yashsingh1/xdaforums huggingface dataset:
[Security Discussion] Mr.LOVER:
No Escape!

Well, after researching a lot on this matter, i have come to certain conclusions,

that no matter what, you can't escape the reality that there is no privacy for people,

all we can do is to protect our privacy against other people trying to hack us by different means and trying to spy us through different means,

it is very awful to say, that we can't protect our privacy from Big B.

their approach is at hardware levels, and until we create our own hardware, we have no escape from it.

on the level of software, we only can protect our privacy from younger brothers, but not from Big B.

with saying that, it is very painful to know that people on other hand have no clue about what is going on, no body is aware of this fact, and nobody is protesting about it.

We need political power to avoid it, and we individually have no control over it. and Political powers are unfortunately are not with us and will not let the pure people get the power at any cost.

i really am sorrowful to know those facts, I'm broken to know humanity is suffering through it, and bigger question that no body care about it, nobody talk about it, no media is telling this, no companies are working on it!

in a society i live, i have no control! and i will be crushed if i tried to... but may be in open societies which claim "freedom of speech, expression and otherwise" people can start campaigning about it. but i don't really feel they will give you this freedom at all! (to me, freedom is just a mystery to let people believe they're free)

i appreciate brothers [MENTION=4703661]unclefab[/MENTION] & [MENTION=5075064]optimumpro[/MENTION] ! that you are doing a good work within the limits of your power, and i appreciate your work and enlightenment and awareness you given to me and others about it.

i have nothing to hide from the world, so i quit trying to escape from Big B, yes, you win Big B.

but one day if we got a pure government system, we will win!

the technology we praise, is the worst enemy of mankind if falls into wrong hands!

that is my last words on this topic,
[Security Discussion] Froschohnenamen:
Why not AOSP?

First things first: Ive read through this whole thread(except for the messenger stuff :D), so i have read the discussion that was going on.

And I am NO cm fanboy. I never used cm before and will probably never use it. Cm seems to be like ubuntu: The most common of their category, but adding spyware into their systems.

But: I am using an aosp rom. And i dont really get your approach of choosing stock rom over aosp rom... I mean sure, aosp has spying software build in too as you showed us, but stock roms are built upon aosp PLUS their oem skin over it. And you cant control that oem skin because its proprietary. So you have the aosp spying PLUS very likely the oem spying... In this regard its better going with aosp, isnt it?
[Security Discussion] Froschohnenamen:
What do you mean by on the level of hardware? Do you mean that they build actual spying devices into motherboards that manually send data over to intelligence agencies? If so, then we are really pretty much without any escape, unless we build our own hardware.

But if you mean, that Big B. injects hardware on firmware or bios level, then the time has come for coreboot and replicant! By pushing these, we could avoid something like this.
[Security Discussion] Mr.LOVER:
yes u heard me right. while researching about solution i came about an article in which people were talking about that. that after injecting spyware into system, kernels, bootloaders etc now there is a fear that they have start infecting hardware which will independently work for them. listen to mic through cellular network etc. but no proof for rhat yet. i should have bookmarked that article but i will have to search again as it was in tor browser.

but being ignorant of how this technology works, i dont have enough to say what technical mechanism can that b. all i can do is to get more scared of that intrusive acts on my privacy if it is true.

the solution was given to encourage companies to creat open hardware design like open source softwares and protest against these acts politically.
[Security Discussion] Froschohnenamen:
Well, that would be pretty bad... I still cant imagine, that they execute such practice on a huge amount of devices, because the power consumption would be too high. On the other hand, if they build up a p2p network consisiting of these spying devices... Man that would be evil genius O.o

The bad thing is, that open hardware wouldnt help a lot against this practice, because you cant "compile" the hardware by yourself (unless you are willing to spend a lot of money).
[Security Discussion] Mr.LOVER:
setting tasker to change dns for mobile data

[MENTION=4703661]unclefab[/MENTION] [MENTION=5075064]optimumpro[/MENTION]

i have found a better way to change dns with tasker, so no special app for dns needed.

set tasker like this.

Go in Profiles tab.

