yashsingh1/xdaforums huggingface dataset:
[Security Discussion] michelsberg:
I strongly recommend posteo.de and mailbox.org for mail, too. I'm at posteo but the founder of mailbox.org, Peer Heinlein, has a very solid history in e-mail services and he is the author of the standard literature on how to setup a postfix mail server:

http://www.imap-book.com/web/home/authors/

http://www.postfixbuch.de/

Both services are very quick in implementing the most recent encryption methods.

=== Browser ===

Speaking of encryption... To see how bad an encrypted (TLS-) connectinon is, I recommend this FF addon:

https://addons.mozilla.org/en-US/firefox/addon/calomel-ssl-validation/

To see the supported Cipher suites of *your browser*:

https://cc.dcsec.uni-hannover.de/

To see the TLS version and ciphers supported by a server:

https://www.ssllabs.com/ssltest/analyze.html

In general you want to disable at least SSL 3.0 (and only allow TLS 1.0 or newer) as well as the RC4 cipher suites which are said to be decryptable in real time. In Firefox the cipher suites can be viewed in about:config (security.ssl3.*).

If you set "security.tls.version.min" to 1, at least TLS 1.0 is required for https connections.

=== instant messaging ===

In Germany, Threema became quite popular when Facebook bought WhatApp. It's really usable, not only from a technical point of view, but people are actually available.

Problem is: It's closed source. Everything they claim to do is *really* good but you actually can't tell what it is doing.

Nevertheless, a very interesting (German...) podcast interview with the founder, Manuel Kaspar from Jan 2013.

An OpenSource *and* good IM client is TextSecure (with that lovely little Hitler icon). It's integrated in CM11 but it never worked for me.
[Security Discussion] an0n981:
You have to consider that all these politicians also have things to hide, and the NSA, GCHQ and BND know their secrets, they have no choice but to obey.
[Security Discussion] traceless:
+999

This one is a great example for how irresponsible most of us are. The majority of those people I talked to about privacy related topics laughed at me and responded they don't care if someone can easily spy on traffic from WA in an open WiFi. It's horrible. People just don't get THAT PRIVACY IS or should be A FUNDAMENTAL RIGHT. And everybody has sth to hide. Just being considered about privacy doesn't mean you're hiding sth illegal.
[Security Discussion] dvdram:
You're welcome!

Yes, it's really a shame that the FF crew broke the compatibility with OwnClouds bookmark syncing. If you want to sync your bookmarks, there are two options:

You can trust Mozilla and their promises about security and you can use their syncing service to sync your Firefoxes.

Or you can use this app. It does not sync your desktop Firefox's bookmarks to your Android FF, but it syncs your OwnCloud bookmarks to your Android. You have to import your desktop bookmarks manually into OC, and then you can use this app to sync them to Android. There you can use these bookmarks with any browser installed, just by long tapping onto them and saying "open with...".
[Security Discussion] traceless:
Nice tip. Thanks for the app.

I'm also very sad about this but it shows how most users are about to have ultra usable services at the expense of security.
[Security Discussion] dvdram:
I think it depends on who you're asking. If you talk to people living in the areas of the former East Germany, I believe they will wholeheartedly agree that something needs to be done and that it needs to be done fast!
[Security Discussion] traceless:
That may be true, really. I don't have that much contact to people from that area but I see what you mean. Also I think it's a global problem; we live in a world were our data is more valuable as everything else and most people don't know that. Few weeks ago I told some colleagues how valuable a data set including the exact position is for advertising companies. Sadly no one of themel ever thought about that.
[Security Discussion] dvdram:
You're welcome!

Yes, that is right.

On the one hand one could argue that bookmarks don't contain much personal data, if you leave out bookmarks that belong to logins and contain your login name and (beware!) the password.

On the other hand everyone should be aware of the fact that knowing all of a person's bookmarks can help profiling that person!
[Security Discussion] sancho_panzer:
[MENTION=5926898]dvdram[/MENTION] and [MENTION=5367731]an0n981[/MENTION] I totally agree with both of you but please let's keep talking about measures to combat this sad lacking of privacy instead of politicians or secret services. The best way to preserve our minds is not overreact with words or actions but with informed decisions about our choices. Remember this subject is transnational and this thread may have people from different countries, ethnicities and political wings.

