yashsingh1/xdaforums huggingface dataset:
[Security Discussion] optimumpro:
You have to learn how to build an app from sources: a lot easier than a rom. There are many guides on XDA.

---------- Post added at 05:22 PM ---------- Previous post was at 05:20 PM ----------

That's what I said: you can get a compressed source and build it yourself. Or use the 2.0.6 that I compiled months ago and linked by another member a few posts above...
[Security Discussion] Tjee:
I guess I should start learning how to do that then.

Another question:

How do I encrypt my contacts file, but keep it usable? Would I require a specific app?

I would like to keep it stored locally, but heavily encrypted, on both phone and pc.

I don't need it online on an OwnCloud server.
[Security Discussion] optimumpro:
The reasons I am not using my version 2.0.6 are: I wasn't able to import data from 1.0.6, I mean you can restore it, but 2.0.6 does not work; no ability to change identity key. Otherwise 2.0.6 has a better encryption.

I think the dev now works under 3-letter-agencies' approval stamp, meaning you are secure against everything except the government. After all, he was harrased in airports for months, but now, he gets a once in a life time deal to implement textsecure in whats up, which is owned by such a bastion of privacy as Facebook. That's why they need central database (Google) and the unchangeable "mother/master" key. They don't use the actual mother key itself, but rather it's derivatives (salt). However, if you have master key, you should be able to get the data. So, the way it works: you register with Google or CM account and your master key, which is generated when you first start the app, is sent to the central database most likely not through textsecure, which is open source and could be examined for such activity, but rather through closed Google binaries - GSF. So, the dev could rightly claim no back doors, while your master key still gets to the central database. Now, you understand why the app is not available outside of Google and the dev screams murder every time it appears in other repositories.

Now, suppose you periodically change your master key and you have no GSF. Well, you can only use the app for secure sms, but imagine the headache you create for data keepers? :crying:
[Security Discussion] user2k10:
Thanks!
[Security Discussion] IgnitusBoyone:
Wow, I had never really thought about how insecure the phone really is. You take it for granted because its always on your person.. I use remote wipe and screen locks, but I hadn't really considered all of the details.
[Security Discussion] unclefab:
Woops, I'm really getting old:eek:

I have some problems with my java installation that interfere with eclipse but I'll fix it soon. No rush since I hardly use my current sms app:silly:

When I have time I will add some updates to OP, but for now I'm rather busy with other projects...

[MENTION=5075064]optimumpro[/MENTION]:

I've sent you a PM...
[Security Discussion] silentvisitor:
Maybe nothing but no matter where you click (even back button) OK gets clicked.

Second, without XPosed Lollipop is quite insecure IMO.
[Security Discussion] Mr.LOVER:
Device Encryption ?

hi bro, it was very exciting to see your hard work on collecting and giving us those very very important information on security and privacy. though i knew many of those things before but yet you have made a post which is almost talking about all aspects, for that i really appreciate your time investment for us. even thousand likes are not enough for your post :)

secondly i would like to also get your attention on one aspect that you missed, and that is Encryption of Device as well as card connect in it. because that part is also very important to me to secure my device if it get lost or theft/robbed from me, as you know screen lock can be brocken easily and recently i was finding a way to get a fully secure screen lock which cannot be bypassed by removing some apps or keys through recovery but i couldn't find a way yet.

but what i got from many articles is that encrypting the device is the answer to this problem, and i never encrypted my device before and don't know the pros and cones of it. i'm trying to encrypt my device but for some reasons i'm not able to, may be it's a problem or wrong settings of my kernel but i'm still in doubts if encryption would solve the problem?

can you please also add some of your experience and knowledge about encryption in the OP or if you like in a reply or in PM whichever way you think is better,

thank you so much for your work bro
[Security Discussion] snapper.fishes:
Encryption are only as strong as your passcode, and your device is decrypted when it is switched on. If someone can get pass your lock screen (which uses the same password as your encryption) they have access to everything.
[Security Discussion] Mr.LOVER:
Omni KitKat

i just tried to remove all apps except few on my Galaxy Note II GT-N7100 having Omni rom KitKat 4.4.4 and here are the results

it might benefit you that on omni rom on kitkat, i'm able to remove more apps than you said in OP.

