yashsingh1/xdaforums huggingface dataset:
[Security Discussion] unclefab:
Just add this in your script (there are other ways, with the "OUTPUT" command for instance, but at the end of the day it does the same):

#

# Turla outbound

$IPTABLES -A "afwall" --destination "80.248.65.183/32" -j "afwall-reject" || exit

#

# Turla inbound

$IPTABLES -I INPUT -s 80.248.65.183/32 -j DROP || exit

I've updated the script in OP with the above lines, and I added the following address (credits [MENTION=3249429]ukanth[/MENTION] and [MENTION=4415879]CHEF-KOCH[/MENTION] ) for anyone that wants to learn more about firewall scripts:

https://github.com/ukanth/afwall/wiki/CustomScripts

I've added the credits as well, I don't know why but I had forgotten to put them, I'm really getting old:silly:
[Security Discussion] Primokorn:
Ok, done. ;)

It is very inconvenient to enter a custom script from within AF+, we can't scroll the lines. I don't know a good app (like Notepad+ on PC) to create a custom .sh file from my phone so I'll have to do it from my PC.
[Security Discussion] unclefab:
I use that one, it has all what we need:

http://920-text-editor.en.uptodown.com/android

While I'm at it I'll add it to OP...
[Security Discussion] Celestial Fury:
I get "error applying IP tables rules" and AFWall+ becomes disabled.

Using these two lines works.

iptables -I INPUT -s 80.248.65.183 -j DROP

iptables -A OUTPUT -s 80.248.65.183 -j DROP
[Security Discussion] unclefab:
If you get "error applying IP tables rules" and AFWall+ gets disabled it means that there's something wrong in the way the script has been written (on my device it works fine).

It could be that the EOL converson has not been set to Linux/Android, or it could be that when you copied pasted a quotation mark ( " ) or a line break got lost, or something else in the same style.

Anyway, if it works with OUTPUT don't bother, the important is to have it to work, right?;)

Actually when I first wrote this script I only made it outbound, using "afwall" --destination "whatever IP" -j "afwall-reject" || exit.

Then I made it inboud and I used INPUT, and I must confess that I didn't change the original outbound part to use OUTPUT instead of "afwall" --destination "whatever IP" -j "afwall-reject || exit", out of pure lazyness. :cyclops:
[Security Discussion] Celestial Fury:
Maybe it's because it's now called AFWall+? Or maybe because I didn't do any EOL conversion as my Windows Notepad/Wordpad doesn't have it? I just copy pasted what you posted in this thread. I have no idea about the script. I only added in the IP from the block incoming request example.

But your post #2 is more comprehensive and I can't apply it but maybe I can pick out bits and edit using templates? For example:

Why is this necessary at the beginning of each script? I didn't put it in.

# Necessary at the beginning of each script!
IP6TABLES=/system/bin/ip6tables
IPTABLES=/system/bin/iptables

What's bad about IPv6 and why do we need to deny IPv6 only connections?

# Deny IPv6 only connections
$IP6TABLES -P INPUT DROP
$IP6TABLES -P OUTPUT DROP

What are some of those other non google IP destinations that need to be rejected?

P.S. Found the error. It was the line breaks.
[Security Discussion] zelendel:
The biggest thing is that you hit the nail on the head with stating that most dont care. They know true privacy is an illusion. Also most only care about being on the latest release.

I mean think about it. 80% of users use some sort of social networking. This alone shows that most dont care about their privacy. They post the most personal info about their friends and fam on every network they can find. I mean one of the biggest messaging apps that is used is whatsapp which requires knowing phone numbers. And people freely post it on the internet and every forum they can find.
[Security Discussion] iunlock:
Sad but true, however, it is up to those who do care and will go the extra mile to make it happen. My philosophy is just doing the best that you can. We can't be perfect, but any efforts in securing your phone is a plus over those who don't care that post their phone #'s all over the place. I've seen people post their ID's and Passports on social media websites SMH.....Wow.....well let them be sitting ducks out in the open....at least some of us have the common sense to be aware of the very possible chance of ID theft. That alone should put a fire under peoples rear end to do something....

But again....you're right....most don't give a rats butt. This is why it's even more important for those who do care about privacy/security need to stick together and keep it going....

