yashsingh1/xdaforums huggingface dataset:
[Nexus 6  General] :
Now that I'm on a Nexus 6 full-time I can start adding to the thread on a more consistent basis again.

Part of my hesitation using Keepass is in choosing the right database and version:

https://www.keepassx.org/

http://keepass.info/

Part of the challenge on Android, for myself, is finding something FOSS, preferably on F-Droid, and that's updated consistently or, at the least, has a presence or takes advantage of the community on XDA. Perhaps someone else can chime in?
[Nexus 6  General] mexiken:
This thread is great and all but you don't mention anything about devs and ROMs that use test keys, leaving a rather gaping security risk????
[Nexus 6  General] Utini:
test keys.. you mean certification keys that are stored in Android? Or signing a .zip when compiling a ROM ?

Yes you right, choosing the right ROM and DEV is an important thing but when I started this thread I wasn't trying to go that far but instead give a general overview and what everyone can/should focus on (including stock ROM users). I will add a section for ROM/DEV but I wonder what exactly you would expect ? :)

Thanks
[Nexus 6  General] :
https://keepass2android.codeplex.com/

I've been slowly looking at every Keepass app in the Play Store and F-Droid. This looks to be the only app that opens .kpdx but it's not regularly updated, sort of works with Android M and not on F-Droid. Everyone of these applications feel like one man bands with very little eyeballs on them. Not something I'm happy with and particularly mystifying given today's climate. Is there no XDA, community backed, Keepass application?
[Nexus 6  General] Utini:
KeePass2Android was updated ~1-2 months ago? I have been using it for 1-2 years already without any problems. But yes, a community driven prioject or smth opensource would be nice :/
[Nexus 6  General] :
https://git-annex.branchable.com/
[Nexus 6  General] Utini:
What exactly are you trying to tell us with this link? ;P
[Nexus 6  General] :
The whole Lastpass hack has really got me into looking at password management again. There is a great thread on HN:

https://news.ycombinator.com/item?id=9727297

And in the middle they point to this paper:

https://www.cs.ox.ac.uk/files/6487/pwvault.pdf
[Nexus 6  General] Utini:
I think this isn't the first time LastPass got hacked... this is one reason why I prefer KeePass (over anything else) which I sync over my own server (or dropbox, or iCloud, or ftp, or what ever you want to use).
[Nexus 6  General] :
Yeah, well. I tended to favor Keepass myself but after reading the thread I'm left questioning the implementation of the crypto. I'd also like to see a security audit before I fully trust it. I keep looking at Pass but it looks PITA to move across multiple devices.

http://www.passwordstore.org/

I'm watching the HN thread with great interest. I'm also looking forward to Alan Jude's take on it:

http://www.jupiterbroadcasting.com/show/techsnap/
[Nexus 6  General] :
http://www.infoworld.com/article/29...managers-for-pcs-macs-and-mobile-devices.html

Good overview of mid 2015 password managers.

Some good information on Security:

https://www.reddit.com/r/trackers/comments/30xtk9/trackers_security_and_you/
[Nexus 6  General] Utini:
The first link is nice to read. Seems like KeePass is the best choice. LastPass scored a bit higher but looking at all the security leaks with LastPass in the past I rather not use it. Will add those links to the OP !
[Nexus 6  General] mva1985:
I use SafeInCloud. Any thoughts?
[Nexus 6  General] Utini:
Not from me, I haven't tried it and never really cared about it since it is not free and KeePass (free) has everything I need and probably everything that SafeInCloud has as well. Generally speaking all those big cloud companies are causing a risk as they are the main target due to the massive amount of data that can be stolen from them. No one will really care abou a small home-server that you use for your own syncing or similiar.
[Nexus 6  General] Utini:
28.06.2015 - Updated useful resources & links (links from [MENTION=2842059]bmstrong[/MENTION])
[Nexus 6  General] muppetmania:
TextSecure is open source, totally free and fully encrypted. Making it better than either Telegram or WhatsApp. Yes, I know Telegram claims to be encrypted and I'm sure it is, but we have no verifiable proof that it's truly secure.
[Nexus 6  General] :
Agreed. I have have grave doubts about Telegram.

