yashsingh1/xdaforums huggingface dataset:
[Security Discussion] zzerozzero1:
MyScript

Well, it is highly Distro -and wifi-hardware-specific. I am on Opensuse13.1-XFCE But it goes like this:

sudo systemctl stop NetworkManager.service

If using Gnome NetworkManager

sudo /sbin/rcSuSEfirewall2 stop

Kills firewall. Obviously this command is different on any other Distro

ip link set YOURWLANINTERFACENAME down && sudo ip link set YOURWLANINTERFACENAME up

Kills your Wifi-Interface, restarts it (Might not be necessary at all)

sudo ip addr add 192.168.1.1/24 dev YOURWLANINTERFACENAME

Gives yourself a 192.168.1.1 ip

sudo /usr/sbin/hostapd /path/to/your/hostapd.conf

Spawns AP, i copied the generic hostapd.conf and modified only SSID, password and set it to WPA2

Now let Android connect to the AP (very easily accomplished by pressing twice airplane mode, if your phone/tab is set to use the AP at highest priority ) and press sync in Davdroid.
When finished press Ctrl-C in terminal to take down the AP

sudo /sbin/rcSuSEfirewall2 start

Starts firewall. Obviously this command is different on any other Distro

sudo systemctl start NetworkManager.service

restarts GnomeNetworkManager

Well, I admit 4 commands to put the AP up, 2 commands take it down.

I am not really that much a pro here. So any suggestions appreciated
[Security Discussion] an0n981:
You rock at life.
[Security Discussion] zzerozzero1:
First, I have to say: I use the Internet - e.g. Right now!

Of course, I use email. But I never presume my emails would never come back to me.

I use Facebook. I use Dropbox. But I would never post anything on Facebook that I would not say aloud. I would not upload a photo that is for certain eyes only.

My point is this:

Post Snowden, there were several companies, who advertised say "privacy concious services", all this Schland-Net or Schengen-Routing or EMail for Germany or blablabla crap.

But if I want/need/value really really privacy for some stuff, I would not trust any of them that they would not sell you out or that someone is able to tap into your connection to their servers.

I don't know if I get your point. But I think it is less likely that the NSA has a hugh new permanent backdoor - say- in the Linux Kernel than that they simple offer the CTO/admin of a small email- or contact-sync-provider a cheque for 20000 to give them access to their data.

But You are right, it is getting philosophical drift here.
[Security Discussion] nutpants:
I would love to know how to reproduce this and check the information vs kernel source.

Since android is open source(enough of it is) it would not be impossible to build a Rom from scratch that could use the latest security applications by default.

Only email that is encrypted from the sender is safe, hopefully someone will build an email app like text secure to make it simple for the masses.

written in your mud with my stick
[Security Discussion] michelsberg:
What I hate about good asymmetric e-mail encryption (=PGP) in smartphones is the insecurity of the private key.

You *have* to store the incredibly precious private key on the device; I think we agree that the security level of mobile is much worse than on the desktop. Of course you would use the same private key as on the PC... BAAM, screwed!

That's why I don't think that APG (PGP management for Android) is a good idea to use.
[Security Discussion] nutpants:
If your pgp key is stored in a encrypted state (I use luks manager) that makes things more secure, but really it all comes down to how good of a password you use. I use a paraphrase that includes upper case, lower case, and punctuation.

But it would be nice to see a security suite that is stored encrypted and follows proper measures like not using unencrypted cache,

On a daily basis I use

Luks manager

Text secure

Xprivacy

Afwall+

Keepass

A book mark manager (wish it was encrypted)

F droid

Netstats

Orbot/orweb

Minmin guard

Xposed framework

Nobloat/system app remover

Apg Pgp

I need to configure a server to gather personal email and forward it to my phone in an encrypted manner over the internet and sync my contacts and calendar only over Bluetooth.

written in your mud with my stick
[Security Discussion] Gramina Mortis:
What about ProtonMail and SpiderOak?
[Security Discussion] sancho_panzer:
My choices aren't based on buzzwords or fake campaigns, and you can believe me when I tell you I know exactly what's advertising world, if you read carefully what I've wrote you'll see it's all about good sense, a little trust and care. I'm European, not german, in a country with good legislation about privacy matters, problem is I don't trust my country institutions, so I don't use services around here. Should I trust more on German providers than USA? Sure I do, with precaution and tools to avoid being stalked.