Create Profile by clicking on Plus sign -> Event -> System -> Intent Received

set Action field to

now go back and select New Task when it ask

name your new task whatever you want, i named it SetProp

Add action by clicking on Plus sign -> Code -> Run Shell

put following two lines in Command field

setprop net.dns1 208.67.222.222

setprop net.dns1 208.67.220.220

select "Use Root" check box

Done!

i have selected android.net.conn.CONNECTIVITY_CHANGE to activate the task, for now i found that the best as it always change dns whenever any connectivity change occur. but may be there is another intent better than this? please let me know,
[Security Discussion] Mr.LOVER:
ok after a long testing the tasker method, and watching logs, i confirm that it works, there is not a single event when i find google dns set in Prop in getprop shell command. i have put tasker to log after every 1 minute to check getprop output for google dns but no event at all for last 24 hours.
[Security Discussion] user2k10:
This only works reliably for Android versions < 4.3
[Security Discussion] Mr.LOVER:
but i'm doing it on KK 4.4.4
[Security Discussion] user2k10:
Of course you are, but you should be using the new ndc resolver commands for it to work correctly.
[Security Discussion] Mr.LOVER:
what are you talking about? I have tested it and it works! can you elaborate what you are suggesting?
[Security Discussion] Mr.LOVER:
well! tasker does change dns in when i see getprop. but things still don't use opendns, they still using google dns even when it is opendns set in prop.

the hell i am goin back to 4.1.2 :/
[Security Discussion] Froschohnenamen:
Could you please add some stuff to the Tutorial?

1.

A warning on this would be great: I once removed my Stock Keyboard, and thought about how to get more privacy: Of course, fully device encryption, awesome! So i encrypted, and after rebooting i was told to enter the password to decrypt. But there was no Keyboard, because the stock one was removed and my replacement was no system app and therefor still encrypted. I had a Nandroid backup, but that doesnt include media backup... So i lost a little bit of my media.

2. You could link to the NOGAPPS Project, i think they have at least a pretty good approach to replacing the stuff removed via this tutorial.

2,5. The removed play store can be replaced sort of by ApkTrack... At least you can see which Play Store Applications are outdated

3. You could link to some other privacy related threads such as Pry-Fi

4. Krypton Anonymus is a pretty good browser for browsing the Internet via Tor really easy.

5. Bootmanager and ReceiverStop are great Xposed Modules for having better control over the apps (maybe in addition to greenify)

6. In the sction of alternative Apps, I would recommend going with open source Apps being found in F-Droid instead of proprietary Apps, because they generally do care more for your privacy (of course, restricting them is no bad idea either). In case of the gallery for example, this is sadly not possible, but for example the video player could be easily replaced by VLC.
[Security Discussion] HeathenMan:
First these scripts disabled my ability to use terminal or save accounts.

for some more paranoid this should be ok but after modification to get it work all feels snappier now. Nice side effect.

I would recommend

Class0Firewall

ImagePrivacy

ObscuraCam

BetterNet

ZPN

AVG PrivacyFix

Firefox Addons:

ProxMate

PrivacyBadger

FireGloves

Self destruction cookies

Https everywhere

Privacy defense

Shumway

AdblockEdge

(ZenMate) also as app
[Security Discussion] Cyclu:
Here is a good alternative to Pri-Fy works perfectly and doesn't need root.

Wi-Fi Privacy Police:

https://play.google.com/store/apps/details?id=be.uhasselt.privacypolice
[Security Discussion] HeathenMan:
doesnt provide same functions but thanks, good app
[Security Discussion] MercMode:
nice work bud :)
[Security Discussion] Froschohnenamen:
So first of all thank you for implementing my suggestions :good:

Depends. But thats certainly a reason for going with stock.

Because of this, Richard Stallman wants you to say Free Software, because then it respects your freedom :P

The question is: Why does the developer put the code open source? In the case of Android, they didnt put it open source for the user to control the software, they did it in order to improve developement (and Android wouldnt be as successfull as it would have been without open source). So you could basically expect it to have some malicious features.

Sadly same here:D

I thought about this point. The average Joe wouldnt do stuff like this, and he wouldnt follow your tutorial either because its to drastically. But i think, that privacy should be available to as many people as possible. So i thought about this: What about starting a kind of privacy AOSP project? Where the source code is taken, modified in order to remove all the spying stuff by google. And then, it could be released in the same kind of repo that AOSP uses with the same device tree and so on, that developers can easily change their scratch from regular AOSP to the super duper privacy AOSP. Similar to Linux-Libre.

