yashsingh1/xdaforums huggingface dataset:
[Security Discussion] traceless:
[MENTION=5942520]sancho_panzer[/MENTION]

I knew, that Disconnect was founded by a former Google employee but didn't know he was linked to the NSA. Anyway my current FF configuration looks just as you recommended, but I additionally installed a plugin that's called FireGloves. This is especially useful if you want to make fingerprinting your browser harder. It disables or disguises trackable settings; if you'd like to every browsing session. How unique ones configuration is, can be seen here at Panopticlick.

I agree, that it's a pity some services aren't available in the most common languages. Posteo's webmailer can be changed to English, but the whole service is German. Btw you don't have to be worried about the de ccTLD, the 16m mail that were compromised earlier this year were most likely taken due a hack of a german online shop and as the most customers were germans, the majority of the mails end up with *.de. So it doesn't mean every german domain is compromised and mail provider are insecure.

As you don't speak german you could take a look at Secure-Mail, a mail service provided by the mainly german VPN Perfect Privacy. It hosts in NL and supposes to store no identifiable data and is also encrypted. I found no setting to change the language to english on Secure-mail, but I thought I've seen it once in english, maybe it canges only if your country is english-speaking.

Flock is really nice, but I stay with aCal, cause it comes with a calender other than the integrated one and I'm not dependent on the built-in one with the (also switchable) Googl sync.
[Security Discussion] Ultramanoid:
Excellent thread, thank you for starting it.

Edit : I think HTTPS Everywhere by the EFF should be mentioned in a thread like this.

https://www.eff.org/https-everywhere
[Security Discussion] dvdram:
It doesn't matter if you think you life is important enough to be watched or if it's just boring. The fact that you know you *could* be watched in every move you make, automatically changes your behaviour. It changes the way you think, it changes the way you speak and write. It influences the way you interact with others. Feeling watched makes you fear of what you do!

Opening a thread like this is a good thing to begin to overcome this fear. :good:
[Security Discussion] jukyO:
Good linux expert, my colleague, told me some finding, android wise.....

He has installed Android Firewall, and blocked every possible application and system modules, including kernel.

In apk log, found that all ip packets sent by android kernel are routed through some chinese ip address, regardless of theirs final destination.

After some research, turned out that this IP is used by NSA. Yes, all ip packets going out of our android phone are sniffed by NSA. Embedded in kernel.

My 2 cents here, and sorry if ot.

Cheers!
[Security Discussion] bastei:
Nice thread, thanks! :good:

Some thoughts from my side:

I generally distrust every online service, especially if I don't pay for them. I think it is better to decentralise services and host them on self managed servers in families, groups of friends,... and thus basically only give data to trusted persons you know in real life.

Here are two good links that show alternatives to proprietary software/cloud services:

https://prism-break.org/en/

https://wiki.debian.org/FreedomBox/LeavingTheCloud

== SERVICES ==

Mail -

I think mails are generally difficult to self-host. So you need a good mail service. Posteo was mentioned here, another similar reliable german mail provider (with english translation) is mailbox.org. They even encrypt unencrypted incoming mails with your PGP-key before they store them.

Contacts & calendar -

Posteo and mail.org also include contact and calendar synchronisation via CalDav/CardDav. Even better: Host it by yourself.

Instant Messaging -

XMPP (Jabber) is an open decentralised protocol with lots of implementations for almost every platform. You can host it by yourself or use an existing server. There are also very good clients for Android like Conversations or Xabber

== ANDROID SYSTEM ==

Two additions:

Free Your Android! - campaign of the Free Software Foundation Europe

IMSI Catcher/Spy Detector

== APPS ==

Don't do this! Firefox for Android is also a good choice. And Orweb not to forget!

DAVdroid is also a very good FOSS CalDav/CardDav-provider that integrates with the contacts/calendar app of android. And it is under active development (in contrast to aCal)
[Security Discussion] an0n981:
I can only agree that using posteo.de is a must. Completely anonymous. I put cash in an envelop (didn't actually touch any of it myself ;) ) and they opened my account no problem. Last time I checked their site alao had an English version. Feel free to pm me with translation issues. I speak both languages fluently. Also a thread like this without XPrivacy?