------------------------------------------------------

only these apps left on omni rom and all others were uninstalled and omni still boots up tooo fast :D

i didn't uninstall these apps so i'm not sure if phone will boot without them or not.

System UI

Fused Location

Package Access Helper (you can even remove this)

Settings

Settings Storage

Shell

External Storage (didn't remove it so i'm not sure if phone boot without it or not)

------------------------------------------------------

that was just to check, but i kept more apps after testing the extreme above.

i kept these apps for now to continue. all following apps are removable and phone boot without them.

com.android.keyguard (will i be able to lock my screen after removing it? i didn't check this)

Phone (i don't get network without it, but phone boots without it)

Phone/Messaging Storage (same as above)

Es File Explorer (File manager, Removable)

SuperSu (important, Removable)

Advanced settings (Omni rom's extra settings, Removable)

Android Keyboard (Keyboard, Removable)

Calculator (Removable)

Camera (Removable)

com.android.wallpapercropper (need it to crop wallpapers :P, Removable)

Dev Tools (Developer Tools, Important, Removable)

Download Manager (Removable)

Downloads (Removable)

Gallery (Removable)

HTML Viewer (Removable)

Launcher3 (Removable after replacing)

Media Storage (changing ring tones, important, Removable)

Package installer (to install apps?, Removable)

SIM Toolkit (Sim Tools, GSM Network Tools, Removable)

Sound Recorder (need it, Removable)

Torch (need it, Removable)

VpnDialogs (need it, Removable)

so it's possible on kitkat to boot phone with 7 apps only rather than 30+ :)

---------- Post added at 07:52 PM ---------- Previous post was at 07:47 PM ----------

and i have a question, i don't know how to init.d in my rom? i tried to search but may be i don't know right terms to search a good guide on it. can anyone please link me to a guide which talk about how to init.d into android phone and what apps or packages do i need for that?

thanks

Edit:

i found a guide and now i understand, but i have a further question which i didn't find there,

when i use 920 text editor, i copy all code in it, then save it as convert line break to (Unix/Android), but in which format do i save it? in text format or without any extention in the end of file name?

secondly am i right that i would put those script files in etc/init.d/ folder and thats it?
[Security Discussion] silentvisitor:
[MENTION=4930305]Mr.LOVER[/MENTION] Your phone booted and worked without SystemUI ?

Infact I'd caution anyone to be cautious about what you're removing.
[Security Discussion] Mr.LOVER:
no brother! read my post carefully, here is what i said before listing these apps.

i didn't remove System UI, why do you interpret my post like that? :confused:

Edit: i just edited my post to make it more clear. :)
[Security Discussion] silentvisitor:
[MENTION=4930305]Mr.LOVER[/MENTION] Read your post again and got it. Apologies.
[Security Discussion] unclefab:
Sorry for the late reply, at the moment I'm very busy with a new project that some people here may like but chhhht, it's still a secret...:p

[MENTION=4930305]Mr.LOVER[/MENTION]

I already talked about encryption, and I said that I don't use it cuz I don't really believe in it.

Because I think that most, if not all, encryptions can be broken.

And because encrypting is more or less security through obscurity, which is not a good idea and could only raise suspicion (why does he encrypt his messages, he must have some secrets).

If you need to talk about sensitive stuff just use metaphores, robots can't understand that type of writing, and since most likely you are not spied by big brother nothing will happen. Then, if you are spied I don't think that encryption would make you safe (but for sure it would make big b's work harder), allways bear in mind that anything that leaves your phone can be intercepted...

You didn't remove more apps tham me mate!:cyclops:

I let phone and telephony provider in the list cuz most people want to phone, but the device can of course boot without them. Then, I left fm radio too, cuz I like it and cuz there's one on my device, but it's not compulsory either.

See?

10 minus 3 makes 7;)

Do not remove Package Access Helper cuz most likely you won't be able to install apps anymore.

But hey, if you have removed all those apps without installing any third part apps then your phone can't work since there's no launcher.

And you can't access any files, including freshly downloaded ones, since you don't have any file manager anymore.

Just kidding...:silly:

More seriously, it's nice to see that Omni boots even with all those apps removed but tell me, is it stock based?

One thing is that the phone boots, but if you use it for a while you may find out that some things don't work very well, like for instance the touch screen that will probably become rather unresponsive (that was the case on stock 4.4.2, dunno on Omni), that's the difference with 4.2.2 where everything still works.