I dont know, does such a project already exist and i always overlooked it? Because i really like the idea, and chances are that some custom rom developers use this as a base. That would make a rom much more trustworthy in terms of privacy, wouldnt it?
[Security Discussion] HeathenMan:
many popular projects are near to this, but the functions of some 'bad' apps/connections are needed by many users so the method of self-fix is mostly used.

Im with freecyngn which aims to delete some of these 'bad' parts in cm, also created BPHF - largest hostfile i know yet ( http://r.8.je/fin )

Same opinion on opensource- isnt always good but for me the better one cause someone is able to proof trustworthy.

Its also a known fact that this way isnt provitable, often donation drived and/or rebuild without ads.
[Security Discussion] hugh g rection:
are things better now?

Hey,

Great post first of all but you said that sticking with older android versions is better due to the spy ware google has been installing but ha anything changed with android 5.0.2? or have things gotten worse?
[Security Discussion] optimumpro:
Of course, things have gotten worse. Who do you think Google works for? By the way, Open Whisper Systems that make Textsecure received between $1 and $1.3 mln from BBG in 2013-2014, which was setup by one three-letter-agency, Guardian project received about $384K. So did several known "privacy advocates/security experts." Just read here: http://pando.com/2015/03/01/internet-privacy-funded-by-spooks-a-brief-history-of-the-bbg/

But, there is always but. Lollipop, for example, has introduced a pretty good (in principle) data partition encryption scheme. They just (non-deliberately of course), weakened encryption a bit, so that paying spooks can get a hold of your data if needed. But the beauty of open source project is that you can go in and fix the weakening. You can enable several things in kernel (ciphers and random number generation hashes) that are disabled by default. Then, you can go to /system/vold/ in the source and increase the length of keys, increase the iteration number and so on. So, a fixed lollipop is more secure than previous android versions. Also, the afwall guy is working on the lollipop version of his firewall, so, pretty soon this will be fixed too. Xprivacy is already working with lollipop. So, because Google is dumb (in my opinion of course), we can still have hope. LOL.
[Security Discussion] Mr.LOVER:
can you please write a guide how to do that? i mean fixing the weakening in lollypop? :fingers-crossed:
[Security Discussion] unclefab:
[MENTION=5979475]Froschohnenamen[/MENTION]

I ve been working on such a project with some friends, and soon we will release the first ROM.

Private and secure, the way all ROMs should be.

[MENTION=4289125]HeathenMan[/MENTION]

I think it s not so much a matter of closed vs open source app, it s more a matter of decent and honest apps vs apps spying on my back.

Most people think that restricting the permissions declared in the android manifest (the ones you see in the list of apps you have in the settings) is enough, but it s only the emerged part of the iceberg. Some apps have in their code lines like getserial, or get whatever data, that enable them to get the requested data, and they don t need any permission for that. So they do it stealthily in our back, yes, that s it, unless we scrutinise them and force them to behave.

The article [MENTION=5075064]optimumpro[/MENTION] put shows, for those that didn t know it already, how little trust one can have with all those "nice' and "secure" projects, and why people laughing at "tin foil hats" are fools.

In the last month I have been through dozens of apps for this project I m working on, and I have seen some pretty incredible things.

Can you believe that I found google's DNS in Tor?

Yep, that says it all...

Anyway, Xposed works with Lollipop and as optimumpro said there's hope, cuz at one point it won t be possible anymore to stay with old android versions...

[MENTION=4930305]Mr.LOVER[/MENTION]

Didn t I mention in Op that firewall's scripts must have the .sh extension?

I go check, and I will add your KK lines, thanks!
[Security Discussion] optimumpro:
Basically, you need to go into source of your rom into the following directory: /system/vold/ and edit 2 files: cryptfs.c and cryptfs.h

1. cryptfs.c; find the following lines and change the numbers to the ones below:

#define HASH_COUNT 5000

#define KEY_LEN_BYTES 32

#define IV_LEN_BYTES 32

#define RSA_KEY_SIZE 3072

#define RSA_KEY_SIZE_BYTES (RSA_KEY_SIZE / 16)

2. cryptfs.h:

#define MAX_CRYPTO_TYPE_NAME_LEN 128

#define MAX_KEY_LEN 96

#define SALT_LEN 32

#define SCRYPT_LEN 64

Then compile the rom. Remember, you can't change those numbers on the rom itself.

