yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] Rakoen:
Thank you for your valuable reaction. According to what you say, Android actually doesn't care about security at all. I've just read that the Device Encryption isn't even 256-bit AES, but only 128. However, according to the link I can see that it actually uses some kind of VPN to connect to my Google account? If it is that secure, can I assume that my SQL Database of the Googel account also has extra encryption on it? And how far do you think that tunnel connection goes, does it also count for the GMail app or just for the basic Android connection? However, my contacts are indeed synced with my Google account. What do you suggest to do then? Noone should ever possibly get access to it. Let's say that I want to be as secure as that even the FBI or CIA won't be able to access it, any suggestions to accomplish that?

What I'm thinking about now is unlinking my Google account with my Android device (or even flashing a rom without Google Apps), but what would my phone make sense then? All of my contacts, numbers and more are stored on my Google profile, no other place. You also mentioned "so it'll be harder to recovery your device's internal data", from which I presume it is possible. Because I'm kind of paranoid because of what happened to me in the past, I hereby think that the only way to fix it is by encrypting the device. However, I can't get past that logo and a 3rd party app doesn't seem to do that kind of job (except for WhisperCore, which has been out of development since it has been bought by Twitter).

An interesting idea that I've just thought of is importing my contacts into Skype and then just always use the Skype app (combined with 3G). Skype always uses a 256-bit AES encryption and so it is secure for sure.

So, what do you think? Should I unlink my Google account with my Android device? Or should I just disable sync? Also, in my experience, there indeed always is a way to bypass an app locker (as easy as just removing the app, which can easily be done from recovery).

PS: It fully boots up. My previous version of CM9 booted to the battery charging icon, it's that that I want back.
[Android Q&A, Help & Troubleshooting] melvinchng:
Set a pattern unlock... it is FBI-proof as stated by CNET (if I've not mistaken)

And even amazon is using 128-bit... that isn't anything strange that Google isn't using 256-bit

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Theonew:
Yes it does use that connection (it wouldn't make sense to make it "open stream"). Your database files can be easily accessed from your device. The information will be secured in your Google account, but hackers can still find ways to access it (difficulty would depend on what you do). The tunnel connection goes for all your Google apps. Well if you're that paranoid, you'll probably want to remove your contacts from your Google account and disable sync.

If you do that, you will not be able to access any Google services from an app, your device will be missing important Google framework files, and you will not be able to download apps from the Play Store. Everything's possible ;).

Yes, you could do that. Keep in mind that the number of bits isn't necessarily important. See here: http://www.bestsslcertificates.com/articles11.html.

I would suggest disable sync.

P.S: Did you change your recovery since then?
[Android Q&A, Help & Troubleshooting] Rakoen:
I am going to be honest, the first thing I did when I read this was laughing. But after some research, I saw you actually have a point. I've just read this: http://www.electricpig.co.uk/2012/0...roids-old-school-pattern-unlock-is-fbi-proof/

But then I ask myself, how hard can the FBI suck? If I'm right, you can just reboot into recovery and then access everything from there? Even disabling the pattern unlock from there is an option, no?

Beside that, what about encrypted messaging and encrypting calls. There are lots of apps available for that, but none except for Skype is stable and non-ugly at the same time.
[Android Q&A, Help & Troubleshooting] melvinchng:
You can't change the setting in recovery, eg. Disable pattern unlock. It is a setting, unless you are just a little bit lucky, or else system will be corrupted

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Theonew:
You could "encrypt" your messages and calls with an app locker (make "settings" be a locked app so it cannot be uninstalled). No, the pattern unlock cannot be disabled via recovery. You can access many things from recovery, but not like that. The only way they could know your pattern would be by finger markings (which you could wipe away or get a fingerprint resistant screen; unless your device is one of those which can be bypassed with key combinations).
[Android Q&A, Help & Troubleshooting] Rakoen:
There must be a solution for this, without having to remove the complete Google framework. But indeed, I am that paranoid. Nothing may lead to any personal file I have. However, you also mentioned "removing contacts from my Google account". Why would that be necessary? Google doesn't even give the FBI access to my account so why wouldn't it be secure? What I'm thinking off now is syncing my Google account with my Android device. Then unlinking it and then encrypting the contacts, just the contacts. Then I did sync, I did unlink and did encrypt. Wouldn't that make it impossible for enyone on the entire world to access anything from me?