Plus, I didn't see the Task Manager in your list, and I didn't see Default Container Service either (so probably apps wouldn't install).

Or maybe I'm wrong?

If you don't mind, test a bit more your device and tell us how it goes, thanks in advance.

For the init.d scripts, you don't need to put any extension name.

You are correct, they have to be copied in the system/etc/init.d folder.

The init.d folder must have permissions 755 (rwx, rx, rx), and the scripts too.

Reboot, done!:good:
[Security Discussion] Mr.LOVER:
[MENTION=4703661]unclefab[/MENTION]

thanks for replying.

about encryption:

yes u r right that it can be brocken, but my concern was the vulnerable lockscreen when i found the idea to encrypt device to survive lockscreen bypass. there is a flashable zip available in note2 forums n may b in others as well, which if u flash, it removes lockscreen security. so people say after device encryption that hack is not possible, and thats what i want to ask if true? and ofcourse if i encrypt my device, it will atleast make it hard for others to get into my data until someone is so committed to break the encryption rather than just wiping everything.

About encryption on air data:

yes this might b suspicious for big b to know i am using encryption on sms n chats etc, but why should i give a damn to it? i have a right to my privacy. if big b stop dumping about what i say to my gf or where next am i dating her then i have no need to encrypt, or if big b is my friend then also i dont need to hide. but that is not the case unfortunately for most of us.

well there is no task manager in omni, never saw it in it. im an old omni user since i had LG O4X. default container service is there in system apps folder, i dont remember if i removed it. i think i didnt remove it too.

i think omni is already minimum. its based on AOSP.

after removing all those apps, i have no probs at all. it works smoothest ever n good battery life. since im using it it gave me no probs yet. i have tried to check almost everything, n all is working. videos, music, gps, touch, camera, flashlight, wifi tethering, internet, sms in go sms, calls, using firefox to reply u from it :) .

but

omni also has google dns by default on my 3g. n network log shown me that. but im not able to change my dns to open dns yet. i also tried to install dns forwarder (which has lots of scary perms) but it also is not able to change my dns when i check at https://store.opendns.com/settings .well it work sometimes but not always, and it doesn't start at boot, i cant make it, when i click on its option "start at boot" it automatically disable that option. so its not a solution that u always have to start it manually. and after applying all scripts u gave for inti.d i still can access google, fb etc.

i have put the script u gave for firewal into right path but its not working. may be script file for afwall should have any extension? as i read in guide of afwall they have extension of .sh ? and 920 text editor does not have unix/osx format, it has windows, unix/android, Macintosh? which one should i use?

do i only have to put that script in afwall folder and thats it?

and i was reading where optimum has told about his transfering 2 files from afwall into system, but i didnt do it yet coz i dont know which 2 files to move? n after moving which settings in afwall i should select for binary? system or built-in?

---------- Post added at 05:57 AM ---------- Previous post was at 05:08 AM ----------

what is "nobody" in network log? its using my internet?
[Security Discussion] optimumpro:
If you re-read my post, you will see I was talking about 2 files iptables and iptables6 located in /system/bin/. They have to be replaced with afwall's corresponding files.
[Security Discussion] Mr.LOVER:
[MENTION=4703661]unclefab[/MENTION]
[MENTION=5075064]optimumpro[/MENTION]

i just downgraded to 4.1.1.

on note 2 n7100 android 4.1.1, i don't have system/etc/resolv.config file.

but i have system/etc/dhcpd/dhcpd-hooks/20-dns.conf

now what do i do? where do i put opendns ips in 20-dns.conf file??
[Security Discussion] unclefab:
Edit your 20-dns.conf file to look like this (look for where I put "setprop dhcp.wlan0.dns1 208.67.222.222" and " setprop dhcp.wlan0.dns2 208.67.220.220"), and save it as unix/android in 920 Text Editor:

# Set net.<iface>.dnsN properties that contain the

# DNS server addresses given by the DHCP server.

if [[ $interface == p2p* ]]

then

intf=p2p

else

intf=$interface

fi

set_dns_props()