Most people don't realize (the majority that has their necks out on the chopping board for ID theft etc...) that ignoring simple security/privacy practices is like taking a crap in a public restroom with all glass walls and windows with no TP. Really...it's even worse than that. They just don't get it, because that's exactly how this system is designed....to keep people ignorant in creating that false illusion that they are safe.....:rolleyes:
[Security Discussion] optimumpro:
Sip service: I don't think I was clear enough: Csipsimple does not strip anything. It is done on server level, so, if you use google servers, the packets carrying ZRTP will be stripped. Most other services/servers like sip2sip or ostel.co don't do this. Truphone does it. You'll know once you make a call...

VPN and sip: I don't think it is going to work with live voice calls: too much delay and loss...
[Security Discussion] iunlock:
Gotcha.

What about vsee as their video chat is encrypted. Using this with both ends on VPN.....safer bet?

"vsee" is super easy to use and seems pretty light....

What do you think?

I've seen that "Jitsi," has a phone app in Beta, but I personally don't like it...it's just too incomplete and strange.....hence...Uber Beta LOL....
[Security Discussion] optimumpro:
Vsee my foot: proprietary protocol and apps; app has internet access and no one knows what it does; they also use server for "administrative purposes" to report to mother-ship? Lol.

Jitsi is good, but their android app is unusable and the project seems abandoned. The best thing is when you have an open source app, which lets you choose the server. Encryption happens on app/client level, so, servers would only know that you are connected, i.e, no content...
[Security Discussion] iunlock:
In that case, what would you recommend as the safest chat app for security/privacy? A few of them have end to end encryption ....any good?

How's this scenario:

Using a chat app that has end to end encryption over VPN on both ends....still not good?

Thanks !
[Security Discussion] optimumpro:
Conversations app is good. You can use any Xmp server including Google and the other person does not have to be on the same server. The app takes care of content and vpn - of anonimity.
[Security Discussion] beyondbuxton:
"Powered Off"

Perhaps I missed this part of the discussion (there's a lot of great info in this thread - thanks to all!), so forgive me if this is in any way redundant:

The idea of turning off a device and then removing the battery has been around for quite a while. For my purposes, this is done mainly to ensure I'm not draining the battery when the phone is stored for long periods: weeks/months/... But occasionally, I prefer to know that the device in my pocket really is "off".

With many new(er) phones, it is not practical/feasible to remove the battery. Which in my mind leaves a question regarding what the phone really is doing while it's "off" (but still has a battery). Has anybody looked into this using something like SDR (software defined radio) or other tool?

Cheers,

BB
[Security Discussion] iunlock:
I'll look that up. Thanks!

Can you provide some insight on "KakaoTalk," which is huge all over the World and has recently come out with end-to-end encrypted chat both 1:1 and now Group Chat. The app works great and the calls are more clear than my regular phone. I use this heavily for the, "Hi hun, dinner tonight?" type of stuff. What I like about this is the cleanliness of the interface and how light the app is.... it doesn't drain battery like some of the other clients I've tested.

There's another similar one called "Telegram," which is very popular in Europe. It features self destructing messages of any content, text, photos, videos, files etc.... of course this would mean it's temporarily stored on their servers, but.... I think they use a similar encryption as Kakao does.

Either way, I'm just curious how secure these end-to-end encryption offered by the two chat apps above really are.

I use both of these chat clients; which is widely used amongst my family overseas in Europe and Asia and I tend to trust this more than those other apps where you have to enter in your credentials into a third party app just to access your other chat client....like IM+, which I don't like.
[Security Discussion] optimumpro:
Kakao is proprietory, so no one knows what kind of encryption they have, which is whatever they say. Telegram is not bad, but it forces you to use their own server, which is proprietory. You can't trust any server, even if it is open source, because you don't know what is implemented there. You can't put your secrets into one hand like telegram or kakao, unless you use them for hi hun, dinner. For privacy you need content encrypted by an open source client + a separate server-carrier. You create an account on that server that is used for chats only and which is separated from the client. This way, if someone takes over the server, all they get is gibberish. So, conversations app plus an xmpp server of your choice controled by a different country.
[Security Discussion] iunlock:
Nice! Good stuff...