Some nice reading for you:

http://www.dailydot.com/technology/tor-anonymous-os-tails-freitas/

https://guardianproject.info/

... unfortunately this seems to be abandoned:

http://shadowdcatconsulting.com/sammaguro

http://xdaforums.com/nexus-4/development/secure-guardian-rom-t2316300/page2

Fully agree.

Each time you decrypt or copy it you're opening a breach, each time you copy and paste from KeePassDroid you're leaving temporary traces, even the simple fact you have to digit the password to open your security apps it's dangerous. Your phone is potentially the most insecure hardware you can use (besides a chainsaw :cool: ).

Side note: One of the most clever solutions for Android login I'm ware of is TimePIN. Would be great if one day something "not static" like this could be implemented everywhere.
[Security Discussion] nutpants:
I think your phone is only as Insecure as you make it.

You want to play the latest fad game? You lose security.

You want to surf the web, chances are you lose security.

You want to sync to the cloud?

Even if it's your own server, you got a big security hole there.

You leave your phone on the table while you go to the bathroom?

You lose security.

You use your phone for everything under the Sun? You lose security.

You have a alpha numeric pin lock on your phone, your personal databases are encrypted, and you only tether through afirewall internet to a tablet to play games/surf the web and you sleep with it under your pillow?

Chances are, your phone is good.

I would kill for more offline apps like contacts, calendar, notes, journals, finance, and fitness that don't sync every little detail about you to some cloud someplace because the 10gb of space on my phone is not big enough or fast enough to store it.

written in your mud with my stick
[Security Discussion] RogyHyde:
IMHO, truth is there are not full security/privacy, but the more we protect, the less we get attacked because our information is as valuable as normal users that have no protection at all.

So, get a shield and avoid the first attack to gain time to look for more protection.
[Security Discussion] sancho_panzer:
Please take a look to my second post about FOSS alternatives. Quite few apps right now but will grow in the future.

http://xdaforums.com/showthread.php?p=54554921
[Security Discussion] RogyHyde:
Is there a Syncthing client in F-Droid? I cannot find it in the Android app nor the web, although I found a topic in the forum.

Oh. August 10th of 2014. I got it, :)
[Security Discussion] sancho_panzer:
[MENTION=5442917]RogyHyde[/MENTION] you got a PM.
[Security Discussion] Ultramanoid:
Just wanted to confirm to anyone put off by Posteo.de being a German service with a German web site and a German sign-up process... Well, it just takes any translation service and half a dozen copy-paste queries to sign up, even in German. I do not speak German and did it. Then one can use it on the web with any browser or preferred local mail client, for Android or any other OS.

And then, two important points :

1. The interface of the service itself can be used in pretty much any language; it's the open source Roundcube webmail client deployed and configured by Posteo, but one can customize it and personalize it, including language preferences. Even in Japanese.

2. Posteo staff will reply at the very least in English for sure, I know from experience, if there is a problem and one contacts them.
[Security Discussion] traceless:
[MENTION=4004386]Ultramanoid[/MENTION] which way do you like to pay? I choose to send them 20€ via post mail so it's competely anonymous. PayPal or bank won't get linked to your user account they say
[Security Discussion] Ultramanoid:
They are pretty serious about privacy, they will not kid around with that. Unfortunately they have some growing pains, as they had a massive surge of clients in the last year or so because of all the NSA crap, Gmail, Yahoo and Hotmail scanning ( read : looking at ) users' mail, etc. Sometimes they have some downtime because clearly they didn't expect to grow so much so fast.

Once when they were out for a day or two they offered a free month to users and no data was lost anyway.

I normally use anonymous prepaid cards that expire, to pay for things on the internet. If they get hacked or used or stolen, no problem. Not much money unless you recharge them either. That is if they can be charged, some just have a fixed amount and when it's used, bye. I suppose most banks in Europe, ( and not just banks, Google itself, Amazon, other companies, phone carriers, etc ) or the US have that kind of card service too.

