this post was submitted on 19 Apr 2024
72 points (95.0% liked)

Privacy

32120 readers
472 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
72
Safest way of using WeChat on Android? (lemmy.ca)
submitted 7 months ago by [email protected] to c/[email protected]
81 comments fedilink hide all child comments
 

I live in Canada. My girlfriend is Chinese (also living in Canada), and while we are able to communicate via SMS, her mobile carrier isn't the best, and so there have often been issues for us with regular texting. She expressed a strong preference to use WeChat, at least as a backup option for when texting fails us. While I have some pretty significant reservations, it's not the hill I want to die on. So my question is: what can be done to use WeChat without compromising my whole phone? I'm okay with it if our conversations aren't private, but I'd like to know that I'm not giving unfettered access to all of my phone's systems and data to the CCP. What can be done to limit the reach of this ubiquitous app on my device?

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 50 points 7 months ago* (last edited 7 months ago) (5 children)

I'm in China and have to use that piece of crap. So here's how I locked it down:

  1. Root your phone with Magisk. There's no way around it.
  2. Install Storage Isolation (https://play.google.com/store/apps/details?id=moe.shizuku.redirectstorage) and deny access to all folders.
  3. Install ApOps (https://play.google.com/store/apps/details?id=rikka.appops) and set pretty much everything to deny or ignore (ignore means the app receives the information "permission granted", but no data is provided, in case some permissions are "mandatory"). If you intend to use wechat to exchange voice messages or make video calls/send photos, the "use microphone" and "use camera" functions would be required. In a similar fashion the location access if you intend to use the location sharing feature.
  4. Be acutely aware that wechat is not encrypting messages, neither end to end nor in the server communicaton. Everything you say can (and probably will) be read and archived. Don't say anything confidential or critical there.

And yeah really, try to convince your ~~wife~~ girlfriend to use signal instead. Or hell, even whatsapp is miles ahead.

My wife is Chinese as well, so even after we leave here she'll be using wechat to stay in touch with family, no way around it, but using messengers more commonplace in other countries is definitely better. Personally I will move wechat to another phone once we're out. For now that's not feasible as it's too much integrated into every function of life here.

[–] [email protected] 2 points 7 months ago (2 children)

Can it be used without a smartphone, like in an Android VM?

[–] [email protected] 3 points 7 months ago

Yeah I was considering Waydroid but then I lose the ability to connect outside of my PC

[–] [email protected] 2 points 7 months ago

I guess it could be, but that kills the use case of being contactable by his GF on the fly.

[–] [email protected] 2 points 7 months ago (1 children)
  1. Install Shizuku -> Doesn't require root
  2. Install Island and use the built in work profile feature of your android device
  3. Install AppOps and block most of the app with garbage data
  4. Be happy without rooting your phone
[–] [email protected] 1 points 7 months ago

Yeah I've played around with it in the past, but having to re-establish the wireless adb was quite annoying. Plus I need root for AdAway already, I don't think that can be achieved via Shizuku, but that might not apply to the OP. I've tried island back in the beta stage and it wouldn't work on my phone, but I guess things have change since. Might give it another try.

[–] [email protected] 2 points 7 months ago (2 children)

+1 for signal but i doubt whatsapp is ahead at all

[–] [email protected] 14 points 7 months ago (2 children)

Whatsapp uses end to end encryption and is far from as intrusive as wechat.

[–] [email protected] 4 points 7 months ago (1 children)

So they say, but its closed source, so its hard to verify.

[–] [email protected] 10 points 7 months ago

Nah it's rather easy to do and has been done by security experts. If your phone is a rooted android, you can do it yourself using PCAPdroid, it's basically a network logger that allows to install a trusted certificate as a local proxy and go man in the middle on yourself. That way you can decrypt the https traffic between your phone and the whatsapp server.

[–] [email protected] 2 points 7 months ago (1 children)

whatsapp is certainly backdoored, its closed source and unverifiable.

[–] [email protected] 1 points 7 months ago (1 children)

then so does your claim, unverifiable

[–] [email protected] 1 points 7 months ago* (last edited 7 months ago)

my claim is completely open, unlike whatsapp

[–] [email protected] 4 points 7 months ago (1 children)

At least Whaysapp have the content encrypted

[–] [email protected] 0 points 7 months ago

its certainly backdoored