So with "conversations app," what would you recommend to use for the xmpp server and the best country? (Just anything but US or China? LOL)

Is Swiss one of the better choices? Along with Netherlands and South American countries?
[Security Discussion] iunlock:
On another note:

As for Xposed and the new update for LP....is there any other news that you know about that I may be overlooking about it working with Touchwiz on Lollipop? It's apparent that although there is an update for Xposed for LP, it just so happens to not work for Touchwiz LOL....what are the freakin' Odds hahaha....yikes...

This thread <- click link.... seems to be the main source for any type of updates, but I was just curious if there is anything else that I may not know about at the moment....

My Brand New S6 Edge, still wrapped in plastic is just sitting on my desk looking pretty, because I don't want to switch my number over to it until I know I can get Xprivacy to work without bootloops on Touchwiz on Lollipop.

Sucks I know.....sad.....until there is an update, I'll still be using my Note 4 .....

I hope there is a fix soon.....sigh... :fingers-crossed:
[Security Discussion] CHEF-KOCH:
Since there is an 30k char limit for each single post I leave this here (I don't want do split the posts because people will full quote anything and I hate this [this always break the search]).

Click here , the syntax/tags may not work, since I quickly wrote this here on xda and copied it into ZeroBin, so excuse me for the wrong displayed tags. You can discuss directly here or directly on ZeroBin (it's also available as .onoin address).
[Security Discussion] setmov:
[MENTION=4415879]CHEF-KOCH[/MENTION], optimumpro forgot to ask: Who do you work for?

[MENTION=5075064]optimumpro[/MENTION] Well said!!!

HAPPY EASTER TO EVERYONE!!!
[Security Discussion] Celestial Fury:
[MENTION=4415879]CHEF-KOCH[/MENTION], so that we can get something out of this little debate - what exactly are you not happy about? The

philosophy

behind how we secure our phones or the

techniques

?

Being a practical person, I only care about the techniques. Do you have techniques to contribute here? When you settle the techniques, you settle the philosophy.
[Security Discussion] CHEF-KOCH:
My "problem" is that people constantly believing in myths + that it's simple wrong and naive to believe that third-party apps prevent hackers/attackers to get your stuff. Sad, but it's the truth, as written, it's only a matter/combination of time + how many afford the attacker want to spent to get your data. I think that's now clear enouth. If you think you're safe you can skip it, can't tell anything against this, because I can't watch anything or say you're wrong. For example an expert will be always a little bit more secure compared to other users only because of knowledge - that's it.

So the thing is, all is secure as long nobody can show other stuff (like with physics, your theory is okay/correct - no matter how crazy it is - as long nobody can proof you're wrong). Simply and effective! Now, Snowden (btw not the only whistleblower) already gave clear statements + proof and everyone can download and see the documents. Now, what was changed? Nothing, we still using the old protocols and trying to fix 20 or more years old stuff with encryption which will be stored in a cloud or local (very bad and bad). Even I would show here the asnwer for anything or show how insecure xyz is, people will still hold on this no matter if there are free alternatives, apps or whatever. How many android users exists? I bet around more than 800 millions (definitely) and how many know about Xposed, Xprivacy and AFWall+? Maybe 1 million, even if it would be 10 million, it's anyway snake oil. NSA not care about single person, they want stuff to collect as much as possible from the mass and not from about that little 1 million group that say it's more secure.

Now, there are some persons like me to show that application layer is always attackable and some people that believe that the application layer is secure as long it's proper implemented. I agree that I disagree, because the best implementation is useless if the user don't know how to deal with or just make stupid mistakes.

As written, instead of showing or telling which is "secure" and which stuff not, let the user make that decision and only write something how to use it, and show some examples why there is such connections from e.g. Firefox Browser to Google, this would be the first and real method if you asking me to prevent that myths and rumors still widely hit the internet.

Again, if people would care a lot of more how common things work, such how your provider manage the "security philisophy" nobody would need such addition tools. We already trust our providers by choosing them, so now it's the time that there are secure protocols + some proof that the provider does what he promises and it's not only about keeping logs (I have no problem with that as long as I know it will be destroyed or nobody external service has access to it - but sad most time it isn't that easy).