I suggest you to use PM to exchange private or ideological thoughts.
[Security Discussion] traceless:
Indeed! Bookmarks are not sensitive as medical files are. But profiling is one thing that is made easy without caring about it and also one can carry links and content in bookmarks that aren't that easy to handle. I mean someone who stores nsfw content links in his bookmarks don't want to expose this data to everyone he talks to.
[Security Discussion] sancho_panzer:
This is a fact no one wants to accept in the name of convenience.

Guys, I will analyse and make a list of the best suggestions around here over the next weeks. I really hope with the help of this amazing community to achieve the ultimate objective of making our systems more private and worry free.
[Security Discussion] traceless:
Back to the FF topic it seems to be possible to host even the new sync on the own server see here.
[Security Discussion] dvdram:
I am sorry for the digression there. This subject just makes me very sad and angry, and sometimes I loose a bit of control.

---------- Post added at 11:59 PM ---------- Previous post was at 11:55 PM ----------

What does that mean? (Sorry, but I am not a native English speaker!)
[Security Discussion] sancho_panzer:
Nsfw = Not Safe For Work
[Security Discussion] dvdram:
One more item for you list: if your internet speed at home is fast enough, you can set up a small pc or something like a Raspberry, running OwnCloud on it and access your data using WebDAV. (Of course using https there!)
[Security Discussion] sancho_panzer:
[MENTION=5926898]dvdram[/MENTION] I already mentioned my experience with that solution on the OP. I don't consider it ideal for various reasons.
[Security Discussion] mint-an:
I did like to add dnscrypt.

http://dnscrypt.org/

https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscrypt-resolvers.csv

No apk. But you can install a binary manually and set up a init.d script for android.

I just setted it up on my arch box. My phone is next.
[Security Discussion] sancho_panzer:
[MENTION=4191793]mint-an[/MENTION] nice suggestion, will try ASAP. Meanwhile you can try this solution and tell us if you found similarities: Set DNS.
[Security Discussion] bastei:
It appears to be incompatible with Android 4.3 and 4.4. I would stick with these methods to change the DNS server as long as there is no FOSS tool for that:

https://android.stackexchange.com/q...nge-mobile-connectionss-dns-on-android-kitkat

But note that DNSCrypt does more than changing the DNS server: It encrypts the DNS requests. You can think of it as a DNS proxy running on the device and forwarding your DNS requests encrypted.

_____________

I'm also interested if and how you guys encrypt your phone, especially sdcard. I'm a little bit confused about the possibilities of sdcard encryption - there are ROMs that support it, others don't. Can you shed some light on that topic? Does anybody know if you can get sdcard encryption with AOSP/Cyanogenmod/etc. ? Thanks!

I had to work out a custom solution with encfs because I didn't know a better way. It is working nice so far, but I have to run a script as root every time I want to unmount /sdcard (if anyone knows how to run a script when Android is unmounting /sdcard, please tell me! :o )
[Security Discussion] an0n981:
For regular DNS (not DNSCrypt, I'm also inteested but haven't any documentation on getting it setup on Android) you can also use a IPTables rules. Here is an example written for AFWall custom script:

$IPTABLES -t nat -I OUTPUT -p tcp --dport 53 -j DNAT --to-destination 194.150.168.168:53 || exit

$IPTABLES -t nat -I OUTPUT -p udp --dport 53 -j DNAT --to-destination 194.150.168.168:53 || exit

It reroutes all traffic to DNS server of your choice. Also works with 4.3+. No closed source software required.
[Security Discussion] traceless:
I'm also using Tinfoil for Facebook, it's really great.

Correct me if I'm wrong but I thought mega.co.nz isn't that privacy-friendly because of Mr. Dotcoms past, regarding to law enforcement.

And I totally sign your opinion about WA.