For those interested in tor along with afwall, I have posted instructions on getting them to work together in the afwall thread
[Security Discussion] aelmahmoudy:
I prefer the Android system to be: OMNI + NOGAPPS + SuperSU

Note that freecyngn & NOGAPPS author has switched to OMNI
[Security Discussion] dvdram:
Regarding OwnCloud: it's a great software, but you're right not to trust it when it runs on some server that is not under your control. That's why I run OwnCloud on a Raspberry Pi that is running at my home, behind my firewall. Syncing is made with CardDAV and CalDAV, and both apps use SSL. I think I can trust that one. ;)
[Security Discussion] traceless:
And what connection are you using? :D I thought about exactly the same solution, but it's nearly useless with ADSL.. (6 MBit/s down and just 60kbits upstream)
[Security Discussion] an0n981:
Both are 100% open source, just not distributed through F-Droid. You can compile them yourself, source is on GitHub. Security software will always add some lag.
[Security Discussion] sancho_panzer:
You're absolutely right, my mistake. Still when I used them my system felt somehow lagging.
[Security Discussion] mrrocketdog:
:delete:

err on the side of kindness
[Security Discussion] dvdram:
I admit I have a bit more speed than you, but it depends on what you want to use OwnCloud for. I use it only for syncing calendars and contacts, and for that few bits of information even your speed is more than enough, although you should consider to do the first time syncing over WiFi. Later, when you add contacts and calendar entries, you won't notice much disadvantage.

Of course, if you want to sync pictures and movies, that speed will not be enough. But do you really need that? Is it not much more efficient to copy pictures and photos via USB cable, when you're at home? Do you really need to sync them while on the road?

That is what you need to ask yourself. Like I said: contacts and meetings are very small pieces of information, less than a text message. A 60k download (from your phone's point of view) is more than enough for that.
[Security Discussion] traceless:
Thanks. Firstly I wanted to use it for an alternative to Dropbox but then I found out the Cal- and CardDAV support. And you're totally right with syncing after first initialisation. Maybe I get an RPi later and try this one and also the owncloud feed reader [emoji2]

Any idea how to use the FF sync of owncloud, since FF only supports upgrading old accs to the new mozilla ones but personally I'd prefer the old way.

Greetz
[Security Discussion] Ultramanoid:
Personally I don't like Firefox on Android at all, never mind the ads issue etc. It's slow, interface is awful, doesn't have the most basic functions ( "save as" needs an add-on, seriously ? ). It's not even my default browser ( it is in other OSes ).

But for developing cross-platform web sites and / or web applications, one needs to test them for the Gecko engine as it is a major player. I work a lot on Android devices and need this just for a start.

I also need full support for CJK characters and formatting in CSS, which WebKit and Blink do not have yet, with issues that have been opened for years now. Then people are surprised that Japanese love their IE...

And regarding Android there is an urgent, real need for competition and independent engines. Most browsers on Android rely on the system's WebView, which is an inferior rendering engine, and prone to break whenever Google changes things ( with KitKat Google broke file upload, text reflow, cookie management, etc, etc, it was a disaster ) and also relies on system updates to patch security issues or fix bugs, which can take months or years.

The list goes on.
[Security Discussion] sancho_panzer:
[MENTION=5185138]aelmahmoudy[/MENTION] got a point here and the dev is a great guy.
[Security Discussion] sancho_panzer:
You're really mad, calm down it's only another browser. I've been a Firefox loyal follower for many years, it was (and still is) my web development platform for all kind of websites and projects. These latest news are real sad but that's life, money always wins. Like I said before I missed Altavista and Netscape for a while, just like I miss Presto engine from Opera, but the alternatives are there and we must adapt.

You have to agree that [MENTION=5185138]aelmahmoudy[/MENTION] suggestion is logical. I also like Lightning more than Orfox, but even so it's quite limited right now. I really hope Atlas to became the privacy/speed/specs reference but as you know it's framework dependent and that could be a real problem.

