yashsingh1/xdaforums huggingface dataset:
[Security Discussion] unclefab:
Here we are, I saw it coming...

So if I folowed you well you are qualified enough to judge what is right and what is wrong?

Or is just another cm fanboy's reply?

Or maybe it's because you asked your security thread to be closed, thread that i read and where I saw that your expertise is even less than mine (note that I never claimed to be this or that, and I said a few times that "I'm no dev")?

You say that I'm disrespectful, but what about a guy like you that comes here and slashes over 60 pages of free advices he seems to have not much clue about?

My theories on all devs i mentionned in OP?

Which ones?

The ones I mentionned are the ones developping privacy oriented apps and as far as I remember I didn't say anything bad about him.

Then cm, yes, I do dislike their boss, and I'm not the only one, and I think it's my right. Have a look at the google analytics in cm's roms and the abusive stock apps' perms just like in any stock rom, see what they have done to oneplus one, but hey, it's up to you.

Anyway, this thread is not about fanboyism, this thread is about security and so far many more advices on that matter have been given than in your whole security thread where you basically mentionned 2-3 apps and 2-3 web services.

I don't need to report anything to the mods, I'm not the kind of guy whinning to them when somebody writes something I disagree with in my thread, unlike you.

I was expecting to get replies like yours, and I saw yours coming from the first post where you asked me about my pedigree.

You know what?

Since you seem to know what you are talking about I'd like you to point me at mistakes or incoherences in the scripts I gave, the apps I said were safe to delete, my Xprivacy settings, my App Settings' restrictions, the way I deal with the baseband, and so on.

If people follow the advices given here their phone will be much safer, and if you disagree then please prove me wrong.

What I mean is, be constructive instead of attacking me about a few lines buried in over 60 pages because those lines hurt your beloved cm, like the other guy last page.

You know another thing?

If you don't trust a guy that tells you how to fix your car on your own and don't try to understand and experiment on your own, but rather go to another guy that does it for you, and learn nothing in the process, that's your choice. But that shows that you are not qualified to talk about the whole process, as simple as that.

As I said, if you like somebody to do it for you go for it, but as for me I do it on my own.

Symbian?

You know when I got my first mobile phone?

That was three years ago, and it was running Android.

My first computer?

Last year.

Before that I used to completely boycot those things, cuz since the very early days of internet back in the 90'ies I saw what threat it was on people's privacy.

That last sentence is part of my pedigree, I hope you enjoyed it:silly:
[Security Discussion] sancho_panzer:
FYI I never reported anyone or any thread, not a single time. One more of your theories...

Do I need to say more?

They still do, obviously and with a reason. As for my thread it was about conscious privacy, not about conspiracy geeks living on their cocoons...

End of talk, nothing interesting to see here. Thank you for your efforts.

Have a nice new year.
[Security Discussion] unclefab:
What about this?:cyclops:

I found it in this thread, and I thought you were OP, sorry if I have been wrong;

http://xdaforums.com/general/security/security-android-security-conscious-mind-t2835412/page26

Little boy, I have travelled to about 100 countries overland (some of which you don't even know they exist), I can read 4 alphabets and some chinese caracters, I speak fluently 6 languages, plus 2 more half fluently, and I have some notions in 3 more tongues.

That's, again, part of my pedigree, so long for a geek living in his cocoon.

Guys like you are funny, you attack on a little single point you disagree with, but you don't answer questions and you have nothing to really add to the debate.

Anyway, too bad to see you leaving, we will miss you and your unmatched expertise.

It's a pity though, you could have been, and have already been, a great contribution to this thread.

Happy new year?

In which calendar?

Not in mine:silly:
[Security Discussion] iunlock:
Will do... :good:

Update: DONE! Here you guys go...
[Security Discussion] Creekone:
Best read in a long time. Thanks for a lot of intresting tips.
[Security Discussion] unclefab:
Nice to see that you found this thread useful:)!

I've updated OP, it's in post #3.;)
[Security Discussion] Temetka:
Minus some drama, there is legit security advice in this thread.
[Security Discussion] Creekone:
I'm subscribed to this thread. I'm experimenting with my new L system to see what to remove. I'm also looking at source code to cm12 to see what I need to build to get it working...
[Security Discussion] iunlock:
AppLock App?

