yashsingh1/xdaforums huggingface dataset:
[Security Discussion] Ultramanoid:
I don't know how kind the Samsung crowd is in XDA these days, but you can check the sub-forum and threads for your device for good information. Being a Nexus at least, you will always have better support for security and personalization than with other kind of devices.

Rooting and applying changes can be a bit of work, but it is usually absolutely worth it as the previous post explains.

I would recommend to read a bit over those threads to get an idea of what people do and why they do it, and also what are the usual problems.

If you decide to root the device, a good custom ROM with the latest security patches and optimizations would be highly recommended ( CyanogenMod, Omni, etc ).

Take it easy, feel free to ask in detail about things.

I'd bet anything this is a Korean media company working with Japanese partners ( there are many, mostly anime, manga and game products ) data mining for device specs, carrier info, demographics... Not as worrisome as someone trying to get your financial data or personal photos, but still bad.

Plus their ads are irritatingly cute. They must be stopped. :eek:
[Security Discussion] sancho_panzer:
Maybe but I liked the fact they informed yesterday about crash reporting on the latest v1.1.28B release. Don't like to be reported at will but at least they told us. Anyway, the following IP range is already blocked on AFWall and those "irritatingly cute" ads won't pass on AdAway.

Edit: I forgot to mention how AWFUL is the new icon, one of the most kitsch I ever saw on my devices. The old one wasn't great either but much better than this Barbie thingy.

== AFWall IPtables rules ==

# Habit Browser - Korea, Amazon and Softbank Japan -

$IPTABLES -A "afwall" --destination "14.0.42.0/24" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "14.0.43.0/24" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "14.0.44.0/24" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "14.0.45.0/24" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "54.64.0.0/24" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "54.248.0.0/24" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "54.249.0.0/24" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "54.250.0.0/24" -j "afwall-reject" || exit

$IPTABLES -A "afwall" --destination "210.168.30.0/24" -j "afwall-reject" || exit

== AdAway blacklist ==

127.0.0.1 sh.zucks.net

127.0.0.1 spap.adingo.jp.eimg.jp

127.0.0.1 j.zucks.net.zimg.jp

127.0.0.1 static.zucks.net.zimg.jp

127.0.0.1 a.cosmi.io

127.0.0.1 k.zucks.net
[Security Discussion] Myfou:
nice job

exelent thread !
[Security Discussion] sancho_panzer:
Skype is dead, no more P2P encrypted communications, look for a better alternative. Microsoft app is officially the most intrusive, battery hog but above all the worst privacy intruder you can imagine.

http://www.disruptivetelephony.com/...-on-all-of-us-plus-the-community-outrage.html
[Security Discussion] polonordo:
Thank you for the answer guys. The reason I don't want to get into rooting and flashing is not that I'm afraid that something will break or the system will become vulnerable. It's just that when it comes to computer work (in any form) I'm pretty lazy :(.

I just don't have the time to sit there and research what is the best way to root, the best rom for privacy, the best kernel, and what to flash after you have all that to additionaly improve your privacy.

If you say that factory restoring my Galaxy nexus and start using it without Google account would be nearly useless because Google has other ways to track you , I might just buy a Blackphone (is it any good for privacy as WE intend it??) or go back to my old Nokia N8 and relax knowing that the old Nokia could be trusted.
[Security Discussion] Ultramanoid:
Well, you're answering your own question right there, really.

If you can't devote time to do those things, no one else will do them for you, so that's that.

Not using Google products means Google will have less information about you. Doesn't stop them from putting you in a map with one of their satellites, or show you walking down the street on Street View. Or get info about you when scanning mailboxes of anyone with a GMail account that ever received a message from you in the past.

The point being, absolute privacy as of today means absolute isolation. Otherwise, find a compromise you can agree with.

A Blackphone does come with some things secured, so you don't have to do those things yourself, bur it also means you have less functionality compared to a normal device. See the reviews, for instance the recent one at Ars Technica.

