I live in Canada. My girlfriend is Chinese (also living in Canada), and while we are able to communicate via SMS, her mobile carrier isn’t the best, and so there have often been issues for us with regular texting. She expressed a strong preference to use WeChat, at least as a backup option for when texting fails us. While I have some pretty significant reservations, it’s not the hill I want to die on. So my question is: what can be done to use WeChat without compromising my whole phone? I’m okay with it if our conversations aren’t private, but I’d like to know that I’m not giving unfettered access to all of my phone’s systems and data to the CCP. What can be done to limit the reach of this ubiquitous app on my device?

  • viking@infosec.pub
    47·
    2 months ago

    I’m in China and have to use that piece of crap. So here’s how I locked it down:

    1. Root your phone with Magisk. There’s no way around it.
    2. Install Storage Isolation (https://play.google.com/store/apps/details?id=moe.shizuku.redirectstorage) and deny access to all folders.
    3. Install ApOps (https://play.google.com/store/apps/details?id=rikka.appops) and set pretty much everything to deny or ignore (ignore means the app receives the information “permission granted”, but no data is provided, in case some permissions are “mandatory”). If you intend to use wechat to exchange voice messages or make video calls/send photos, the “use microphone” and “use camera” functions would be required. In a similar fashion the location access if you intend to use the location sharing feature.
    4. Be acutely aware that wechat is not encrypting messages, neither end to end nor in the server communicaton. Everything you say can (and probably will) be read and archived. Don’t say anything confidential or critical there.

    And yeah really, try to convince your wife girlfriend to use signal instead. Or hell, even whatsapp is miles ahead.

    My wife is Chinese as well, so even after we leave here she’ll be using wechat to stay in touch with family, no way around it, but using messengers more commonplace in other countries is definitely better. Personally I will move wechat to another phone once we’re out. For now that’s not feasible as it’s too much integrated into every function of life here.

      • bionicjoey@lemmy.caOP
        3·
        2 months ago

        Yeah I was considering Waydroid but then I lose the ability to connect outside of my PC

      • viking@infosec.pub
        2·
        2 months ago

        I guess it could be, but that kills the use case of being contactable by his GF on the fly.

    • Ainz@lemmy.world
      2·
      2 months ago
      1. Install Shizuku -> Doesn’t require root
      2. Install Island and use the built in work profile feature of your android device
      3. Install AppOps and block most of the app with garbage data
      4. Be happy without rooting your phone
      • viking@infosec.pub
        1·
        2 months ago

        Yeah I’ve played around with it in the past, but having to re-establish the wireless adb was quite annoying. Plus I need root for AdAway already, I don’t think that can be achieved via Shizuku, but that might not apply to the OP. I’ve tried island back in the beta stage and it wouldn’t work on my phone, but I guess things have change since. Might give it another try.

  • 🦄🦄🦄@feddit.de
    192·
    2 months ago

    To answer the question: GrapheneOS and a separate profile would be the safest but still…

    If you are both outside of china there really is zero reason (other than preference) to use that piece of spyware.

    • bionicjoey@lemmy.caOP
      81·
      2 months ago

      To answer the question: GrapheneOS and a separate profile would be the safest

      I appreciate the suggestion, but maybe I should add that I’d like to not have to change up my phone too much. It’s a Fairphone 4 running the OEM Android and my preference would be to keep it that way. Are separate profiles like that a thing on stock Android?

      If you are both outside of china there really is zero reason (other than preference) to use that piece of spyware.

      She travels back to China sometimes, uses it to contact friends and family back home, and uses it to chat with lots of mainlanders here in Canada. For her it’s not weird at all.

      In fact, she expressed to me that she’s perfectly comfortable with the fact that they use WeChat combined facial recognition technology in China for payment processing. When you get on public transit, you can have them scan your face and it will automatically charge you the bus fare. It really skeeves me out, but it’s simply not the hill I want to die on in this relationship. I’m crazy about her in so many ways, it’s okay with me if we don’t see eye-to-eye on digital privacy.

