[Security Discussion] iunlock:
Now we're cooking boys! I've just read word for word the entire posts and that long thread posted by CHEF-KOCH AND everything in between with all this ping pong going on....

As a security/privacy junkie just wanting to know "how," I can see a lot of points from both sides....

You're absolutely right about this one. I would bet 99% of the people who use such apps and Xprivacy for example, configure their set up AFTER the math....that is indeed, pointless. What good is it if you've already transmitted your data to said apps and have given them everything they wanted in the first place on a silver platter? I've commented on this in the respected thread and sure enough only one or two people even commented on my questions. I'm thinking because most were too ashamed to have realized that they've already screwed up. Now to be fair, taking such preventative measures are for the hard core enthusiasts which are few, however, the fact does not change that setting it up after the math defeats the purpose of Xprivay's function. For the majority of the users, they are using it to practice preventative measures....I guess? Well okay....but doesn't that make it an oxymoron to do such a thing of setting it up after the math? (ie...You've already given your apps what it wanted ....it's like giving a hacker everything they wanted to hack in the first place, once, but that one time is all they would need regardless of you shooting blanks at them thereafter....)

I believe you have stated that, ".....because the best implementation is useless if the user don't know how to deal with or just make stupid mistakes....." - I guess doing things after the math is a stupid mistake.....but for most it is an honest mistake.....once it is realized then yes I would agree that doing the same thing over again that you know is wrong is: Stupid.

On another note, I've noticed that you had replied to one of my recent posts where I had said, "...My philosophy is just doing the best we can with what we have available...."

Therefore, at the end of the day, even if a user does something after the math, at least they are one step further than one who does nothing....to be fair...

I'd like to also add that most of the people, including me LOL.... don't really have anything to hide....nothing even close to serious....we're just regular Joe Shmoe who likes to have fun, hang out, watch football.....whatever.... the point here is that some of us have a different outlook on security/privacy and just don't want them b@$#@rds all up in our $#!^....know what I mean? Yes, that includes, "....hey hun dinner tonight at xyz? love you....etc...." - If you know you can do something about, why not try your best?

SOLUTION:

(For the sake of this thread and this wonderful community, please do correct me if I'm wrong, but here is ideally how one should set up Xprivacy.)

Starting fresh from a brand new device/after flashing a new ROM, upon setting it up, do not connect to the internet.

Transfer over Xprivacy from your computer to your device and set that up.

Transfer over only the apps that you use to your device, but do not set those up yet.

At this time load your saved configurations (Xprivacy) if you have them. If not, just proceed....

Download an app called, "Network Signal Info," install and launch the app.

You should see a pop up window upon launching the app asking for permissions.....Deny/Allow accordingly....

Once you're in the app, go to System Info (within the app itself) and look at your IMEI / Phone Number etc....and see if it's shooting it blanks....if so, you know that it's working....This is a little test that I do before setting up all my other apps...

Install your apps one by one. (If you did upload your saved configurations, you may still be prompt a pop up window....) In that case....

After you launch the app, you should see a pop up window asking for permissions....Deny/Allow accordingly....

Yes, you're setting up each app one by one, but it is what it is.....in most cases though once you have Xprivacy installed, upon launching an app you'll get the permissions pop up window....so just Allow/Deny accordingly.....

OR you can just go into Xprivacy after you have installed an app and configure manually.

You'll want to do this so that you are properly configured before even connecting to the internet so that when the apps do ask for whatever permissions, you're giving them what they want, but with blanks....

Again correct me if I'm missing anything.

This is exactly what I wish there was more of.....which is also why I'm thankful for xda. The issue that I see in a lot of write ups is that a new user has to go through hundreds of posts just to find a simple answer to a simple questions. Even with doing a search, that doesn't guarantee one will find what they are looking for. I really like how some threads have a FAQ section in Post #1, so that it would save a lot of time for someone who's actively seeking info....this is not to be confused with being lazy and not wanting to read. There are obviously perks to that as well, but I think efficiency would make this a much more productive community. So the solution? Perhaps highly suggest all major posts to provide a FAQ in the OP. Just my take....

I'd have to disagree with that "we already trust our providers by choosing them." Maybe for most who don't care about all this stuff, just does so by default, but for some of us (like us all here) we just go with our provider knowing that we have to do our part to bring about the preventative measures in practicing good security/privacy habits. I don't trust my provider and I don't expect them to be any line of defense in providing me security. You and I know for anyone to think our providers will provide such security/privacy is a fairy tale. They keep logs and will keep logs. They have access to whatever they have access to. This is why we resort to certain apps and protocols to utilize encryption.