{

case "${new_domain_name_servers}" in

"") return 0;;

esac

count=1

for i in 1 2 3 4; do

setprop dhcp.${intf}.dns${i} ""

done

count=1

for dnsaddr in ${new_domain_name_servers}; do

setprop dhcp.${intf}.dns${count} ${dnsaddr}

count=$(($count + 1))

done

setprop dhcp.wlan0.dns1 208.67.222.222

setprop dhcp.wlan0.dns2 208.67.220.220

}

unset_dns_props()

{

for i in 1 2 3 4; do

setprop dhcp.${intf}.dns${i} ""

done

setprop dhcp.${interface}.domain ""

}

case "${reason}" in

BOUND|INFORM|REBIND|REBOOT|RENEW|TIMEOUT) set_dns_props;;

EXPIRE|FAIL|IPV4LL|RELEASE|STOP) unset_dns_props;;

esac

To completely disable all access to google you ll have to use the host file I put in OP on top of the firewall script, but bear in mind hat it will disable ALL google services, including youtube, blogger, google search etc.

I m not sure whether it s possible to fine tune the host file and the firewall script in order to be able to access only some google services, try and if you manage thanks for letting us know (as for me I didn t bother, I don t have time for that at the moment and I anyway don t care about google stuff, be it youtube, search or whatever "enhanced user experience").

Good luck!;)
[Security Discussion] Mr.LOVER:
something is wrong bro, when i put wlan0 in your lines i lose my internet, and when i put rmnet0 it does nothing.

and in both above cases, apps still request DNS to 8.8.8.8 :(

are you sure i have to put wlan0 for my 3g internet? i see in network log rmnet0 as my interface in all 3g traffic?

---------- Post added at 03:37 PM ---------- Previous post was at 03:17 PM ----------

@unclefab
[MENTION=5075064]optimumpro[/MENTION]

i only came on 4.1. to just be able to set dns static, and i don't need any app for that. but otherwise i could have all the things on 4.4.4 omni too.

please help me, may be something is wrong in your scripts? a small Dot missing somewhere or a small Dot is extra in them?

i totally copied your scripts from opening post and paste them directly in 920 text editor and saved as adviced. firewall works very well, it blocks kernel without moving iptables files from afwall to system in 4.1 . but i don't get internet when i put wlan0 in script, and sometime i get internet but still apps are using 8.8.8.8 or 8.8.4.4 as dns in network log.
[Security Discussion] optimumpro:
To change dns while on 3g is tricky, because you are on your provider's proxy. For the same reason, adaway may not work on 3g. Try to edit your access point and clear proxy field. Save, reboot and see if that fixes the problem. Also, on kitkat, you should be able to set dns per wlan access point by going to wifi, long pressing your access point, ticking advanced options, changing from dhcp to static and inputting your server choice. Save and reboot.
[Security Discussion] Mr.LOVER:
i always use 3g. i have 24mbps 3g connection which gives me 2.4MBps download speed on mobile n on pc when i use tethering usb/wifi.

so i never use wifi on my mobile.

my mobile network APN does not have proxy settings in it, its blank. i dont know if mobile network company has transparent proxy or not.

but i want to change dns for 3g connection. not for wifi

can u please tell me how can i achieve that on android 4.1.2 without using any app like dns changer or forwarder etc?

thanks in advance

sTiLL tYpiNg...
[Security Discussion] unclefab:
[MENTION=4930305]Mr.LOVER[/MENTION]

When there's "wlan" somewhere it obviously is for the wifi.:p

Anyway, open your terminal app and type:

su

getprop

Then, see what the output for net.dns1, net.dns2, net.ppp0.dns1 and net.ppp0.dns2 is.

If it shows the google dns here you are!

To correct it you can either edit your build prop and add the following lines (the values are for open dns, change them if you wish to connect to another dns):

net.dns1=208.67.222.222

net.dns2=208.67.220.220

net.ppp0.dns1=208.67.222.222

net.ppp0.dns2=208.67.220.220

or, make a init.d script using the setprop command, more or less like:

#!/system/bin/sh

/system/bin/setprop net.dns1 whateverfirstdnsyoulike

/system/bin/setprop net.dns2 whateverseconddnsyoulike

etc...

If the problem persists then it comes from some of your installed apps, and/or some jars in the framework folder and/or some stock apps (I talk about it in OP).

What are those apps connecting to google's dns?

Do you know how to decompile and recompile apps?

Cuz you will have to decompile/recompile the incriminated apps and look for lines in the smalis pointing to a google website or to google's dns.

