[Security Discussion] unclefab:
Sorry guys, I'm rather busy at the moment and I don't come here very often...

[MENTION=2595499]iunlock[/MENTION];

I skipped KK (I'm still on JB and I don't plan to "upgrade" any time soon) but at the moment I'm working on a phone running LL 5.0 and it gets on my nerves, to say the least, because yes, it's full of nasty stuff.

I'd say that if you want to take the plunge to LL you''ll need a device whose kernel source is available and built that kernel yourself, slashing this and that on selinux' policies, or even removing it alltogether and replacing it with one of the available alternatives, and modifying this and that here and there.

Then, you will have to go through the art headache (no more dvm), it took me time to figure it out but once it's done it's possible to more or less follow the guidelines I gave in OP and uninstall apps, jars etc.

If the phone is a 64 bit model you'll have another trouble because there will be 2 folders in /system/framework (one for 32 bits apps and one for 64's), and thus 2 folders in the dalvik-cache, and it may be a bit tricky to deodex. Plus you will see that even if you delete the 32 bits folders the dalvik-cache 32 bits section gets recreated.

Well, all in all it's interesting for me to work on a new OS, but I can't say that I recommend LL, for me JB is still the best (plus, the multiwindows Samsung had until JB 4.2 was awesome with the minimize icon on all full screen windows, unfortunately they completely ruined it from 4.3 onwards)

About Samsung and the knox fatigue, I'm not sure whether a knox infested bootloader can be modified or not because I didn't check (but I guess it's not possible, feel free to correct me if I'm wrong), my next phone won't be a Samsung.

For the keyboard, they all are more or less full of outrageous permissions.

Hacker keyboard isn't, but it doesn't allow swipe gestures which is a deal breaker for me.

I personnally use a modified xperia keyboard originally made for JB, but it doesn't work on KK.

I plan to try to make it working on JB and LL when I have time, but I don't know when that will be.

That said, I have seen on the apps and games section other more recent xperia keyboard modded to work on non sony devices, their permissions are not too invasive compared to Samsung's, touchpal or swiftkey.

Still, whatever keyboard you use can be restricted.

Appsettings can do part of the job, then Privay Blocker can finalise the job (or you can do it by yourself, it's more fun).

[MENTION=4289125]HeathenMan[/MENTION]

You shouldn't care too much about apps' updates, most of the time it's only cosmetic and more than often they add more spying, it's only once in a while and once in a blue moon that they put new functionalities, except for apps that were in alpha or beta phase.

I use to praise xprivacy too but I realised that it is overrated and gives a false sense of security.

Many restrictions can be circumvented (they are the ones that show an open lock) and xprivay can't restrict the android system from accessing internet or sucking your serial number and other IDs, so what's the point?

Nowadays I only use it to see what data apps try to access, and I mod them accordingly.

A much better solution is the firewall, because it really does restrict internet for everybody.

From your screenshot I see that your phone app had internet access, so first restrict it in the firewall (actually restrict all apps, except the ones that need to have internet access like your browsers, and depending on your rom maybe media server).

Then in Network Log's settings uncheck resolve hosts, that will show the connections' IPs instead of the DNS names.

Once you have those IPs you can put them in a firewall script (see OP).

Done!!

If you want to read more about firewall and IPs blocking, have a read at the exchanges I had with optimumpro earlier in this thread (it starts in the 7th page)...