Google services are not important for me, that "important framework files" don't sound important enough to me and the Google Play store... I don't care about it. Enough APK's around. Security first.

You are reminding me that the bits aren't important, while that's true, I want to remind you that secure deletion of 35x isn't that important too. 7x is more than enough if you choose a powerfull PNG stream.
[Android Q&A, Help & Troubleshooting] Rakoen:
Well, I actually was thinking like "why would you even neet to unlock the device". As far as I know, something as a pattern lockscreen doens't encrypt/decrypt anything except for your launcher, which is not a necessary product. I mean, you say "you can access many things from recovery", doesn't this include like every important files? Aren't databases accessible and so also contacts or messages?

However, about the encrypted calls and messages I actually mean off the record things. Like TextSecure do.
[Android Q&A, Help & Troubleshooting] Theonew:
About the Google framework files, you may want to take a look here: http://xdaforums.com/showthread.php?t=1715375. That could be necessary to prevent hackers from getting to them. Yes, unless your data was still left on Google servers (in your account) and hackers got to it.

Yes, but some powerful undelete and data recovery softwares can still recovery data deleted using 7x (especially if the files were fragmented).

You can use 3rd party apps to set pattern unlock for other apps. Partly, but not quite. In recovery, you can access /data (where all your data is stored), but only to backup that partition (unless you made a previous backup which would also allow you to "restore"). You can't access the files like being able to view them (unless you are using Aroma file manager, but you still won't access those files). Databases, contacts, and messages are not accessible (unless you backed them up to your SDcard - they still wouldn't be readable though).
[Android Q&A, Help & Troubleshooting] melvinchng:
This topic is getting more and more interesting.

In the other hand, IF you're having pure Google Device with build in memory, people cant access your storage (built in memory) without entering a pattern or etc

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Rakoen:
The 7x note is not correct for 100%. The way that I overwrite data won't make it possible to recover anything at 7x, not even using powerful undelete or data recovery software. Even if you're a professional, it will be very hard to get back any data. I have experience in this sector, so I know where I'm talking about on this part.

However, what you just said about the pattern unlock is almost unbelievable. Doesn't this simply solve everything? I mean, why would anyone ever use the Android Device Encryption in ICS if there is something as a pattern unlock? Why would it make sense to use AES 128-bit when you can't even access it without the encryption?

So it wouldn't even make sense to unlink my Google account, would it? It isn't accessible you say, so why whould it be any concern? If the FBI isn't able to break behind the pattern unlock, who would be? You first said that a hacker can easily get access to any sensitive data if I sync my Google account, but why should it? Even without OpenVPN, it uses a VPN encryption for every Google App ... so Android is the best in security, I was wrong?

You are very right on that. It really is getting interesting. Your "IF" makes me wonder what exactly you mean. As I have a LG Optimus One (P500) with custom rom, custom recovery and custom radio. Does it make any difference here?
[Android Q&A, Help & Troubleshooting] melvinchng:
You can't access your storage WITHOUT entering the pattern in stock device. IF you're in stock and wanted to root, both system and internal SD will be wiped (a factory reset will be made). So no data will be left

Device: nexus s, galaxy nexus, nexus 7

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] melvinchng:
And regarding to the security, Google released an app that helps you to monitor which app is requesting what permission. You can even set which permission is deny so that you can't install the app and highly "dangerous" app will be kept away from your device.

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Theonew:
Not necessarily. If someone knows your pattern unlock, they could unlock your device. Or even people standing behind you could see it. Someone may use it if another person knows their unlock pattern (but wouldn't know the code).

