yashsingh1/xdaforums huggingface dataset:
[Security Discussion] an0n981:
The fact the your IP address is known to the site you visit has never been new, it is how the Internet works. And the fact your IP provides geo location data is also not new
[Security Discussion] Ultramanoid:
You asked if I had Gapps, so I answered. No, and nothing from Google. With that setting, Lightning, location off, it still shows city level ( I'm using 4G, no WiFi right now ).

Using TOR in Japan, depending how much your carrier / ISP worries, can cost you losing the service, whatever it is, fiber, cable, 3G, 4G, and / or worse, put you in a list you don't want to be a part of. Targeted surveillance or officials directly showing up at your door. Government and police are publicly trying to kill TOR and anything like it.
[Security Discussion] mrrocketdog:
went to http://forecast.io , clicked on current location, and got this: i'm at the bottom of u.s., not the top.

this with startpage,location off, 4G, not using tor or blankstore.

err on the side of kindness
[Security Discussion] sancho_panzer:
Please, don't be in denial mode, everyone on this thread is aware of this. Already tried to explain it's something different.

Ok, next weird thing and I'm back to my 3310. :D
[Security Discussion] bastei:
Yeah, I only wanted to make clear that Google Location Service could be active without having a Google account. ;)

Well, that is what I expected. As [MENTION=5367731]an0n981[/MENTION] said this was always normal and it is the kind of location data you provide to every single server you connect to.

Make sure you clean localstorage (DOM storage)! It is not exactly the same as cache or cookies and the site seems to use it as a fallback method. But I can't tell you how to clear it in Tint or Atlas Browser...

Can you wireshark your communication with the website? Look for the request "http://forecast.io/ipgeo", this URL responses with the location it gets from your IP. Is it actually your exact current location?

If the site doesn't request this URL something is wrong with your configuration, because apparently then the site has access to the HTML5 geolocation interface. In that case, look at the GET-parameters of the "http://forecast.io/forecast"-request. They should contain the location data the site got from your device.
[Security Discussion] sancho_panzer:
[MENTION=842726]bastei[/MENTION] any IP Tracing and IP Tracking I've made directly from my phone and from some web trackers are consistently giving me a location about 150km from where I'm now. Great and normal.

That damn website is tracking me at something like 200m!

Ok, going to make some tests, reporting later.
[Security Discussion] michelsberg:
When I deny forecast.io to access the geo API (Firefox beta) the site locates me in Berlin, while I'm actually somewhere in southern Germany, some 500km away.

This is *with* gapps and google account, no firewall, only restricted rights for some stuff.
[Security Discussion] Ultramanoid:
Ah, when phones had a week of battery life. Those were the days.
[Security Discussion] sancho_panzer:
Finally, Syncthing is coming to F-Droid

https://gitlab.com/fdroid/fdroiddata/merge_requests/227
[Security Discussion] aelmahmoudy:
Can they know if you are using TOR even if you are using TOR bridges ?
[Security Discussion] Ultramanoid:
I don't know what they can or cannot do. I just don't think it very wise to go against the authorities in Japan. You better have a hell of a reason and an army of lawyers to justify using TOR if the police show up at you door to ask.
[Security Discussion] sushidog:
Really tough cops I must say.

http://youtu.be/6bBT8ta0afM
[Security Discussion] Ultramanoid:
Yes, they're really funny, caring people.
[Security Discussion] Nostra3:
Tested forecast.io

Nokia X - custom rom with Gaaps / Location service disabled, 3G+ , firewall rules to block everything but Firefox mobile / Private browsing mode.

Its put me in Paris, so far 724,1 KM from where i'am actually are.

Checked IP on ip-score, dynamic provider ip from mobile ISP, registred in Paris.

So i bet this website use IP registred location if he is blocked to use location service.
[Security Discussion] aelmahmoudy:
You were using some proxy (such as TOR) ?
[Security Discussion] Nostra3:
No nothing like that.

My mobile ISP using dynamic IP ranges (since its new ip but same range all the time) and all are registred in Paris.

