[Security Discussion] optimumpro:
A little common sense here, if I may:

Let's say someone is using what's up or similar social app and they have you in their contacts, which are stored on Facebook's and Google's servers.. So, what's the big deal? They don't have your device, they have no serial number, simcard info, location, mac address and other important things. They can't track you. Yeah, facebook and google have you. So, what? They probably have you anyway through their paying masters. Well, socio/psycho-paths owners (the ones who say I don't believe these dumbf**ks trust me their private info) can have my name and address (it is in public domain in most freedom loving countries anyway), but that's not what we are talking about here. We try to protect our devices from giving out info that enables them to track us and this thread is right on point here.

What's the point of continuously talking about the futility of software, because you can be hacked through hardware? Well, as I have already said if they go at this length to get you, then throw away your phone and run (these attacks are not going to be coming from social sites). There is nothing we can do about hardware, other than try to isolate it to some extent and here is what I do in my roms:

1. Kernel: disable selinux and replace it with inbuilt Tomoyo or several other linux alternatives; disable hardware based random number generation; enable (disabled by default) linux regular random number generation; enable (again disabled by default) all ciphers/block modes/digests etc; disable android logger; restrict various debugging tools; disable hardware crypto modules and drivers, i.e. isolate hardware.

2. Disable background wifi scanning (preferably in source). Even if your wifi is off, thanks to Google, back ground scanning goes on exposing your mac address, which can identify you. So, you travel in a city passing different wifi access points and you can be easily tracked. So, if background scanning is disabled, when you turn your wifi off, it is really off. Why I say it should be done in source? Because you flag to the system (before compiling) that your wifi chip has no background scanning abilities and tens of files including libs are compiled with this flag. If you do it in framework-res.apk, it may work, but the ability to do background scanning is still there.

Airplane mode. If properly implemented and you use it, it takes care of over the air baseband attacks, especially in devices with non-removable batteries.

However, the best case scenario is described in "Hardening Android Mission Impossible" article by TOR people: you carry a small GSM/LTE dongle with simcard and wifi access. Your phone is in airplane mode and connected to the dongle through wifi. You can still make and receive all calls and use data, but the baseband is in the dongle and separated from Android/phone data/phone ram. Yes, you carry the dongle with you all the time, but it is smaller and lighter than a phone, just a little larger than usb flashdrive.

The good rule of thumb is: don't install any internal apps from social "services." This way, you won't have to restrict their activities in Xprivacy, which may result in crashing. Use your phone as a desktop when it comes to the internet. You can access all your loved social sites through the phone's web browser. And when it comes to messaging, have a client that encrypts content and use a separate server for communicating.

P.S. Be careful with removing stock keyboard, because if your device is encrypted, the system will be looking for that keyboard on boot and as a result, you will have a password prompt without a keyboard, which means you are deep in a sea of troubles... :)