[Security Discussion] CHEF-KOCH:
@optimumpro

Than if it's really that unrelated to you why do you answer or react on it?

Sorry if you think that I'm to rude to others (maybe I just used the wrong words), but I have no other words for it since clicking on anything is just like that ... and said not only here million times that it could comes with risks.

Well, if you re-read all stuff and take you time, you already notice it isn't against anybody in person (I'm speaking to the mass since cyber crime is huge problem), but okay - as always you reject legit arguments. You never showed any proof for anything. Paranoia that's all, all is evil without any reasons and because thinks you not understand.

Please read the full story and not the first header or sentence, he exactly said it not works out of the box + it's not enough (his words), in fact he said that it still needs some extra stuff which begins with the OS itself.

Not true, flashlight have internet permission but not the sound recorder. But no matter if you have any special version still no proof that it's that evil you intent it maybe is. Why do you not add a patch to the source to just remove that line in the manifest?

Your own words, you don't use any cloud, so I said it's just another words for server, in fact xda is also an kind of cloud since you upload your text, pictures, and other data to this server, so you states are again wrong. You use cloud's daily, what you may wonted to say is that you don't use any extra "cloud server" to directly upload you private stuff, like dropbox, mega and such services. Okay.

This are your words, but system apps != kernel traffic. Pings aren't evil as long it's not a specific attack, so still no proof from you and you don't even provides infos that are really necessary, which hardware is connected and interferences in this (and AP) which background apps are running and such. Since you have root, just uninstall/freeze them or show me what each system app + uid 0 (kernel) exactly do, means tcpdump and we can talk about it. Still waiting and I already know you will never show me something because it would reveal that this are legit reasons to connect and not "evil" or attacks.

Never read such wrong statements, google does not have anything todo wit it if someone place external content in his page, you don't even know how a webpage works - didn't you? Some sites uses CEO tools to optimize there google results, speed, whatever it comes with ... That is what you may want to show, but this comes from the webmaster since he decided to use this. So jzst don't use any site and good luck on the underground. Most pages use CEO tools and other stuff to get a better search result. Maybe you tools help to block them, ....

If you talking about browser fingerprinting, than I have to disappoint you, this wasn't builded by Google and it's e.g. Amazon which uses supercookies.

Yes I can, here it is: No connection (not any), only DNS traffic which comes from Port 53. And I wasn't the guy which claimed gp services is that bad, so why I should do your work? What is the logic, GP services is well documented, take a look over here: https://developer.android.com/google/play-services/ for location: https://developer.android.com/google/play-services/location/

As it shows it isn't directly an ordinary app, it's mostly an API which provides features to external apps, like Ads service, push, sync, and such stuff. So if your own app uses one of this api and it have internet access you may see that this want to connect to it. So in your words this is spying! Good joke.

Why 20 Gigs, why you come with that big size? You just need to analyze the traffic via wireshark/tcpdump on your listening apps (if no apps use any of this api there will be only a heartbeat, which isn't evil). You really better start reading the basics, of course you will never do. Capturing the whole traffic at each time 24 hours also wouldn't reveal anything bad.

Wrong again, the developer of amplify (here on xda) decompiled services [for his app] and many others too [including myself]. And you don't even need to decompile something to understand how it works or what it trys to connect to.

Easy, because I know how to control wireshark to see what connection attempt this app makes. None "steal" your data or is an attack. There are also several articles that shows what is behind all this. If you don't want any sync, just don't use it, you are really and seriously wondering why is there a connection if you use sync? Are you kidding me? And of course this sync are as said, optional, like most of your mentioned arguments.

Yes, and because of this all is automatically evil according to that logic. Selinux was also design with and from the NSA, but that doesn't mean it's automatically vulnerable. https://www.nsa.gov/research/selinux/ + https://www.nsa.gov/research/selinux/faqs.shtml Now come with the backdoor argument and you maid my day.

An simple hello world does not need any serial number, without any name of which app you're talking about it's pretty useless. - To make people confusing and work with there fears, that's all you do.

Nope, you never read all my stuff or was able to understand it, according to your answers, as said it's way beyond you horizon as long you never read the docs or give anything we can work with. I'm not here the guy which write my recommendation to others without anything. You just respell the stuff which is already written down on there official pages that's all. Useless as said. Yeahhh, SMSSecure is the answer to all, of course, but ignoring the fact to send an sms with an 8 MB big app instead of the 1,6 MB big TinFoil which needs less memory and space is just an proof that people recommend each new stuff which popups on the markets.

Again show me the evil connections and hacker attempts that directly comes from Google. Your constantly distrust without anything come out of nothing. There is none, wouldn't you think if it is that evil someone here on XDA or on the net wouldn't already reveal hacker actions? Good luck with your google paranoia, just use FirefoxOS/selfish or other systems, some of them are already pretty stable yet. You also realized that NSA helped a lot to build TOR, just by the way. Read here (also available at the Tor page how they get money for the project) http://www.theguardian.com/technology/2014/jul/29/us-government-funding-tor-18m-onion-router

http://www.washingtonpost.com/blogs...rcent-of-tors-development-can-users-trust-it/

I would like to say you stuff is correct but it's more and more paranoia, like my example about the moon landing, people don't check the stuff themselves and never able to deal with arguments from others. As said pseudo experts.

Yes, you want to shutdown the discussion because with each new answer from you, it's getting more worst with so horrible wrong. Sorry to say that, if you feel now angry about it, I'm sorry but no arguments no reasons that I should waste my time longer with you.

I already made my statement, as written twice, if you don't like it, ignore that - it's you right but do not come without anything except your words and argue with such inexperience. Security, isn't that easy, I got the OP already got that important fact. To understand the term security you first need to know how the attacks working, as long nobody doing this I'm out from here, not waste my time to teach people with the basics.

Final report to truecrypt (as pdf):

https://opencryptoaudit.org/reports/TrueCrypt_Phase_II_NCC_OCAP_final.pdf

Some must read stuff (it's worth to read really all in there):

http://betanews.com/2015/02/22/os-x-ios-and-linux-have-more-vulnerabilities-than-windows/

http://www.techrepublic.com/blog/it...software-is-useless-against-military-malware/

http://www.cbc.ca/news/technology/m...anti-virus-software-totally-useless-1.2559432

http://www.pcworld.com/article/2884...d-nsastyle-techniques-to-hit-iran-russia.html

http://blog.kaspersky.com/equation-hdd-malware/

http://blog.cryptographyengineering.com/

http://resources.infosecinstitute.com/nsa-bios-backdoor-god-mode-malware-deitybounce/

http://www.csoonline.com/article/25...rotection-router-malware-fact-or-fiction.html

http://kb.linksys.com/Linksys/ukp.a...6_How_to_prevent_getting_The_Moon_malware.xml

http://security.stackexchange.com/questions/29355/why-is-windows-considered-insecure

http://www.techopedia.com/definition/27310/super-cookie

And to bump and make some people happy, Xposed Installer v3.0 alpha 2 (for Android 5.1 only!):

Spoiler content hidden.