Anyone using AppLock?

If so, how do you like and is there something better?

Thanks!
[Security Discussion] Tjee:
Wouldn't you be better off just encrypting your phone?
[Security Discussion] optimumpro:
"About one year ago I found out that my kernel was connecting to some google related IPs and to google's DNS (eventhough I had set the phone to use Open DNS in the resolv.conf file, eventhough I had removed over 150 system apps and eventhough I was already using AF+Firewall, App Settings and Xprivacy), and that my android system was calling home (read "at google's central office in Mountain View, California") everytime I connected (note that my phone had never been linked to any google account whatsoever)."

Excellent thread. By the way, have you found a way to prevent kernel from phoning home despite firewall and all scripts?

---------- Post added at 02:01 PM ---------- Previous post was at 01:58 PM ----------

Encrypting your phone has nothing to do with this discussion. Encryption only protects you when your phone is off (how often does that happen). Once your phone is on, it is open to outside attacks the same way as an unencrypted phone. And by the way, thanks to Google (again), encryption is only available for Data partition and SDcard. Your system partition (unlike in Linux) remains unencrypted.

---------- Post added at 02:19 PM ---------- Previous post was at 02:01 PM ----------

Well, you have just been attacked by someone who I call "google thug." They don't like the fact that you question something that they (or their friends) do and they attack the messenger. The key to his diabribe was the sentence where he said you critisized custom roms. In my view, most custom roms are much worse than stock in terms of privacy, because at least we know all about stock, but custom roms have an aura of being privacy oriented, which they are not. As far as I know, only Omniroms have no Google analytics. They also have no Cyanogen's infamous theme engine, because it is proprietary. All others do. Interestingly, there was a question on Slimroms forum whether they have Google analytics, and the answer was: if you don't have GAPPS, you are OK, however, there may be Google analytics in system apps...

Anyway, keep up the good work.
[Security Discussion] unclefab:
[MENTION=5075064]optimumpro[/MENTION]

Yep, some addresses can be blocked by restricting their IP with the firewall, and the others are blocked by restricting their host name in the /system/etc/host file.

Check OP (chapter II, section seven and eight), if you follow what's written there your phone won't connect to any unwanted addresses (you can check your connections with Network Log app).

Yeah, fanboys...

Their opinion doesn't really matter, they are only followers and most of them can't make much android wise, apart from flashing other people's ROMs, mods, tweaks and kernels.

Then, the fact that they feel they have to defend this or that dev or this or that ROM is well documented in psychology, it's called identification:

https://en.wikipedia.org/wiki/Identification_(psychology)

I agree.

CM ROMs do have google analytics, that's why a guy on the forum developped freecyngn. If anyone is interested it's here:

http://xdaforums.com/showthread.php?t=2550769

Thanks mate!;)
[Security Discussion] optimumpro:
Well, we have developers, but secuity experts? I doubt it, and by the way, most developers have privacy issues on their back burner, if at all. In addition, most of them get some dough from Google, so, naturally, they won't bite the feeding hand, but rather attack those who expose Google.

I use skulone android firewall, which is also open source. Unlike the firewall mentioned in the OP, skulone's firewall has input chains, which is useful. I put most of my additional scripts in the firewall as custom. I also have a number of scripts, (I put them in a custom scripts shutdown section) which disable internet (both wifi and data) if firewall is disabled. If that happens, there is no internet until the phone is rebooted. Here is the script, which I borrowed from here: https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy

You can put the following in a file, which is called by the firewall.

#!/system/bin/sh

IP6TABLES=/system/bin/ip6tables

IPTABLES=/system/bin/iptables

## Block all traffic at boot ##

$IP6TABLES -t nat -F

$IP6TABLES -F

$IP6TABLES -A INPUT -j LOG --log-prefix "Denied bootup IPv6 input: "

$IP6TABLES -A INPUT -j DROP

$IP6TABLES -A OUTPUT -j LOG --log-prefix "Denied bootup IPv6 output: "

$IP6TABLES -A OUTPUT -j DROP

$IPTABLES -N INPUT-firewall

$IPTABLES -A INPUT-firewall -j LOG --log-prefix "Denied bootup IPv4 input: "

$IPTABLES -A INPUT-firewall -j DROP

$IPTABLES -I INPUT -j INPUT-firewall

$IPTABLES -N OUTPUT-firewall

$IPTABLES -A OUTPUT-firewall -j LOG --log-prefix "Denied bootup IPv4 output: "

$IPTABLES -A OUTPUT-firewall -j DROP

$IPTABLES -I OUTPUT -j OUTPUT-firewall
[Security Discussion] user2k10:
Please post more of your custom startup and shutdown scripts.

