Two years ago, I bought a secondary phone. It’s a cheap Android phone that always travels with me outside of town. I’ve for the case that my main phone breaks from a fall, fails to boot after an update, gets lost or runs out of battery.
The secondary phone has a set of essential apps installed. Simply put, its task is to get me to my next destination and have some hours or days to repair or replace the main phone.
The success of this of course also depends on the apps. Some apps essential apps blow some big holes into this safety net of having a secondary phone.
The well-behaving apps
These include:
- a synced calendar, so I know where to go
- CoMaps for finding my destinations
- Nextcloud for some essential files
- a Matrix client to chat
- an e-mail client
- a music app, synced with my Subsonic server, to relax
- my password manager
All of these work offline because I downloaded the most important files to a cache. All of them do not invalidate their “offline files” or cache if I boot up the secondary phone a year after its last use. This is important because I may not have access to the Internet right away. There’s no data plan for the secondary phone, but I expect that WiFi or (if not lost) the SIM card of the main phone will give me enough time to replace the main phone.
These apps are also amazing because they will sync as soon as the Internet is available, giving me access my latest calendar events, files and passwords.
Their also amazing because their services are available on a laptop. Those that work as an online service, I can fully and independently access from any computer.
The problematic apps
Having a functioning, configured smart phone is required for a handful of situation in modern life. Without it I would navigate slower, have trouble with many purchases and couldn’t access most online accounts.
But my secondary phone’s also a bunch of essential apps that are not well-behaving:
- WhatsApp for chatting with my family and partner
- DB Navigator for train tickets
- GLS Banking for sending money
- VR Secure for approving Mastercard purchases
If the main phone becomes unavailable, I won’t be able to use these services right away on my secondary phone. Worse, migrating might take several days, access to my postal address and cause uneccessary data loss.
Next, I’m going to list the ill-guided assumptions that make the switch to a secondary phone terrible.
Assumption: You have one phone
Most of these apps require ONE (and only one!) phone as a primary device. DB Navigator and my banking apps run only on smart phones and won’t allow for more than one device to be logged in. No laptop or secondary phone will help me if I lose the main phone. This is terrible especially for how important these apps are when travelling and things are already going wrong.
DB Navigator sends PDFs of bought long-distance tickets to my e-mail account. This is great because I can access them via an e-mail client. But the Deutschlandticket for local trains and buses cannot be copied to another device or printed. The only way seems to be a migration from one phone to another. The migration will remove access on the first phone.
My banking apps also only support a migration. In case the main phone isn’t available, I’m required to request a new setup token which will be send to my postal address. That locks me out until I and the mail arrive at home. My alternative for onlien purchases is Paypal, but it could be so much easier if the services allowed for more than one device to be logged in.
Assumption: You have an Internet connection
DB Navigator frequently makes me uneasy when opening it during a ticket inspection. The Deutschlandticket takes an active Internet connection and a handful of seconds to show up. Other tickets are cached and show up right away, but the Deutschlandticket, as a subscription, is not even displayed if the server reevaluation has been too long ago.
At least WhatApp works well on the main phone without an Internet connection. I can read all messages, write new messages and everything gets synced in the background when I have a connection. They do have a web app, but it’s not a full client for long. If you’re phone doesn’t connect within 14 days, it will log out the web client.
Assumption: You use the Google Play store
As far as I know, these apps can officially only be downloaded through the Google Play store. Some private mirrors (e.g. chip.de) also seem to distribute the DB Navigator but I would only want to download an app from the developer itself.
Google announced plans to further restrict Android starting this summer. It pushes Google Play as the only way to distribute apps.
Their reliance on Google Play is a big risk when using the apps listed above. There’s also no alternative for these apps on other operating systems. I’m skipping over iOS as it’s even more reliant on its company Apple.
The operating system
While focusing on specific apps, I want to point out that Android can be a bit of a risk by becoming quite restrictive and annoying when the login to Google fails, apps haven’t been updated in a whle or you want to install apps from sources other than the Google Play store.
Final thoughts
As shown by some alternatives, there’s no technical reason for these restrictions. In the best case these restictions were motivated by cost cutting or to prevent abuse. But they are a big risk to their users and society.
In some cases the phone is used as a “2nd factor” of authentication (2FA). With VR Secure I prove knowledge of a password and possession of a hardware device (my phone) to authorise a financial transaction. But while I can securely replicate my password, the bank prevents me from securely replicating my hardware device. Hardware devices for 2FA are great, but no one said that it must be only one device that unlocks the account.
Smart phones are a single point of failure for essential services used by millions of people. A country that wants resilient infrastructure which withstands outages and external manipulation cannot accept these risks for its citizens. Sovereign tech can be one answer.
For the companies developing apps:
- Allow for multiple devices to be logged in
- Protest to keep Android open
- Build fully-featured web apps as alternatives
- Invalidate cached elements only after a successful online sync
- Build for Linux, the only free operating system that’s not in the hands of a giant, private US company
- Distribute the applications you build on your website
Until further measures are taken, these are my single point of failure apps.