18

I am unsure how to formulate this question, so please feel free to edit it.

I considered asking on https://android.stackexchange.com/ but feel that this is more security related and more likely to be answered here.

I want, so far as is possible, to avoid Google (or anyone) scanning my emails, tracking location, using me as the product.

I use a laptop running Windows (which I can't change for business reasons); I can use my own (someone else's which I pay for) servers, which might make email more secure. Plus an Android 'phone.

Let us assume that I am willing to eschew all Google products; which, for me is Gmail & Google maps.

Q: if I factory reset my phone, will Google recognize me when I next use it? I presume so, as they have at least a fingerprint of hardware/installed apps/whatever.

In any case, if I use the same SIM card, I image they will tie me to the device.

Q: would a new 'phone help? If I did not get a new SIM/'phone number?

Q: what if I get both a new SIM card/phone number and a new 'phone number simultaneously?

That might work for a while, I guess, by how do I install new apps? I guess I could make a single use Gmail address, only for app install.

I have never used FaceTweet or even YouTube. Only LinkedIn - and am happy to use that in private mode, via a VPN.

I am willing to make some effort, but not extremis.

Question: can I avoid Google, et al, become "newborn", and remain untracked? Or are things like tracking cookies too ubiquitous, such that just one slipping through the cracks will pw0n me & I may as well welcome out new Goooglian overlords?

  • 1
    In short; avoid any products they own, manage, control, maintain or contribute to. When looking for products to use make sure Google doesn't own the company that makes them, do your research on every product you use and you can completely avoid Google (In theory) – J.J Jun 18 '18 at 19:59
  • 5
    Just buy a new Android phone, install a custom ROM, don't install Google apps, don't access Google services from the phone, use Firefox Focus or other history-deleting browser. Google does not know about you unless you use Google services. – ThoriumBR Jun 18 '18 at 20:44
  • 2
    If your Android phone supports custom ROM, you don't need to buy another one. – ThoriumBR Jun 18 '18 at 21:49
  • 2
    Android is a Google product. You cannot "escape Google" while continuing to use an Android phone. – duskwuff Jun 19 '18 at 20:53
  • 1
    This is a good general topic, and several websites have lengthy blogs to de-Google yourself. It will require a lot of reading and a lot of technical know how, and you won't be able to use the cool kids software/apps. However, I don't think that it fits well with the SE style Q&A sites because of its depth and the fact it will change over time as Google thwarts your attempts to escape. You seem primarily concerned with the phone side, and that's only a small tracking vector. It's also one of the hardest to anonymize due to the nature of the phone systems. – YetAnotherRandomUser Jun 19 '18 at 23:44
14

Two initial points to start:

  1. Location tracking

    If you don't want to be location-tracked, you cannot carry a smart phone, or flip phone with a cell provider contract.

    The phone you carry on high frequency intervals is communicating with cell phone towers, constantly, 24/7, establishing its triangulated position with them and confirming its ability to receive calls and to transmit data. The service provider records this location history and may share it in some aggregated or sampled form with third parties that you have never heard of (along with some you have).

    The phone of course has a number of hardware components the IDs for which are included in these communications and are unique, so individual physical phones have individual histories. In terms of associating those histories with specific humans, all providers make it possible for third parties to have business arrangements wherein it becomes possible to associate those IDs with specific customer account data- name, snail mail address, etc.

    There are numerous third parties that had previously built out historical databases of names, including spelling variants, and snail mail addresses, and turn those into whole family histories- parents, grandparents, siblings, children- along with neighbors and other coarse location associations. Some of these are participating in more granular cell-based location tracking arrangements.

    Third parties are sometimes not supposed to use this data for certain purposes, or to save it for an extended period of time, and in general they can be trusted only to completely fail to not use this data or to not save it for an extended period. From time to time these failures and the resulting exposures are egregious enough that they make the news.

    (Note that if you also leave wifi on, the same is happening with hot spot providers, who are under even less obligation to not do whatever they want with the observation that MAC address x:y:z comes into range of hotspot 12345 every Friday night at 11pm, etc.)