Btw i think this website use IP location if the browser/device block GPS location settings, nothing fancy.
[Security Discussion] traceless:
Apart from the fact that TOR has great advantages, you should also consider looking at this before continuing using this service. Due to the possible "compromisability" (see this) I stopped using TOR already last year.
[Security Discussion] sancho_panzer:
[MENTION=5891486]traceless[/MENTION] nice to see you here again. Yes, obviously Tor is the main target for NSA and other agencies, even so it's better than nothing. There aren't perfect solutions, always will be like mice and cat game. But again, as I told previously, my main concern isn't a paranoid and traceless (sorry for that :) ) anonymity, all I want is privacy by not giving my personal data in vain.
[Security Discussion] traceless:
I don't mind [emoji2]

You are right and I think privacy goes always with anonymity. And I agree with your opinion TOR is better than nothing, but is it worth if your Internet connection is monitored especially due to TOR use? I mean if someone uses it to hide his/her identity and the result is actually the complete opposite.

And

Thanks a lot!
[Security Discussion] sancho_panzer:
Guys, finally NOGAPPS it's working again please thank [MENTION=3999488]MaR-V-iN[/MENTION] and contribute if you can.

http://xdaforums.com/showthread.php?t=1715375

[APP/FRAMEWORK] NOGAPPS Project (NetworkLocation, MapsAPI, Blank Store)

Edit: and this time it's even better, you don't have to install it like system app. [MENTION=3999488]MaR-V-iN[/MENTION] is a real hero.
[Security Discussion] traceless:
Breaking News: Posteo was mentioned by the Guardian
[Security Discussion] sancho_panzer:
Ops, your link it's wrong. Here you go: http://www.theguardian.com/technology/2014/aug/24/posteo-protect-email-the-german-way-patrik-lohr
[Security Discussion] traceless:
Damn I forgot a "=" in the URL Tag. Thanks for correction
[Security Discussion] Ultramanoid:
So, here's what's going on with ads in Firefox :

http://thenextweb.com/apps/2014/08/28/mozilla-rolls-sponsored-tiles-firefox-nightlys-new-tab-page/

Time to leave Mozilla after more than a decade and a half. What a ckufing shame. I hope someone takes the Gecko engine and does something useful with it.

Edit : "News of the non-profit organization’s plan to sell ads in Firefox..." WTFH ?
[Security Discussion] michelsberg:
Well, they were always actively promoting Google. How is that so enormously different? I'm happy they try to get money from different channels. Funding doesn't work on this scale.

It's open source. Fork it, remove undesired code, compile it, be happy.
[Security Discussion] Ultramanoid:
Well, like I said, hope someone takes Gecko and runs away with it.

On a personal note, if I had to compile all the software I need on a daily basis for work and personal use, I wouldn't be doing anything else all day but compiling software. Sad but true. It's the same reason why I don't plant, grow, and harvest the food I eat, or build myself the devices I work with, or the trains and planes I travel with. I pay for things, like everyone else. And people pay me, for what I do.

I do compile and build things I consider absolutely essential for my own needs and donate to open source projects that I think are useful - even if I don't use them myself. And I believe they are needed to compensate all the "evil" corporate crap, the spyware, etc.

It is and has been for a while now a serious concern that most of Mozilla's funding comes from Google, that does as much evil as it wants by now. But bundling their application with spyware ( have you seen the things that AdMob, or Flurry, embedded on Android applications can and do get from a device to send back home ? ) is certainly a line they never crossed before. And they've lost all decent rights to call themselves a "non-profit"... The nerve.

EDIT : Speaking of safe browsers.

There is a build of Chromium ( NOT Chrome, but Chromium, the open source part of the project, without all the propietary Google bits that Chrome has ) available in the link below, and they keep posting an updated build whenever they have a new one :

http://chromium.woolyss.com/#android

I don't think this is available anywhere else. Most people use Chrome -- or Opera, which uses the same Blink engine.

And yes, one can compile Chromium since it's open source and available, but it's always nice to have a public release ready and available for download, plus many people don't have the means or knowledge to deal with code.
[Security Discussion] sancho_panzer:
[MENTION=4004386]Ultramanoid[/MENTION] I never trusted Firefox again after their marriage with Google, even so I'm still using on my PC a portable version. With these latest news I'll stop updating and I'll use it until becomes obsolete.

As for Android Chromium I don't advise it, it's highly unstable and limited on functions. You can follow a nice debate at F-Droid about why they didn't released it. Opera is another animal, much mature and stable, but I really miss the old reliable Presto engine.