Edit : In recent years here in many Asian countries the same service is growing quite a bit in the 3G / 4G market, and that may include using your carrier as payer too, even with NFC chips. You buy a prepaid 4G card with unlimited data for say, a month, pay a fixed 40 USD or 30 EUR or whatever and off you go. Then you recharge or throw it away. I think unlimited data in Europe or the US doesn't exist though, or is terribly expensive, and I don't know about paying with the phone over there.
[Security Discussion] mint-an:
I tried dnscrypt, well I do not get it to autorun at boot.

For now just include a dns forcer app and opendns as suggestion please.
[Security Discussion] Ultramanoid:
Anybody knows of a dialer that just, well, can dial numbers ( and tones ) and NOTHING else ? Something that can't even keep a call log, ideally.

I have no use or need or even want in a device the info contained in contacts, agendas, events, calendars, sms, social crap, etc, etc. Unfortunately there doesn't seem to be a pure dialer that isn't bundled with some of those things, at the very least a contact management element that I do not want but must be running. Even on AOSP-derived ROMs deleting or disabling the apks for Contacts breaks the Dialer part.
[Security Discussion] sancho_panzer:
Good luck. http://eagle.phys.utk.edu/guidry/android/simpleDialer.html

I've sent you a PM.
[Security Discussion] Ultramanoid:
Thank you for that.

Has OS Monitor been mentioned in here yet ? I don't think so...

Very, very nice open source system tool to monitor CPU usage, IP connections, running threads, logs, et al. Actually this is the one that showed me how ES File Manager was making IP connections to suspicious places for no reason whatsoever.

https://play.google.com/store/apps/details?id=com.eolwral.osmonitor

https://code.google.com/p/android-os-monitor/downloads/list

https://github.com/eolwral/OSMonitor
[Security Discussion] RogyHyde:
I'd like to drop the F-Droid version here, 3.0.9.0:

https://f-droid.org/app/com.eolwral.osmonitor

Trying it right now, ;)
[Security Discussion] SecUpwN:
[MENTION=5942520]sancho_panzer[/MENTION], thank you for creating this very informative and helpful thread! Since you seem to have some knowledge in the field of security and setting up your own stuff, are you interested in helping us on development of the Android IMSI-Catcher Detector? Would be happy to see ya there on GitHub! ;)
[Security Discussion] sancho_panzer:
Hi, really nice to see you here. PM me and tell me what do you need. Meanwhile please give this thread some inputs.

Guys I'm not using it because in my country isn't need (yet) but some of you will like to know about this project called Android IMSI-Catcher Detector (AIMSICD). You can talk/ask/contribute on this Xda thread IMSI Catcher/Spy Detector.

You can read this interesting Newsweek article about this subject.
[Security Discussion] pulser_g2:
I have the patches to make Privacy Guard work in Omni, but the big problem Omni lacks right now is developers who care about privacy/security. I've tried to get more people interested in introducing those features (as alone I have no time to go doing it), yet most people don't seem to even realise the problems.

I will merge privacy guard if we can get it all tested, and a few extra things protected - IMEI, IMSI, phone number need protected, as does the list of accounts on the device. I suspect for accounts that can be setup so apps can only see their own accounts, without a permission request.

I'd really like the focus for Omni to be on security and privacy, but there's too many users, and not enough people wanting to look at, or contribute, code unfortunately. So those goals remain a dream for now, along with our list of security goals for the undefined future (http://docs.omnirom.org/Security_features)
[Security Discussion] pulser_g2:
Well, while you're right that Android is hardly a particularly secure platform, there's even less restrictions on the desktop. Desktop architectures are simply not designed for isolation and denying access to files or data. Virtually everything is there.

On the desktop, there's virtually no isolation of resources, or a concept of ownership of files in a manner that prevents applications from abusing access to them - one application could simply wipe out your home directory if it chose to. Or rather than wipe it out, go looking for private keys, and upload them. Since every application you run on the desktop has access to every file owned by you (since the application runs as your user), there's a whole pile of problems on desktop too.