In the end it's great to see all these new projects arising, giving us the hope that we always will have alternatives to corporate trash.
[Security Discussion] Ultramanoid:
You both missed the point I made about not having a replacement for the Gecko engine. If the job is to make sure CSS code works correctly in a Gecko browser for example, this can't be tested on a WebKit browser ( and the other way around ), it's like saying "test the vaccine for dogs with a turtle, it's the same..." Well, no, you can't do that. That's not how developing with UTF charts, or CSS, or Javascript, works. Every engine is different.

If a WebKit browser goes down or turns spyware, there are a dozen new ones popping out every week. If Mozilla is mining my device for information, and I can't accept that but still need Firefox for work, I can't use any other replacement.

Opera still makes the Classic browser with the Presto engine available, by the way. It is not being developed as they've moved on to use Blink, but there it is.

Other than that, I have been very calm, read some of the feedback Mozilla is getting to compare. It matters a great deal because it is one of the few open source projects that's good, popular, and a role model. It sets an awful precedent. The bundling with AdMob in Android is just gross.

If you want to try good browsers with full options ( using Android's currently damaged WebView element unfortunately ), check Sleipnir ( no analytics, no ads ) or Habit ( paid option to remove ads ). I'm hoping Atlas gets to where these two are now, and I hope the three of them get a good engine of their own, but the last part is harder.

Edit : I'm always posting from a developer's point of view ( this is a developers' forum ), so that it's clear.
[Security Discussion] sancho_panzer:
I didn't miss the point, I only have to accept the facts. Firefox never was the world leader, always have been IE and Safari, right now Chrome is leading on Windows and soon on iOS. Even so all we programing for web preferred the convenience, compliance, analytic power, support community, addons and above all XUL and XPCOM of Firefox, even knowing Presto was better on W3C compliance and the integrated Dragonfly was an amazing development tool (better than Firebug IMHO). Shouldn't we care more about CSS code working correctly on Trident and WebKit knowing they're most used?

True, but if everyone stopped using Firefox what's the point?

Same way you can use an older Firefox version (and you must not forget Opera was a paid app once and Presto always have been proprietary code). And again, if Presto isn't used anymore but you still see it as an option to code why do you say "If the job is to make sure CSS code works correctly in a Gecko browser for example, this can't be tested on a WebKit browser"?

Fully agree and I'm convinced Mozilla will rethink this decision, if not they'll sink.

Already tried first two and really hated the logic and interface of both and the instability of Habit. Atlas is my best bet right now and I agree [MENTION=2954544]tliebeck[/MENTION] team should consider to do a full browser with its own engine.

I'm aware of that but if you forget the reality outside Xda you'll become a geek ;)
[Security Discussion] Ultramanoid:
No, I have no interest work-wise in Opera now that they are just a Chrome clone, and are using Blink. If at least they had no Google Analytics ( which they do in Android ) they could be a nicer Chrome version for my personal use, but not even that since they must have that crap bundled too. I was linking it for you, but I suppose you already know Presto is still available.

Gecko is a major player in the web engine league as of today. Simplifying it a lot ( there are many OSes and versions ) the truth is that any cross-platform web application / site needs to support - today, now - at least Trident, Gecko, and WebKit / Blink. With those three you cover most of Windows, Linux, iOS, Android and OS X. I say three because until Google pushes forward with their WebKit fork in Blink, these last two are still basically the same engine.
[Security Discussion] sancho_panzer:
Guys, finally AdAway is getting the so need TLC: https://github.com/dschuermann/ad-away/pull/536
[Security Discussion] SecUpwN:
Why not just use the awesome MoaAB?
[Security Discussion] sancho_panzer:
I like the control AdAway gives me, like choosing my multiple favorite hosts sources, edit my own lists on a convenient way and merge them with the former, and the Tcpdump to log DNS calls.
[Security Discussion] Hedied4me:
Yeah I like MoaAB also. One less app to take up ram.
[Security Discussion] sancho_panzer:
You don't need to leave AdAway running if you don't want to but it's a very small side effect trade for the convenience of the interface and some nice additions, like whitelisting and local webserver for IP log.
[Security Discussion] cavemandaveman:
I'm curious what you guys use for secure messaging. Since TextSecure is dependent on GCM, I can't use it on gapps-less omni. I've come across TinfoilSMS and Kontalk but have yet to try them. From what I understand, TinfoilSMS uses only SMS protocol while Kontalk uses TCP/IP. Anybody use either or have suggestions for other secure sms apps?
[Security Discussion] sancho_panzer:
I've read good reviews about TextSecure. Here you can read an interesting article about it and some more options like Telegram.