If you blame me for my long post, just to it or ignore my words (or just enable the ignore function here on XDA) but I think that's a lot of more complex as some people think - so that's why is it so long actually.
[Security Discussion] ARGD:
Thanks.

Great tutorial.:good:
[Security Discussion] optimumpro:
When did I say that everything works out of the box? If it did, we wouldn't be needing XDA or this useful thread thanks to [MENTION=4703661]unclefab[/MENTION]. Just another made up statement and phony argument. Your nonsense has nothing to do with the substance of this tread, but rather has everything to do with your promoting your "superiority." I answer you to take apart your "facts" and show them bogus...

Am I angry? No, I just think this discussion is not productive, because you are in this just to show your "superiority" and poke fun of "stupid" mortals. Great "Maestro" (you) is wasting time teaching basics to "ignorant." But when your bogus arguments and made up facts are taken apart, you start attacking the person... Why are you attacking SMSsecure? Because I modified and shared it on XDA and because I have shown you wrong in many instances? Now, let's take apart some more bogus facts and phony arguments:

Sound recorder has no internet access. And I say BS and here is the proof: https://android.googlesource.com/platform/packages/apps/SoundRecorder/+/master/AndroidManifest.xml . See the internet permission right after record_audio permission? Keep in mind, this is Google source, not CM or any OEM modification. Here goes another bogus statement and argument. Are you for real? Because when you make a statement that is 100% wrong and continue to repeat it, you just lose any remnants of credibility.

Kernel pings and tcp transmission: My sync is disabled and none of the applications that are allowed internet access is active or in the background and yet my kernel transmits in TCP (and sometimes encrypted) to servers in Taiwan, China, Brazil, Portugal and Germany. And by the way, my ping and ping6 binaries are disabled. Neat, isn't it? And by the way, this traffic cannot be stopped by a firewall with stock iptables, only with builtin ones. As I said, developer/programming mind is not enough to grasp the extent of data mining and surveillance. You, certainly, do not qualify...

NSA help to build SElinux. That is why Selinux is disabled in all my roms and replaced with Tomoyo security, but users always have a choice: they can just replace the kernel with stock/cm one.. Do you want people who rob banks be in charge of banks' security? I don't...

US government helped to build TOR. Well, that's not why I am not using it: my reason is that the current Tor developers, as well as people at the Gardian Project, Textsecure and a few others are basically on government payroll...

I have never said anything bad about truecrypt, but it was their own statement and warning not to use truecrypt...

And finally, what is the point of reposting Xposed framework info that is already available on XDA, but thanks anyway: I accept this as your contribution to our discussion...
[Security Discussion] dawgdoc:
Any idea which of the tracking modules they did not remove?

From the F-Droid site:
[Security Discussion] optimumpro:
That's before building. If you click on antifeatures, you will see the explanation. Also, if you click on build recipe:

https://gitlab.com/fdroid/fdroiddata/blob/master/metadata/org.mozilla.fennec_fdroid.txt, you'll see that tracking, as well as google binaries were removed.

The original firefox on f-droid was not built by f-droid. That's why they now offer fennec, because Mozilla requires you to have a different name and icon if you re-publish...
[Security Discussion] dawgdoc:
Thanks for replying.

I did that before posting, it said some tracking features were present, and a possible use of that tracking, without specifying which tracking features were present nor for what they were used.

Well, I didn't get to that earlier when I tried using the links, the link shortening .... lead me to a 404 page. Going there now I see that crashreporter and some test extensions are removed. I knew that from reading the app info page earlier. I also see

And still, on the app info page and at the top of this fdroiddata page it says it contains the Tracking Antifeature. I take this to mean there is some unspecified tracking still present, even though some is removed.
[Security Discussion] optimumpro:
Well, that's a little ambiguous. I read it that anti-feature is F-droid feature that is applied if there are binaries or non free (closed source) add-ons. And they say such apps don't appear on F-Droid. With Fennec (because its source is quite large) , they are just covering their behind in case they have missed something. But judging by no new removals in the latest version, most likely all "bad" things are gone...
[Security Discussion] setmov:
UnaOS for the Samsung Galaxy Grand 2