Edit: for those looking for an alternative I suggest Atlas, it's in beta stage and it's paid but worth every penny and I believe it will be a reference in a near future. You can also get it on Play Store.
[Security Discussion] RogyHyde:
I'm against this move of Mozilla, but I think it's an obvious move.

I'll try to explain that (my point of view, maybe not the reality):

Google did a master move with Chrome/Chromium, in terms of business. It's a magnet for users because of it's simplicity and well-function, and for devs because of it's openess. Devs recommends it to users because of its "FOSS-friendly" (not real!), and users recommends it to other users because its good and "it's Google's". The result is that nearly all the users and devs are moving to Chrome (not Chromium!!! Because of the lack of official builds), in the benefit of Google and their services. Something Google repeated with AOSP and Android (Android is not FOSS if include GApps!).

Master. Move. But only possible if you have the financial power to do a real better software.

Mozilla has been relegated to a second in-the-bottom-of-the-hole place. I'm sure that the volume of donations have been reduced because the principle of the less users, the less donations. They cannot win Google in better software without funding, and it's major value, FOSS, is under the shadow of Chromium.

So, they need money. That's the reason for this move. Without money, Mozilla is going to dissapear (maybe not tomorrow, but in a point in the future).

I'm personally resisting the change to Chromium as principal browser because of it false FOSS. Chromium is not FOSS because of the philosophy, but because it's usefull for business. I'm not going to support Chromium while I can because it's using us. I feel like I'm being fooled by Google. I'm not going to support Google anymore. Google is evil because it's a business with no moral behind (yeah, that's an utopian thought, business with moral).

THAT'S MY POINT OF VIEW. Only. Maybe not-so-real. Probably incomplete.

On the other hand, I don't thing that changing our principal browser to another less-FOSS one is going to benefit our privacy... :/

I have a dilemma.
[Security Discussion] sancho_panzer:
[MENTION=5442917]RogyHyde[/MENTION] don't know how old are you but do you remember Altavista, Netscape and lately Yahoo? That's the way money talks...

Why don't you try Tint or Lightning from F-Droid?
[Security Discussion] Ultramanoid:
I don't like many things that I have to use daily. Dropping browsers is not an option if you have a web site or a web application that needs to work on all of them.

That said, free software aside, there are two business models.

One is a developer making a product ( the browser ) and selling it to you ( the client ) to be used, and you pay for that. There is nothing wrong with this, morally. There might be security issues is source is closed, etc.

The second model is a developer getting information from you ( the product, that's you ) to be used or sold for profit to marketers, corporations, et al ( the client ). The browser in this second model is what Chrome and ( now ) Firefox, are.

Pixlr Express is a free and good image editor on Android. One of the things it does through embedding statistics in the apk is tell them when you open the application and for how long it's used. Hey, it's not your address or your age, nothing personal, use the app for free ! No ads ! Enjoy !

Let's translate that into terms anyone can understand. How would you like a person total stranger to stand behind you with a notebook writing down every time you open an application and following you until you close it ? Isn't it beyond creepy to say the least ? Ah, but wait, they do get your location... And device specs, and... Hey ! No ads ! Enjoy !

Ah, well.
[Security Discussion] RogyHyde:
No, I'm so young, but I'll revise the cases. Thank you, ?

I'm actually using Lightning in my second phone, but it's pretty limited for me because multiplatform integration (bookmarks sync, over all). There are some disadvantages, too: it doesn't implement the engine, thus uses webkit through a WebView (usually done by 3rd party browsers in Android), that depends of system, and therefore, it only updates with the system.

I will take a look to other options and post here if I found something complete (probably various apps combined).

[MENTION=4004386]Ultramanoid[/MENTION] Absolutely right. But we are looking after privacy and security on internet, and only Open Source is truly assuring both to us (or every model if the software it's not connected to the internet, of course).

I don't like many things that I have to use daily too. Because of this, I'm always searching for new things that I like more. This is an infinite search, :/
[Security Discussion] Ultramanoid:
I know open source would be the ideal, but I was setting that aside, and comparing two business models. And Firefox is choosing to go with the worst.

