yashsingh1/xdaforums huggingface dataset:
[Security Discussion] niubboxp:
i'm pretty noob, what does it change if i set afwall as administrator?

if i turn on the phone with no mobile data/wifi can i avoid the script?

there is a way (some kind of pop up) to know when the afwall is disabled?
[Security Discussion] optimumpro:
Nothing is misleading about Afwall. You can read about all this at its gihub site. It is just that init.d indeed runs later. If init.qcom.rc does not exist, then the entry can be put into another init file. You don't need to compile the entire rom, just the kernel, because all init files are in your ram disk which is in kernel. On some older phones, you can go inside your ramdisk and make changes there, but on newer phones, it is not possible. In the latter case, you would need your rom sources and build environment setup and you need to put the changes in your device tree where your init files are. You can't do it on the phone itself, because those files are recreated on boot. You also need to know where exactly to put the entries: they should go before your wifi supplicant or radio data runs.

If afwall is device administrator, it is more difficult to disable it, that's all. If you turn off data and wifi and even turn on the airplane mode, there is no guarantee that the same won't run on boot, as the airplane mode would kick in also later.

---------- Post added at 01:00 PM ---------- Previous post was at 12:25 PM ----------

Here is an excerpt of my entries in init.qucom.rc:

++++++++++++++++++++++++++++++++++++++++++++++++++++

on early-boot

# set RLIMIT_MEMLOCK to 64MB

setrlimit 8 67108864 67108864

write /sys/kernel/boot_adsp/boot 1

# Deny all internet services

exec /system/bin/sh /system/etc/crashdod.sh

# Run pre_hw_config.sh before entering charge only mode.

exec /system/bin/sh /system/etc/pre_hw_config.sh

exec /system/bin/sh /system/etc/init.qcom.wifi.sh

++++++++++++++++++++++++++++++++++++++++++++++++

See, my script crashdod.sh runs before hardware on script runs and before wifi script...
[Security Discussion] niubboxp:
With afwall enabled allowing only firefox after a while i see some system services sending 60byte each to google, what do you think they r sending? Just some kind of ping or something else?
[Security Discussion] optimumpro:
Read this thread: in Afwall, you have to enable builtin iptables in Settings/binaries/Iptables Binary. Then no system app will be sending anything if you restrict it...
[Security Discussion] niubboxp:
thanks, and what about the script on first page? is better to apply or with "buildin iptable" i solve my problem?
[Security Discussion] optimumpro:
My script has one purpose - to prevent internet access before the Afwall has a chance to run. You are using userinit.sh, which still comes in later on after system apps are running. The real solution is to put the execute command into your ramdisk. However, it is still better than nothing.

Builtin iptables are separate from this script and should be used anyway, because standard iptables allow "essential" Google services to talk to "home." If you enable internal iptables, that "talk" is cut off.

Other scripts: you can put there whatever you want, Google or else... You should also use Adaway (F-droid) which could supplement the afwall in that it can prevent apps that are allowed in Afwall (such as firefox) from connecting to some bad sites...
[Security Discussion] niubboxp:
usually i dont activate data when i turn on the devices, so afwall should be on before data is up, but i will turning on data connection a bit later for be safe

could u pls tell me in #others and #turla what ip are and why we should deny them?

pls tell me more about adaway and firefox, i was supposing adaway was just something like adblock plus/ublock origin, i've installed ublock as extension inside firefox, do u think is enough or adaway do something more? and if it does is better use him deleting ublock or they work together?

thanks for the answers!!!
[Security Discussion] optimumpro:
It doesn't matter whether you activate data/wifi or not, because on boot system has access to both before your settings set in. One can see it clearly in a debug log.

Adaway works for all apps. Adblock/Ublock -- only for the browser they are installed on. I don't need adblock/ublock, because adaway already does the job.
[Security Discussion] niubboxp:
so that's why i should use the script in the first post...

now the problem is i wanna access to google site when i'm browsing what can i do for deny it just on booting phase?

Edit: i see in network log usually kernel and root receive and send packets to 10.x.x.x classes when on mobile data, something are dns and something are other kind of packets is it normal right?

I also noticed kernel receiving packs from some website i visit, just few website not all, but do send nothing this is ok too?
[Security Discussion] optimumpro:
That's why the only solution is to have a script execute on early boot when the command execute is put into your init.rc. You need to have unlocked bootloader for this, but you can still have it on a stock based kernel (the one that you can have sources, be able to change them and compile that kernel yourself).

