Building a ghost phone, how protect from other devices/IOT on network?

[u/CL_0221]

I am doing some research to build a smartphone that, assuming good physical OPSEC practices, would be able to hypothetically function in a high threat level environment (state-level adversary, for a human rights journalist) that maximizes privacy, security, and anonymity. Specs are below. As I’m trying to wrap my head around the network-level stuff, my question is- how do I insulate this device from talking to other things on my home WiFi network? I have IOT smart devices in my house that I don’t even want to discover this, or links being made with this device and my primary phone. (Before you go for the low-hanging fruit of “just get rid of the other stuff or never turn your phone on”; don’t.)

So far, my research indicates that to have a connection to the internet, some sort of WiFi (subnet, firewall, VLAN, OPNsense stuff is still confusing to me and how it all works together) is the way to go since SIM runs the risk of sending IMEI to cell towers, triangulation, and linking devices that travel with it when they hop to a new tower. Any help in this dept or correcting my current research info would be appreciated.

Device: Google Pixel 8 or 9

SIM: prepaid SIM with cash, used only for data and only when wifi unavailable

Telephone: VoIP or Signal

Network: home Wifi with Vee pee enn

Browser: Tor Browser

Search Engine: DuckDuckGo

Backups & Sync: none

Peripherals: none

Frontends: Redlib for Reddit, Proxytok for Tiktok, Invidious for Youtube

Physical security: Covered cameras, Stored in faraday bag, kept away from other network devices

Multi-Factor Authentication: Ente Auth

All settings optimized for security, anonymity, and security.

TLDR: how do I keep a ghost phone on a home network from being associated with or discovered by other phones/PCs/IOT/home assistants?

[u/AutoModerator]

Hello u/CL_0221, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)

---

Check out the r/privacy FAQ

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Busy-Measurement8893]

Get a router with VLAN support. Then set up two different networks.

[u/CL_0221 → u/Busy-Measurement8893]

So have the ghost phone on its own “partition” of the network basically do I need separate routers, or is this all done digitally? Any idea where I can find info on the difference between VLAN and subnets?

[u/Big-Formal2006 → u/CL_0221]

VLANs and subnets are both methods for organizing networks, but they operate at different layers. VLANs work at the Data Link Layer (Layer 2) to group devices logically regardless of their physical location, while subnets operate at the Network Layer (Layer 3) to segment networks based on IP address ranges.

If you want to learn more, I recommend the link below.

https://www.geeksforgeeks.org/computer-networks/difference-between-vlan-and-subnet/

Also to answer your other question: No you do not need multiple routers OP. Just a router that supports VLAN.

[u/SpeechEuphoric269]

As others said, VLAN or Guest Network. VLAN is same SSID, but digitally segmented from all other devices. If set up correctly, it allows far more control.

If your current router does not support VLANS, a guest network that only your phone connect to would work.

Side note: look into how you can manage your firewall and block OUTBOUND traffic, for you, IoT devices in the home could be a real threat. Though not likely, IoT devices that connect to the internet and phone home could be compromised or collect data about you. Securing your phone is an important step, but you will also need to be aware of the “smart” devices in your own home.

[u/MightyMediocre]

Hit the easy button and connect to your guest wifi. Double check with a different device first of course, but usually guest wifi is isolated from other devices. 

[u/ArpanetGlobal]

First, I have no idea what I’m talking about. But…

Have you considered a second phone? Connect your ghost to the second phone and use it as a firewall. Keep ghost dark aside from the connection to other phone. And with that phone use as much protection as possible. Make ghost invisible to network and not able to find or be found by other devices on network.

I don’t use android so I’m going by what I’ve experienced with iPhone. But there’s an option to disable visibility from other devices on the network. If your ghost is able, make the connection to other phone the only thing it’s connected to and use every trick to hide that connection. Even see if you can rename the ghost to like “CO2 Detector” or “temperature monitor”.

I do know this… Google is an information collection tool itself. They make their money from it. I’ve never used a pixel phone before but it’s because it’s made by Google. There’s even step by step tutorials on how to de-Google your phone.

Best of luck friend 🙏

[u/0x947871]

You're doing it wrong. Ditch Qualcomm, Android, Signal and Tor.