      • xarexyouxmadx@lemmy.world
        310·
        2 months ago

        Personally I’d be way more concerned with using OEM Android in the West than using wechat anywhere but if it’s really an issue for you then I’d say insist on trying session or signal… One of those are probably your best options if you’re worried about being spied on…

        If she’s unwilling to try them or doesn’t like them then I guess you have to settle for wechat or traditional SMS (although without RCS I find SMS to be a trip to a previous decade lol)

  • Ilandar@aussie.zone
    192·
    2 months ago

    Ignore the dumbass “why dOn’T yOu jUsT uSe sOmEtHinG bEtTeR” replies. Anyone who has a partner knows that the onus is generally on the privacy-conscious one in the relationship to make these types of concessions, since the other person is usually incapable/unwilling to use something better.

    • milicent_bystandr@lemm.ee
      132·
      2 months ago

      And, let’s be fair, for most people the real loss from this level of compromised privacy/security is far less than the real gain from helping your relationship.

      Sometimes I look at products I use from dubious companies, take a step back, and think, this company is actually a blessing in my life even if there is a smaller curse attached. That said, I’m grateful for all the tremendous effort put in by many people to make the digital (and rest of) world a safer, more private, fairer and more honest place. And I try to do at least a little of my share!

  • wpuckering@lm.williampuckering.com
    15·
    2 months ago

    You could sandbox it into a work profile that doesn’t have access to your main profile. Storage is completely segregated, and the work profile can be easily disabled when you’re not using it.

    The best solution is obviously to choose another platform and convince your girlfriend to use that, explaining how this little extra effort on her part to use another app goes a long way with you in terms of appreciation and understanding of a partner’s boundaries and comfort zone.

  • thanks_shakey_snake@lemmy.ca
    141·
    2 months ago

    FWIW, WeChat and 微信 are different apps. With a non-Chinese phone number and Google Play Store download, you’ll be using the international one (WeChat) instead of the Chinese one (微信). There are still privacy concerns, but it’ll be less invasive than what you’d have with the version that people in China are buying their groceries with and stuff.

    I’m sorry I don’t have advice for how to actually protect yourself, though… I’ll be keeping an eye on this thread to see what I can learn.

    • bionicjoey@lemmy.caOP
      4·
      2 months ago

      That’s a great point, thanks! I will definitely be using the international one. I expect since I’m getting it through Google Play it’ll be constrained based on the OS permissions I give it. And I don’t intend to give it any permissions

      • bionicjoey@lemmy.caOP
        3·
        2 months ago

        I’ve heard of matrix bridges before but I’m unfamiliar with how to actually set them up and use them. I understand the basic idea is that they relay messages out of matrix and into some other messaging service, but I don’t understand how to actually enact that onto the element client on my phone. Matrix is so complicated 😅

        • a1studmuffin 🇦🇺@aussie.zoneEnglish
          3·
          2 months ago

          I’ll level with you… I’ve never used Matrix either. 🤣 But all the cool kids around these parts recommend it, and I fundamentally agree with the cause of the project and saw they had the WeChat bridge, so thought I’d mention it.

  • John@discuss.tchncs.de
    71·
    2 months ago

    I stopped using every messenger besides signal and Matrix. Even my not tech savy parents are using signal now - its in my opinion the better solution to stand your ground and may push others into using the better apps

  • EunieIsTheBus@feddit.de
    138·
    2 months ago

    Maybe get a girlfriend that isn’t a brain washed spy? \s

    Just use a different app then? You don’t need to come up with some high tech solution. She won’t use that anyway. But something simple like signal should be sufficient.

    • bionicjoey@lemmy.caOP
      8·
      2 months ago

      Maybe get a girlfriend that isn’t a brain washed spy? \s

      Listen here, I like my qt tankie sleeper cell gf. As long as she doesn’t hear anyone say the activation phrase, she’s very sweet.

