So, let me start with a very short story, Someone met a person somewhere, they shared their internet profiles after talking and travelling together for some time. One of them found that person’s phone number there on the internet profile links. And that person got creeped out. And they never talked again.
Now, People don’t realise, what’s their privacy profile, In simple words what information they want to share with whom and what information they don’t want to share with.
Also about the information they are sharing, do they know what there information is getting tagged by it without them knowing.
For example, Lets say you have a family group photo in front of your house. Your house number might be getting tagged with the photo without your consent or knowledge.
And this is a very very very basic example of this. There are very simple ways to get a lot of data about a photo like the photo metadata. And in this AI age there are tools to like google photos where they can get waaaaay more data than we realise. Check this out theyseeyourphotos.com
This is just photos. There are hundreds of other ways we share information to unknown people / companies unknowingly or even knowingly, but the information can be or have been or will be used without your real consent.
Let’s talk about some of them.
What information about them is floating around without them actively knowing?
For example, your UPI address should not to be your_phone_number@your_bank. Anyone you pay with UPI can get your phone number.
Another easy one is the services that you use where you need to call a person sometimes. If they don’t proxy your number those people that you called have your number.
Again one example, There is a company in India whose name is sometime synonymous to bike taxis. So if you book any service with them bike/auto/cab, and then you call, or the driver person call you they would have your phone number & you would have their phone number.
As we have already seen how much data can be pulled out from a simple photo, Let’s talk about something which is happening to everyone and very common, the application most of us used to say “what’s up?” to our near and deer ones is end-to-end encrypted, but because it’s a proprietary application, We don’t even know if they decrypt on the server side or not. If we trust them. Let’s see how much data they do / can collect even if they can’t / don’t read our chats?
Side note before we start:- There is another very popular instant messaging application, which is named on a very old communication technology. Also, there are very huge tech communities on this application. Popular for it’s 2GB Attachment size limit for the non-paid account. People have used it for piracy as well because of this reason. Also, some people do trust this app for their super private communications. But by default this application does not even offer basic end-to-end encryption for chats.
- When do we wake up? (Because first thing that we do after we wake up, check messages of our near and dear ones)
- When do we sleep? (Because the last thing that most of us do before we sleep is again talk to the people who are near and dear to us)
- Who are your near and dear ones? How do we talk to the most and when?
- Which services that we use? (Because they also message on this app as well, because for companies SMS is way too expensive compared to this, also people are not as comfortable with email, or they feel its too official)
- What are you buying or inquiring for? (Because Business version of this application’s chat is not encrypted by default, they say it upfront)
- We talked about photos and these apps have a 24-hour photo sharing feature. Just think about how much data can be pulled out.
- Who are we talking to and who are we not talking, this helps them do profile us and also make echo chambers.
- Where are we at? (Because of location data, and also cell data, there are other ways to calculate location as well).
- Our Whole contact list (We share it to discover more people on the application, It might not be this harmless).
- The Application all have call and call log access, as this application also have call feature as well (So they who are you calling to and when and duration).
There are whole hosts of other things as well. This is just tip of the iceberg.
Last but not the least, Most of us use smartphones these days. And there are lots of apps that want unnecessary permissions like stockbroker needs call permission, news app needs storage access, email i client needs location permission, calendar app needing full contact permission, music player needing camera access.
Location data Note:- There is a feature in newer versions of android that you can give approximate location and not precise location. But most app abuse that API and asks for precise location. If you don’t give it, the app does not work, And most of these apps should not even need location permission in the first place.
Even crazy there are some loan apps in India make your phone a managed device.
The Reactions I get when I talk about privacy people in my circle…
When I mention privacy to plenty of People they say I don’t do anything bad or illegal, why should I care?
Another argument I get a lot is let them get my data so that I get personalized advertisement, and it’s super convenient.
Another super wired one is let them get as much data as possible so that I always provide wrong information.
I have some very simple questions to them To all of these do you really trust the companies who you are giving data to? If you trust them is there are way to verify it? Do we really know how they are storing these data? And what is security posture? If all the answers are favourable, If the company is taken over by another company will they follow the same security posture.
There are no ways to verify that. So, Please don’t share any information on the internet which you are not comfortable. Because once an information goes to the internet it stays on the internet.
Now, we have already discussed the few of the public information that we have in the wild. Unfortunately there are way more problems regarding privacy that I could every cover in my blog posts. Because data is the new oil. Let’s talk about some solutions:-
For photo metadata Removal :- EXIF Remove While sending or saving a photos share it to this app and then share to where-ever you wanted to send.
UPI ID :- Change your UPI ID from your_phone_number@your_bank to maybe to some_random_words@your_bank.
Call Proxy:- So choose services where they use call proxy for calls. Like the company I have talked about didn’t have the call proxy. There is some other company in the same space which is synonymous for cabs. They have call proxy and this is not a recommendation. You do you…
Instant Messaging:- We should use decentralized & free libre open source communication systems.
XMPP Guide by Contrapunctus is a good place to start reading about XMPP. But if you don’t have the time you can start here. It Is very good for 1:1 or small group communication. Super easy to host using applications like snikket.
Matrix has more features, can accommodate big groups. You can start here. You can host your server using Synapse. One con is as matrix server are a little heavy to host. It has become a little more centralised than a lot of people like it to be. But here is an official list of public community servers.
Some honourable mentions:-
Signal is a centralised communication service by an independent nonprofit, and their promises and track record seems well. But Autistci / inventati shut down can happen to signal as well. And also there app is not fully free libre and open source software, because……. I use molly a signal client
Delta Chat is basically secure chat over you email. You would need just email account on an email server to communicate.
Android Permissions :- Now natively on android you would have a privacy manager where you can check which app have what permission and if you feel it’s should not be there just remove and check. There are apps which make it a hard requirement for the app function, for that you can change the app or maybe even user the service in the web.
Also while installing an app lets not blindly say yes, yes, yes for every permission the app is asking for.
This is not even the tip of the iceberg of why you should care about privacy and surveillance in general. And I hope I gave enough food for taught to you be curious about this.
Last updated on - 11.10.26.