[Security Discussion] CHEF-KOCH:
The opposite to install third-party software to hardening the system

I never wrote anything about that only my stuff is 100% correct or that I know all the answers, but it's very hard even for experts. I won't call me expert, since I don't like that term, we all can learn anything new all day the whole day.

My exactly words are that I don't like such guides or tutorials and of course the logic behind it (because it's horrible wrong for several reasons I already gave). Which is okay if you don't agree with, but always provide something I/we can work with as long this isn't done it's all pseudo talk from guys which don't even know what some things working. It's the the moon landing myth, there are already huge "fans" pseudo experts which "showing" wrong fact's that we aren't at the moon yet - it's so terrible wrong and shows how naive and stupid some people are. Or simply, they believe it because they don't better know it or are to arrogant to accept the truth (Btw. there is a mirror at the moon which proof that we was there - just use a laser and the light will come back to earth).

But as you may realized I already gave a huge collection examples and show a lot of possibility's, one was the "airport" story, so how many tools can prevent me or you to get under the microscope if a friend is suspected by this?

Apps, Software and such recommendations are as written -> useless. With every new app that popups on F-Droid, Aptoide, .. people telling again and again others "hey use this app ...xyz" without any proof or logic behind that. Such tools are usually build by one or two persons which be like smart, but in fact there are stupid because they don't even know how the software works what they mod (btw sometimes without any permission, see WhatsApp). Some mods are really okay, but most are just useless. It's really a lack of knowledge why so many tools popping up, myths, rumours, supineness and such, see the whole taskiller android story, nothing such myth that it safes battery (if you 2 second use your brain how can what safe your batter if you kill it and it starts again and again -> in fact because of this it coasts more battery). But people, always naive. If you don't want it why you installed it? Or why not ask the developer to fix it, NO - a lot of easier install another tool which also coasts battery to kill/freeze, whatever it.. Makes me laughing so hard. Funny how that still works, even malware use such stupidness (called fake AV - install it to secure your PC ... just another trap).

No tools no spying and no battery will be lost - that's how it works and nothing else. But okay, use a Google OS and claim it will communicate with Google. Funny²

If people would read more such FAQ/Readme/Wiki's none of such "problems" would exist or only a few of them. And speaking about reading, here it comes what will be send by Mozilla (which can be disabled), just for people that believe another myth that is "spying":

https://testpilot.mozillalabs.com/privacy.php

http://kb.mozillazine.org(Connections_etablished_on_startup_-_Firefox

For manual user feedback): http://input.mozilla.org/en-US/feedback (change en-US to your lang code)

http://forums.mozillazine.org/viewtopic.php?=38&t=5333209&start=0&sk=t&sd=a

So, as everyone can see it's well documented and there are los a lot of other links to show what exactly will be transmitted and of course to bring the source argument, it's also in there. But okay, people still thinking it's "spying", wrong it's called legit feedback which can be disabled anytime in every Firefox version, but okay. - Ignorance as his bliss.

* Just disable the following: Telemetrie, crash reporter, location service, beta-status service + optional (you may see this also as "spying" even if it try's to secure your connections -> the webpage analyser service

So, after that, show me any proof that there is still connection. I tried and nothing is to see. If you really think every connection to a service is always evil than explain me why. If you don't like xyz service, than nobody is forced to use it.

Cloud is just another word for server, so without it nothing works. Good luck if you don't use it, than why you are on XDA is also hosted on a server.

Don't know what you meant by "sitting ducks" it's also horrible wrong, I'm the one who said ask your provider, start a demonstration to the "right" thing, if you think that's sitting, than what's not sitting?

You horrible wrong states about that software and encryption, always, Snowden and the documents you never read (given as a spiegel link at the end of my article) shows that it's such kind of useless even if you are that smart and genius to managed somehow that the software itself isn't attackable (I know no one btw).