Edit : If you don't want to use Google services and are thinking of a new device, why not try Apple's iPhone or a Windows Phone device ? I won't go as far as to recommend a Blackberry these days. Like the previous post said, without Google products but also no rooting or personalization, an Android device makes for a very poor experience, to be honest.
[Security Discussion] mrrocketdog:
i thought i read somewhere that to use a blackphone , the receiver of the call also had to have a blackphone. (?)

err on the side of kindness
[Security Discussion] polonordo:
Do you mean get an iPhone or a Windows Phone and starts using it as it was intended to be used? Logging in with the apple/Microsoft account, and use all their services?

What's the difference between Microsoft, Google and Apple? Just the name. They all are in the same business. They provide you with a device that you carry with you all the time, so you can fill their servers with a report of your life. They all want to know: who you are, what you like, what you do, where you go, what you think, what you will do, and so on.

About RIM : I know that privacy has been their goal since they started making phones, and their devices were used by all presidents and other people who wanted a high level of privacy. The problem is that I don't know what path they have taken with blackberry 10.... I don't know if they became a data mining company like Microsoft and Google or they stayed old school.
[Security Discussion] Ultramanoid:
When they say Angela Merkel or Barack Obama are using a Blackberry, don't think for a second that means anything regarding what 'normal people' get from Blackberry.

Yes, you choose a hardware manufacturer, a carrier, and you exchange money and / or data for products / services, there is no other way to live unless you isolate yourself from society. Since I thought your specific worry was Google from what you first wrote, I mentioned the other companies, that is all.
[Security Discussion] charlie95113:
So sense omni is a privacy concerned ROM does any other ROM based on omni follow.. Like DU
[Security Discussion] sancho_panzer:
I've been using CyanogenMod+hacks like mentioned on OP with great success and that's my best choice if you ask me, even compared to Omni. Omni could be great but development is slow and support is scarce, they need more devs and a more enthusiastic philosophy.

Guardian ROM was promising but have huge limitations and seems lethargic on development:

Known issues:

- Superuser doesn't work properly (SU is only available over adb shell).

- Windows installer is not yet tested or released. Meaning windows user must manually flash using fastboot.

- No GUI for encryption (Must be done by installer or adb).

More about Guardian here.
[Security Discussion] CHEF-KOCH:
A good Tor search engine that search especially .onion sites seems https://ahmia.fi/search/. It's open source, mentioned at tor blog. it also support forward secrecy, most of the content works without Java Script enabled (except some sites that needs stats visualizations).
[Security Discussion] Ultramanoid:
Here we go again.

Comcast calls rumor that it disconnects Tor users “wildly inaccurate”...

Edit : "Tor, the web browser for criminals..." Whoa.
[Security Discussion] sancho_panzer:
So much ignorance and stupidity, everybody talks about Tor network and no one knows sh*t. Let's hope it's just a rumour... once again...
[Security Discussion] polonordo:
How can i browse their default store? on the web site i can only choose others people stores

beside f-droid and aptoide is there any other safe place where we can get apps?
[Security Discussion] CHEF-KOCH:
I wouldn't trust aptoide, most of the cracked apps come from there. You only need the "correct" uploader name/nick and bingo, you get a cracked app (with of course different signatures). I don't say all of the apps are cracked, but nobody would use it if there wouldn't be cracked apps (because you can download all from legit places and check yourself the "Top" stores, 99% are known cracker) Better stick with F-Droid or Raccoon and buy all apps you really need daily to help and motivate the developers.
[Security Discussion] sancho_panzer:
[MENTION=4322972]polonordo[/MENTION]

First you should go to <CENSORED>and install the <CENSORED> app. When you open the app for the first time it asks if you want to install the official store <CENSORED>and you say yes. THIS IS THE ONLY STORE YOU SHOULD USE, all apps downloaded from here are official, just like Play Store. Even so you should always confirm if the app you're installing have the green seal "TRUSTED".

Aptoide gives everybody the chance to have its own store (you may call it repository) where you can upload your apps and share them if you want. And this is where bad things can happen if you install something from a repository you don't know. Yes, everybody knows many of them are focused on piracy but then you use them if you want, just like guys on iPhone use Cydia if they choose.