You're right about the logs though....but to think they will be destroyed in any timely manner or if at all, IMO, can be an illusion for the sole purpose of making us think they'll be gone forever. Most have the time frame disclosed in their terms...some 30-60 days...some 6 months...some a year...some 2 years...but again, it's not about the logs that we need to be worried about, because it is what it is and they'll log as much as they want; it's about preventing the content that we are wanting to protect to show up in anyone's hands in the first place..

Drum roll please........."Isn't this what Lollipop has more of?" ---- What a piece of rubbish LP is.....just a nightmare all over again.....

---------- Post added at 07:55 PM ---------- Previous post was at 07:10 PM ----------

Ok so with all this debate going on, which is GOOD for keeping the fire lit, I have some questions and comments for anyone to pick at. As a reminder, this is for the average Joe who has nothing to hide and just wants privacy/security.

Sorted from what I think is the most overlooked (TOP) to looked (BOTTOM):

Keyboard:I have been baffled for the longest time on how little this is talked about among the security threads. I've seen security junkies who goes all out with their device, yet use an aftermarket keyboard that can compromise everything "security/privacy," by recording all his keystrokes. I mean come on....am I missing something here guys? Why don't a lot of people realize the importance of the very real reality of your inputs being captured and sent away to who knows where for who knows what? (Not that we don't know....I'm just saying...)

SOLUTION:

Thanks to "unclefab" for enlightening us with an answer to this by the way.

"For the keyboard, I use a modified version of Sony's Xperia keyboard, you ll find it in the add-ons section of the Una web site, along with explanations about the restrictions you ll have to apply to it.

I quite like that keyboard, it works without connecting anywhere, and it doesn't mind to have everything restricted in Xprivacy except the loadLibrary field."

For the longest time, I've been just using the stock Samsung keyboard. Believe me, I've been weary this whole time, but at the same time I figured it'd be safer than some random ol' third party app that asks for a million permissions.....who knows....but hey....if anyone has any input, please do share.

Is the stock Samsung keyboard safe? Or any stock keyboard for that matter....

VPN: It's funny how this is debated and I still don't understand the other half of it when someone says that using a VPN doesn't help. Really? You gotta be kidding me right?

Correct me if I'm wrong: So for the nay sayers, you're telling me that you'd be completely content sitting at the mall connected to an open WiFi and doing your online shopping, perhaps ordering your passport, signing up for a new credit card, all things that require sensitive info and be okay with it; completely ignoring the fact that you could fall victim to a middle man attack? Seriously?

Of course there's that whole thing with...."You have to trust your VPN provider etc....blah blah blah..." Well duh!

I'd rather take my chances on trusting my VPN provider than leaving myself wide open. I still believe that there are some good VPN providers that exist.

Firewall: AFWall+

"...make sure you go to settings and enable builtin iptables binaries as android system's ones are modified to allow "phoning home (Google servers)." - Thanks "optimumpro."

Browser:Thanks to, "optimumpro," -

"I recommend an F-Droid version of firefox called Fennec: https://f-droid.org/repository/brows....fennec_fdroid. It is the same firefox with several tracking/reporting binaries/modules removed and unlike Palemoon, it is updated as soon as Firefox is."

Encrypted Chat Client: Conversations App.

"Conversations app is good. You can use any Xmp server including Google and the other person does not have to be on the same server. The app takes care of content and vpn - of anonimity." - Thanks "optimumpro."

Mail Client: K-9

Encrypted Call Apps: Having encrypted calls is just a preference that I'd like to have. I deal with private client info etc....sensitive info..... of course I don't care about all the other general calls..."Hey hun, want to go to the movie tomorrow?" etc....that's not what I'm concerned about. I just want a sense of privacy when talking numbers and financial info as I don't trust them. (The others). So between one of the encrypted call apps and being connected on VPN on both ends....pretty solid? Red Phone or Silent Phone....yay or nay?

Passwords: I use 50 character passwords for everything, unless it only allows 21 characters. This brings me to using Password managers like OnePass or 1Password, which again...goes back to the whole, "....you have trust your password manager provider etc...." - That's another, Duh? Really? - The point here is.... I'll take my chances.

Do keep in mind that you don't have to label your saved password as what they are LOL. In my case, I don't as I only save the password and and a hint for the description so only I know what that password is used for. This is just another layer of security that I use to practice ...well....common sense really....

--

Thanks for any input! I'm so glad that this thread is here....