If USB debugging is enabled, someone could access your databases, etc. over adb. You wouldn't need to sync your Google account - your device would do that automatically (unless you disabled sync which is what I suggested).
[Android Q&A, Help & Troubleshooting] Rakoen:
That's a true thing you say there. But however, it doesn't apply in my situation. I currently am on a rooted device that not even is a nexus (LG Optimus One P500)... so how does it make sense in my case?

I've blocked all connections using DroidWall, so it would be impossible to upload anything personal to an intruder. Beside that, I use my own way of scanning apps and so I do know if I'm secure on that matter. However, thanks for letting me know there is an app for that.

However, I'm not concerned about that kind of security (I am protected against any kind of virusses or malware), my concern is about sniffers and more importantly thiefs that are great hackers (which in my case are around the corner).
[Android Q&A, Help & Troubleshooting] melvinchng:
Disable visible pattern and use two steps verification for Gmail.

Google search for it, 2 steps verification for Gmail.

Even thought someone has your Gmail account AND password, they still aren't able to log in into your mail... and the password that you use to log in in your Android device IS different from the normal one AND the password has to renew monthly..

Google really put a lot of hard work on solving those problem that you mentioned. Try out those things that Google has made

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Rakoen:
Well, then I'm going to create a pattern unlock as strong that it's impossible to follow, even if the person is standing beside me and looking at it. I'm also not planning to show it to anyone and will look around if there are cameras every time I unlock (yes, I am paranoid, but with reason).

I thought exactly the same about USB debugging and so I disabled it. I don't understand what you are trying to say with the sync. Why would I want to disable it? What would it add as security?

And it seems like I skipped this:

No, I haven't change my recovery since a long time.
[Android Q&A, Help & Troubleshooting] melvinchng:
Can you let us know what is your job / what does your phone contains / what is most of them...

And actually, there is an Chinese app, 360 Strong Box, and what it does is exactly what you want. It is a software made by 360 company, the app can convert image / video / documents and data into a file that can only be access by using the 360 strongbox... you don't have to worry about the security, 360 is one of the largest Chinese security company that provides antivirus or anti spyware on different platform, windows, android, symbian, iOS etc.

UNFORTUNATELY, it is in Chinese language and the company signed it in private, so I couldn't compile and recompile it and make a translation.

Request from the company for the English translation. I can help them to translate if they're willing to release a copy of English version. The translation is about 400 lines only, a short app.

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Theonew:
You said "You first said that a hacker can easily get access to any sensitive data if I sync my Google account, but why should it?". Define "it". Having it enabled does not make your device any more secure than disabling it.

If he would do that, I don't think he would be so paranoid :p.
[Android Q&A, Help & Troubleshooting] melvinchng:
Who knows he is a FBI? :banghead:

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Rakoen:
I've already disabled the visible pattern, but indeed, very good advice. The GMail verification also is a very usefull thing, thanks for sharing. However, while I might be paranoid in some situations, I know one thing: no one will ever get my password. So I don't need a 2 step verification. My only concern was my Android device, but with the pattern unlock proof and the secure connection, it seems to be alright. Great news.

I am sorry, but I can't tell you more about my job or what I do. Just know that if any of my data gets stolen, this can damage a lot more than only my life. My phone at the moment contains nothing, except for my contacts and my Google account. But both contain vital things that should not be accessed by someone not priveleged to.

That app you are talking about sounds interesting, but Chinese is not my best language. Maybe we should have a look at an older version of WhisperCore, which seems to be doing exactly what I was looking for.

--

Or just generally, these products should get a refresh. The idea of the developer is exactly what I would like.

http://whispersys.com/

WhisperCore for securing my data. -> it no longer exists

RedPhone Beta for securing my phone calls. -> it doesn't work in my country

TextSecure for securing my messages. -> it is unstable and ugly, especially when using ICS
[Android Q&A, Help & Troubleshooting] melvinchng:
You can just get a Nokia 3310, no one will steal it ;)

Na, just joking, just leave your idea here. Will check that out once I'm up from bed... 1am here... school tomorrow... such an interesting topic.

