The Sus Phone: my 2 iPhone setup to sandbox apps I don't trust, but can't live without

Tech News Talk
1

I can no longer live without certain apps. It’s just a practical reality. It’s a major bummer for me as a security enthusiast.

You simply cannot get around China without WeChat, which is basically now the national money system. Most vendors will look at you like you’re a rube if you try to pay cash. (They don’t know what they’ve given up but they will one day figure this out.)

You can’t stay in touch with friends abroad without WhatsApp. This is due in part to the patchwork of telecoms is now the default messaging app. Network effects, even a little bit of friction getting people to switch to Signal. So many little forces that make WhatsApp an inescapable monopoly.

Once I accepted I needed these apps I hatched a plan.

My Sus Phone Setup

It was time for me to get a new phone. Apple loves to “age out” their phones, and I was maybe one iOS version update from being unsupported so I took the plunge. $900. That’s what a new iPhone 17 with base stats cost me. Not cheap. But I use the hell out of this thing.

New battery. From 64GB storage to 256GB. It was not a hard choice. And no I’m not an Android guy. I tried. XD

Instead of trading in my old phone or giving it to a relative, I made it my “sus phone.” Any app that is sus I put it on that phone.

Uber, X, LinkedIn, any app associated with Mark Zuckerberg, I threw it onto my sus phone.

Steps to Reproduce

  1. Make sure your email, authentication apps, password apps, sim cards, all that stuff is independently installed on your trusted phone
  2. Reset your sus phone to factory settings
  3. Ideally you have a second SIM card / phone number but not necessary
  4. You do however want a separate gmail address because you’re gonna…
  5. Create a brand new iCloud account
  6. Sign in with that iCloud account
  7. Install all your sus apps. You DO NOT need to create brand new accounts for these. That would defeat the purpose. Just use accounts you’d use in a browser (browsers leak SO MUCH LESS DATA than phones do if you know what you’re doing)
  8. For added security, install Signal on both devices, set up disappearing messages and you can send important files to your yourself (like your profile pic) from one phone phone to the other.

Boom. You’ve got a sus phone.

Just use it on wifi, or tether off your trusted phone when you’re on the go. Power it off when not using it. Bonus points if you set up a Wireguard / Tailscale instance and tunnel through there.

Why bother?

I can’t help you. One day you’ll understand.

Why use a phone at all?

I’ve met serious security folks who essentially don’t use smart phones because they hemorrhage so much PII. Hats off to them. I value my opsec but the convenience trade off is too great for me.

2 Likes
2

Or even sometimes with a physical credit card. At least that was my experience in hong kong. Most of them preferred I had the octopus app.

I feel like I would need a bigger purse for two phones.

Also, I would probably forget my real one home and walk out the house with the sus one :laughing:

1 Like
3

Hi @QuincyLarson

Sounds like the way things are going we’ll need iris, retinal, facial, and biometric scanners (Minority Report).

Amazon Fresh and Go already use “Just Walk Out”, frictionless checkout lanes, or cashier-less technology.

Traditionally passwords are vulnerable to data breaches, phishing, and forgetfulness. Security tech is moving towards zero-effort security, which allows you to unlock doors or pay for goods just by existing in the space. As generative AI becomes better at imitating identity, physical real-time biometrics could become the standard for proving you are a real person. Instead of using a login, systems may use behavioural biometrics, like how someone holds their phone, gait, or typing rhythm to constantly verify someone’s identity.

Facial, iris, and fingerprint scanners are already a part of modern smartphones.

Airports are already beginning to use passportless authentication.

1 Like