Thanks
[Security Discussion] Andy1767:
Maps

Why not use OsmAnd for a replacement of GMaps?

Can be found at f-droid.

It can work completely offline.

Maps can be downloaded, then unzipped into the osmand folder.

download.osmand.net/list.php
[Security Discussion] optimumpro:
Interestingly, after much testing, I have found that scunlon firewall cannot prevent kernel from contacting Google and several other servers when your phone is active. Initially, afwall did not work either. Neither did multiple scripts, various entries in hosts file or adaway work. They all were fine blocking regular apps, but not the kernel. Only when I went into afwall settings and chose builtin iptables, as opposed to system ones, I got the result, i.e., the firewall successfully blocked kernel pings and outgoing pockets. Apparently iptables binary used in Android (I have Kitkat) has been altered to allow kernel phoning home. I have set afwall to report dropped packets and it started showing kernel's activities as blocked. Congratulations, Google. You have done it again. By the way, my network monitoring app showed curious webservers belonging to Google and several other "security" companies in the US, UK, Canada and Australia all members of the 5 eyes bunch...

Even when using afwall's builtin iptables, the most that can be done is preventing outgoing kernel activity. The firewall cannot block incoming pings. I am looking at 2 possibilities to go around that: one, try to put firewall's iptables binary in the rom or redirect all scripts to afwall's iptables.

[MENTION=4703661]unclefab[/MENTION] What are your thoughts?
[Security Discussion] optimumpro:
Well, success!

I have replaced Android iptables with those from afwall and now kernel's activites are completely blocked with additional scripts. It all makes sense. Scripts, including those mentioned in the OP, did not block kernel because of altered stock (and CM based) iptables. By the way, the corresponding files (iptables and ip6tables) from afwall are twice as large as Google's iptables. Now, the same scripts do their job with afwall's binaries. What I did was: took afwall's 2 files from root directory of the phone -

/data/data/dev.ukanth.ufirewall/app_bin/ and put them into /system/bin/ with 755 permissions.. I bet now scunlon firewall would work fine too with new iptables...

Edit: as I reported in the previous post, afwall initially blocked only outgoing pings with its own iptables and didn't work against kernel at all with stock iptables.. Why? Because afwall does not have input chains enabled by default, and scripts recommended by the OP did not work, because they were addressing Android deficient iptables. Once I put afwall's iptables in the system, the scripts started working and the result: all input/output packets for kernel are now blocked.

Shame on Google again...
[Security Discussion] mrrocketdog:
thank you (& all contributors) to this thread. am not real tech savvy , but trying to learn. (old guy here. lol) but do have concerns.

:good:

"all i can really do , is stay out of my own way and let the will of heaven be done"
[Security Discussion] optimumpro:
I agree on Android versions, but unfortunately, I have Xperia Z1, It is a good phone, but the lowest functional non stock version available is Kitkat (Jeallybean has problems with camera). The reason I never use stock is because it can't be compiled and I only use roms built by myself. I also trash Selinux from kernel (right now I use Tomoyo instead).

As far as unwanted webservers: I have dolphin browser, because it is the only one that has working adobe flash player. All other times, I have it frozen by Greenify. So, I did an experiment: I started dolphin with blank page and left it for about 20 minutes. Surprise, surprise: I had over 40 sites listed in network monitor; you name it Google, Amazon, Liquidweb and others all without me clicking on any link...

My ping and ping6 files have 000. That, however, does not prevent pings...
[Security Discussion] unclefab:
Yeah, I know that fetid bunch, they have a zillion IPs and they are like Hydra, you cut one IP-head and a new one pops out....

I used to use Dolphin too but I left it due to the same IPs problem, and now I use Atlas and Naked Browser but I don't think they can play flash videos.

