[Security Discussion] SecUpwN:
Whoa, this has to be the longest answer I've received since registering here. Huge thanks! Grab a coffee..

Ok, fair. Will keep it anyhow.

Just to mention it here: An awesome site to see which attack vectors and vulnerabilities exist is Smartphone Attack Vektor by [MENTION=4600707]He3556[/MENTION].

Ok, I get the point. Also like [MENTION=2376614]jcase[/MENTION] already pointed out: If we root, we pwn ourselves. And if we don't, too.

I only install trusted Applications.

Guess if I use the F-Droid Store I should be pretty safe, right? But don't worry, I don't rely on it - as for me, smartphones are huge bugs with touchscreens. That is why I also built a phone signal blocking pouch for myself and friends. Further good recommendations can be found on the bottom of my GitHub.

Actually, no. I already have two or three. Or maybe even four? :cowboy:

Good to know we've come to an end here. Reading all this makes me want to throw my phone out of the window.

I DON'T use public hotspots. Why? Because you can be almost certain that stuff will be logged and analyzed once you use that. Over here in my town, we've got a HUGE Apple Store. And guess what - FREE WIFI for everyone! Yeyyy... not.

- Pressuring developers of apps you use. What dev wouldn't implement a security hole into an app of his, if a guy in a black suit comes up and points a gun to his head? Well that escalated quickly... But with "secret courts" and all the **** that happens secretly sanctioned or is just done by some agencies because they are above the law, is it really such an impossible scenario? The ends justify the means? Do they?

You are right, threats against family, friends and relatives are a no-go. If I remember correctly, something similar had happened to my beloved XDA developer [MENTION=2899970]idcrisis[/MENTION] who invented CrossBreeder. He left development of his toolset because starnge things occured in his life which he linked to his development. Shortly after leaving his project, he proposed a new license: The Aware License. Hope this guy is still living a happy life, though. Added to the above security-issues: Trust NOONE! How come? Well, just read this stunning story I discovered yesterday where a US critical infrastructure company last year revealed that its star developer had outsourced his own job to a Chinese subcontractor and was spending all his work time playing around on the internet adn surfing cat videos. ^^

I don't quite get what you meanb by that. Please clarify, it sounds interesting.

The way I see it: The only thing that we have no real access to, is the baseband. I am sure that these are full of backdoors and switches for agencies that they just need to trigger - just like the Samsung Galaxy Backdoor discovered by Replicant.

Nope, I don't trust the manufacturer either. And I am SICK of bloatware! hence, I am a happy user of AOKP since several years - but regarding the binary blobs, I would certainly love to try out Replicant (sadly not yet available for the HTC One).

Nothing is impossible, everything can be done. A wise man once said: Everything you can imagine, will happen.

Good advice, I already do follow that one. As already said, if I were a spy company, I'd just team up with manufacturers of basebands..

Highly-likely nothing. I already know that there is not much I can do to prevent them to get in, but at least I do want to detect them - and having such a detection mechanism raises the bar in disguising their actions even further - and who knows, maybe they're not interested anymore then?

Not much.

Absolutely right. But what I am really curious of: How do people from the security-community really protect their phones? Do you have friends that are using their phones to just communicate via VPN and VOIP, not sending SMS and never calling people? Perfect place for [MENTION=5024122]InvaderX[/MENTION] to chime in, he told me before to really do a combination of that approach.

Sigh.. mobile phones are a total threat to humanity, I get it..