Also nice collection of tools. Slowly but surly our "repo" grows :)

Edit: I had a short look at DIASPORA*. It's really interesting maybe we all should become friends there [emoji2]
[Security Discussion] Franktdf:
I think there is a 3rd option. You can install an older version of Firefox, like version 28 or 29. You set up sync with your own own cloud server and it's Mozilla plug-in. Once it is running you upgrade to the latest version. I did it and it works nicely for now.
[Security Discussion] RogyHyde:
I think we can have two opinions about Mega.co.nz:

1. Mr. Dotcom, after the closure of his services, build that really private server for avoiding crime-investigation organizations and keep a legal platform for legal AND doubtful file-sharing (they don't know what are sharing their users, so they cannot criminalize the user and the business continues legal).

OR

2. They are tricking their users with a non-private server, they can see all the content somehow, but externally, crime-investigation organizations can't or cannot stop their business because of how the world works (inter-country laws and that things).

There's a third option that came to my mind about money-laundering, but I didn't thought objectively about that.

I don't have another option for large files at the moment. When I have one, I'll switch as far as I can.

PD: I want to know more about proxying and VPNs. You can get a proxy or VPN for avoiding your ISP's data recolection (or wild wifis), but aren't you giving this same data to your VPN/proxy provider?
[Security Discussion] bastei:
Let me throw in friendica here. It's also a decentralized social network but runs on PHP (as easy to install as owncloud) and has various connectors to other platforms (Wordpress, Diaspora, Facebook, Twitter, ...). The good thing here: Its API is compatible to the StatusNet API and Twitter API 1.0, so you can use Mustard, Twidere or other compatible clients.

I think there is a 4th option. ;) You could also use Firefox ESR until there is a proper self hosting solution.
[Security Discussion] dvdram:
The only problem there is: where do you find the older FF for Android?
[Security Discussion] traceless:
Exactly! And that's why choosing a VPN is always a thing of trust.
[Security Discussion] an0n981:
AndroidDrawer, F-Droid...
[Security Discussion] RogyHyde:
I can help here. Download ir from Mozilla's FTP: ftp[DOT]mozilla[DOT]org[SLASH]mozilla[DOT]org[SLASH]firefox[SLASH]releases

(Sorry about braquets thing, I can't post links yet)

Well. We don't trust anyone unless us. So... maybe a self-hosted VPN for knowing who have our data (our ISP) for using with wild wifis out there? :/

I know about these open services, but what information have Twitter (using FOSS clients) which any user can't get from our public twitter feed?
[Security Discussion] bastei:
Logs, social graph, personality profile,... I don't believe that post privacy is a serious solution against mass surveillance. Just my 2 cents.

Don't be confused that I used the word "Twitter". Friendica is a FOSS social network and you can use it with FOSS clients via an open protocol (that was once used and established by Twitter). And it is not explicitly designed as replacement for Twitter, so what is your point?
[Security Discussion] RogyHyde:
I didn't explain well (I have to study more English...). I meant that, with a public Twitter account (every single post is public) anyone can get that things.

Well... not as detailed as Twitter servers, I understand that now, thank you, :)

I'll have a look at Friendica if it's not only a replacement for Twitter (I think I confuse it with identi.ca and pump.io). Actually, I don't have a "personal" Twitter account (I deleted it years ago because of privacy), but a shared Twitter account with two friends for fun purposes (jokes and that type of things).

Anyway, hope this discussion benefits other readers, :)

EDIT: OH, I understand now. Friendica is more a replacement for a "complete" social network, not for microblogging only (in Spain, microblogging sites are considered social networks too. Sorry for misunderstanding you).

Alternatives to FB and G+ ("complete" social network): Friendica, Diaspora*.

Alternatives to Twitter (microblogging): identi.ca, pump.io.

Right? (I am not up-to-date with FOSS microblogging sites).
[Security Discussion] Franktdf:
all versions can be found on the ftp server of mozilla:

ftp.mozilla.org

cheers,

Frank
[Security Discussion] mint-an:
[MENTION=936432]afe[/MENTION]wofyou

Yes dnscrypt encrypts the dns calls itself.

If you just want to use a better dns server, I recommend opendns.

Quick noob quide why it matters:

You open a webbrowser and go to: www.google.com

Your browser opens google, you start searching....great....

