Ask HN: What's your strategy to handle your phone being stolen?
I use an Android phone.
I keep location and mobile data ON when I go outside.(So that I can locate it / remotely wipe it). I use phone's default encryption. Both my sim cards are locked using PIN. What else can I do to prevent misuses/data leak if my phone gets stolen? Whats your approach?
17 comments
Most comments here are "my phone is already stolen because google bad", or "dont use 90% of the features and youre fine".
Here's an answer for normal users.
Buy a pop socket with a ring, keep your finger in it - it gets difficult to take the phone from your hands. Keep your phone in a closed bag when not in use, on the front of your body, like one of those "fanny pack" things, for example. Keep all your important things synced, and know where to find and how to use the "find my phone" and similar features.
For android, for example, you can remotely find and hard-lock your phone and SIM. Know where to find and how to use that.
Buy a non-apple phone, or any other phone that isnt highly desirable by thiefs. iPhones have a very high resell value.
Here's an answer for normal users.
Buy a pop socket with a ring, keep your finger in it - it gets difficult to take the phone from your hands. Keep your phone in a closed bag when not in use, on the front of your body, like one of those "fanny pack" things, for example. Keep all your important things synced, and know where to find and how to use the "find my phone" and similar features.
For android, for example, you can remotely find and hard-lock your phone and SIM. Know where to find and how to use that.
Buy a non-apple phone, or any other phone that isnt highly desirable by thiefs. iPhones have a very high resell value.
Your comment is addressing how to make it less likely that your phone, the physical property, will be stolen. The original question seemed to be asking how to prevent digital damage from occurring, assuming the physical device will eventually become lost or stolen somehow.
While my original comment was a bit flippant and terse, it points to the main thing you can do - minimize the activities on a device that you routinely take out of the house and generally want to remain unlocked for easy use. The "normal user" answer is still to obtain multiple devices, rather than bundling everything onto that phone. For one, it's easy and cheap to buy an old tablet (~$100) for "mobile apps" where having the functionality in your pocket is an outright liability (eg banking, do you really want a mugger to be able to view your account balances?). Second, a "normal user" should still have a laptop with a keyboard they can use at home, to sidestep the extractive "mobile" ecosystem all together. A used one can easily be had for $400 and won't turn into ewaste in three short years, placing it well within the budget of most "normal users".
While my original comment was a bit flippant and terse, it points to the main thing you can do - minimize the activities on a device that you routinely take out of the house and generally want to remain unlocked for easy use. The "normal user" answer is still to obtain multiple devices, rather than bundling everything onto that phone. For one, it's easy and cheap to buy an old tablet (~$100) for "mobile apps" where having the functionality in your pocket is an outright liability (eg banking, do you really want a mugger to be able to view your account balances?). Second, a "normal user" should still have a laptop with a keyboard they can use at home, to sidestep the extractive "mobile" ecosystem all together. A used one can easily be had for $400 and won't turn into ewaste in three short years, placing it well within the budget of most "normal users".
> Keep your phone in a closed bag when not in use, on the front of your body, like one of those "fanny pack" things, for example.
To add to that, cutting the bottom or side of bags on crowded trains is a known theft method, so if it is in a bag, beware anyone in your personal space, and don't assume the bag is full protection.
To add to that, cutting the bottom or side of bags on crowded trains is a known theft method, so if it is in a bag, beware anyone in your personal space, and don't assume the bag is full protection.
> Buy a non-apple phone, or any other phone that isnt highly desirable by thiefs. iPhones have a very high resell value.
Is that still true? Seems to me there's been a major reduction in iPhone theft since iCloud locking became a thing. Maybe less in countries where phones are stripped for parts...
Is that still true? Seems to me there's been a major reduction in iPhone theft since iCloud locking became a thing. Maybe less in countries where phones are stripped for parts...
>Buy a non-apple phone, or any other phone that isnt highly desirable by thiefs. iPhones have a very high resell value.
or get an Iphone SE. People will think you're crazy for having such an old iPhone, and you get 80% of all the latest iphone tech inside.
or get an Iphone SE. People will think you're crazy for having such an old iPhone, and you get 80% of all the latest iphone tech inside.
