Secure Your Phone

Most people don't consider just how much personal data is sitting in their pocket, which can potentially be compromised. In this section, we go over several common topics that come into play when securing an iPhone (though many of these topics have similar processes for Android and other operating systems).

Passcode

Turn on your passcode (if you haven't already) and add a secure password of 6+ characters. Don't use a repeating code like 111111 or a simple incremental code like 123456.
Require the passcode immediately, to minimize the amount of time the phone is unlocked after use.
Set the phone to erase after 10 failed passcode attempts are made. iPhones are set with full disk encryption by default, so these protections go a long way to safeguard your data.

TouchID

Many in the security community point out that using TouchID (using your thumbprint to log in) is a bad idea for several reasons:

A thumbprint can be compelled by law enforcement as a search in the United States, whereas a passcode is protected by fifth amendment self-incrimination protections. If you're an activist or concerned about U.S. law enforcement search of your phone, disabling TouchID (or turning off your phone when concerned) are potential mitigation methods.
Thumbprints can also be taken while you're sleeping or otherwise incapacitated, where passcodes cannot.

This is an area where convenience conflicts with security: each person should make an informed choice on what they're comfortable with.

Location Services

Location services are the systems on your phone which provide GPS location access to the apps on your phone. We often don't consider the different ways that applications use our location data, but if unchecked, this can leak more information than we intend to tech companies who track our location, or through social media posts that attach location information to what we share.

The risk: Your location data can leak your home or work address.
Another risk: Publicly shared location can signal to potential thieves that your home is unoccupied.
Yet another risk: Publicly sharing your location in real-time can signal people to come to meet you in public venues when you don't intend.

Some people like to turn location services off. If you prefer not to turn off location services entirely, make an active choice as to what situations are warranted.

Note that most photos you take are Geotagged by default. Some like to have their photos geotagged when they take them as a way of documenting the location of the photo. But, be aware that this information is embedded into the metadata of photos and can be published by the applications that use the photos (e.g., social media sites).

Manage which applications should have access to your location, and when. Go to Settings, Privacy, Location Services to see which apps have location services enabled. It's very rare that apps really need the "Always" setting, and most can do fine with "While you're using the app." There's a ton of settings in here you can personalize to your liking to balance the convenience/privacy of your phone.

Access to Contacts

Go to Settings, Privacy, Contacts to see which apps can access your contacts. Not so much a security concern as a privacy concern, but it's a personal preference.

The risk: You start a social media account which you aren't ready to publicly broadcast, but your social media profile is attached to your contact list, and the social network sends out a notification as soon as you set up the account to all other people who you know on the network.
Another risk: The social media site that stores your contacts gets hacked, and your contact list becomes public.

Limit Ad Tracking

This is more of a privacy-related setting than security-related, but you can tweak the default ad tracking settings by going to Settings, Privacy, Advertising, Limit Ad Tracking (Turn on).

Data Accessible Outside Lock Screen

Check out what data is available when your phone is unlocked, and make sure you're comfortable with it.

Several functions on the phone (calendar, directions, etc) are made available outside the lock screen through iOS' "Control Center." To turn off outside access altogether go to Settings, Control Center, Access on Lock Screen (turn off).
Just take a moment to decide if you're okay with your text messages and emails showing in notifications outside your lock screen. You can disable message content showing outside the lock screen by going to Settings, Notifications, Messages, Show on Lock Screen (turn off).
Go through each app and check if you're comfortable showing the data from that app outside the lock screen. This can be changed from the app's entry in Settings, Notifications.

iMessage on Laptop & Desktop

The iMessage apps on desktops and laptops leak more personal information than we feel comfortable with. For example, iMessages have shown up on a computer's notifications when not logged in, and personal messages have come up on the computer during business presentations. We suggest logging out of iMessage altogether on devices other than your phone.

Calls on Other Devices

There's a feature on iOS that allows you to ring multiple devices when your phone rings. For example, ringing your MacBook when your phone rings. You can disable this at Settings, Phone, Calls on Other Devices.

Explore In-App Security

Many apps allow the option to add passcodes or TouchID inside the app. Imagine a situation where you give your phone to someone (like a curious 10-year-old nephew who wants to play a game) - is there any app you wouldn't want that person to access?

iMessage Retention Policy

One of the main concepts in digital security is about not just preventing a breach, but minimizing the amount of data that is available in the event of a breach. In the case of iMessage, most people set their phones on the default of keeping their messages forever, but this offers a huge trove of potential data to an attacker that might access this data.

You can set your phone to delete messages after a certain amount of time - I've set mine to delete messages after 30 days, in Settings, Messages, Keep Messages (set to 30 days).

Setting the retention policy helps to keep personal and sensitive information from persisting.