Maybe you do not know it but what actually happens is this:

Your browser creates a connection, unencrypted, to a dns server.

(The address of dns server is stored and managed by your operating system.)

Because your browser does not know where "www.google.com" is.

The dns server sents back the ip address of www.google.com to your browser.

Your browser starts a connection to this ip address.

BUT what if someone tells your browser to go to "www.malewaref..kyourself.google.com" instead.

It is possible. It is not simple and your neighbor can not do it. But their are enough powerful organisations.

Just imaging this:

YOU>>>node>>a hacker who does not belong here>>>node>>>>dns server

YOU<<<node<<a hacker who does not belong here<<<node<<<<dns server

You see?? The worst part is, you wont even notice it. Your browser may just go to the original google.

But just one bit of code from "a hacker who does not belong here" was added to the site.

Really, your neighbor can not do this. You need to intercept the connection itself.

Only possible with (local) access to one or more node(s) of your connection. Now do yourself a favor and traceroot.

Just search for "traceroot" if you do not know how to do it.

It tells you how many nodes your connections has from you to the destination.

Traceroot yourself to the dns server you are using.

To intercept and modify your dns calls, one of those nodes needs to be compromised. Include your dns as possibility.

Now, I want to go to www.google.com and not to a scam site.

Encrypted dns traffic solves this problem at least to a point.

dnscrypt is a program creating a little dns proxy on your system.

Every dns call gets encrypted. You can use dnssec with it too.

Dnssec is an other solution to this problem. But instead of encrypting the connections it confirms the data.

Dnscrypt alone is good enough for me. But you can use both together,

The diffrence is simple. If you want to look it up on your own, search for dnscrypt.

Alright. On my pc its running great.

Primetime.

Later today I will settup my phone.

No their is no app doing the work for you.

But I am going to post a little explanaition how to do it here.

Really, its just a binary and a little init.d script...
[Security Discussion] aelmahmoudy:
Add a script to /etc/init.d/
[Security Discussion] bastei:
Yeah, I could run a service for that. But honestly, I don't want to run a background process waiting for an event that happens once a week.. There must be a smarter way. :confused:
[Security Discussion] Gramina Mortis:
Does creating google account with gmx make it less secure?
[Security Discussion] sancho_panzer:
Can you please elaborate a little more?
[Security Discussion] Gramina Mortis:
Could it become a target because of this? I mean a "oh you dont use standard service, you must be hiding something" mentality.

Ofc, was reffering to GMX mail.
[Security Discussion] mint-an:
[MENTION=5942520]sancho_panzer[/MENTION]

Please add https://play.google.com/store/apps/details?id=eu.chainfire.pryfi

http://xdaforums.com/showthread.php?t=2631512

to your app list.

If you do not mind, I will suggest a few more applications.

Would be nice of you adding them too if they fit.

Testing dnssec on my phone now. Guide follows.
[Security Discussion] sancho_panzer:
Of course not. GMX is the biggest email provider in Europe and one of big five in the world:

" GMX Mail is a free webmail service provided by GMX (Global Mail Exchange). GMX was founded in 1997 and is now a subsidiary of United Internet AG, a stock-listed company in Germany. GMX offers a free webmail service called “GMX FreeMail” which currently hosts about 11,000,000 (11 million) active users in Germany, Austria, Switzerland and the United Kingdom."

Fear not, this is not a obscure provider.
[Security Discussion] sancho_panzer:
[MENTION=4191793]mint-an[/MENTION] yes I will, [MENTION=631273]Chainfire[/MENTION] apps are "state of the art" and will be mentioned. I'm waiting for more activity here and new contributions to begin the list.

Keep posting ideas and suggestions but please justify your choices. Spread the word, bring more users. :thumbup:
[Security Discussion] RogyHyde:
Oh, I forget about this. I am currently not using it, but he opened my eyes. Now, my Wi-Fi don't autoscan and I assure to toggle off my Wi-Fi when going outside.