For Android, you had better keep your 2FA codes in an accessible location if you plan on locking/finding your phone. There's nothing like losing your phone, trying to log into your account from your SO/friend/stranger's phone so that you can. get to Find My Phone, and being blocked from taking action because you don't have your 2fa codes on you.
Solutions: First obvious one is to keep a physical copy of your recovery keys in your wallet. Of course, that doesn't help if your wallet is stolen, so the next option that I use:
Keep a KeePass (or equivalent) database in a hosted cloud like Dropbox (that DOESN'T require 2fa), holding your recovery keys. This way your database is protected by two passwords, so that if either are compromised you are still protected. You'll have to memorize both passwords but that's a good tradeoff imo. Then use KeeWeb (preferably a self-hosted one) to access your database and codes. So the model here is: borrow a phone, log into Dropbox, download KP database, open KeeWeb, open database, and get your 2fa codes. Log into Google (actually, third password you should memorize), and lock/ring/clear your phone.
Solutions: First obvious one is to keep a physical copy of your recovery keys in your wallet. Of course, that doesn't help if your wallet is stolen, so the next option that I use:
Keep a KeePass (or equivalent) database in a hosted cloud like Dropbox (that DOESN'T require 2fa), holding your recovery keys. This way your database is protected by two passwords, so that if either are compromised you are still protected. You'll have to memorize both passwords but that's a good tradeoff imo. Then use KeeWeb (preferably a self-hosted one) to access your database and codes. So the model here is: borrow a phone, log into Dropbox, download KP database, open KeeWeb, open database, and get your 2fa codes. Log into Google (actually, third password you should memorize), and lock/ring/clear your phone.
Buy a 2nd cheap $50 android camera phone, install authenticator but with no sim card or wifi access.
Make sure all your authenticator codes are also registered on this phone as a backup.
It is no problem to register the same authenticator code on multiple phones.
It is no problem to register the same authenticator code on multiple phones.
Immediately mark the device as lost/stolen in iCloud and force a warning message with an alternate contact number.
6 digit PIN, device encryption, cloud backup of my photos and Apple’s FindMy device feature.
Has worked before fantastically.
6 digit PIN, device encryption, cloud backup of my photos and Apple’s FindMy device feature.
Has worked before fantastically.
I lost my android phone in the park on Thursday afternoon. It was in an area around a cabin selling hot drinks and some food. I went back but no sign of it and the cabin was closed. Tried again the next morning and they had my phone! I was overjoyed but it made me think.
I had logged it out of google and had the chance to stop the SIM - but getting it working again sounded long winded so I didn't.
They said they looked for emergency contact numbers, but I didn't have any set up. I didn't know you could do that, but I have added them.
I later found a call to it I didn't recognise, but realised I had a business card with the phone which they had tried to contact me with, but just called the phone they already had.
All in all I think I was so lucky and they were magnificently kind. So far as I know there is nothing on it I couldn't get back, but I realised that having personal information with it was probably not actually a good idea. I think I am ok with the emergency contacts because I am getting old and may need to be helped one day. I probably should have put a stop on the SIM. Not sure what else I should have learned.
I had logged it out of google and had the chance to stop the SIM - but getting it working again sounded long winded so I didn't.
They said they looked for emergency contact numbers, but I didn't have any set up. I didn't know you could do that, but I have added them.
I later found a call to it I didn't recognise, but realised I had a business card with the phone which they had tried to contact me with, but just called the phone they already had.
All in all I think I was so lucky and they were magnificently kind. So far as I know there is nothing on it I couldn't get back, but I realised that having personal information with it was probably not actually a good idea. I think I am ok with the emergency contacts because I am getting old and may need to be helped one day. I probably should have put a stop on the SIM. Not sure what else I should have learned.
I set my lock screen message to email and name. That way I can still check my email on a computer.
Please contact [=====] for reward!
My approach is not taking a phone when possible. No PIN because I am bad at remembering PINs and no encryption because there is nothing on it except of my nude photos.
In 2014 I had my phone stolen by a couple of homeless people. I had footage of them and printed flyers with their faces clearly visible. I distributed the flyers around the local homeless areas and the thieves actually brought the phone back and left it where it would be found.
The SD card was gone, and they had tried to reset the phone. I was able to get into it with USB debugging and recovered about 3 Bitcoin that was only stored in a wallet on that device.