Aptoide is the oldest alternative store, it's trusted by millions and always evolving. It's so good that was the only store that had the balls to file a European antitrust complaint over Google dominance. I'm using it for years, already compared several signatures and decompiled many apps and I assure you it's the real thing.

[MENTION=4415879]CHEF-KOCH[/MENTION]

So, as you can use Google to search and Drive to download piracy... Google is a evil pirate boat!

Once again you talk to much about subjects you don't have a clue. It's becoming a classic and a shame on several threads. Learn something or keep your mouth shut please.

Thank you.

Edit: please show us the results of the security audit to Raccoon.
[Security Discussion] Ultramanoid:
Hope CyanogenMod browser, Lightning, Tint, and any /all AOSP-based browsers developers are in on this :

Android Browser flaw a “privacy disaster” for half of Android users - Bug enables malicious sites to grab cookies, passwords from other sites.

Best and probably only comment needed about this, from the responses to the article :

Edit : AOSP and WebKit vulnerable, WebView broken, Chromium only in data mining browsers, Firefox embracing AdMob... Android browsing looking better and better every single day. Sigh.
[Security Discussion] tga.d:
If you look at the Hacker News thread on it someone posted a link to test your browser (new user, can't post links yet).

Haven't heard anything about this, what are you talking about?
[Security Discussion] Ultramanoid:
I don't use a browser affected by this, I was saying I hope developers of browsers affected by it do something about it, and fast.

You can post links as text.

Read through the thread to know about Firefox. Nightlies for Android come bundled with AdMob ( download one and check yourself ) and as for the rest of platforms, find the links on this thread or refer to Mozilla themselves and their program for "sponsored tiles"...
[Security Discussion] tga.d:
I figured as much, the vulnerable browser doesn't even run on the latest versions of android afaik.

It's not letting me post that particular link, even in code tags.

I did. The only mention of it is either you or people replying to you, and no source was ever provided for this information.

Did that too, no ad mob to be found. In fact, since it seemed so out of character to me (at least, it doesn't sound like something any of the Mozilla devs I've met would ever do), I grep'd the entire source code for any mention of admob, but found nothing. Figuring maybe they pulled the library after backlash, I searched the changelog as well. Nothing. And for one last stab, I searched Bugzilla, where such a matter would have been discussed (either by mozilla devs, or the random angry people who file a bug report for every slight, percieved or othehrwise). Still nothing. So maybe you can link me to a signed copy of Fennec with admob in it, but failing that, it sounds to me like you're spreading FUD, which I don't think is fair to the good people at Mozilla.

You mean the "sponsored tiles" that weren't rolled into nightly until August 28th, weeks after you started posting all this nonsense? In any case, the only "tracking" done with those tiles is 1. geoip, for default language (which has been done for years on all major browsers), 2. how many times any tile is displayed, and 3. how many times a tile is clicked on - all of this done using simple http requests, no additional libraries needed. The latter two are collected in aggregate, and the whole thing can be easily hidden (meaning the only data collected would be "0, 0") by clicking the little button in the right hand corner, or be completely disabled by switching the asociated flag in about:config if you're super paranoid, or even examine the code yourself:

https://hg.mozilla.org/mozilla-central/log?rev=sponsored
[Security Discussion] Ultramanoid:
It does. There are dozens of AOSP-based browsers and compiled versions of the AOSP browser itself -- and applications including this code to render web pages within them.

Search for any, install it on KitKat, check yourself.

Seriously ? You can't put spaces or otherwise write a link, to say anything dot com, anything .com or any other of various combinations of text to post a link even if it's not clickable ? Joke is on me for even replying with this paragraph.

https :// news.ycombinator.com/item?id=8321185

I'm not responding to anything else you write, as I don't want to give more arguments to someone starting a flame war. Enough of those all over XDA.

Edit : Just wanted to add this :

I'm one of those "good people", myself. Not just contributor, but user of Firefox Mozilla since the 90s, which is why I'm furious about this development. And no, I won't give you my work address or my name to prove it.
[Security Discussion] jcase:
Guys, lets be adult here, instead of slinging insults. I fought long and hard for us to even get a security forum, lets not turn it into a zoo.