I never tried TextSecure but I've read this: "it's possible to use the current version without GCM/GSF installed, it works very well, there is simply a message that tells the user he/she won't be able to use push messages without GCM."

You should also see this: https://guardianproject.info/apps/chatsecure/
[Security Discussion] an0n981:
What ya'll recommend for a cross-platform messenger. iOS can't do Jabber with OTR, TextSecure isn't available yet, and Threema is closed source. Please don't say WhatsApp.
[Security Discussion] blackmeth:
WhatsApp .,.. [emoji12]
[Security Discussion] RogyHyde:
Telegram is a full cross-platform option. And have a bunch of actual non-tech users. The only problem is that the server-side source code isn't available YET... But you can audit the encryption process on clients.

You can choose trust or do not trust the server, or wait until source is published.

I tried Kontalk time ago, but no more.

Secure IM is a hard thing.
[Security Discussion] sancho_panzer:
Do you know Tigase? Please don't mention WhatsApp on this thread :cool:
[Security Discussion] traceless:
Ever heard 'bout tox.im? A friend of mine told me about it. I've used the Android builds, that are horrible atm but as my friend says it runs well on Windows. If development continues it looks like a great alternative to Skype
[Security Discussion] SecUpwN:
I'm actively using it with my close friends on openSUSE & Ubuntu, it works great! And the best website to find alternatives for proprietary software is this one (bookmarking highly recommended): PRISM-BREAK.
[Security Discussion] Hedied4me:
What are your guys thoughts on Naked browser?

Sent from my cdma Virgin Mobile HTC Desire 601 zara_cl
[Security Discussion] Ultramanoid:
- Developer is obsessed with security and privacy, has had rough encounters with XDA mods for aggressively criticizing other invasive / spyware browsers -- with proper information and arguments, though, in my opinion. ( He raised hell about Dolphin for instance, and yet Dolphin developers can do or say anything they want in XDA and he can't... )

- Interface ( or the total lack of ) is clunky and uncomfortable -- personal opinion. It also means full resources are devoted to browsing, makes it fast.

- It is using Android's WebView ( currently broken ) so any issues can't be resolved ( cookie management or private browsing for instance ) until Google pleases to update the system... Which may break it even more, given history so far.
[Security Discussion] Hedied4me:
Oh ok thanks. I personally like the interface and deal with the fact that certain websites don't work on it. But sercurity wise it seems ok to me. However I'm no expert. Plus its speedy

Sent from my cdma Virgin Mobile HTC Desire 601 zara_cl
[Security Discussion] Ultramanoid:
Atlas and Naked are probably the two cleanest WebView browsers ( privacy-wise ) on Android today, no worries about that. Regardless of interface, they'd be much better browsers with their own engine, fixing Google's crap. Ah, well.

Edit : Tint is just as clean, but even more broken, after almost a year they still haven't fixed file upload though they've been told, so right now it can't be used.
[Security Discussion] pulser_g2:
Could you send me a PM and let me know about this please? This isn't something that will be tolerated on XDA - privacy is a big concern, and there are not double standards around browsers, let's be clear on that. In fact, some browsers are vehemently disgusting in terms of their practices in looking after user data.

If you can give me any info on the matter, I would much appreciate it, so I can look into this, as this is something I take very seriously indeed.

Thanks :)

P
[Security Discussion] sancho_panzer:
[MENTION=4004386]Ultramanoid[/MENTION] some days ago you recommended Habit Browser and I didn't know that was completely remade from scratch. I really didn't liked the previous version but this one is absolutely amazing. It's a shame it as Admob and analytical data being sent to some Korean IP (already blocked on my devices but still...).

[MENTION=2178960]pulser_g2[/MENTION] did you ever tried the above mentioned browser?
[Security Discussion] Ultramanoid:
Yes, it was completely rewritten and the old version renamed 'classic' is still available. The customization options, both for interface and functionality are unrivaled, even comparing with 'desktop browsers'...