If all the above sounds like too much work try this app (I does what the init.d script or the build.prop edit do, but you have to redo it everytime your IP changes and everytime you reboot) :

https://f-droid.org/repository/browse/?fdfilter=change+dns&fdid=be.brunoparmentier.dnssetter

Good luck!!:)
[Security Discussion] optimumpro:
I think you need a script that inludes rmnet commands to change dns on mobile data and still it may not work because regardless of your having or not having settings for proxy, you still go through your provider's proxy. The only app I know worked for my Sony Xperia Ion running jb 4.1.2 on tmobile usa was set dns pro. But then I got Xperia z1 and the only custom rom that has working camera is kitkat; and on kitkat, there is no way to change dns on mobile data unless you make changes in core/framework/base and recompile the rom. Don't trust any google play app that claims to successfully change dns on kitkat 3g. They don't work on mobile data.

So, if you are on jb 4.1.2, you may try to decompile set dns app and see what commands are used there, but you may not find the place if it is hidden in binaries.
[Security Discussion] Mr.LOVER:
hey bro [MENTION=4703661]unclefab[/MENTION] & [MENTION=5075064]optimumpro[/MENTION] thank you for taking time to answer my questions,

i will use your given commands tonight on my galaxy note 2 n7100 and on my LG optimus 4x hd p880 both. and i will give you feed back tomorrow.

secondly, i don't know how to decompile/recompile the apps, but i can learn it if you have some good guide for it? i have a coding background and may be learn it quickly. but an app having google dns set into it can only work for itself, and will not also force other apps to use google dns, am i right? and if this is the case then i would like to learn that thing :P

but that init.d script will do for all the apps which does not have any individual settings for dns, right? and i will not have to run the script everytime my ip is changed? or i always have to do that when ip changed?

and lastly, is this in the control of a rom developer if he want dns to set for any dns services? and all other stuff you wrote in OP ?

coz if it's true then i might learn android, rom development, or may be request some other devs to create a fully secure rom?

or may be you can create a flashable recovery zip with all those things ? (don't be mad if it's not possible, as i'm not very knowledgable in what can be done and what not)

it's very tiring job for me now, as a newbie in these things, to continue testing on my daily useable devices, i also have to use them as my phone :) (thats the reason i'm not replying fast coz i need to use my device too, and in the nights i do testings when i'm not tired lol)

i also blocked the usage of my wife's O4x p880, for testing purposes lol :D (you know, you are not the only one extreme in security and privacy, i also have same desires, not to give out any of my info to anyone without my own permission).

and thanks once again for your replies to my noob questions.
[Security Discussion] unclefab:
There are a zillion guides, here are some:

https://duckduckgo.com/html/

An third part app doesn t normally have enough privileges to force other apps to use any dns, but it depends from the app cuz some, like dns changer, can (not to mention malware/spyware).

The init.d script may work, although it s better to edit your build.prop (but check if it works) cuz you are not dependant on the moody init.d.

In any case, once it works it works, but if you do it through init.d you have to check after each boot that the init isn t deactivated (it happens sometimes).

Yeah, kind of, but it depends if the rom is open source or not.

If it s open source then you can edit directly in the source code and then compile, as optimumpro told you yesterday.

If it s not open source you ll have to edit the smalis and try to guess what is what by reverse engineering them into java form.

Nope, it s too device dependant.

A few tweaks could be made as a zip though, but still, it s better people to understand what they do and learn how to install manualy, instead of blindly flashing this or that zip without having the smallest clue about what it does, and then come to complain because they botched their device.

MR Lover, I send you a MP...
[Security Discussion] Mr.LOVER:
xposed for lollypop is available now :)
[Security Discussion] silentvisitor:
XPrivacy too :)
[Security Discussion] KNIGHT97:
Why buy a phone in this case :eek:
[Security Discussion] mohit141785:
Best solution. Buy a Nokia 1100.no more privacy concerns.
[Security Discussion] Primokorn:
ty for this constructive feedback :eek:
[Security Discussion] mohit141785:
Sorry if you feel offended . That wasn't my intention

Just wanted to lighten the mood a bit

Anyway cheers and all the best of luck on your quest of finding perfect annyonimity in this age of all pervading surveillance.

And yeah

Bring out the tin foil hats

Big brother is watching[emoji23] [emoji23] [emoji23]