These days, you can't necessarily "trust" even a desktop, unless it's offline and not running any unverified and unaudited software. I'd certainly not suggest trusting "online" computers which have third party software installed on them.
[Security Discussion] mrrocketdog:
[Short time ago (6 months?) I was loyal to CM, but after the group became comercial oriented and I realize they have some proprietary software, I give up on they. I respect they, but not trust them anymore. Their Privacy Guard is something I'd like to have in OMNI instead of the App permission manager, but it's sufficient.]

this is probably already known here, but just in case.... http://xdaforums.com/showthread.php?t=2550769

this will/supposedly remove proprietary components from CM ROMs.

great thread.

thank you.

err on the side of kindness
[Security Discussion] sancho_panzer:
And that's the main reason I still prefer CM, that and all the third party patches and optimisations specially made for it. It's a shame to see Omni don't get the deserved attention, the project reminds me Steve Kondik CM on the early days (or even VillainRom on my old Hero ;)).

It's really nice to see you here, please keep coming and give us more news about Omni.

[MENTION=5511100]mrrocketdog[/MENTION] Thank you for your contribution but if you read the OP you'll see I've already mentioned it (my android system links). I know from another thread you're concerned about privacy so my advice is you should read the OP and follow this thread.
[Security Discussion] mrrocketdog:
[MENTION=5511100]mrrocketdog[/MENTION] Thank you for your contribution but if you read the OP you'll see I've already mentioned it (my android system links). I know from another thread you're concerned about privacy so my advice is you should read the OP and follow this thread.[/QUOTE]

subscribed!:thumbup:

err on the side of kindness
[Security Discussion] an0n981:
Here is another one for the OP Offline Calendar (Local calendar adapter) - https://f-droid.org/app/org.sufficientlysecure.localcalendar
[Security Discussion] Ultramanoid:
Just a heads up for Mozilla users. Firefox nightlies for Android are bundled with an AdMob library now. Why, I don't know, and if anybody finds out the reason please let us know.

Bad, bad move. For user statistics maybe ? There are no ads in display.

Firefox Beta and the stable release do not come with AdMob.
[Security Discussion] sancho_panzer:
Yes, I've heard this recently, very concerning news. Really hoping this isn't a strategic move to please Google (even more) and nothing more than a test ditched on stable releases. My expectations on a stable and light Firefox have been eternal disappointments, now this...
[Security Discussion] sancho_panzer:
FrOScon is near, just three more days to go. All info here: http://www.froscon.de/en/home/
[Security Discussion] Ultramanoid:
Anybody knows where to find a compiled binary of shred or wipe for Android ( ARM ) ? No GUI required, as long as it runs in a terminal to overwrite / delete files securely.
[Security Discussion] michelsberg:
Not tested, but you can try to use the shred binary in Debian's coreutils package. Open the deb file with any decompressor and extract /usr/bin/shred.

edit: If the binary does not work you can try this package for older ARM chips.
[Security Discussion] Ultramanoid:
Ah, good thinking, I will check and report back. Fedora has builds for arm too, didn't occur to me to look that way.

Edit : Well, can't get them to work but it was well worth a try, thanks.

Edit 2 : By the way, Zarchiver can handle .deb on Android, amazing piece of software.
[Security Discussion] sancho_panzer:
Why don't you just use MiXplorer for individual files? Nevertheless read this Safely wipe file content
[Security Discussion] Ultramanoid:
Very interesting, thanks.

I want a binary independent of application to run at system level from /bin with terminal or using scripts. By the way someone asked how MiXplorer implements wiping but Hootan is away at the moment, I'm waiting for the answer too.
[Security Discussion] sancho_panzer:
Guys, this is crazy. Try this and tell us your results (for clean systems without Gapps).

Disable your location, block on your AFWall everything except your browser, clear your browser cache, disable location and relaunch it. Now go to http://forecast.io ...

Jesus, how can this guys know our GPS coordinates?!
[Security Discussion] Ultramanoid:
WiFi location and / or cell tower triangulation, your carrier / ISP.
[Security Discussion] sancho_panzer:
I'm blocking all of them (just system wise) and I forgot to say I'm on airplane mode (with wifi on) while making this test.

Edit: Google maps supposedly can't do it, Open Street Maps also can't...
[Security Discussion] bastei:
It's a simple geo-localisation via IP address. The coarse location of an IP adress is no secret. You can do it also yourself: db-ip.com/db. But note that the results are not very precise. You basically only get the city as location, not the exact address.
[Security Discussion] Ultramanoid:
Exactly. They are not asking your device, they just check with whatever connection you use, in that case the ISP providing your WiFi IP. It will be as detailed as the ISP / carrier allows. Could be city-level, could be down to your next door.