You shouldn't have any kernel traffic if you use Afwall with builtin iptables enabled...
[Security Discussion] niubboxp:
i dont really know how to write (and what write inside) and execute the script, my bootloader is unlocked i'm currently running CM, there is any way for a "normal" user to do something about that?

i have enablet buildin iptables, but i have kernel traffic, and not only him :/

i dont really know what should i do, i'm considering to change platform, but it seems others platform have the same security/privacy issue
[Security Discussion] optimumpro:
Changing platform? On all other platforms you can't do anything about the issues...

Afwall has white list and black list. Use default white list meaning only checked apps can connect to the internet. You should only allow access to your browser, e-mail client and chat. So, any traffic you have will be associated with those apps. Read and learn...
[Security Discussion] niubboxp:
I ve already done it, but seems system apps dont care about afwall, i also tryed a pure aosp rom and is the same, phone app, setting app, sending packets to google

edit:i've also tryed to make a host file with the adress i see in the network log, and with firefox i cant access, but these services doesent care and keep sending and receive packets

i'm thinking its a code problem i cant solve without modifying it, and i'm not able to do that
[Security Discussion] talkcc144:
Sounds good, but as a noob, how do I use a script for this added security you are referring to ?

Thanks
[Security Discussion] Sidebandit:
Works on opera mini 7.6.4 including Google analytics db's. Haven't tried with the new ui version as it has more permissions, no likey. So anything webview ???
[Security Discussion] optimumpro:
Instead of looking at your network log, you should enable logging in Afwall and then see which packets are denied. The firewall won't prevent an app from attempting to connect, instead, it will deny such an attempt, so, your non-firewall log will still show the attempt, but the afwall log will show that as denied.
[Security Discussion] optimumpro:
Also, your phone app is connecting because you have phone # lookup enabled by default. If you disable that, then you won't have any traffic at all.
[Security Discussion] mrrocketdog:
ok unticked "forward" , "people" & "reverse" lookup.:thumbup:

thank you [MENTION=5075064]optimumpro[/MENTION].

"err on the side of kindness"
[Security Discussion] niubboxp:
but if i disable the root i cant use the firewall
[Security Discussion] optimumpro:
Why do you need to disable the root at all?
[Security Discussion] niubboxp:
how can i disable the # w/o disable the root?
[Security Discussion] optimumpro:
I am not getting you at all. You don't need to disable root to turn off phone number lookup in phone.apk. Just go to dialer/settings/phone number lookup and untick forward/people/reverse lookup...
[Security Discussion] HeathenMan:
Now checkout

found those mail providers which provide encryption outside the 14-eyes

protonmail.com

ghostmail.com

im personally stuck on inbox.lv, no encryption but privacy aware

for vpn (cheapest first) , paid ones outside the 14th as always preferred

lantern (p2p vpn) - free

shadowsocks (socks5 proxy) - free

trust.zone - 7$/m

nordvpn.com (doublevpn! torvpn) - 8$/m

ivpn.net - 15$/m

perfect-privacy.com - 17$/m

u know dnscrypt.

For twitter: firetweet.io

Firefox addons:

Dolus

Google privacy

Noscript

Notrace

Blur (maskme)

Blender

Blend in

Skyzip

Random useragent spoofer

Smart referer

Csfire

decentraleyes

secret agent

Bundle them with CLEO or FEBE to one single .xpi

if you are using metasearch engines, u surely love searx. my personal favorite was unbubble.eu, for a long time but its closed source so here are the searx engines from official github list that are located in 'safer' countries:

first, the one with most available engines = searx.oe5tpo.com - austria

searx.potato.hu - hungary

iguana.cubeclan.ch - switzerland

search.jpope.org - turkey

an easy way to add them (for example in mobile firefox) = http://ready.to/search/en/
[Security Discussion] iwanttoknow:
Hello,

Sorry if my question is stupid :

Are there for Android versions without transmitting information to Google or its partners, or is it an utopia ?

When reading all the posts in this Tuto, I understood that Android kernel could contain "calls" to Google or its partners. I thing that it's complicated to filter all the IP addresses with an HOSTS file, and also difficult to maintain it up to date.

Also I understood that even with a firewall like AFWall+, it could be insufficient.

I will be very happy to have your advice.

