[Security Discussion] unclefab:
[MENTION=5075064]optimumpro[/MENTION] :

yep, that s neat, and that illustrates well what I wrote about open source apps not being necessarly good.

People install an open source app from open whisper or from the guardian project (cuz they too have some questionable apps) and think they are covered, which is actualy worse than installing a closed source app where you know you have to be careful.

There s nothing worse than a wrong feeling of security:(...

Sadly that s true, not to mention comments on forums or on the play store showing a total lack of respect for devs spending months developing this or that freely for the community and that make some of them leave.

If I remember well even rovo ( the dev for Xposed) wrote that he won t publish Xposed on the play store because "comments are not acceptable".

When it comes to privacy, one has to distinguish between 2 threats.

What comes out of the phone (data mining, exposing of the phone s IDs etc.) and what comes into the phone (attacks, spyware etc.).

The second threat is more or less impossible to overcome, they are too many ways to hack a phone by too many attacks, hackers are much better documented and tech savvy than most users, many users install cracked apps from shaddy sources to save 1 or 2 usd, and most people don t care about learning anything, they want a "secure" patch or whatever that works out of the box and that will save them the effort to learn (thats more time to spend on facebook to upload their status with their brand new shiny phone or their latest selfies).

Even a very knowlegeable security expert can t claim he s safe from those threats, if the agencies are after him chances are that they employ some people even more knowledgeable that him, and even if they don t they have means of coercition, tools and money in abundance that allow them to do whatever they want.

Plus, whatever you do, if you use gsm and data your provider will know where you are, no way out.

As said optimumpro, if they are after you, you d better throw your phone away and run!:silly:

Then, google releases new versions that are patched against some of those outside threats (but of course not against the main ones, agencies wouldn t allow it and as we know google is a good cooperative boy) and at the same time adds more inside spying/data mining stuff (compare KK and JB for that matter).

"Experts" write articles about that new "secure" version and everybody is happy, users didn t need to think about anything and they now have a more "secure" phone, or so they believe, google has strenghtened its grip on android, and the agencies can run their businesses as usual.

There are ways to overcome that outside threat, but they have nothing to do with technology, they have to do with the good old common sense.

Having different emails, connecting to them from different devices (each device being used for a different type of browsing) and never mixing the devices' use.

For example, device A for my regular email where I talk about the weather and the last football match, and device B for my sensitive browsing/emails/activities.

A hard disk, or any removable device that is passive when unplugged and doens t have any way to connect to the internet (like an usb stick), for your sensitive data, and a computer without any wifi or connection drivers installed to plug in your hard disk or your usb when you need to transfer data to a less secure removable support (I mean a secondary hard disk or usb that will later be plugged into a computer that has internet access). If you want to be on the safe side you should dump that secondary hard disk/usb often, if not after every use, and get a new one when you need to transfer data again from your safe hard disk/usb.

There s much more to say on that subject, but you got the idea.

Still, before you become paranoid and buy 1 zillion devices ask yourself, are you worth of such attention?

Are you plotting the third wold war or a coup d etat in your favorite banana republic?

Do you have state secrets or 10 billion dollars corporation deals to hide?

If not then let it be, nobody cares about you and nobody will attack your phone, who cares about your pictures and your contacts, music etc.?

Wait, someone cares about it, it s our "friend" google and now we are back to the first threat that is data mining.

The good thing is that that threat can be circumvented, even without Xposed and Xprivacy, but that s a lot of work.

Many things about it have been published here and there and of course in OP, like removing as many apps, jars, libs and xmls as possible, changing your IDs in case Xprivacy doesn t work (and anyway Xprivacy can t restrict the android system from accessing those IDs, hence the importance to change them).

Of course you shouldn t keep any app without having decompiled it and checked what s inside (for example if you see some google stuff in the com folder you try to remove/replace it, and if it doesn t work you forget about that app and get a similar but cleaner one), it doesn t matter if the app is open source or not.

Last but not least you can do some deep cleaning by patching the apps and jars in the system (that s the hard work I was talking about, the other modfications mentionned above are easy, and far less time consuming, in comparison).

That s what I m doing on those Una ROMs I m currently working on, the third one will be released today.

It may get to an end prematurely though, cuz the amout of work is overwhelming (an average of 10 hours work a day for nearly 2 and a half months now) and nobody offered any significant help or feedback apart from, to my opinion misplaced, critics and uncle bashing.

Time will tell...