When you buy a new phone these days the chances are that it’s running the operating system called Android. This is the operating system produced by Google. As of 2019 its on about 75% of the phones out there (https://gs.statcounter.com/os-market-share/mobile/worldwide). It’s a hugely powerful OS but it’s also complex, with a bewildering amount of options that most users will never delve into. Unfortunately many users don’t realise that there are steps they can take to secure their phone and data until after a catastrophe occurs. If you’re thinking about security after a catastrophe then it’s too late. Read on to see what you should do the first day you have a new phone.
But first, there’s no point blindly changing settings without understanding why your doing it. Whats the worst that can happen? Well think it through. For many people a mobile phone is now a powerful mini computer. You can
- Access your mails on it. Friends, family, work probably send you emails that you wouldn’t want to be shared with the world.
- Access your banking on it. View your financial transactions and probably transfer money to third parties.
- Access your social media on it. If you use Facebook, Twitter, Instagram, etc. etc. on your phone then every post you’ve ever made is accessible, no matter how private you made those posts. Anybody who has your phone can send messages to these platforms as you.
- Store 1000s of photographs on it. Weddings, birthdays, births, kids pictures, holidays and many other important occasions. are all stored on your device.
- Access all of your SMS, WhatsApp, Telegram, Signal, Line, Viber messages and send as you to your colleagues and friends.
- Access your home address. If you use mapping services then they’re logging where you travel to and where you spend time. This is handy information if you’ve lost your keys as well as your phone.
- Access your surfing history. What sites do you go to, what are your interested?
- Access your media accounts. Have you got Netflix, Disney +, Sky, installed?
And the list goes on and on. These are only the items that are common to most people. There are an almost infinite array of other personal uses that people use their phone for and this list just gets bigger each day.
So what ….
…you might say, I don’t care or I don’t use most of the functions that you’ve outlined above or I don’t care who has access to my phone, I’ve nothing to hide.
- the people who want this information are smart. They’ve figured out how to manipulate people / systems in ways that we can’t start to imagine. People and companies are being manipulated every day with stolen information. Why make it easy for them?
- you don’t always know what your phone is doing. How many apps have you got on your phone? Do you know what data each of those apps has access to? Do you know how well they’ve been security tested. Some apps can store passwords, screenshots of accounts and other personal information in a folder on the device. Whoever has the device can access that information.
- even if you delete all sensitive data as you use your device that doesn’t mean it’s gone forever. A hacker, law enforcement official or particularly savvy IT professional can probably get way more information out of your device thatn you’re comfortable with.
So hopefully you can see the benefits of putting having some security on your device. In reality, these steps only take a few minutes to set up and then you never need to worry about them again.
The first thing anybody who steals / finds your phone will try to do is turn it on obviously. Android has plenty of options for blocking this. The trick is to set it up in such a way that it blocks somebody from accessing your data while not causing you issues. There’s no point setting up a password for example for somebody who has problems typing it in or can’t remember it.
As usual there are several settings types each with their advantages and disadvantages
This is the simplest authentication mechanism. On modern Android devices you can set up a 6 digit numeric number as your password.
You will have to set up a password anyway even if you use the other methods to unlock your phone. This is used as a backup.
Pick a number that you’re not going to forget and don’t reuse your bank card PINs or date of birth or anything else that might be guessable.
You can set up your phone to only unlock when it recognises your face.
In previous incarnations this could be fooled by photographs. Also if your face changes dramatically it might not unlock your phone. In this case you can fall back to the password. So if your face is not recognised you don’t need to be worried about being locked out of your device forever.
You have to train the phone to use your fingerprint. It will take multiple imprints of your finger and you can use multiple fingers.
Not all phones have this as an option and some phones have better systems for recognising fingerprints than others. When it works well it’s highly recommended.
You will still have to set up a password as a backup. If for some reason your phone won’t recognise your fingerprints anymore then you can fall back to your password.
Watch the video to see how to set up pattern unlock.
Using this method you set a parttern on the phone and it won’t unlock until the correct pattern is entered.
Pattern unlock is very easy to use but it’s also easy to watch somebody entering their pattern. Also people tend to draw simple patterns so it’s not very difficult to guess the pattern after a few tries.
So which is best?
In order of preference
- Fingerprint Unlock – If your fingerprint sensor is good on your phone then use this. Once the sensor is good then the fingerprint won’t slow down your phone at all when turning on.
- Password – This is a secure alternative (as long as you don’t use easy to guess passwords).
- Pattern Unlock – Set a patter that touches at least 5 points. If you find the Password unlock option too slow when you’re opening the phone then this is an OK option if you are careful not to let anybody see you opening your phone.
- Face Unlock – This is the last option. It’s better than nothing but there have been too many stories of this type of lock being bypassed.
Lock Screen Message
OK, so now you’ve secured your phone. If anybody steals it they’re not getting anywhere. Great. What if you lose it and it’s found by an honest person, you’d like them to return it to you. Luckily there’s an option for this too. You can put a message on your lock screen that people can read when the phone is turned on. A small simple message telling the finder to ring a spouse, brother, sister, parent, son is enough. They’ll have your number and can ring you to tell you where to pick up your expensive phone.
Here’s a simple lock screen message.
Watch the video to see the steps to set up the message for your lock screen.
Set up some Emergency Contacts
Lock Screen Notifications
Securing the Sim
OK, if your phone is stolen they can’t get into your data as you’ve put a good password or fingerprint on your lock screen. There’s nothing to stop the thief from opening up your device and taking out the SIM to pop into another phone. Then they can ring expensive numbers racking up a nice bill until you’re able to contact your provider to cancel the SIM.