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Rakoen:
I meant "he" (the hacker). Why should it make it easier for him to get any data? It is impossible to get behind the pattern unlock, so the only thing I would accomplish with turning off sync is that I've lost a feature, without a positive part. So why did you suggest turning it off, as it doesn't make sense?
[Android Q&A, Help & Troubleshooting] Theonew:
Now that is classic :highfive:.

I was referring if the hacker hacked your account.
[Android Q&A, Help & Troubleshooting] melvinchng:
Just last useful information, I'd recommend you to keep it on. You still have >80% chances tracking where is your device once you lost it. Install webkey and you can keep contact with your phone either your phone is online or offline. And there is many great app in market like Plan B (I dunno whether it still exists or not). If you disable sync, YOU HAVE NO CHANCE to track your device and remote install those tracking app from the market.

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Rakoen:
That's a very correct thing. Something like the apps from Comodo also seem to be great (I even remember some of Remote Access Tools for Android). On the other hand, it also means that I can be tracked down easier. But if I don't want to be tracked, I think my only option is to turn on airplane mode. Or no, wait, if I remove my SIM and remove Google Apps, then I'm untraceable again. Then I can connect to public wifi networks and just use Skype everywhere. That would fix all of my concerns. Encrypted messaging, encrypted calling, encrypted video calling, no data stored (so no pattern unlock even required) and untraceable! Interesting situation...
[Android Q&A, Help & Troubleshooting] Theonew:
That actually makes a lot of sense. This is one of the most interesting topics i've read on this site this year :good:. If you do that though, make sure you don't lose you device or else you won't be able to remotely wipe it or track your own device.

P.S: Did your device go threw any hardware damage from the time?
[Android Q&A, Help & Troubleshooting] Rakoen:
This actually is my first real post here, so thanks for letting me know that it's interesting.

If I do that, there wouldn't be any need to wipe or track it. Money is something I don't care about, so if I lose my device I can just get myself a new one. I have a full Titanium and Nandroid backup in an encrypted Dropbox folder, so if my phone gets stolen I can just get myself a new one and restore the backup (I might not have sensitive data, but I have a lot of usefull other stuff). These times you can get yourself a great Android smartphone for less than 100$, if you know where to find them atleast.

PS: My phone has falled off the stairs and into water multiple times before, but except from that, the only thing in hardware damage that I can say is that it had some artifacts while overclocking. But even after that the battery recharging worked perfectly, it appeared after flashing the new rom.
[Android Q&A, Help & Troubleshooting] Theonew:
So problem solved? :highfive:

P.S: I guess that rom disabled off-mode charging or something. It usually only happens with a change of recovery though. Does that rom include a different kernel?
[Android Q&A, Help & Troubleshooting] Rakoen:
That's right. Problem solved. I've learned a lot today, thank you for your contributions to the discussion.

Wait... there is one thing we've overlooked: "Skype does not allow you to make emergency calls to emergency services. You must make alternative communications arrangements to ensure that you can make emergency calls if needed." So what should we do in such a situation?

PS: That would be very weird. However, I don't think my kernel has changed. It is the same rom actually, only a newer version. If I'm correct they both used the CAF Kernel.
[Android Q&A, Help & Troubleshooting] Theonew:
Make the call with your stock dialer. Emergency calls do not require a SIM card.

P.S: I don't know what it could be then. You'll probably need to talk with the developer/compiler.
[Android Q&A, Help & Troubleshooting] Rakoen:
Emergency calls do not require a SIM card? How is that possible? When I unmount my SIM then I don't have a connection anymore.