      For real though, this app is pretty culturally ingrained over there and so I don’t really have the option of pushing something else (we all know how real messaging app fatigue has gotten these days). Especially when other apps will be restricted whenever she travels home, and we want something that can serve as a backup when other communication methods aren’t an option. I’m pretty sure WeChat will work through The Great Firewall, so it’s ideal for our purposes. I have no idea if the same can be said for WhatsApp or Signal.

      • JJLinux@lemmy.ml
        21·
        2 months ago

        If you love her (and it seems like you do) talk to her openly about your concerns and suggest something else. Heck, even set up a Matrix user for each and tell her you want to use that exclusively for both of you as a romantic gesture. That’s how I got my wife on Matrix (Element).

  • guyrocket@kbin.social
    51·
    2 months ago

    If you really want to isolate it, grapheneOS lets you put it in its own profile almost totally isolated from anything in any other profile.

    But you probably don’t want to buy a g! Pixel.

    You could buy a separate phone and only run that app on it. Hassle but it would be secure.

  • bloodfart@lemmy.ml
    3·
    2 months ago

    Brace yourself for a weird recommendation:

    Don’t worry about it or switch to ios.

    You’re on a different marketplace for phone apps than chinese nationals so you’re not getting the same wechat as they are. If you trust your platforms marketplace and your phones security and privacy tools then just don’t worry about it and use them like a normal person.

    If you don’t trust your platforms marketplace or security and privacy tools, switch platforms.

    It doesn’t seem from your responses in this thread that you’re in a good spot right now to learn everything required to root and run an alternative os securely and act as your own security auditor. Not a value judgement, I’m not in a position to act as my own diesel mechanic. That’s why I said maybe switch to ios if you feel exposed by stock android instead of saying you ought to try to navigate the alternate os/custom rom world.

    It might seem like some people in the replies have given good walkthroughs, and they definitely have, but at some point you’re gonna have to make a decision about something that either isn’t documented on a wiki or no one responds to questions about.

    Maybe the best choice is to either not worry about it or switch platforms and no matter what you choose, put the phones security and privacy tools to use and be more considered and self aware about how you use your phone.

    E: Jesus Christ. Some of the responses you’ve gotten are astonishing. Maybe ask in hexbear or something just to get an alternative view.

    • bionicjoey@lemmy.caOP
      1·
      2 months ago

      Yeah I ended up installing it in an Android work profile using Shelter, and it is a disaster of an app. I expected a lot more of a professional looking app given how popular the WeChat service is and how big of a company Tencent is, but it’s like a shittier WhatsApp. It’s not even localized properly, a bunch of strings in the app (like error screens and stuff) are in Chinese, and the English is poorly translated. The mechanism to reply to someone’s message is unclear (it’s not just long pressing or dragging on a message like in other apps), and you can’t send a reaction emoji to a message.

      • bloodfart@lemmy.ml
        21·
        2 months ago

        It’s always funny to me how people assume the most half-assed software the world has ever seen somehow carries incredibly advanced and impossible to detect tracking deep inside it.

        Like we have t-1000 at home! T-1000 at home: that bucket robot that got murdered in Philly.

        I just saw you’re from .ca, you may have to make an alt to ask but 100% ask on hexbear. There’s people on there who have dealt with wechat and phones going to and from china and won’t be near as overtly weird and racist as some of the responses here. Maybe differently overtly weird.

  • Antitoxic9087@slrpnk.net
    53·
    2 months ago

    If you are serious with this relationship (or you expect to still have Chinese partners in the future), I strongly recommend you buy a separate device for all the Chinese spywares required to maintain communication with your partner(s). At some point you will have to enter China, and it is best that you take only this device with you into it then.

    • bionicjoey@lemmy.caOP
      5·
      2 months ago

      I’ll cross that bridge when I get to it. If I’m going to do that I might as well buy the burner phone once I’m actually in China rather than preemptively get one now. I like her a lot but I’d say we’re at least a year away from going to China together.

      • wpuckering@lm.williampuckering.com
        4·
        2 months ago

        The good thing about getting one from the start is that you can set it up to your liking from the get-go and won’t have to do it later. You’ll also get used to using it daily and see how managing two devices works for you.