Thankfully all SIMs can be password protected. When you use the phone daily you won’t be asked for the PIN. If the phone is rebooted or if the SIM is put into a new phone then you won’t be able to use it until you type in the correct SIM. It’ll lock out if you enter the SIM incorrectly a few times and you’ll have to contact your provider to set a new one.
- Get the PIN that was provided to you by your network provider. If you didn’t get one then it’s probably 000
Watch the video to see the steps to set up the PIN for your SIM.
What happens if your phone is lost but nobody has found it. Your phone might be secure but you’d still like a chance to get it back. Google (and other companies) have Location Tracking so you can narrow it down to see where your phone is. Note, your phone must be turned on and have a signal for this to work. If it’s off then you’ll only see where the phone was last identified which might not be where the phone is now.
This should be enabled on modern Android phones by default. However, you may have an older phone or you may have disabled it by saying no to some permissions when the phone was first set up.
To check if the setting is enabled follow these steps.
Now go to https://www.google.com/android/find and sign in. You should see a screen like this. I’ve zoomed out, as it shows my address, but it does show down to the street level by default.
From this screen you can play a sound (handy if the phone is near you).
You can also lock the device. This allows you to put a message on the screen in case somebody finds it and locks the phone.
And you can wipe the device. This is covered in the next section.
Watch the video here to see how to set up the Find My Device settings and see them in action
This is related to the previous section in that you use the same settings. Remote Wipe is used when you’ve given up hope of getting the phone back and want to make sure your data is safe. So make sure ther Remote Location options are working by following the instructions in the previous section.
Go to https://www.google.com/android/find and sign in.
Hit the Erase Device option. Then on the next screen accept the options. Now when your phone nexts connects to the network it will be wiped.
DO NOT do this as an experiment.
Backup your photos
We’ve covered what to do to stop people accessing your data if the phone is lost or stolen. That’s great, but you’ll want some or most of the data back. If you haven’t considered backing up your phone, it’s too late to think about it after the device is gone or broken. Most Android devices come with Google Photos. This is a great automatic system for copying your images up to your Google account. You can access these on a new device or on the web at any time. As usual, there’s a small bit of tweaking required.
- Open the Google Photos app on your phone.
- Click on the Menu option at the top of the screen.
- Go to Settings
- Go to Backup & Sync
- Ensure that your Gmail account is set up here.
- Go to Upload size. There are two important options here.
- If you choose High Quality there is no limit to the amount of photos that will be backed up. But be aware that Google will apply some compression to the photos so it may not be as good quality as on your phone.
- If you choose Original Quality then every photo it backs up will count towards your Google space. So if this space fills up then the photos will stop backing up. You can purchase extra space (100Gb for 41.99 per month)
- Check the Mobile Data Backup options. Choose your options accordingly. If you back up over mobile data you may get charged by your provider. The same is true for Roaming. And be careful of video files. If you back these up over Mobile Data it could cost your a fortune.
My recommended settings
I use the following settings for my photos backup.
- Set the upload size to High Quality. This is good enough for me and I can’t tell the difference between these and Original Quality.
- I don’t allow uploads over Mobile Data. This means the Photos won’t backup until the phone next connects to a WiFi network. So potentially I could lose a few hours of photos. I can live with this. And when I’m on holidays I connect to hotel networks and the photos back up.
- As a secondary backup I connect my phone to my laptop once every 6 months and copy all of the photos on my phone to a thumbdrive. Now I have a second backup of all the photos in their original quality.
To see these settings being set up just watch this video.
You can access your photos from any device. Simply go to photos.google.com and log on.
If you lose your phone, once you log in to a new device with your Gmail account then all of the photos that you had before will be accessible in the Photos app on the new phone.
What security settings are there to do with Apps? Well not much, but there are some best practices that you should be aware of.
Use the Play Store
When you install most applications you’ll go into the Play Store, search for it and install away. Ocassionally you might find an app on a different store or on a website. If you try to install these Android will pop up a warning and ask if you want to continue.
You’ll see a warning similar to the one shown here. The reason why we trust the Play Store is that Google attempt to scan for malicious software and remove it from the store. If you install from a random website then this check is not performed. The app may be fine or it may have viruses / trojans built in that you’re not expecting.
Note: The Play Store is NOT perfect. There have been instances of malware installed on applications in apps in the Play Store. However Google does make a good effort at keeping the apps clean and removes the dodgy ones when they’re found.
When you see a warning like the one shown here you can click the settings button and choose to trust the source. So be careful of what you’re installing.
Pay attention to what you’re installing on the Play Store
Check the name (Is this the app I want?)
Some apps will be named similarly. Sometimes this is because they do similar tasks and sometimes it’s because the app developer wants to fool you to installing his app. He can either do this to get market share or to get an app onto your device for other reasons.
So if you’re installing an app from the Play Store check the name of the app and the Developer / Company name.
How many other users are using this app?
When you open app details in the play store check two important details.
- Its feedback. This is the number of stars it has. If an app has 1 or 2 stars then most people who installed it didn’t like it. Avoid. But if an app has 5 stars that doesn’t mean it’s perfect either. It might mean only one or two people have given the app a review. Check how many reviews it has. If it’s only a couple then avoid.
- The number of installed users. If there are less than 1000 users then I avoid the app. The more users that have an app installed the more likely it is that any malware that is in the app has been notice. If there are 10’s of 1000s of users then the app is “probably” OK. Every so often you might hear of apps that have been removed on the play store becuase of malware. These are ALWAYS apps that have little feedback and only a few users.
Check your app permissions
Check your Smart Lock Settings