:)
[Security Discussion] mrrocketdog:
well , this is not really a specific answer but as i was told ; "if your on android then youre in bed with google".

BUT the OP has some very good ideas for what you can do.

"err on the side of kindness"
[Security Discussion] optimumpro:
I am yet to see anyone providing any reference to Google or "partners" calls in kernel sources. There are some references in Android source, but not in kernel.

Generally speaking, if you uninstall Google Services Framework and Gapps, you are OK. There are some things in baseband that setup routs through DOD servers, but it could be dealt with on early boot. My roms, for example, execute a script that completely disables the internet on boot until Afwall starts, which means no Afwall - no internet. This also includes a scenario where Afwall crashes for some reason, which would again result in no internet...
[Security Discussion] iwanttoknow:
Hi optimumpro,

Sorry for my lated answer.

You wrote that if I uninstall Google Services Framework and Gapps, I am OK.

If I do that, will be my device unstable ?

Also, I don't understand what you explained about baseband.

Thanks.
[Security Discussion] silentvisitor:
[MENTION=5075064]optimumpro[/MENTION]

Can you share the script?

Thanks !
[Security Discussion] optimumpro:
I did it months ago in this very same thread: http://xdaforums.com/showpost.php?p=65026893&postcount=294

---------- Post added at 03:03 PM ---------- Previous post was at 02:59 PM ----------

Your device will be more stable, BUT you won't have google services at all: all of them including Google Play...
[Security Discussion] silentvisitor:
[MENTION=5075064]optimumpro[/MENTION]

Thanks for sharing !

[MENTION=7545844]iwanttoknow[/MENTION]

You cam use MicroG instead of Google Services Framework. Search on XDA.
[Security Discussion] sotoLOTO-:
[MENTION=4703661]unclefab[/MENTION] - totally subscribed. I see we speak the same language. Privacy is basically being tyrannically raped, as Darlene put it! You idea is great and I see no reason why ppl so willingly trust those big companies out there and simply give away their data and privacy for nothing.
[Security Discussion] sotoLOTO-:
heheee, those lads at Google. Only Privacy Inspector is on the Play Store and Privacy Inspector is, as the app description says, the lite version of Privacy Blocker. Google surely knows know what to remove from the $hit Store Luckily there are alternatives ... thank God! The monopoly Google are exercising over ... nearly all of us is a $hit show.
[Security Discussion] sotoLOTO-:
Hm, has anyone else had problems with 'Privacy Blocker' and 'Permissions Denied Pro'? Not sure which one of these 2 apps it is, but after I installed the 2 of them my phone went a bit crazy. First apps such as TiBu were no longer granted root access and just kept hanging on a screen waiting for root access, never receiving it. Then also Nova Launcher got messed up, slow as hell and started also hanging. AFWall+ started crashing again and again, no matter how many times I rebooted. Nova Launcher wouldn't respond any longer to a double-tap-to-sleep/wake. All kinds of weird stuff. So I switched to the default home launcher and remedied the situation by uninstalling both apps and reinstalling (for now only) Nova. Either Privacy Blocker or Permissions Denied caused some havoc. I didn't tweak much in those apps. In P. Blocker I just scanned all my apps and performed a fix on 1 camera app, nothing else. In Permissions Denied I tweaked another 3rd party app ... I think it was an SMS reminder, but nothing related to SuperSU or TiBu or Nova Launcher. Very mysterious. Has anyone else had issues with those two apps and can they actually be trusted? What I have is 'Privacy Blocker v1.4.1' and 'Permissions-donate-v3,7-build32'. Share your experience pls.
[Security Discussion] Primokorn:
Uninstall these apps and install XPrivacy. Remove SuperSU and install Phh's Superuser. You won't have any issues with them if you do things right.
[Security Discussion] sotoLOTO-:
Thanks for the reply! To install XPrivacy I think one needs to have the Xposed Framework on board, which I don't have. So for now an uninstall and staying away form those apps will do it.

How is Phh's Superuser superior to SuperSU. Just curious. Thought SuperSU is THE one!
[Security Discussion] Primokorn:
Yes you need the power of Xposed but it's worth it.

Phh's Superuser is open source and not owned by an obscur company.
[Security Discussion] sotoLOTO-:
Erm, just to clarify ... do both Privacy Blocker nor Permissions Denied require Xposed or just one of them and which one in that case? In the OP there were also other nice-looking privacy apps that I wanted to try out but I'm guessing they too require Xposed.
[Security Discussion] Primokorn:
I never used these apps but it seems Permissions Denied doesn't require Xposed. No idea for Privacy Blocker since I can't find it on Google Play.