The hardware aspects means that for example, if your CPU is already "infected" (well, the wrong word) or manipulated your strongest generated passwords are such kind of useless, but it's way beyond your horizon because you think that the software gives any protection against this, it's definitely wrong. If something is manipulated direct on the hardware, the software you using on it won't even recognize this. My story to this was the proof that there are sometimes two cables (one for encrypted and one for unencrypted "raw") traffic. And these was one one example. I know 100 more and it's already confirmed by Snowden and others (a long time).

Yes, again Google Play services doesn't spy, you think I'm wrong, show me me what did you reveal and we can talk about this but as long there is nothing, it's nothing just paranoia to tell people it does spy without anything. If every connection which is made from your router to the internet spying, than just disable your internet connection and enjoy it. Not every attempt/connection is spying and only because there are "some" bad guys out there this doesn't mean automatically that all is spying on you. Always provide proof or you are just the paranoid guy talking bull****.

Again about that app/software logic that it secure something. It's definitely wrong (again for you only - but I already wrote that in my other post):

* Software is a lot of easier to hack instead of something which is for example implemented in a hardware (like a NAT-Firewall) (also the reasons I don't need any Software based firewall)

* Software is the last line of defence not the first, if all would be builded by design to secure anything we wouldn't need any third-party apps/software to "secure" our data

* Software especially on third-party sources is always a risk, especially on "trusted" servers like aptoide good joke)

* Software never prevent me or a hacker to get access to your stuff, no encryption and no app locker app (it's a matter of time and the question how many effort the attacker will spent to get it)

* Software not preventing anyone from several other attacks, social engineering (I don't need to hack anything if you gave me what I want via Browser fingerprints, asking, email pishing, whatever...)

* The most people does not spent the time to install million apps + configure them (install and that's it) - as said I think tutorial how to "proper" configuration them is more useful instead of showing people which app is secure and which not, because they simply don't care about.

* The best software is pretty useless in the wrong hands or if it's to complicated to the user.

So you haven't denied that, the whole software argumentation seems pretty useless.

Abut admin accounts vs non admin accounts, it's true that this will protect some attacks, but since we are not in the 90's anymore it's useless to since most attackers want your money and data and not destroy your OS. Every year there are several exploits for Chrome, Firefox, Java, ... to proof and show how "easy" it is to escape from sandbox, well, to restrict such stuff is theoretically good but in fact it is very complicated and complex which under the lines explains why there are so many exploits.

Sandbox + Guest account is theoretically okay, but in fact this also can be pretty easy bypassed and again, why an attacker would spent 100 hours to hack if you gave them all what they want via sql injection - You tools (if that attack was good coded) won't even notice that if the site is infected or not, the same was done by some "genius" silkroad guys, they are so smart that they not noticed they were infected by the FBI. (also truly shows that TOR and other services automatically "secure" anything and it should be already clear).

Story:

http://www.forbes.com/sites/andygre...the-webs-biggest-anonymous-drug-black-market/

Yes, I can setup SU I can setup any software because I 'm so genius, ... I must really laughing because of such arguments. I already told you twice, not all people are that smart and you can't say that the mass read the whole day the documentation to really set-up the tools so that it will protect you against xyz. And even if all is "correct" that also not preventing anything, since, oh, again, sideloading,.... End of the story.

AFWall use iptables, which is very good, but it's itself just a GUI, that's it (which of course can be disabled directly on the OS or under CWM/TWRP or adb, and and and ... Sure, not all OS including all external binaries such as iptables, but even if you are so smart to control such stuff via Terminal Emulator or adb/scripts or whatever, that also can't prevent any hacker to get in if you installed any malware app or trust any external sides which claims to be secure but in fact they are already infected without knowing it - And these are only examples without the human factor. You gave me/us lot of apps but not said anything which IP are from which app. (human factor)

Btw, Sound recorder doesn't even have any internet permission so there will no internet traffic, nice try. But I smile if you say that an account syncing app needs internet, what's the point? Because it sends heartbeat and other stuff it must be automatically evil, than show me/us. You may should better read some stuff how (insecure) http works and what some apps need at the startup and you would realize that it isn't evil at all - you just think it is. Yes, some apps are maybe bad, but maybe not. Difficult to say without any exact information. Again, just to scare the people - the internet is dangerous, yes.

