André K. - CloudPirat

07/04/26

04/01/22

This article provides a comprehensive guide to improving privacy and security on your iPhone, focusing on key features from iOS 16 to iOS 18. It covers essential tools like using a password manager, enabling Two-Factor Authentication, and securely configuring Face ID and Passcode. The guide also highlights the importance of privacy-friendly apps and introduces Lockdown Mode for high-risk users like journalists and activists.

Recent updates include Passkeys, a passwordless authentication method that enhances security against phishing and data breaches. The article also advises on managing app permissions, especially limiting access to contacts, and turning off unnecessary tracking features. With tools like the Privacy Report, Apple helps users stay informed about how their data is used, encouraging proactive digital security.

I recommend to work through the article Protect Yourself or Be Tracked  beforehand.

Enjoy exploring these tips. I look forward to your questions and feedback.

(1) Install a Password Manager

I recommend using Bitwarden as your password manager. You can currently install it via Apple’s App Store.

I do not recommend Apple’s new integrated password manager which comes with iOS18. It is convenient and integrated into the iOS ecosystem but it is is proprietary software. This means users must place their trust entirely in Apple without the ability to independently verify how their data is handled or secured. For those who prioritize control over their personal information, this lack of transparency is a significant drawback.

(2) Secure Your Apple ID

Use a truly secure password or passphrase for your Apple ID. Bitwarden can handle this for you. Also, write down the new password on a separate, blank index card.

Settings -> Apple ID / Sign-In & Security / Change Password

Enable “Two-Factor Authentication” This adds an extra layer of security, as Apple will verify your identity on another trusted device or via another method for logins or unusual changes.

Settings -> Apple ID / Sign-In & Security / Two-Factor Authentication

Turn on “Two-Factor Authentication”.

(3) Configure Face ID and Passcode

Set a secure passcode:

Settings -> Face ID & Passcode / Turn Passcode On

Enter a randomly generated six-digit numeric code. Bitwarden can generate this code for you. Store the code in Bitwarden and write it down on another separate, blank index card.

Alternatively, you can choose an even more secure alphanumeric code through “Passcode Options”.

Don’t use Face ID or Touch ID to unlock your phone:

Settings -> Face ID & Passcode / Use Face ID For

Turn off “iPhone Unlock”.

This means you’ll need to enter the passcode to unlock your phone. I have discussed the pro’s and cons in the article Mobile Security – Basics For Everyday Mobile Life. Other apps and services can still use Face ID after you’ve unlocked the phone with your passcode. You can control this under “Other Apps“.

Restrict Lock Screen notifications

When your iPhone is locked, no notifications or call alerts should appear on the lock screen. Notifications should only be visible when the phone is unlocked.

Settings -> Face ID & Passcode / Allow Access When Locked

Turn off all the displayed options.

Erase iPhone after 10 failed pass-code attempts

If your iPhone falls into the wrong hands, all data will be erased after 10 failed passcode attempts.

Settings -> Face ID & Passcode / Erase Data

Turn on “Erase Data”.

(4) Use Privacy-Friendly Apps

From the CloudPirat Privacy Toolbox, I recommend the following apps and providers for your iPhone. Most of these apps are open-source, the providers are trustworthy, and they function without tracking you.

  • Password Manager – As mentioned, it’s crucial that you use unique passwords or passphrases for all your accounts. I recommend Bitwarden, which allows you to sync your accounts and passwords across multiple devices.
  • VPN – Install Mullvad. It protects against ads, trackers, and malware. Configure Mullvad to always be active. For more details, read my article on Benefits of using a VPN Service.
  • Internet Browser – I recommend Brave as your default browser. You can sync settings and bookmarks securely with Brave browsers on other devices.
  • Search Engine – Use Brave Search as your default search engine.
  • Messenger – Use Signal for messaging.
  • Video Conferencing – Use Signal for quick Face-to-Faces. With Element Call you may interact with more people.
  • Navigation – If you want a offline navigation app that doesn’t store your location history, I recommended OSMandMaps the past. A bit easier is from my point of view Magic Earth. Both app allows you to download Open Street maps for offline use on your iPhone.
  • Email – The default email app on the iPhone offers some email privacy protections. However, you’ll need a trusted email provider. I recommend Mailbox.org from Berlin, where you can set up email, contacts, and calendars and sync them across all your devices.
  • Newsfeed – Instead of saving a web link for each news source or installing separate apps, consider using an RSS reader. The reader collects news from your selected sources and gives you a quick overview of what’s happening. For iPhone, Mac, and iPad, I recommend NetNewsWire (free and open source).