  2. Google

    If in particular you want to not leave a data footprint with google, you cannot own or use an Android product. The Android OS is in frequent communications with Google servers to convey various sorts of telemetry. This happens independently of whether you are using any Google-branded apps.

    I have not studied what happens if you use a third party OS on Android hardware. They are all to a degree based on the upstream Android source. My scepticism is that all traces of interactions with Android server infrastructure, under all edge cases and so forth, had been excised, would be high.

    If you do not want to leave a data footprint with Google then you also cannot visit any websites, because nearly all of them use Google Analytics.

So, with that background, the specific questions:

Q: if I factory reset my phone, will Google recognize me when I next use it? I presume so, as they have at least a fingerprint of hardware/installed apps/whatever.

A: Yes. Phones have unique hardware identifiers. Those identifiers are not changed with a factory reset.

Q: In any case, if I use the same SIM card, I image they will tie me to the device.

A: There is a difference between the cell service provider- for whom the SIM card services as a unique identifier- and Google- which has its own identity infrastructure based on Gmail accounts. Google servers receiving network traffic that originated from the device then comes to Google from the cell provider egress are able in many cases, though not all, to associate that traffic with a unique account at a cell provider. But Google's identity management is not based on the SIM.

Q: would a new 'phone help? If I did not get a new SIM/'phone number?

A new phone, in order to use the cell network, needs to be associated with an account, and that account has to have an identifiable owner- either a person with a name, SSN and address, or a business with a name, TIN, and address. So as long as you have a SIM tied to an account in your name with a cell provider, your use of whatever physical phone with that SIM will associate telemetry data with that account.

Q: what if I get both a new SIM card/phone number and a new 'phone number simultaneously?

See above. One has to think about the concept of "account" in a different way.

Only LinkedIn - and am happy to use that in private mode, via a VPN.

Neither of these things matters if you are authenticating with LinkedIn. All that's happening in "private" mode is that the permanent cookie LinkedIn wants to save with your browser doesn't get saved. But as long as you authenticate- surprise- they know it's you!

Similarly, VPN makes little difference. Sure, the IP address you seem to be coming from may be the VPN provider's, but many VPN setups are broken and the real IPs are easily leaked. There are also numerous tells in searches and communications on LinkedIn that can inform regarding the location of the account. LinkedIn has relationships with third parties with whom some of this data, at coarse levels of granularity, is shared.

I am willing to make some effort, but not extremis.

This is the most important point to follow up on. What exactly is the concern with location and other kinds of tracking?

At the end of the day, ad targeting, while unpleasant, in the US at least is largely innocuous.

There are plenty of places around the world where tracking of various kinds is not innocuous, and where there isn't even the pretence to various forms of privacy. But usually the concerns in those cases center more directly on various authorities and less on specific companies.

  • 6
    Disposable phones don't require name and other ID registration. – Neil Smithline Jun 19 '18 at 3:52
  • 1
    Agree of course re burners, will edit later to clarify. Re: location tracking- it is mentioned as a concern in the question, but seemingly assuming that only google location tracks. Point of the Matrix reference is that it isn't only or even primarily google that does this. – Jonah Benton Jun 19 '18 at 11:44
  • 1
    Sigh! I am not so paranoid as to use a burner. I guess that means that I can't, but maybe I can limit it by limiting my sue of Google products. At least, not use Gmail, which is scanned for keywords to serve ads, and not Google docs. I will also use Firefox Locus on my 'phone, maybe a TOR browser on my laptop, and not use Google search or Google maps (although I can be tracked by other means). I suppose that's about the best that the "amateur paranoid" can do, – Mawg Jun 19 '18 at 18:27
  • 1
    A day after this answer was submitted, a report that cell providers promise to be more judicious about their sharing/selling of location data. Noted only because of the timing, I have no opinion on its veracity: mobile.nytimes.com/2018/06/19/technology/… – Jonah Benton Jun 20 '18 at 2:20
  • 1
    @NeilSmithline that depends on the country you aquire that phone. Some countries have laws that avoid selling phones without linking those to a person/company. – YoMismo Jun 20 '18 at 6:55
4

If you want to escape Google as much as possible, you should first avoid their products and services. Here are some tips and tricks. Not sufficient, but should help.