Funny you talking about XPrivacy, AFwall and other projects I contribute but okay, someday you realize that I already helped a lot in this projects and wrote a lot of guides about it,... So I think I know what I'm talking about, thanks.

You also may realized that "based" on is never be the same, so without any proof it's also nothing we can talk about. You know what Debian is also based on Linux, same as 600 other distributions and that doesn't mean that all working the same because different kernel versions (fragmentation - same like on Android), different compiling flags, different reasons why this was compiled for (server/workstation/desktop environments), and and and,...

Instead of telling me/us how genius you are, why not wrote an article about it? It would help much more than your pseudo recommendation to any new app which claims to be secure like that Fennic modded/manipulated package?

Good that you the first time give us an example what is blocked or what do you think it's insecure, now let me explain. These IP's you gave are from what? Which packages and which running processes? You see I can't explain something without proper information.... So to post random IP's which may be bad or may be good is just pseudo security talk and scares people without any real facts. I can gave you now million domains which are definitely scam sites or pishing sites or infected by malware, but that doesn't mean now all people are affected by this (as long they not visit there sites). This only shows how easy it is to scare people but nothing else. I agree that there are a lot of possible sites out there which are definitely untrusted but as said, if you use just some brain you don't even need such apps + in most cases brain or apps doesn't matter since there as said a lot of possible attacks out there which can't be that easy blocked. Bios malware and such. But okay, you always ignore that,... It's just how people argument like this.

Yes, I keep in mind you are so smart, using no social media, no gapps, no accounts. If that is really true why you are on XDA, it's also on a cloud server and a social media related platform. Don't understand that logic, XDA and other servers are secure but Google is automatically evil? Are you so naiv that you believe that you can escape? If you visit a server site it automatically detects to other servers too, for ads, login, whatever, but oh, I forget, your tools protecting you against all this - let me guess uBlock and NoScript what? So genius you are really. Makes me laughing again, people really think that will change something, .... Please again do me a favour before you wrote something check if it's already in the given NSA leaked documents or not. After that show me/us tools which aren't compromised/or by design secure, you will find zero -> 0.

No, Snowden never said it works, read again, he clearly said that encryption isn't enough. Just for you: http://searchcio.techtarget.com/opinion/Snowden-Data-encryption-is-good-but-not-good-enough

In fact he said that what I wrote long time ago on some sites they not exist anymore or difficult to find since some boards don't use any google seo stuff to hide from the search (for different reasons).

I always give credits to the agencies, it have nothing todo that (like everything else there are some stupid idiots) but they have simply the money and knowledge + power (means they buy talented hackers) to break the most stuff at the lowest level and such attacks are very very hard to protect with security tools people mentioned over and over and over again and again.

If it comes to security, imho there should be no compromised, that's why I'm saying it should be there for all activated from the first day and build with maximum security the first day. So, again no tools necessary, but only for you another example. If all would be encrypted by known "trusted" algos stupid people like us wouldn't care about the whole bad IP argument but since this isn't always done and possible we still need to care about. I'm not saying that this would mean we should be careless give all our data to the clouds but it would be help a lot - that's how security should work - and not install xyz and our stuff is still vulnerable and will be send in plain text to every xyz server. Of course, the human factor - the solution should be available for all, (not only experts) and should be work without any bigger configuration - You may realize that your enemy "google" already worked on a successor of http (called http 2.0/spdy) and remember that without google some sites including XDA would never exist and the internet wouldn't be that what we know todo, and if every user activate on all pages there Ads blocker you don't even need to wonder why there is so many "spying". We need to pay our bills, yes - as you said compromise - free or paid and since people don't want all for free there is "such spying".