New Keepass application in Material:

https://play.google.com/store/apps/details?id=com.lukaszgajos.keepassmob

https://www.reddit.com/r/androidapps/comments/3bfx0d/dev_keepass_in_material_design/

2FA:

http://www.pcmag.com/article2/0,2817,2486877,00.asp

VPN:

http://www.net-security.org/secworld.php?id=18571
[Nexus 6  General] :
http://www.networkworld.com/article...-two-factor-authentication-goes-wireless.html

https://engineering.gosquared.com/evolution-of-password-security

Pure fun:

http://www.wired.com/2015/07/online-anonymity-box-puts-mile-away-ip-address/

and:

https://guardianproject.info/2015/06/30/orfox-aspiring-to-bring-tor-browser-to-android/

http://readwrite.com/2015/07/01/medium-passwordless-system?utm_source=feedly&utm_medium=webfeeds
[Nexus 6  General] :
https://news.ycombinator.com/item?id=9789729

Really good thread on web based email services.
[Nexus 6  General] :
https://neosmart.net/blog/2015/never-store-answers-to-security-questions-in-plain-text/

https://www.quora.com/What-does-Adrián-Lamo-use-to-manage-passwords?share=1
[Nexus 6  General] DarqAnshin:
So I thought I would add my two cents about KeePass vs LastPass.

I've done my own independent studies and tests. These are by no way professional so take it with a grain of salt.

LastPass:

Pros

Cloud Based

Easy to Set up across multiple devices

Yubikey / 2fa

Allows for easy management of sites for monthly changes

Cons

Cloud Based

Breaches on their side could leave you exposed to anything

KeePass:

Pros

Secure

Less exposure to risk due to location of file

Cons

Integration is not as easy to use

loss of a file could pose complete loss

anyone gets a hold of your file and you could have complete loss

So playing around with both files (obviously I'm not going to try to hack the server side version of LastPass)., but you can download your entire database in its encrypted form, which I did. Both KeePass and LastPass hold up to the encryption standards, however as for ease of use across multiple platforms I have to give it LastPass.

Using tests like memory peeks to see what was available in memory, clipboard exploits, and similar yielded relatively the same result for both apps

Performance on devices:

KeePass is all or nothing. You either have it open where it balloons in memory till everything has loaded or its closed and off and out of memory

LastPass has a smaller footprint, but remains in memory for 15 minutes before logging out. It does remain in memory.

Both had small performance drops while running, with LastPass having the smallest decrees in performance consistently on my Note 4/Macbook Pro/Windows Box

Basically I found it is honestly a matter of preference.

If you never have to sync or don't mind going through manual synching, then Keepass is for you

If you like having your database encrypted and synced across the cloud then lastpass is for you.
[Nexus 6  General] Utini:
KeePass has syncing out of the box (ftp, dropbox,.. )?
[Nexus 6  General] DarqAnshin:
http://keepass.info/help/v2/sync.html

I'm not sure of the question so I will answer it like this.

I increased my level of exposure by syncing my keepass with spideroak so I could transfer from my Note4 to my Galaxy Tablet to my Macbook to my windows machine (just left spideroak on sync) in the back

I left the default encryption on SpiderOak.

I also tested the following https://www.sookasa.com/ and used my dropbox, as well as https://www.boxcryptor.com/en but I felt like I needed to encrypt the files first before either service

So I used this on all devices:

https://www.aescrypt.com/

This would encrypt the file first then I would simply upload the file and then download and such.

Now I will admit, probably overkill, definitely complicated and after a while of trying to get generated passcodes of (bhjty7ugh uoklji,m34etrfd/88ukj2 %&TYGUHJO) <-[slammed my face and rolled for a few seconds-- not actual passcode] it got tedious.

For 1 dollar a month I bought the LastPass, set it up to use my 2fa and that was it. I was done.

Keepass is definitely safer IMO if you memorize the passwords or want to control where your data is. LastPass was definitely more convient.... by far.

Keepass's big downfall for me was the synching of passwords or such. For example I purposely killed my internet on my phone to see if I could access my passwords. LastPass allowed me to view in offline mode. KeePass did not have the updated data so lastpass won on that account.

Again, I'm doing this for fun, school, and possible career for testing. I do not pretend to be an authority and my methods may be rudimentary for some of you. The best that I can say is this. I will use LastPass for a majority of my websites (IE Xda, and many others I sign into). If Lastpass gets hacked an my data gets decrypted, well I lose but the reset method that Lastpass has makes it easy to recover.

KeePass for now is used for sites I don't plan on changing often and I deem to be a more need to know. Yes putting it into a cloud base exposes it even if I encrypt the file first. However, that is a small chance I will take to sync the files.

For what its worth:

Unencrpyted the Temp Keypass loaded up to Dropbox almost instantly compared to SpiderOak that encrypted the file as it uploaded.

Encrypting the file took about 10 seconds or so depending on the device (decryption) same thing.

Uploading the encrypted file did take longer 2 seconds to Dropbox and about 5 seconds to SpiderOak.