[MENTION=4703661]unclefab[/MENTION] This illustrates the difference between stock roms (closed source) and AOSP based roms. The numbers above go to tens of files including libs. And if you know libs, there is no way whatsoever to decompile/read/edit them no matter what you do..
[Security Discussion] Froschohnenamen:
Wow, thats amazing! What device will this ROM be for?
[Security Discussion] setmov:
Here is the first one:

Samsung Galaxy Mega i9200

You can check it here: http://xdaforums.com/galaxy-mega/development/4-2-2-una-rom-private-secure-fast-t3054038
[Security Discussion] mrrocketdog:
any chance for an M8 port? would love to see/have/use it.

P.S. any development in this area deseves :thumbup::good:

"all i can really do , is stay out of my own way and let the will of heaven be done"
[Security Discussion] setmov:
Maybe in time, we have some plans, but for the moment I can't say when.

Thank you for your support!
[Security Discussion] Froschohnenamen:
Haha, that dramatically reduces target group for this ROM :D

Youve got a pretty impressive Website running for your Project, congrats. :good: And jugding from that, the plan is to encrease the amount of supported devices. Do you happen to have a i9300 in your lineup?

In other words, would it be enough to install the Stock ROM, follow this guide right here, install all the apps you have installed, test the device to be stable, make a zip file like this and put the Una ROM brand on it? If this is the case, i would be intended to contribute a ROM for my device to this project.

Oh, and by the way, could you somewhere post the APKs of your modded Tor (and probably also Text Secure and Conversations) app? Or did I overlook it?
[Security Discussion] setmov:
Thank you for the compliments. But is not that simple you have described it. Doing what you have explained is a piece of cake, and honestly it is not "just that"! The UNA ROM has features that goes beyond and reaches an outstanding level of security that cannot be comparable to any project so far. I am sure we will develop a rom for the i9300, but at the moment I cannot say when.

Thank you
[Security Discussion] Froschohnenamen:
Ok, so if its more than this I wouldnt be much use to you :p

I really look forward to see a ROM for my device, but I can understand that this takes a long time. Good luck:good:
[Security Discussion] setmov:
Any help will be useful, and helping is not only coding. Right now we are developing 4 more roms, then we will concentrate on other models like your i9300. So probably you will not have to wait that long :)
[Security Discussion] unclefab:
Yep, there are not many people on the Galaxy Mega forum:eek:.

At the moment we are working on releasing Una for the Galaxy Grand, the Galaxy Grand 2, the Galaxy Tab 3 Lite and the Galaxy Note 8000 (Note 10.1) cuz those are the devices we have at hand. Alas, those devices are not very popular either:(.

Once it's done we are thinking about supporting more popular devices, and the I9300 is in the list.

In the meanwhile you can apply the tweaks and mods described in OP, but that won t make your ROM an Una since there are more changes under the hood, plus the theming (cuz secure doesn't mean ugly;)).

That said, it would be a good start, your phone would be much more secure, faster and less battery hungry.

If you want to be a tester for the I9300 we can talk about it later, but let us finish the 4 ROMs first.

A port for M8, in theory it s possible, but the problem is that we are only 2 persons actively working on the projects so obviously our time and energy are limited...:(

Plus, it s quite difficult to make such a ROM without having the device at hand, cuz there are so many things that are modded and edited everywhere in the system that you need a lot of testing to make sure that the ROM is usable and stable enough.
[Security Discussion] dawgdoc:
That's good news, because then, maybe, it could be extended to the i747, also a Samsung SGS3.
[Security Discussion] HeathenMan:
i would test for i9505
[Security Discussion] mrrocketdog:
:thumbup: test for M8 , rooted , unlocked bootloader , superCID , s-off , nands on PC , learning fastboot. :cowboy:

"all I can really do , is stay out of my own way and let the will of heaven be done"
[Security Discussion] setmov:
What kind of problem? Could you please explain this "loading problem"?

