[Security Discussion] unclefab:
"I completely agree with you. I have also tried to rise some awareness, but I keep seeing answers like "agencies don't have much interest in a regular person" and those are the first that are wrong (or are working for "someone")! "

Yeah, I've noticed the same, and they sometimes remain suspiciously silent on other subjects (like the questions I asked in my previous post or the issue I rose about illegitimate perms in home made apps), so I start to think the same than you.

Which means that we re back to the:

TRUST NOONE!

"when you first start your phone, and connect to the internet, in that very first moment, Google will receive your data, no matter what you did to restrict the leakage!"

True, that's why before to connect for the first time one should do the things I mentionned in post #12, plus some other settings that I will explain about in a soon to come tutorial on how to secure one's phone.

"You don't connect to internet? No problem, your operator will receive the same thing when you put their sim into your device!"

True again, but there's an easy way to bypass that.

First, don't give your real name when you buy a phone (sounds obvious but most people don't even think about it).

Second, don't give your real name when you buy a sim (same remark as above).

Third, with Xprivacy, AF+ Firewall, AppSettings, a firewall script, some init.d scripts etc. I don't think one's operator can get much in terms of private data out of the phone, apart from the sim imsi, the phone number and how many credits left there are.

To secure the internet connection use Tor, your operator will know that you use it but it won't know anything else.

It still knows who we are calling, for how long etc. when we use the phone functions and AFAIK there's no way to prevent that, except maybe by using those apps that encrypt communications (I can't comment on that since I don't use my phone to phone or to text, and anyway I don't believe in encryption, see below).

But then comes common sense and the TRUST NOONE concept, if you call mum for her birthday you can use your phone, if you want to make a sensitive call use a public phone.

"Are you "people" aware that Google has a direct line (yes a "red phone" connect directly with the gov.?"

Yep, the same applies to Microsoft and Skype, Facebook, Twitter, Apple etc.

It's true that they don't really care about us for now but still, they gather as much data as possible in case one day they need to chase people like you and me because of a new anti subversion law.

"And just to be fully clear, encryption will help you with the local thief, any gov. agency will break it in no time"

I agree with you, and I even think that encryption is dangerous cuz it gives people a false sense of security. I don't think there's any encryption that can resist a two storeys computer, and there probably are anyway backdoors everywhere regardless of what their devs claim.

The same applies to Linux, it has been compromised by the NSA since 2003.

Open source, the code can be reviewed blah blah, yeah, sure, and who reviews it?

Who has weeks to spend reading boring lines of code?

The schema is simple, as soon as you have an app, a website or an operating system, or whatever that becomes relatively popular, the men in black come knocking at your door.

Unless you have been clever enough to hide properly, but most of the time that's not the case (see how easily they caught silk road, how easily they trace anonymous hackers, the list goes endless).

You want another example?

After Snowden's revelation many so called secure emails have popped out here and there. I've tried quite a few and guess what?

You can't use most of them if you are on Tor with java script disabled. The funny thing being that you still can use gmail or yahoo without java script, interesting isn't it?

Now back to encryption, instead of using it once more one has to use one's common sense:

DO NOT store sensitive data in your phone, that's it.

If you have sensitive data keep it on an usb stick, or a hard disk, the idea is to have it on a support that is not web connected.

"do you think this is the work of some hacker: http://www.symantec.com/connect/blogs/regin-top-tier-espionage-tool-enables-stealthy-surveillance"

Hehehe, the only question is which men in black agency made it.

The US? China? Russia? The zionist? India?