Have you tried Pale Moon Browser? It's Firefox based and open source, but I'm not sure whether it supports flash or not since I don't use my phone to watch videos.

Ok thanks, now I know...

Regarding Android's evolution I have to say that I'm a bit worried, KK is full of upleasant stuff, LL is propably the same, and there's more to come.

At one point I will need to get a new phone, so either I purchase an old model running JB and buy myself some time (but in 2-3 years I'll be facing the same problem again) or I get a more recent that is on LL and try to port a JB ROM for it.

I'm currently trying to port a ROM with a different Android version (a 4.1.2 ROM for my device running 4.2.2, for testing purposes) but it fails to boot due to compatibility problems in the kernel, and I can't find any documentation to help me on that matter.

Do you have any link (s) or suggestion (s)?
[Security Discussion] optimumpro:
Only dolphin supports flash on kitkat. I tried palemoon and I didn't like it because I am used to lightweight browsers. Naked browser, as I learned recently, also reports you to amazon and google servers, although the author swore to me that it didn't. But at least, it is manageable, but it is closed source. I am afraid we are left with lightning browser. I only use dolphin for flash.

4.2.2 vs. 4.1.2. The problem is in the firmware blobs and the way they hook into hardware on one side and the OS on the other. If your phone was never intended for 4.1.2, then there are no appropriate blobs for it. And even if you can manage to boot the phone, you won't have radio/wifi/gps etc, even though baseband in of itself mostly stays the same from version to version. It's the blobs stupid...
[Security Discussion] unclefab:
I allways liked Dolphin and its gestures, but about one year ago I found out about all its IP leaks and I decided not to use it anymore.

After your previous message I reinstalled it and to my surprise it behaves, thanks to the Firewall script and thanks to some smali edits I have made to remove web site addresses.

Naked browser does behave too, again thanks to the Firewall;)

But some of the causes for those unwanted connections actually lie within the OS, I found quite a few in the Settings app, the framework.jar and the framework2.jar.

Something else I noticed, and I had risen the issue here but without getting any answer from the "experts", is that all apps (both system/stock and data/downloaded) request id serial number, mcc and mnc (anyone can easily check it with Xprivacy's data usage function).

Then I made a test with an app I compiled myself, same story.

Lastly, I made a hello world app, that has only a few very basic lines of code and certainly no permissions like read phone state or code like getSerial and the like, and to my surprise it required id serial number and mcc/mnc too.

You see what I mean...

One more, yesterday I have installed a chat app I had downloaded from the guardian project website, namely Chat Secure AKA Gibberbot, and you know what?

I found out that it snitches on me to Amazon, and that if I block the IP with the Firewall the app doesn't work anymore. So long for a "secure" chat...

Mmmmh, that's not very encouraging, but thanks for the explanation anyway.

I guess I'll have to dig deep into the blobs story, and find out how they manage to do it on CM or AOSP Roms...
[Security Discussion] optimumpro:
Don't use chatsecure version 14. Older versions, especially when they were gibberbot don't report you. Guardian project received a couple of hundred thousands from Google about 6 months ago, so now the new version offers you a Google account at start. I have no further interest in Guardian. There is a similar app on F-Droid called Conversations: offers you same features plus a choice of PGP. Textsecure, after 1.0.6 version isn't safe either. There is a discussion on XDA and F-Droid about it, I got a lot of garbage from fanboys. Both developments Guardian and Textsecure are now compromised.

Blobs: usually, you are able to work issues when porting a higher OS version, but not vice versa, and again if there are no blobs for lower version, you are out of luck. What cm does is having blobs for both port and base (or new and old OS), try to put in older ones and make corresponding changes in new kernel.
[Security Discussion] Tjee:
Any alternative for textsecure? I like the fact that it encrypts my messages locally
[Security Discussion] optimumpro:
As I have already said, use Textsecure 1.0.6. That one is pure SMS, no Google GCM. Textsecure in of itself is pretty good, however, once the developer introduced Google push messages, the app includes Google's closed binaries and you can't use the push services unless you have Gapps, which include google services framework. The latter has root access to your device and can read all your outgoing messages before and incoming messages after they are encrypted/decrypted. Through GSF, Google can silently install/uninstall/delete/alter anything you have on your phone. In other words, if you have GSF, Google has total control of your phone...
[Security Discussion] unclefab:
Guys, those chat apps are giving me a 3D headache!!!