I'd rather pay for Photoshop on Android and have a say in what they do, as a client, than use Pixlr Express even if it is better and faster and free. Go to hell, Pixlr, I want to edit a photo, not tell you where I am or how many times I edit JPGs versus PNGs. None of what I do is your ckufing business.

If Firefox would say, we're gonna charge users from now on, or become shareware, or give extra features for a price, that would be one thing.

But they are effectively saying by embracing spyware, "users are not the client or goal anymore, they are the product to be sold"... And they top it off insulting anyone with a brain, calling themselves a "non-profit", please. The goal now is to get money from an advertiser by studying the user.

I'm a Mozilla user since the 90s.

There is no replacement for Gecko at present, which makes this move worse. Neither Presto, Trident, WebKit nor Blink are anywhere near as good as a rendering engine as of today. Not HTML5 full-fledged applications, but in the most basic things. WebKit or Blink still have issues even displaying Asian fonts correctly, for chrissake. Only two or three billion people care.
[Security Discussion] an0n981:
Sorry to change the subject from this interesting Mozilla subject, but how can anyone if we truly trust F-Droid? Has any ever compiled an apk and compared it to an F-Droid release?
[Security Discussion] michelsberg:
Is there any evidence that Firefox will track users and sell user data? I'm only aware of telemetry which is a different thing.

I mean I could as well say "I'll leave Firefox, because it's totally immoral from Mozilla to kidnap children and feed them in their cafeteria just because their meat is more tender". I am really not aware of anything different than default tiles in about:newtab being set to amafacetubbc instead of being empty.
[Security Discussion] Ultramanoid:
Actually, that's a clear issue with open source. The fact that source is available does not mean that the compiled versions are "clean" or that there is ( surely ! ) someone checking the source for problems to fix them. Look at the SSL disaster recently.

There is an extremely interesting debate about that, with people saying that they trust much more a business with a closed source product that they spend money in and look over and fix constantly, than an open source one, with tickets open that no one is looking at or fixing.

I think it's a case-by-case scenario. In an ideal world, of course, open source would be the way to go, always. But no one lives in an ideal world.

Of course it will be perfectly safe, marketers are not the important part here, Mozilla only cares about users.

See ? Nothing to worry about.

All those Chinese browsers don't send info back home, either. It's just bad press. Why, there are millions using Dolphin, how could they do anything wrong. You must be paranoid if you think that.

:cyclops:
[Security Discussion] sancho_panzer:
Lookout they aren't all equal. Dolphin was the worst case scenario, deeply analysed and exposed at Xda and several prominent tech websites like Android Police. Even so the millions using it you refer are common people, not concerned or informed about these tech subjects, but what concerns me more are those hundreds tech websites still advising it today.

It's amazing that no one really knows who's behind Mobotap and develop Dolphin. Official reports refer it as American, others believe they're Chinese but Dolphin official website don't give a single clue here.

Once again people prefer usability over privacy/security, something clearly exemplified with Dropbox success. Nevertheless I never liked the all green interface from Dolphin, hurts my eyes and reminds me goblins. :cool:
[Security Discussion] sancho_panzer:
This is illogical.

Yes, support always be better on commercial products but claiming they can be trusted about their proprietary code is dumb.

Sure, you can ask who/if F-Droid releases are being audited, and that applies to all open source projects, but at least you have sure the code CAN BE analysed at any time. This openness will self control deployment by knowing the dangers of being exposed and lose credibility. Nevertheless I assure you F-Droid is being HIGHLY scrutinised right now by coders, developers and above all by Google itself. Google is losing market for solutions like F-Droid and Aptoide and if something fishy is going on with users expectations Google will exposed them, directly or indirectly, to disbelieve them.

Open source give us a balance that proprietary never will. "Errare humanum est" and OpenSSL was really embarrassing but you can't change to the "other side" because of this gigantic mistake. Benefit of the doubt is better than blindness...
[Security Discussion] traceless:
Off-Topic: anyone else having issues with F-Droid?
[Security Discussion] bastei:
This by far not an issue! I was quite happy to see certificate pinning as a feature of the app.

Anyway, they changed their certificate as the old one expires in a week or so. So I think we should be fine with that "issue". ;)
[Security Discussion] sancho_panzer:
Which version are you using?
[Security Discussion] aelmahmoudy:
There are news about GuardianProject dropping Orweb for the sake of the new Orfox (which is based on Firefox)
[Security Discussion] traceless:
Well, it is. What if F-Droid certs were hijacked or the app points to another malicious repo? But thanks anyways for the info with cert update.