The SD card was gone, and they had tried to reset the phone. I was able to get into it with USB debugging and recovered about 3 Bitcoin that was only stored in a wallet on that device.
Don't store important data on your phone unless it's synced.
Make backups.
If you have sensitive data, prefer an iPhone. They're slightly harder to crack and extract the data for the average script kiddie. If you require real security, you're on your own. Very few things stay secure once they're in someone else's hands.
Don't use SMS 2FA.
Store 2FA tokens in your password manager (I use Bitwarden).
Protect your password manager 2FA with a Yubikey. Keep it on your person. Have a spare Yubikey in another location.
Make backups.
If you have sensitive data, prefer an iPhone. They're slightly harder to crack and extract the data for the average script kiddie. If you require real security, you're on your own. Very few things stay secure once they're in someone else's hands.
Don't use SMS 2FA.
Store 2FA tokens in your password manager (I use Bitwarden).
Protect your password manager 2FA with a Yubikey. Keep it on your person. Have a spare Yubikey in another location.
Also, if you “have to” use SMS 2FA an e-sim is more secure in this case as it prevents someone from just physically pulling the sim and moving it to another device.
SMS 2FA is still a mess due to a variety of other issues, of course.
SMS 2FA is still a mess due to a variety of other issues, of course.
Just don't use your phone in such a way that having it stolen would mean your whole digital life is gone. Use it as a radio to call people or emergency services, and use things like the alarm clock or calendar and nothing else.
PIN and standard encryption. I also try not to do anything sensitive on it in the first place. I also take steps to reduce the risk of it being stolen.
4x4 pattern, encryption, multiple backups (rsync via termux is great), disable fingerprint unlock when in transit (lockdown mode). If it happens: grab an old backup phone, visit the carrier store and leave with a new SIM with the old number. Revoke access of the stolen one wherever possible.
If you are using an app on your phone for 2FA, make sure you have its state backed up somewhere else.
It can be very difficult, sometimes impossible, to fix access to an account blocked by lack of access to your 2FA app.
It can be very difficult, sometimes impossible, to fix access to an account blocked by lack of access to your 2FA app.
I do not have a phone. Can not steal what I do not have. Problem solved.
Authy and keepass file stored remotely, pictures backed up to cloud. It'd be really inconvenient, but I try and have nothing I care about only local to my phone.
among my obfusicated contacts are various entries such as: sexbuddy, hottie across the hall; etcetera.
Each of them are given the same contact number [911 911 9119]
If the names are obfuscated and the contact info is the same, what purpose do they serve?
It's a cunning plan to get the thief to call the police and turn themselves in
How would your average thief get into the phone in the first place?
Do people just not have encrypted devices with reasonably strong pass codes?
I'm wondering what the threat model is here. Is an agency with the capability to break into the device going to be fooled by these?
Do people just not have encrypted devices with reasonably strong pass codes?
I'm wondering what the threat model is here. Is an agency with the capability to break into the device going to be fooled by these?
the threat model is my phone; when stolen is as hostile as possible if you use it normally, there is little to gain and every chance i can drum up for the location and environment to be made available. [honeypot]
How would somebody even use it? You make it easy to break into?
yes its a honeypot.
If it's a honeypot that means you actively want people to steal your phone?
yes!
I guess that's a far different perspective from my own. I don't want the annoying inconvenience of needing to get a new phone and install software all over again, restore my backups etc.
Why would I want to waste that time, to what end? To catch a thief who is probably just hard out for money? That seems like an awful lot of time and effort just to be vindictive
Why would I want to waste that time, to what end? To catch a thief who is probably just hard out for money? That seems like an awful lot of time and effort just to be vindictive
Prevention. I don't let it get stolen. Never leave it laying around unattended or where it could easily be grabbed by someone.
My phone has effectively already been stolen, because it runs software that has been developed to work against my interests. None of the data on it would I miss losing, because it's not an authoritative copy. None of the data on it would I be upset about someone else having, because the advanced persistent threat of the surveillance industrial complex already has it. Sensitive information would have never been on my phone in the first place.
I would never keep anything important on the phone -- it's a Google Android phone after all -- so the strategy is simply to have the stolen SIM card locked and a new one mailed to me.
Any old mobile phone sitting around would be fine at that point, until I decide to get a new one.
Any old mobile phone sitting around would be fine at that point, until I decide to get a new one.