FireFox Nightly does indeed have the admob library in it

Is it actually used? No idea.
[Security Discussion] traceless:
Guys, a little off topic: what Linux distro would you recommend? I'd like to install one on my laptop instead of W7. Any idea which one focuses on privacy but also has a easy to use interface?

It should have a packet manager because I'm not that familiar enough with Linux to deal with the makefiles :/

Greetz
[Security Discussion] sancho_panzer:
If you're beginning with Linux Ubuntu is the most friendly but a "normal" distrito as concerned to security.

Here you can find a list of good and secure distributions.

But you can always run the system from a live CD, that way you don't leave any trails. ;)
[Security Discussion] Ultramanoid:
As mentioned above, Ubuntu is arguably the friendliest. Mint is up there too, probably the most 'popular' these days. I haven't checked openSUSE, Mandriva / Mageia in the last few months but they were nice for newbies last time I did.

If you get comfortable, I'd suggest moving on to Debian, Fedora, or Arch. Fedora runs great from an encrypted USB drive, others do too.

Tails is probably the most secure one.

https://tails.boum.org/

Lots of info here as well :

http://distrowatch.com
[Security Discussion] aguaz:
Ubuntu still is violating your privacy: http://www.gnu.org/philosophy/ubuntu-spyware.en.html

Also it's unfortunate that you promote CyanogenMod in your signature as it does not respect privacy as well.
[Security Discussion] Ultramanoid:
Cross-platform secure voice and text communication application, BitTorrent Bleep, launches with public alpha.

http://blog.bittorrent.com/2014/09/...-goes-public-introduces-mac-and-android-apps/
[Security Discussion] traceless:
Thanks guys for your reply. I'm asking because I'm not willing to use Ubuntu (did you know it git the big brother award for using Amazon ads?).

I've received the email just a few minutes ago :D
[Security Discussion] polonordo:
What a shame that AOSP Browser is so bad on the privacy front!! Because it is literally the fastest browser out there :(

Does disabling javascript solve the flaws?
[Security Discussion] Ultramanoid:
The problem is the AOSP browser is not the only issue, but its engine ( part of the OS ) on anything below KitKat ( Android 4.4.x ) is affected. It means not just the browser, but ANY application using pre-KitKat WebKit is affected.

The only sure solution right now is upgrading to KitKat and not installing any browser or application that uses an old version of Android's WebKit.

This is a tremendously serious security issue, not just about privacy. The flaw means a malicious site can steal and use any info from the browser. If you're logged into something in another page or tab, anything, they can access it too.

More info :

http://thehackernews.com/2014/09/new-android-browser-vulnerability-is.html

This article points to patches from Google for developers, carriers or anyone who wants to fix this in an older system ( which means 99% of users won't, can't, don't know how to use this code, but whatever... ) :

http://blog.digicert.com/android-browser-bug-allows-origin-policy-bypass/
[Security Discussion] sancho_panzer:
Hum, let's see. If you take a privacy modded ROM like Omni will be fine, but if I take CyanogenMod and mod it myself like EXPLAINED on OP you find it unfortunate! Ok, I can't agree. Even so the dangers of CyanogenMod are very limited.

You also will see on OP that I'm using a Chinese browser as default and I didn't mentioned but my secondary browser is a well known Korean beast. Even knowing the dangers I still prefer them over the Chrome crap because I know and I'm able to control them much better than many others. I'm still waiting to see Atlas grow up.

In the end it's how you use your tools what determines who you are and what you're doing. Instead of criticizing CyanogenMod you should respect them for being the first one to take measures against big G.

Finally I'll remind you that this thread it's about using your devices with privacy, safely and to HAVE PLEASURE doing it. If you want be REALLY incognito use your old Nokia 3310 and buy a disposable SIM.

Peace.