Edit : I am inside a building right now and with 4G they get pretty close to my location. If I turn on WiFi and use that, they get the address of the router in this building and almost the exact office, and that's because the router is there ( not my device )...

It gets creepier and creepier every day.
[Security Discussion] sancho_panzer:
[MENTION=842726]bastei[/MENTION] Yes, I know that, but as [MENTION=4004386]Ultramanoid[/MENTION] said "with 4G they get pretty close to my location. If I turn on WiFi and use that, they get the address of the router in this building and almost the exact office". That's insanely precise and most accurate than last year (I'm on holidays on a remote beach location). I don't have wifi here, I'm using from a near coffee shop.

[MENTION=4004386]Ultramanoid[/MENTION] "It gets creepier and creepier every day" you bet.

Finally ISPs here use same IP range for large areas... and why can't Google and Open Street give me coordinates also?
[Security Discussion] bastei:
I can't confirm that. It locates me in a city 200 km from here with 4G and only somewhere in the city via wifi. Did you delete your offline web content and user data and also deactivate location aware browsing in your browser?

Also, if you use a company-wifi-network for internet access it is possible to find out the company and match it with its address. There are also scientific papers with approaches that go even further.
[Security Discussion] Ultramanoid:
It's really creepy. My 4G connection without GPS puts me in a city-block-wide spot. Basically, it's just as good as GPS by now. With the IP like I said, they spot the router and forecast.io for example locates street and number ( and gets it right of course ) so it's disturbing any way you look at it.

The point is, they don't even need a bit of data from any device, just to know where it connects to the grid.
[Security Discussion] bastei:
Sorry, I can hardly believe that this is possible. :)

It really sounds like cell triangulation and/or wifi localization.. Which browser do you use? Gapps installed?

[MENTION=5942520]sancho_panzer[/MENTION]

Did you try it with Lightning Browser, "Location Access" turned off in settings?
[Security Discussion] Ultramanoid:
I don't even have an account of anything on the device, not social, no Google, nothing. Some of the most connected places in the world are in Asia, Seoul or Tokyo are on a different level than the rest of the world - for good and bad. SoftBank offers clients the option to locate a lost phone - in theory only if it's turned on. I say in theory because they located my boss' phone in Osaka and he had lost it there a week before in a meeting, the thing had been sitting in an office since then, battery gone and dead. This was in 2009, by the way. He had numbers and notes there he really needed, so didn't ask questions, just glad they could find it.

Seriously, any notion of privacy or "that's impossible" after the NSA news or knowing that Google's next wave of satellites have enough resolution to photograph faces, not just blurry cars, from space ?

Those things were reserved for military use and spies for years. Now they're just services in the communications market. Welcome to the future, it may not be so great to make advanced technology available to everyone.
[Security Discussion] bastei:
Yeah, but we don't talk about mobile carriers or intelligence services here. We talk about the possibilities you have using web standards. I bet this site is not doing anything magically (except using HTML5 geolocation, localstorage and offline application cache...).

Dude, you don't need to have an account for Location Services. Anyway, please make a fresh install of Lightning Browser, double-check that "Location Access" in browser settings is disabled and try again.
[Security Discussion] RogyHyde:
Oh. Now I see the goods of VPNs/proxies. At least, not everybody will get your IP/location, only your VPN/proxy provider...
[Security Discussion] sancho_panzer:
I also can hardly believe it and that's exactly why I'm bringing this subject here. But believe me, it's crazy, never saw such thing till today.

Read the OP, I don't use Gapps, my system is firewalled (even kernel), don't use ROM/CM proprietary, codeSELinux is enforced, location is of. I've tried with Tint and Atlas browsers, location access of and cache/cookies/history cleaned.

Already told you Google and Open Street Maps can't give me location on browser BUT forecast.io can!!
[Security Discussion] an0n981:
forcast.io results. Note that I am nowhere near Amsterdam. Tor is amazing
[Security Discussion] sancho_panzer:
Ok, all we know Tor and how amazing it is, but we are talking about something weird and eventually new.

FYI last week Google changed something on their policy. If you read my OP you'll see I've been using Blank Store for Play Store access and download. Since last Friday everybody is complaining about blocked access and FC. Never happened before!

Don't know what's going on, could be a coincidence, but these events are new and concerning.