Shame indeed about the AdMob bundle ( I think it has Nend too, a Japanese equivalent ), I don't fear any foul intention from the developer otherwise. I haven't bought the paid version to see if that code is removed, and since they seem to be perfectly content with using WebView, I am afraid I probably won't, but I keep an eye on it just in case.
[Security Discussion] Ultramanoid:
For anyone interested in this issue and to see what this developer had to say about all those browsers ( Boat, Dolphin, Maxthon, UC, etc... ), just run a search for aminaked's posts here in XDA, that's his username.

Rather blunt posts, but I don't think he was wrong.

PM sent, and added the comment above for anyone who might be interested.
[Security Discussion] sancho_panzer:
[MENTION=2178960]pulser_g2[/MENTION] , [MENTION=4004386]Ultramanoid[/MENTION]

I think [MENTION=4317380]aminaked[/MENTION] is a victim of cultural and misunderstood straightforwardness. Many people around Xda, users and mods, are always forgetting there are people posting from around the globe, with different visions and trying hard to explain subjects on a foreign language (I myself I'm not that good in English). Latins in general are very direct and lose patience easily, Germans too but they limit their arguments to subject, Japanese guys are always running from police :rolleyes: (sorry [MENTION=4004386]Ultramanoid[/MENTION] you're marked forever, he, he)...

I don't know [MENTION=4317380]aminaked[/MENTION] but being a dev here on Xda it's really tough, many of them lost their patience and gone. Some people only think about themselves and demand solutions to their problems and desires, mainly free and "at this moment". But there's also brilliant people unfairly quieted by moderators leaving to alternative forums. It's a shame and waste for all community.

I guess [MENTION=4317380]aminaked[/MENTION] was fed up with rants, ignorance and bad criticism. Another "recognised-developer-by-followers-but-not-by-Xda" that leaves, unfortunately:
[Security Discussion] traceless:
What do you think about unseen.is? I recently heard of it and hadn't enough time for getting into it, but it sounds interesting
[Security Discussion] sancho_panzer:
Never used the service but their privacy policy isn't good. Iceland is on top of privacy laws and free speech but... no encryption, no warranties, no good.
[Security Discussion] polonordo:
Hi everyone. I recently started to develop the desire to get away from Google but I wanted to keep using my android phone. I can't believe I found this thread :-}

What I wanted to do was something effective but also something that didn't involve modding and rooting. (It's just not for me)

I own a Galaxy Nexus running 4.3, never rooted and never installed any custom rom or recovery. We can call it fully stock.

I was thinking about doing a full wipe and than start using the device without entering the Google account.

Unfortunately I don't know if this will really make me invisible for Google or they will still have a way of tracking me.

(If you don't understand my English, please let me know, I'll try to explain better. I really need an answer )
[Security Discussion] sancho_panzer:
Great to know. Welcome and please spread the word.

Rooting your phone isn't difficult, you should consider it so you could enjoy your phone full potential. It's your device, you can do whatever you decide to.

There are thousands of webpages debating about the virtues of rooting vs exploit dangers. One thing I can assure you, you'll be much more secure by rooting your device if you know what you're doing. Xda it's the right place and you'll find many people willing to help you.

If you choose not to root then you'll be limited to the official ROM, with all the garbage, trackers, listeners and whatever your phone maker and Google decided to put inside, late updates and lousy support (if any). You may not enter the Google account but your phone will still be traceable, well your operator is always tracking you unless you're using a disposable/prepaid phone/card, but each time you connect to Web big G is watching you. You can't rely on gapps or their framework, you can't know what Packets they're receiving from your phone, you lose control completely.

Besides that you'll lose Play Store access, you'll never be able to sync your calendars and contacts to whatever you want (you'll lose Google services so you're limited to your computer and few bad solutions), you can't use any Google app from the system and you can't remove it either, and the list continues...

So, in the end you'll turn your smartphone on a simple phone with Web access and some games. Reminds me my old Nokias ;)

My advice is you should root your phone for privacy and security reasons but above all for your pleasure. If not, keep using Google so you can use your smartphone as intended.

Believe me, some years ago I had same dilemma but after all this time I only regret not having decided soon. Take a deep breath and go for it, you'll never look back again.