  • Avoid GMail
  • Avoid using Android (e.g. you can use a secondhand Windows Phone instead)
  • Avoid installing any app from the Google Play store and even having an account on the Play store. Sometimes, you really have to look at the very tiny strings at the bottom of webpages to find alternate download links that are not on the Play store. I remember this was the case for Firefox.
  • Choose a bank that does not ask you to download an app on the Play store for their secure login.
  • Use web search engines that use their own index. There are few as most engines are metasearch engines, but there are some. YaCy.net is a peer to peer search engine; data are not centralized but are stored in a peer to peer network. Amongst centralized engines with their own index are Yandex.com (Russian), Baidu (Chinese), Bing (Microsoft) and partly Qwant.com (French), which is also a metasearch engine at the current time.

    Is Yippy.com developing its own index? Maybe. It is described as a metasearch engine. However, most results seem to have been cached and coming from Yippy index.

  • Be careful with all online services are many are using components from Google. Prefer standalones when you can, even if paid.

  • Be aware that the vast majority of time planning software (especially online services, but also several standalone with synchronization features) rely on Google Agenda, or use it to synchronize with it. Simply don't use them or avoid the synchronization.
  • On PC, edit your host file in C:\Windows\System32\drivers\etc so that your browser will search those sites locally instead of calling them.

127.0.0.1 googletagmanager.com 127.0.0.1 google-analytics.com 127.0.0.1 data.coremetrics.com 127.0.0.1 criteo.net 127.0.0.1 criteo.com

You should also avoid fonts loaded from Google. Many websites use them. There are many more sites to add. You can visit this for a long list: https://someonewhocares.org/hosts/

  • Try to remember the address of websites and enter them directly in the address bar instead of searching them in Google.
  • For translations, you can use deepl.com.
  • For videos, remember that YouTube is owned by Google. Some alternatives are Vimeo, Wistia, Dailymotion, Metacafe and more.
  • Favor buying a standalone executable (or using a free one) when you can, because online services, including those from startups often use a lot of services from Google, especially Analytics. When you cannot, use web apps that are open source and that you can run locally on an xampp/mampp/lampp server (Apache+PHP+MariaDB). For alternative online services, a useful list is on https://framasoft.org. Their website is available in English and French. Many standalone software are reasonably priced. By buying them you help small companies to survive and offer alternatives to Google products and services.
  • Lastly, be aware that the Mozilla Foundation owns Mozilla Corporation which is a "for profit" company and that search engines like Google pay to be the default search engine in Firefox. As an alternative to Thunderbird from Mozilla there are several standalone mail clients like TheBAT!, Chaos Intellect, EverDesk, Claws. Each has its pro and cons.
  • A very comprehensive answer, thanks. For search, I use startpage.com which front-ends Google, so I still et those good results, but privately. I did buy The Bat! but stopped using it a few years ago and can't remember why. Some good tips about the Windows hosts file - and more. You seem to be new around here, but I am sure that you are going to be a great help. Thanx a 1,000,000 – Mawg Jul 27 '18 at 9:14
  • 1
    You're welcome. Tools that front-end Google do not allow you to search privately. It is an illusion. Yes, to a certain extent they can "anonymize" your search. But each front-end can also can add its own layer of analytics. Furthermore, from your areas of interest, the sites you're visiting on a regular basis, the time of your searchs, possible forum posts that follow searches, online translations you do, Google can certainly know restrospectively who did some "anonymized" search. Only by the newspapers site you visit, the browser version you use, the plugins, you create an almost unique ID. – OuzoPower Aug 2 '18 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.