(5) Adjust Siri and Search Settings

Siri is much more than just a simple voice assistant. It’s part of Apple’s personalization system, which tracks how we use our iPhones. Siri’s suggestions are based on what it knows about us. For example, Siri can search your private notes or rummage through your password manager, all in an attempt to learn more about you. And this knowledge likely ends up on a server farm in California.

Settings -> Siri & Search

Turn off all the toggles.

Disable Siri settings for each app

Settings -> Siri & Search / [for each app]

Turn off all the toggles.

(6) Configure Notifications

On the iPhone, apps can send notifications, which can be useful for missed calls or daily news summaries.

For privacy, it’s important that these notifications remain hidden behind the lock screen and are not visible to others, especially if your phone is on a table or falls into the wrong hands.

(1) First, you need to prevent all notifications from showing a preview (e.g., of a phone call) when the iPhone is locked.

Settings -> Notifications

Set “Show Previews” to “When Unlocked” or “Never”.

(2) Unfortunately, you’ll need to configure notification settings for each app. Here’s an example for the Messages app:

Settings -> Notifications / Messages

Toggle “Allow Notifications” on or off.

Toggle “Critical Alerts” off.

Turn off “Lock Screen”.

(7) Turn Off Email Tracking

This feature protects you from email tracking by anonymizing your IP address and safely loading remote content (such as images or documents) in the background.

Settings -> Mail / Privacy Protection

Turn on “Protect Mail Activity”.

(8) Privacy & Security / Background

This section has been expanded in the latest iOS updates. New features in iOS 15, 16, 17 include the App Privacy Report and Lockdown Mode.

These improvements may be a response to the NSO scandal. The Israeli firm NSO used its Pegasus spyware to exploit a vulnerability in the iOS messaging protocol, allowing iPhones to be infected and their users to be fully monitored. NSO sold this cyber weapon to governments and intelligence agencies worldwide (source: TheCitizenLab).

Since 2016, journalists, dissidents, and government critics have been spied on. Apple only closed this security hole in 2021. This type of surveillance also led to the 2018 assassination of Jamal Khashoggi by the Saudi Arabian government.

How can you keep an eye on your apps?
Every time you install an app, it asks for permission to access hardware and system services like the microphone, your location, the camera, and more. Since you’ve probably granted too many permissions over time, it’s extremely important to keep an eye on this and reset them regularly.

(9) Privacy & Security / Location Services

Your location is a critical part of your privacy. In my opinion, only a few apps should have access to you location, and only while you’re actively using the app (e.g., for navigation). The same goes for other sensors like your microphone, camera, or motion sensors.

Before we dive into this topic, let’s take a quick look at Apple’s privacy policy regarding location tracking.

If the “Location Services” option is enabled, your device periodically sends geo-tagged positions of nearby Wi-Fi hotspots and cell towers to Apple to help build its crowdsourced database of Wi-Fi hotspot and cell tower locations. When you’re on the move (e.g., in a car), a GPS-enabled iOS device with Location Services on sends GPS positions and information about travel speed and air pressure to Apple at regular intervals to build Apple’s crowdsourced traffic and air pressure databases. The crowdsourced data collected by Apple is stored in an encrypted form and does not identify you personally. (Source: Apple Location Services & Privacy)

This means that no matter how much you restrict your apps’ access to location data, your iPhone still shares your location with Apple whenever Location Services is enabled.