PS: Alright, will do that, thanks.
[Android Q&A, Help & Troubleshooting] Theonew:
No, they don't. You don't need one ;). That's why when you remove a SIM, the device may say "emergency calls only", etc.
[Android Q&A, Help & Troubleshooting] Rakoen:
I actually realized that immediately after I posted the question. Sorry, stupid question. Isn't worth it to end with this thread.

So here I comeby with another question about security. What about 3G or 4G. How secure are they. Or better said, how easy is it to trace someone if you're on a 3G network? Is it harder than a normal mobile network to get traced or not? Because I am considering of buying a 3G only SIM-card to use instead of using public wifi networks.
[Android Q&A, Help & Troubleshooting] Theonew:
It seems to be somewhat more secure than "a normal mobile network". See here: http://www.cse.wustl.edu/~jain/cse574-06/ftp/cellular_security/#mech.
[Android Q&A, Help & Troubleshooting] melvinchng:
Check your device whether without SIM, there will or will not have signal...

Nexus based devices have signal even with the SIM removed.

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Rakoen:
I've just tried it and I have no connection.

@Theonew

Okay, I thought the problem was solved, but it seems like it's not. I took a look at the Secure Data Connector you were talking about and it seems like I can't enable it: http://support.google.com/a/bin/answer.py?hl=en&answer=115739

It's only available for Business and Education Google Apps accounts, while I use a personal one.

And another thing I would like to ask, what does LINK2SD actually store on my SD card. If it stores sensitive information, I don't like it.
[Android Q&A, Help & Troubleshooting] kawaiiDango:
well, if u have a custom recovery (doesn't matter which one), anyone can simply use adb pull and adb shell to get all ur data. recovery backups are nothing but yaffs images or in some cases, tar archives.

pattern lock or Sim lock can do nothing to prevent this.

Sent from my LG-P500

Sent from my LG-P500
[Android Q&A, Help & Troubleshooting] kawaiiDango:
link2sd only moves ur apk and dalvik cache and libs. data still resides on /data/data

Sent from my LG-P500
[Android Q&A, Help & Troubleshooting] Rakoen:
So the others were wrong?
[Android Q&A, Help & Troubleshooting] melvinchng:
Make a research yourself and who to trust.

What can be taken?

How can it be taken?

If data is stolen, how those data can be opened and used?

What is the data that can be accessed?

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Rakoen:
You are right. Also, the fact that he doesn't answer anymore makes clear he is wrong.
[Android Q&A, Help & Troubleshooting] Theonew:
Link2SD doesn't store any "sensitive information". It simply links apps to the SD card for users with older android versions which don't allow you to move apps there. Yes, it seems like you won't be able to use that security method, but isn't the VPN connection enough?
[Android Q&A, Help & Troubleshooting] melvinchng:
Data2sd and link2sd are two different story... maybe he is misunderstood and said data can be easily stolen in yesterday's post

Accidentally sent from my Google Nexus S
[Android Q&A, Help & Troubleshooting] Rakoen:
Now I must say that you are wrong. LINK2SD does a lot more than that. It's even made for ICS, so I don't think it is something for older Android versions.

A VPN connection is more than enough, the only problem is that as soon as I enable wifi, Google instantly establishes connections before I'm even able to connect to my VPN.
[Android Q&A, Help & Troubleshooting] Theonew:
Solution - Disable sync, enable wifi, set up your VPN connection, enable sync.
[Android Q&A, Help & Troubleshooting] Rakoen:
So you are sure it doesn't login to my account if we disable sync? And what about the GMail app?
[Android Q&A, Help & Troubleshooting] zelendel:
Security for an open source OS is kinda a catch 22 dont you think. As all the coding is available that means any holes in security are also there to be seen. If you are really worried about security then you might want to think about a device that was built for security and not one that was made for developers that has a complete open OS. While I am in the same boat as you I make sure not to keep anything that important on my android device, as a matter of fact only one device is allowed to be used and it is not android.
[Android Q&A, Help & Troubleshooting] Theonew:
If you were logged in already, it will still be logged in but no data will be sent either way. Same thing for the GMail app.