Note that Permissions Denied hasn't been updated since June, 2013... Moreover, managing the permissions is not enough since apps can have access without asking for permission. I guess you don't have a real-time control, and so on... Better than nothing, though.

Read the Play Store descriptions. I think Xposed is always mentioned if it's a requirement.
[Security Discussion] sotoLOTO-:
Thank you for the reply, but that's sad :( better than nothing yes, you are right, but what good is Permissions Denied if 'apps can have access without asking for permission'. If that's really the case then I don't see how Permissions Denied helps in any way, anyone is welcome to correct me. Just trying to get to the bottom of this.

As to your guess if I have a real-time control ... as far as I dug into it, I came to some apps similar to Perm. Denied. Any other apps or ways to have the real-time control you mention are welcome to be thrown in to this discussion.
[Security Discussion] Primokorn:
A real-time control is very important:

1. You install a crappy app

2. A few seconds after the installation, it will immediately have a look at your contacts. You don't have enough time to open Permissions Denied to block the access. Too late...

I don't know any other apps as XPrivacy to have a real-time control, sorry.

About permissions:

• Android system permissions are completely useless. I did a quick test with two apps promoted on Google Play: New Airpush detector and Material Apps. Android system permissions didn't ask me anything when browsing into the apps! (that's normal for New Airpush detector though. Android system permissions don't manage Internet permissions :D and the app is only requesting "a full network access" and "to view network connections").

• However I noticed that AirPush Detector had access to these data: Identification / Internet / IPC / Phone / Shell / System (get installed package) / View.

This is more than Internet permissions, isn't it? ;)
[Security Discussion] sotoLOTO-:
Point taken! Thanks for dropping some knowledge. For ppl who don't have Xposed framework is there even any point in using Permissions Denied, if as you said 'apps can have access without asking for permission'? If not 'Permissions Denied' what else (non-Xposed) can we use then, if anything at all?
[Security Discussion] Primokorn:
Permissions Denied can help in some situations. Most of reliable apps are asking permissions when they really need them. If I were you I would open Permissions Denied before opening a new installed/updated app. Of course, it will be more difficult to have a full control with apps that do not respect user privacy...

I always use Xposed so I have no idea for other solutions and I guess you do need Xposed for having such a feature. Others may have more ideas.
[Security Discussion] sotoLOTO-:
Thanks! Just a quick note about Privacy Blocker. As far as I researched I didn't see anywhere that it requires Xposed. So if that's really the case then it is really mysterious why either one of the 2 apps P.Denied or P.Blocker messed up my phone a bit.

And back to the topic. Yes, you're prolly right. Actually after installing an app and before opening it and giving it root access (for apps that need that) indeed it makes sense to quickly tweak the app's permissions in P.Denied, but as you said time might not be enough and it's strange that the app was last update in 2013. Thanks anyway for your good input in this discussion.

EDITED
[Security Discussion] sotoLOTO-:
Something got me back to this post of yours. SuperSU is from Chainfire. I thought Chainfire is a highly respected and trusted dev here on XDA. How come an app he develops is owned by an obscure company?
[Security Discussion] Primokorn:
Read the news, with one year late ;)

http://www.xda-developers.com/chainfire-makes-important-announcement-about-supersus-future/

http://xdaforums.com/apps/supersu/supersu-ccmt-clarifying-privacy-t3454147
[Security Discussion] sotoLOTO-:
Ahhh I see. :) Thanks for the update! If that's the case then can't we just use the last stable version/release which is presumably right before CCMT got involved? This will be similar to using uTorrent's v2.2.1 ... I guess ppl will have to find out which version it was and just stick to it. Ofc there's the alternative of using phh's SuperUser, which is being actively developed, but I just know some apps want SuperSU and am not sure if they'll be happy with phh's SuperUser.
[Security Discussion] Primokorn:
The last version built by Chainfire is v2.78, available in the XDA thread.

Anyway, using Phh's Superuser seems a better idea:

• Open source (unlike the last version of Chainfire's SuperSU)

• Magisk (also open source) is mainly supporting Phh's superuser.

• You will need the next root solutions to bypass the new Android (security) features

• We more and more have to hide root to have working features/apps. Chanfire's suhide is also closed source.