That’s why I recommend only turning on Location Services temporarily. Enable them when you need your location for navigation, and then turn them off again. OK, let’s get started.

Configure your Location Services and configure your apps

Settings -> Privacy & Security / Location Services

Turn on “Location Services”.

Now go through the list of apps that want to access your location. Give apps you use for navigation permission to access your location “While Using the App” and set all others to “Never”.

For System Services, I recommend turning off all options, especially “Find My iPhone” and “Share My Location”.

Example settings for the Apple Maps app:

Settings -> Privacy & Security / Location Services / Maps

Set “Allow Location Access” to “While Using the App”.

Now turn Location Services back off:

Settings -> Privacy & Security / Location Services

Turn off “Location Services”.

Using Location Services for Navigation:

When you temporarily turn on Location Services for navigation, your apps will function based on the settings you’ve already configured—meaning only those apps you’ve permitted will access your location while in use. Apple retains these settings, so when you re-enable Location Services, your previous preferences are automatically applied.

However, by keeping Location Services off most of the time, your iPhone will not continuously share your location data with Apple or other apps, thus enhancing your privacy during periods when you do not need location-based services.

If you turn Location Services back on occasionally for navigation, all your apps are already configured for this. Apple remembers the app settings.

However, since Location Services are off most of the time, your iPhone won’t share your location with Apple during this time.

(10) Privacy & Security / Find My iPhone

This feature allows you to locate, lock, or erase a lost iPhone. If “Find My iPhone” is enabled, your iPhone cannot be erased or reactivated by others, making it worthless to thieves. If you have the “Find My Network” enabled, you can locate your iPhone even when it’s offline or in power-saving mode. If your iPhone’s battery is almost dead, it will send its last known location to Apple. You can try this on Apple’s Find My website.

Settings -> Privacy & Security / Location Services / Share My Location

What to do? Should you let your iPhone be tracked or keep your location private? Apple claims they’ve implemented this functionality as securely as possible and that they only have access to anonymized data. Unfortunately, this can’t be verified. But here are some questions you can ask yourself:

  • Will this feature help you find a misplaced or lost device? Definitely.
  • Will it help you recover a “professionally” stolen device? Probably not.
  • Is the ability to remotely wipe your data important to you? No, because you’ve already set up your iPhone to erase itself after 10 failed passcode attempts.

Still have questions?

If you decide to use “Find My iPhone” anyway: If you enable the options “Find My iPhone,” “Find My Network,” and “Send Last Location” and then turn Location Services off completely as described, the location tracking will be reactivated if you trigger the Lost Mode in Find My iPhone.

(11) Privacy & Security / Tracking

Settings -> Privacy & Security / Tracking

Turn off “Allow Apps to Request to Track”.

(12) Privacy & Security / Additional Permissions

In the Privacy & Security section, there are 17+ more settings after Location Services and Tracking. I believe only the following four are crucial. You should carefully consider which apps you grant access to:

  • Settings -> Privacy & Security / Contacts
  • Settings -> Privacy & Security / Photos 
  • Settings -> Privacy & Security / Local Network ..
  • Settings -> Privacy & Security / Microphone  
  • Settings -> Privacy & Security / Camera
  • Settings -> Privacy & Security / Files and Folders

Behind each of these, you’ll find a list of apps requesting access to, for example, your contacts. You need to decide which apps truly need access to your contacts. Be cautious about granting these permissions. If you’re unsure, it’s better to deny access and grant later.

I’d recommend not granting any access to the other options on the list, at least initially.

(13) Privacy & Security / Safety Check

Emergency Reset

The Emergency Reset feature allows you to revoke all permissions for all apps and people at once. It’s like a panic button if you feel something suspicious is happening.