Chat secure app is as secure as an open book, it doesn't work unless I allow my kernel to have internet access:eek:, out of question.

Surespot app doesn't work either, for I don't know what reason. It's probably because of one of the restrictions I have but I won't disable anything so bye bye Surespot.

Conversations app wants to connect to google's DNs, but since they are blocked in the Firewall script the app won't work. I have decompiled the app to replace google's DNS with Open DNS' and it got even worse, now the app stays offline. I have noticed there's a whole google folder in the smalis and that could be the reason but anyway, I give up.

I know there are a heaps of free chat apps in the play store, but most of them are little more than spyware so I pass.

I will try to find a pre 1.0.6 text secure....

Or, maybe someone has an app to recommend?

Edit:

I rebooted, did this and that in Xprivacy and Conversations app eventually connected to my jabber account. The only little problem is that for now I don't have any contacts so I can't know whether it can send and receive IMs or not.:silly:

Hopefully it does, cuz now the app is really safe, no more google DNS:p

I'll keep you updated...
[Security Discussion] optimumpro:
"I rebooted, did this and that in Xprivacy and Conversations app eventually connected to my jabber account. The only little problem is that for now I don't have any contacts so I can't know whether it can send and receive IMs or not.:silly:

Hopefully it does, cuz now the app is really safe, no more google DNS:p

I'll keep you updated..."

You can get all Textsecure prior releases on their github (search for textsecure/openwhisper). Look for releases link on the right. You can download the zip file and compile your own release. I use 1.0.6 with internet blocked. Only SMS work. Otherwise no issues. Trouble started with subsequent releases when first the dev removed the ability of the user to regenerate new identity key, then internet, then GCM et al...

If you use Gibberbot, as opposed to Chatsecure, it works fine. Regarding contacts, you have to create one/send invitation. They don't have to be on the same server to IM with you.

I don't think Conversations has a Google folder unless you have sideloaded a Play Store version of this app, but I could be mistaken...
[Security Discussion] unclefab:
Ok, it s confirmed, Conversationsapp works and I had my first chat ever;)

If anyone wants it PM me and I'll give you the link where to download it (I don t think I can put it here since the app isn t mine).

Gibberbot, the old versions don t work on my phone (they can t connect). It s probably because my ROM is too skinned and/or too restrictive, no worries.

I downloaded Conversations from Fdroid's repo and it definitely has a full google folder, with 267 smalis inside (com/google). It might be only an appellation the dev used since there a no files with "add" in the title and no suspicious http or https addresses within the smalis, but I didn t go very carefully through the whole bunch and I didn t dissasemble the app to java. If you feel like having a look at it it s here:

https://f-droid.org/repository/browse/?fdfilter=conversations&fdid=eu.siacs.conversations

Now I ll give a try to text secure, but if I followed you well it s not a chat app but a sms app cuz it works without internet enabled?

Edit:

no release links on the right, I downloaded the only zip there was to downlaod, and the andoid manifest shows version 2.4.2;-(
[Security Discussion] user2k10:
Where can I find TextSecure 1.0.6 apk? I'm not able to build it from source myself.

Thanks
[Security Discussion] Tjee:
I'd like to know as well
[Security Discussion] optimumpro:
Here:

https://github.com/WhisperSystems/TextSecure/releases

All releases are there. Note that 1.0.6 is the last one before they went GCM in 2.0...
[Security Discussion] user2k10:
I can see the source files but no apk.

I found this 2.0.6 version that you previously compiled without GCM

http://xdaforums.com/showthread.php?p=51781333

Should I use that one or stick to 1.0.6?
[Security Discussion] Tjee:
So, stupid question: How do I transform it into an apk?
[Security Discussion] optimumpro:
Oh, yeah, I forgot all about that. There is no GCM there and the interface is better there, however, still that version has no ability to change the identity key, which 1.0.6 has. So, it is your choice...

Edit: they got pissed at me for removing GCM and changed the script so that it would be more difficult to compile without it... LOL.
[Security Discussion] user2k10:
I can see the source files but no apk.