Thank you for your interest
[Security Discussion] Cyclu:
First big thanks for your thread as I'm worried about security and privacy it's a pleasure to see the people's who feel the same.;)

About XPrivacy pay attention to gray triangle icon next to these functions which means no usage data or rather

we don't know for sure if such functions is really used or not.

Here the functions without usage data:

https://github.com/M66B/XPrivacy/blob/master/src/biz/bokhorst/xprivacy/Meta.java

identification", "SERIAL", "", 1, null, null).restart().noUsageData())

internet", "inet", "INTERNET", 1, null, null).dangerous().restart().noUsageData());

phone", "Configuration.MCC", "", 1, "2.0", null).unsafe().noUsageData().noOnDemand())

phone", "Configuration.MNC", "", 1, "2.0", null).unsafe().noUsageData().noOnDemand

storage", "media", "WRITE_MEDIA_STORAGE", 10, null, null).dangerous().restart().noUsageData())

storage","sdcard","READ_EXTERNAL_STORAGE,WRITE_EXTERNAL_STORAGE,ACCESS_ALL_EXTERNAL_STORAGE",10,null,null).dangerous().restart().noUsageData())

storage", "mtp", "ACCESS_MTP", 10, "2.1.1", null).dangerous().restart().noUsageData())

By cons is true that the applications can get our data and use certain functions without required Android permission (orange triangle icon without green key icon) for example app's with InApp Billing access systematically to our Google account (function getAccountsByType under Accounts category) without required permission GET_ACCOUNTS is only one example among other possible case.
[Security Discussion] optimumpro:
I don't usually quote or respond to myself, but this is just to illustrate the point: I have just found out that OpenWhisper no longer supports SMS encryption, only push messages that go through Google. Neat, isn't it? The dev has removed the last "weak" link that gave trouble to his paying sponsors: people could compile textsecure themselves and use it for SMS only without GAPPS, which meant that Google/Government wouldn't get the master key to decrypt the messages. Now, things are "perfect", you use an open source app without back doors, but Google Services Framework gets all your data including the master key sent to their servers. Wouldn't you (if you are a spying spook) give a couple of millions together with What's up contract to reward the dev for this? Shame and pitty...

P.S. There is a fork of textsecure that uses a pure sms encryption scheme. Here is the source:

https://github.com/SMSSecure/SMSSecure/tree/master
[Security Discussion] setmov:
And here is a new one:

http://xdaforums.com/galaxy-grand-duos/development/una-rom-secure-private-fast-t3062614
[Security Discussion] Primokorn:
I've just seen the recent Lollipop section which should be updated since Xposed is available now. I know that some things do not work yet but we can still use App Settings and Xprivacy (under certain conditions though).
[Security Discussion] Mr.LOVER:
[MENTION=4703661]unclefab[/MENTION] bro dont forget galaxy note 2 GT-N7100 for una rom [emoji39]

Sent from my GT-N7100

---------- Post added at 05:15 PM ---------- Previous post was at 05:11 PM ----------

is there a firewall script which block every inbound and outbound traffic and then allow only exceptions?

and is firewal rules applied on wifi hotspot?

and if there is a comprehensive guide for securing PC? on windows or linux whichever is more secure?

Sent from my GT-N7100
[Security Discussion] Primokorn:
AfWall+ (new beta available by the way)
[Security Discussion] iunlock:
Wow, really?! I hope so....This is crazy as I've just made a post about my concerns about how Xposed isn't working smoothly (in most cases at all) because of the lack of update of Xposed for Lollipop.

For anyone who's interested, would you please be able to give some insight on my post that I've just made? I'd greatly appreciate it.

I have a Note 4 now on 4.4 (VPN, Xposed, Xprivacy, AFWall+ all working almost flawlessly), but am wanting to get the S6 Edge until the Note 5 comes out. But....the S6 comes loaded, as we all know, with Lollipop 5.0.1. SUCKS! Grrrr..

So here's my post that I've just made.

Decisions decisions.....
[Security Discussion] Primokorn:
Xposed will work on the S6 only if you flash an AOSP/CM based rom because Xposed is not compatible with TouchWiz yet.

A beta release will be pushed this week normally (idk what is the changelog).

Xprivacy works pretty well on 5.0.x and it is ready to work on 5.1 as soon as rovo89 posts a working version (beta or stable enough without the need of flashing a zip).