victory for privacy, you will lose the convenience of having your apps and apps settings backed up by Google,” says Newman.
“The open source nature of F-Droid’s software library allows anyone feel generous to regularly add features or fix bugs in any of the software. The possible dark side of this is that any security holes or bugs in the code are visible to anyone and everyone, such as in the recent case of the Heartbleed bug.”