EDIT: Click here and on the top left click on "CM11 Nightlies Changelog"... guess who's link below. Meanwhile I'll be waiting for your suggestions about good and safe ROM's and WHY (don't forget to tell us where are the changelogs and security audits).
[Security Discussion] sancho_panzer:
[MENTION=4004386]Ultramanoid[/MENTION]

Congratulations, this is a rare moment!
[Security Discussion] Ultramanoid:
After iOS 8 strengthens encryption on devices, Android L will be implementing encryption by default.

http://www.washingtonpost.com/blogs...-offering-default-encryption-blocking-police/

This is competition where we all win. It's good that OSs copy each other's good features. But we need more than two major players in the game...
[Security Discussion] jcase:
The android encryption feature has been in the works for some time, wasn't a result of copying, but logical maturing of an os
[Security Discussion] snapper.fishes:
Encryption is only as strong as the password. A 4 digit pin code is way too easy to crack.
[Security Discussion] Ultramanoid:
There's a funny discussion about that over at Slashdot. Wrench mentions included. ( The post is originally about Apple's warrant canary though. )

http://slashdot.org/story/207407

Agreed. Plus it's obvious that software development and hardware design are both done months and years in advance. Was making more of a general comment about healthy competition and innovation prompted by an "arms race', and we might as well thank Snowden too. Suddenly everyone is encrypting everything.

Well, about time. (ノ￣ー￣)ノ
[Security Discussion] aelmahmoudy:
Try Debian.
[Security Discussion] aguaz:
No, in fact the opposite is the case, I appreciate your encouragement. As mentioned above I only find it unfortunate that you promote it in your sig along with "Privacy Matters", because people might not read OP and get a false sense of thinking CyanogenMod respects their privacy. Anyway I'm not here to attack you. It's just what came into my mind when I saw it.

I cut the rest of your post because it is way off-topic.
[Security Discussion] jcase:
No, we are not going to link to nor discuss a piracy/piracy enabling site like aptoide in the security forum. No the APKs are not all "official", I have had to deal with pirated clients app through their service.

Good reason not to trust them, you are hitting the head on the nail.
[Security Discussion] CHEF-KOCH:
My argument is valid and you gave us the proof, everyone can upload infected and modified apk's, and of course cracked apps. That doesn't have anything todo with google. As I said in there Top 10 are most known cracker placed well, and sure, million people doesn't want pay anything for good apps (it's no secret that android user not pay as much as ios users) and there is no control from Aptoide itself. Or do you think thousend of people use boards with cracked apps because there download only free apps?

If you report something on Aptoide the file will be re-uploaded (on other repos as mirror) or the cracker upload his stuff under different account, such behavior is not present in F-Droid because every upload will be checked with signature, source and such mechanism. So yes, there is no control, green shield or antivirus does not help here, most android av's only scan for signatures and not all files get a deep scan or generally a scan if uploader not checked that option.

Raccon is open source, so for what do you need an audit? Compile yourself from the source if you don't trust. I better use this than other sites that uploads cracked/infected apk's use ads or whatever, personally I prefer original files "untouched".

Everyone can use what they want, just saying but to say Aptoide is trusted is really wrong and sounds you not know what you are talking about, the client also comes with ads since some versions now.

So raccoon does not comes with ads, it use original market api and download only legit stuff from google, I think it's a good solution.

Back to topic:

Test if your Android device is affected by recent SOP vulnerability!

Read the full story over here.
[Security Discussion] jcase:
Thread closed at OP's request and due to behavior in this thread.
[Security Discussion] dvdram:
Do you want to know what really annoys me? Those dorks that lie to themselves by repeating again and again "I don't have anything to hide!" :mad:

Of course they do! Everone has something to hide in their lives. That's the dammed reason why we use houses and flats with non-transparent walls and doors, that can be shut and locked!

Please excuse my rudeness, but what really pisses me off is the missing rage of our chancellor. She grew up in a country where no one was safe from being spied upon, where no one could be sure who else listens to that phone call other than the one you were talking to. She knows what it's like to live in such a country. And what does she do? NOTHING!

If I were her I would become mad like the Hulk and give the American government an appropriate answer. But she's just sitting there and waiting until it's all over. That kind of phlegm and disinterest makes me puke!

Thankfully I did not vote for her and her party.