And here it is the UnaOS for the Samsung Galaxy Grand 2: http://xdaforums.com/galaxy-grand-2...st-looking-t3079231/post60047672#post60047672
[Security Discussion] XsheldorX:
still <3 openpdroid

hey,

lanchon continued mateors work on openpdroid, until now only for cm11 milestones, but he already made it work with ART and is going to do new overlays for new 12.1 cyanogenmod milestones (at least he said in january).

http://xdaforums.com/android/software-hacking/mod-openpdroid-patches-cyanogenmod-11-t2839491

I really liked openpdroid and even would be willing to install cm for using it again :)
[Security Discussion] Primokorn:
Not sure if it's the right thread but there are experts here :)

Do you know how to delete the Google's cloud backups? (linked to the feature 'Backup my data' from Backup & restore menu.
[Security Discussion] Celestial Fury:
[MENTION=4958579]Primokorn[/MENTION],

When you untick "backup my data", it's supposed to delete everything that you've backed up. It's not just an on/off toggle.
[Security Discussion] Primokorn:
That's what I thought but: http://xdaforums.com/showthread.php?p=60519287&postcount=8
[Security Discussion] Celestial Fury:
I replied here.
[Security Discussion] mrrocketdog:
ok, pretty newbish here so ..

following OP I have lightning browser , went to data/data/acr.browser.lightning databases folder ; finally figured how to change permissions to rx rx x. but when I delete contents of folder I get error message 'lightning browser has stopped'. anybody have an idea as to what I may be doing wrong ? any help/links/guidance much appreciated.

p.s. this was suppose to stop cookies from being saved.

"all i can really do , is stay out of my own way and let the will of heaven be done"
[Security Discussion] unclefab:
No worries, do as follow:

turn off the wifi,

go to lightning browser's databases folder and change the perms to rwx rwx rx,

open lightning browser and close it,

go back to the databases folder and change the perms to rx rx rx,

in this folder erase all the files whose name starts with webview (there must be 3 of them), but DO NOT erase the 2 files called historyManager (if you erase them lightning browser will fc and I guess that was the problem),

open lightning browser, it works!;)

But, you are note done yet.

Above the databases folder you ll see a folder called cache.

Change its perms to rx rx rx, and erase eveything that s inside the folder.

Then do the same with the app_icons folder (change its perms to rx rx rx and erase its content).

That's it...
[Security Discussion] tillspehr:
I've not read any comments on miui in this forum apart from the general mistrust in custom or third party roms. Are there any known issues security wise with miui? Out of the box it comes without Google apps and i like the look and feel of it.
[Security Discussion] mrrocketdog:
update: worked perfect. ty again [MENTION=4703661]unclefab[/MENTION] for directions AND monitoring this thread. :good:

"all i can really do , is stay out of my own way and let the will of heaven be done"
[Security Discussion] xguyss:
Awesome, it works.. :D
[Security Discussion] setmov:
So here we have something new for the Samsung Galaxy Tab 10.1 N8000

http://xdaforums.com/galaxy-note-10-1/development/rom-una-rom-private-fast-looking-t3155267
[Security Discussion] mrrocketdog:
awesome !! very glad to hear you guys are still on this project. (i dont own a Tab 10.1 N8000 ; but am excited just the same).

AND not to beat a dead horse , and i think i can only get down to KK 4.4.2 ; but ever need a tester or you build for the htc one m8 ; i am all over it.

:good:

"all i can really do , is stay out of my own way and let the will of heaven be done"
[Security Discussion] setmov:
[MENTION=5511100]mrrocketdog[/MENTION], thank you for your support, we truly appreciate it. We are a bit late on the releasing of new roms, but that's because we concentrate all our efforts on an ongoing project. Unfortunately we can release roms only for phones we can get our hands on physically. If we will be able to find a htc one m8, be sure we will gladly build a rom for it and let you know.

Thank you
[Security Discussion] iunlock:
AFWall+ [Settings...]

AFWall+

Menu -> Preferences -> Binaries -> IPtables Binary -> "Should this be on: Auto, System iptables, or Built-In iptables?" Keep it on Auto?

Menu -> Preferences -> Binaries -> Busybox Binary -> "Built-In Binary or System buybox?"

Menu -> Preferences -> Import -> "Import Droidwall Rules" - Recommended?

Is there anything else within AFWall+ that is recommended settings wise?

Thanks guys....:good: