Treat your phone like a passport

Phones are everywhere. On public transport, you might be watching a video or playing a free-to-play, pay-to-win game. On the street, you might be checking the map or texting a friend that you're almost there, really. At the shop, you might pay for your groceries, and before you pay, you might check the balance on your banking account real quick. And of course, there is the ubiquitous two-factor authentication, where services with sensitive data - such as the NHS or your bank - send you text messages to confirm that you're really you before they let you log in.

This is bad.

It might not be obvious why this is bad - we're all boiling frogs at this point - so let me reframe the situation a bit. Imagine that...

• ...while waiting for the tube, you pull out your passport to look at the pretty pictures on the pages. It falls onto the tracks. Better hope someone helps you retrieve it.
• ...while navigating a busy street, you pull out your passport to check the note with directions you stuffed inside it. Someone snatches it from your hand. If you're lucky, they then throw it into the bushes because they were after a passport from a different nationality.

Phones juggle a mix of responsibilities and contexts. They contain valuable data, but we handle them in a carefree way, making them easy and attractive targets. Large cities are plagued by phone snatchers. There is also a type of fraud that takes over control of people's phone numbers remotely without accessing their phone at all (SIM swapping). Currently available solutions are onerous (phone leashes) and partial (only some UK carriers are on record as offering protections against SIM swapping). The fix is to separate the contexts.

One device is doing all of this:

• identity confirmation (2FA, banking apps)
• interaction with the physical world (payment, tickets, navigation)
• communication (chats, calls)
• entertainment (streaming, games)
• data storage (on device, cloud sync)

Of these, only two aspects are critical: identity confirmation and sensitive data storage. They should go on their own, "secure" device which would then be the equivalent of a passport and would be treated like one - always with you, but never pulled out in public. It should have Bluetooth, Wi-Fi, and any other local wireless services like AirDrop switched off. Furthermore, it should be using a SIM from a carrier that provides protection against SIM swapping attacks. This is the number you give to your bank, to NHS, and any other services where access is critical (say, your primary email provider).

Everything else goes on a "public-facing" device which is deliberately cheap and has no data worth stealing. While you will be using it for payments, you can connect it to a card with a spending cap or a separate banking account anyway. Losing the public-facing phone, or having it stolen, should not be a massive issue by design. The SIM in this phone should be selected for maximum coverage, as you will be using it for navigation, texting and calling on the go. This is the number that you will give to family, friends, recruiters, and delivery people as your contact number. If you're experimenting with writing your own apps, this is also the phone you can sideload them onto.

What if the bank calls your secure device while you're out and about? You still don't want to pull it out. Instead, you should set up call forwarding to the public-facing device (depending on the phone type, it's either in the System Settings app or Phone app settings menu). Cancel the call forwarding immediately after you lose the public-facing device.

Lastly, the backups. I mentioned that losing a public-facing device should not be a big deal, but the cost of it is not the only factor here - it would also contain photos and chats; it can really hurt to lose those. You should sync and back up both devices regularly. However, they should sync to different cloud accounts, so that even if the public-facing device is hacked, the attacker cannot inject problematic data to the secure device via sync.

That's a lot of effort. Let's count it:

• the expense of two phones
• the weight of two phones to carry
• the mental burden of having to remember to take the secure device with you (you're not checking it for notifications every 5 minutes)
• setting up two SIMs
• setting up two sync accounts and backing up two devices

Is it worth it? I rather think it is.

Appendix: Do we really need two cloud accounts?

The requirement for two separate cloud accounts might seem to be extra onerous. It isn't. This setup protects against:

Leaks from secure to public-facing device. Apple's Universal Clipboard would let an app on the public-facing device silently read anything copied on the secure one if the two devices shared an Apple ID and sat within Bluetooth range - researchers found dozens of popular apps doing exactly this.

Injections from public to secure device. A 2021 zero-click iMessage exploit could compromise a device on message arrival without user interaction. Attackers will typically have only your public-facing number, but with a shared Apple ID, a message sent there gets delivered to the secure device as well.