I was thinking a more collaborative document, like a page on some Wiki (more user-friendly, but less moderable) or a git repo (less user-friendly, but better moderable). Only dropping here some ideas...
[Security Discussion] an0n981:
Here is good link for setting up an android phone securely

https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy
[Security Discussion] zzerozzero1:
I kinda disagree

I think your hypothesis is a bit off.

1) Laws are always as strong as they are enforced. German personal data laws may be very protective. But with the current German government I see no trace of evidence that Snowden's relevations did cause any change of policy. The German BND is still allowed to filter say 25% of internet traffic and is still one of the better partners of CIA and NSA. Further, Level3 and other US companys are sitting directly at the DE-CIX in Frankfurt. The US Government can probably force them to give full access with a simple FISA warrent. But honestly who knows for sure ?

2) You mention several companies. But can we really trust them with sensitive information ? Just because they post a privacy disclaimer on their website ? Even, if they were so shady to leave your data unencrypted somewhere, how high is the chance that the individuals responsible will be prosecuted ?

3) The first rule of Internet: "What is uploaded into the internet, stays in the internet."

You share your data somewhere, it ain't yours anymore. Very simple

Regarding your suggestions:

1) Email: An email is basically a postcard. It is not encrypted by default. So anybody in the gateway can read it. If you want it secure, encrypt it with OpenPGP (also available on android).

Choosing an email provider on location, is giving you just a false sense of security.

2) Calendar&Contacts: I have an Owncloud server instance installed on my laptop. I have no desktop calendar-contact-client, but rather access my calendar via a browser pointing to localhost/owncloud.

If I want to sync, I use a 2 line script to spawn a AP, take down my firewall. I connect to the AP with my phone (by pressing AirplaneMode twice), press sync on Davdroid, bring my Firewall back up and kill the AP. Sounds complicated, but takes 15 sec, is rock solid so far and actually really simple. There is no 3rd party envolved and even works when there is no internet access available.
[Security Discussion] an0n981:
Care to share?
[Security Discussion] sancho_panzer:
[MENTION=5367731]an0n981[/MENTION] thank you but I've already mentioned on the OP.

[MENTION=4765602]zzerozzero1[/MENTION] your points are valid and I share some of your concerns but the purpose of this thread like said in title is "Android Security for Conscious Mind". I don't want to be rude but being conscious isn't the same as being paranoid or a monk, always afraid about everything based on conspiracy theories.

We live on a society, we share emails, phone and send sms for private or profissional matters, some guys here even use Facebook ( :eek: ), it's IMPOSSIBLE to be in completely anonymity from the moment you've a registered SIM card and a Internet access (eek, you're not anonymous anymore after being registered by your father). Yes you can put a layer on your phone an try to disguise your activity, use TOR network, pay your accounts with cash, you can even buy a disposable phone with unregistered user card, but in the end you don't enjoy life because your mind keeps telling you everyone around "is spying you".

I don't have any proves that makes me trust on German providers, but there's a personal data law and we need to believe it to some extent, if not we're taken by fear imposing ourselves living in Anarchy or Totalitarianism. You can argue that's exactly how we're living right now but Assange and Snowden's revelations show us there always alternatives to escape big brother control, they have... and sadly now they're living imprisoned lives.

American privacy laws are abusive (intrusive or nonexistent), European aren't but no one can prove they're respected or applied. I prefer to believe in something instead of accepting explicitly imposed "national security" bull****. Then I can care about hiding my data, taking realistic measures to TRY guarantee my privacy. I don't want to live in anonymity, I'm not a terrorist or political dissident, all I want is to preserve my dignity and privacy rights.

After OpenSSL "Heartbleed" memory bug, NSA "permanent backdoors" on AES encrypt, Intel and AMD chips... just to name few, it's obvious you can't trust known security measures, so move on and try to enjoy or don't use technology at all.

You've mentioned the first internet rule "What is uploaded into the internet, stays in the internet. You share your data somewhere, it ain't yours anymore." and then you talk about how insecure email is, should I presume you don't use Internet and email at all?!

Long talk, let's keep focused on real life privacy measures.
[Security Discussion] sancho_panzer:
[MENTION=5981985]entient[/MENTION] great post, amazing stuff. You have to try Tails.