0.7.1, the latest one.
[Security Discussion] bastei:
Yeah, but thousands of certificates expire and get renewed every day. And we normally don't call that an issue because it is the way it is. I think the problem is actually that we have to trust certificate authorities.

By the way: The F-Droid Repo is signed, as well as all the binary releases. So you can make sure that your installation is not completely corrupt. ;)
[Security Discussion] traceless:
Totally agree with that. I think it also depends on who you are. Most people don't care about certificate problems and would even change the browser to solve the problem than to worry about security. And also you don't get mad about a outdated certificate on a board you just visit once a month, but as it comes to financial services or those about security, I'm sure you would be worried. Let's say expired certs are not an issue for everyone and every service [emoji1]
[Security Discussion] sancho_panzer:
Orfox project stopped almost a year ago and Github doesn't show any progress, where did you see these news?

The latest stable version is 0.66 and don't have such notices. Here's the official explanation:

" There is a new SSL certificate, and that is the correct one.

However, the popup window is a bug in the 0.71 client (which fortunately is not the recommended release). You have three options:

*Go back to the recommended 0.66

*Go back to 0.70-test

*Click the ‘Always’ button and accept that certificate (it’s fine)

See also*https://gitlab.com/fdroid/fdroidclient/issues/80 "
[Security Discussion] aelmahmoudy:
https://lists.mayfirst.org/pipermail/guardian-dev/2014-August/003717.html

---------- Post added at 08:25 PM ---------- Previous post was at 08:19 PM ----------

As for the PC, Debian already has its fork of Firefox called "IceWeasel", which I'm pretty sure that they will pull out the privacy breach stuff from it, especially if someone brings up the issue to them.
[Security Discussion] sushidog:
Thanks, really hoping this project won't stop again.
[Security Discussion] sancho_panzer:
[MENTION=5185138]aelmahmoudy[/MENTION] thank you for the information. Unfortunately Orfox is "only" a Orweb replacement, meaning it only works on Tor proxy's, but very good news for previous Orweb users. I was really hopeful months ago thinking that they would give us the chance to opt for proxy or not. Right now Orfox isn't a viable Firefox replacement and the way I see it will never be.
[Security Discussion] Ultramanoid:
Splendid. Thank you for the link.
[Security Discussion] sancho_panzer:
What about the Japanese cops? :D
[Security Discussion] Ultramanoid:
Not home right now, travelling. Just tested the latest Orfox build in fact, looking good.

Haven't used Tor at home since the police asked ISPs to block it or report it, though. Better safe than sorry.
[Security Discussion] Hedied4me:
I can't find where to download latest orfox. Can someone point me in the right direction?

Edit: I'm getting "The proxy server is refusing connection." reguardless of whether I use 3g or wifi.

Sent from my cdma Virgin Mobile HTC Desire 601 zara_cl
[Security Discussion] Ultramanoid:
Nightly builds, so to speak, here :

https://guardianproject.info/builds/OrfoxFennec/

You need to have Orbot installed and running, Orfox will work only if you're using Tor, otherwise you get the error you mention. Orfox cannot work on its own without Tor.
[Security Discussion] Hedied4me:
I don't have much to hide. Is using this worth it for an everyday ordinary civilian?

Edit: Also should I add the Proxy mobile add-on for Firefox? I'm guessing no and that's only if your actually using the Firefox app.

Thanks for your help. Internet seems to be a little slower but I'm pretty patient.

Sent from my cdma Virgin Mobile HTC Desire 601 zara_cl
[Security Discussion] Ultramanoid:
Only you can tell.

The advantage is your browsing is much more secure and private. Disadvantages are that browsing is slower, and that you may become a target of surveillance ( the US and Japan target Tor users, for instance ) which ironically is the opposite of what a Tor user would want.

Edit : Not just web browsing, all connections can be made to use Tor proxies.

Yes, that's correct. Different browsers. Orfox is using Firefox as a base, but besides working with Tor, they also want to improve privacy and safety by removing many permissions that Firefox has, like having access to the camera, etc.