• You have notifications from Google Play to update SuperSU app.

• It just works! Use the "full unroot" option from SuperSU app, reboot and flash Phh's superuser to try yourself. (don't forget the nandroid backup of course :))
[Security Discussion] sotoLOTO-:
Are you sure v2.78 is the last one by him? He says it himself here that 'v2.78 is indeed released today by CCMT. I have not built it myself yet. ' - http://xdaforums.com/showpost.php?p=68474748&postcount=11415 That post is from 1 sep this year and I'm sure I got the Play Store update to v2.78 a lot earlier ... maybe a few months back and I did install it. I just read that the latest stable release actually maintained by Chainfire is 2.76
[Security Discussion] Primokorn:
AFAIR v2.78 is the last version with which Chainfire had the source code. He compiled SuperSU on his side and the file has the same as CCMT's one, byte per byte. That's why you can download it on his website.
[Security Discussion] sotoLOTO-:
10x for your tips. Highly appreciate them. Just gotta ask this. Ermm .. full unroot you say, eh? Shouldn't I go for the option under SuperSU's settings called 'Switch superuser app'? Full unroot sounds slightly daunting ...
[Security Discussion] Primokorn:
Trust me. I did it several times ;)

'Switch Superuser

app

' may leave SuperSU stuff (binary, scripts...) in the system partition. I never tried this option but I don't like the description. In other words, the SuperSU

app

is one thing (manage root permissions) but there are several files in the system partition to gain root access.

'Full unroot' completely removes SuperSU and that's what we need before installing a new root solution. It's also the solution suggested in the phh's SuperUser thread.
[Security Discussion] sotoLOTO-:
Thanks for the reply! Does that then mean I have to re-root my phone after I do a full unroot in SuperSU? And how about apps said to work ONLY with Chainfire's SuperSU, such as his Pry-Fi app? Are there any issues with them using phh's S.U.?
[Security Discussion] Primokorn:
Yep, flashing Phh's Superuser will bring root back (+ installation of Superuser apk).

I have no idea of Pry-Fi. If it doesn't work, don't hesitate to post a bug report on Phh's Superuser thread. Anyway, it's never a good thing to use softwares (of companies) that force us to use their own solutions :p
[Security Discussion] sotoLOTO-:
I see!

And here's what is says in the official SuperSU app:

NOTICE: A SPECIAL PROCEDURE IS NEEDED FOR UNINSTALLATION. IF YOU DO NOT LIKE THE APP, DO *NOT* JUST UNINSTALL IT, YOU *WILL* LOSE ROOT.

Superuser access management runs through a so called "su binary". There can be only one of these at a time. So if you install SuperSU, your previous superuser access management solution will no longer operate. So if you want to switch back: (1) Open that application, and search for an option for it to install/update/replace the "su binary". (2) Confirm root-using apps are using the superuser solution you want. (3) Uninstall SuperSU.

---------- Post added at 10:34 AM ---------- Previous post was at 10:23 AM ----------

Oh ... and as to the rom, I'm on Lollipop but might be switching to MM soon. Does phh's SU work on both of em?
[Security Discussion] Primokorn:
No issue with MM (I'm on 6.0.1) and it also works on N. No idea for LP but you should find feedbacks in the official thread.
[Security Discussion] sotoLOTO-:
Nowadays VPN is a must, but which one to use is another discussion. Then again, can we be sure your VPN provider won't resell your data to the highest bidder out there ... I wonder!
[Security Discussion] Primokorn:
No, we can't but I'm sure my ISP sends personal data to my government :D

My main issue with VPNs is battery drain!
[Security Discussion] sotoLOTO-:
Precisely. So with ISPs we are 100% sure info is being forwarded to whoever wants it whereas with VPNs there's a chance this happens but no one knows how big this chance is. Matter of luck I guess. In the end of the day money will seduce any and all VPN providers and with enough dough they'll leak your data to whatever rich entity desires it.
[Security Discussion] sotoLOTO-:
Hm ... searching for Express here https://thatoneprivacysite.net/vpn-comparison-chart/ reveals that it is not that great after all. That's ofc if the source can be trusted.
[Security Discussion] Darkcommand:
sea droping

Im crying i want to do those things but dont understand 99℅ of the stuff here scripting etc . Any siple guide ?
[Security Discussion] user2k10:
Deleted