Settings -> Privacy & Security / Safety Check / Emergency Reset

Manage Sharing & Access

With iOS 16, Apple added the Safety Check feature under Privacy & Security. If you haven’t thought much about sharing and access permissions for apps, this is a good place to start. However a lot of this work we did in th last sections.

Settings -> Privacy & Security / Safety Check / Manage Sharing & Access

(14) Turn Off Sensitive Content Warning

Settings -> Privacy & Security / Sensitive Content Warning

Apple’s introduction of such features feels for me like a step toward more intrusive content moderation or censorship. It is an examples how they respond to external pressures, such as government regulations or social demands, to control or filter content on their platforms.

Just turn it off.

(15) Privacy & Security / Turn Off Analytics & Improvements

Settings -> Privacy & Security / Analytics & Improvements

This section hides five settings that you can safely turn off.

(16) Privacy & Security / Turn Off Apple Advertising

Settings -> Privacy & Security / Apple Advertising

Here you can disable personalized ads.

(17) Privacy & Security / Enable App Privacy Report

Settings -> Privacy & Security / App Privacy Report

The App Privacy Report logs app access to data or sensors. You can also see which apps contact which servers or domains. This is a good way to monitor the network activities triggered by your web browsing.

(18) Lockdown Mode: Extreme Protection for High-Risk Situations

Settings -> Privacy & Security / Lockdown Mode

Since iOS 16, Apple has offered Lockdown Mode on iPhones, a feature designed to provide an extraordinary level of security for users who believe they might be targeted by highly sophisticated cyberattacks. This mode is primarily intended for individuals such as journalists, activists, politicians, human rights defenders, or anyone who may be at risk from advanced spyware like that used by the NSO Group software Pegasus.

Apple’s Statement on Lockdown Mode: “Lockdown Mode is an extreme, optional protection that should only be applied if you believe you may be personally targeted by a highly sophisticated cyberattack. Few people are ever targeted by such attacks.”

What Happens When Lockdown Mode is Activated?

1. Severe Restrictions:
When Lockdown Mode is enabled, your iPhone’s functionality is significantly reduced to minimize the potential attack surface. This includes:

  • Blocking Most Message Attachments: Most types of attachments in Messages, except for images, are blocked. Some features, like link previews, are disabled.
  • Disabling Web Browsing Features: Complex web technologies like just-in-time (JIT) JavaScript compilation are disabled unless you exclude a trusted site from Lockdown Mode.
  • Limiting Incoming Invitations: Incoming invitations and service requests, including FaceTime calls, are blocked if the user has not previously sent a call or request to the initiator.
  • Restricting Wired Connections: The iPhone will not connect to accessories or other devices when it’s locked.
  • Preventing Configuration Profiles: Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM) while Lockdown Mode is on.

2. Usability Considerations:
While Lockdown Mode offers protection, it also limits the usability of the iPhone. Many apps, websites, and features will not work as usual. Essential functions like phone calls and text messaging will work.

Recent Enhancements (iOS 17 & iOS 18):

Granular Control and Exceptions:
Apple has introduced more granular controls in Lockdown Mode with recent iOS updates. You can now exclude specific trusted contacts or apps from the strict restrictions of Lockdown Mode, allowing for critical communications to continue even when you are under threat.

Improved Notifications and Detection:
In the latest updates, Lockdown Mode now includes improved notifications to inform users when certain features are disabled due to Lockdown Mode.

Detection and Reporting:
Apple has also enhanced the ability to report suspicious activity while in Lockdown Mode, enabling users to quickly alert Apple and receive guidance on further actions.

Potential Concerns:

One of the aspects of Lockdown Mode is that its activation can be detected by websites and web ads, which might compromise the privacy aspect. For more information, here’s a short article from Motherboard.

Conclusion:

Lockdown Mode is a powerful tool for those who require the highest level of digital protection, but it comes at the cost of reduced functionality. Apple continues to refine this feature, adding more flexibility and user control, while maintaining its core purpose: safeguarding those who are most at risk from advanced digital threats.

Sources, tips and links for further reading

Total Views: 465