I see this as something to note because if the KeePass database file grew to say 1gb (Multiple sites, Wireless Passwords, Notes, Etc). The sync time, encryption time, and upload time should grow much larger. Where as LastPass will always be server side unless you do a pocket download of it.
[Nexus 6  General] Utini:
I have about 1000+ entries and my databse file is only 200kb (keypass). So I am not really worried about the file size. Also my encryption method is increasing the filesize as I chose a higher encryption. Syncing works for my flawlessly via any ftp/sftp. On my phone I sync my databse via foldersync (automatically when the phone is charging + @ wifi during 02:00AM and 03:00AM).

Thank you for your tests and results ! :)
[Nexus 6  General] DarqAnshin:
I have a few entries into my KeePass which puts it just around 1.5mb, again not too large. My method was not only using the sync method but to have tasker auto encrypt and force a resynch anytime I plugged my phone in and had wifi. With SpyderOak I found that the application was smart enough to detect deltas to the file and perform a sync, which made it nice for things such as my windows box or Macbook which I had to manually sync if I wanted to see immediate changes instead of a scheduled update.
[Nexus 6  General] Utini:
wow 1.5mb ?? I am using keepass for years now and save pretty much everything in it but haven't exceeded the 230kb yet. I also use a master-key-file so that even when someone manages to get hold of my keepass databse, they still need the master-key-file to decrypt.
[Nexus 6  General] :
Keepass FAQ and best practices:

http://www.howtogeek.com/220673/how-to-better-organize-secrets-using-keepass-password-manager/

http://www.ghacks.net/2015/07/14/ho...al&utm_source=twitter.com&utm_campaign=buffer
[Nexus 6  General] :
http://tech-ehow-com.blog.ehow.com/files/2014/09/isyourpasswordsafe_ehow_940x4567px.jpg

http://tacticalnuclearstrike.com/2015/07/yubikey-keepass-android/
[Nexus 6  General] :
https://firstlook.org/theintercept/2015/07/14/communicating-secret-watched/
[Nexus 6  General] Utini:
As always, very nice links ! I love to read the content you are posting here.. very often it is nothing new to me but just another reason to think more and more about security & privacy.

Currently I feel like malware isn't the biggest threat to me these days. I am starting to worry less about malware and more about my privacy. How often do you actually get in touch with malware and how often does microsoft, facebook, google, android, ... get in touch with your sensible information ?
[Nexus 6  General] :
I've started to tackle this myself in two ways. Digital Ocean or some combination of Sync Thing or Bittorrent Sync on my local boxes. Almost all of my data is away from these companies, except Google, at this point. I would imagine data is being touched as fast an as often as they can find a way to monetize it. On a personal level nobody probably cares but when they bundle you together with a couple million people...
[Nexus 6  General] Utini:
Hmm I personally don't sync much online either (no cloud storage) except gmail/google. For everything else (KeePass, Photos, Files,..) I use my local HTPC or my root-server. I am also thinking of switching from windows (as much as I love it) to some linux distro. I usually have all in/out connections in windows as allowed/denied by ESET Firewall. This way I deny most of the windows homecalling without breaking core functions (e.g. windows update). But every day new connection requests come up and it is a pain in the ass to configure this without breaking anything.

Well I definitely care about myself when it comes to privacy. E.g. companies these days use automated programs to analyse your CV, background check on social networks and internet and I wouldn't be surprised if there is a "secret database" which has all your stolen & sold information where companies digg even more.

And that information get stolen from you even without syncing anything into the cloud. It gets stolen from your mails, your chat history, your browsing behaviour, the apps you have installed, the places you log into a wifi,....

But on the other hand I ask myself.. do we even have a chance to change this? Is anything we try to do going to really make a difference? :P
[Nexus 6  General] githyanki:
Security - Firewall: To block incoming / outcoming traffic per app or per IP/DNS/Port. Can drain the battery and be a pain to configure on Android.​

I have been trying to get firewall working properly on CM 12.1 (5.1.1), and have not been having much luck.

AFWALL+ works if you set it up to block/allow apps always. Trying to use Wifi/cellular profiles does not seem to work for me. Must be a CM issue, seems to work for others.

http://xdaforums.com/showthread.php?t=1957231
[Nexus 6  General] Utini:
Sorry, I haven't played with FW on my Android yet (altough it might be a smart thing to do). Maybe you can ask in the CM forum for advice ?
[Nexus 6  General] :
https://www.vpncompare.co.uk/yubikey-review-a-hardware-solution-to-a-password-problem/

http://motherboard.vice.com/read/goodbye-android
[Nexus 6  General] Utini:
Yubikey is an awesome idea but I have had too many encounters where I wouldn't have the yubikey with me (simply because it was not possible) but quickly needed access to my passwords. For example at my working place it is not possible to use any usb devices that aren't on the companies whitelist (and that list is really small).
[Nexus 6  General] Utini:
Telegram is open source : https://telegram.org/faq#q-why-should-i-trust-you

Still not trustworthy?
[Nexus 6  General] muppetmania:
This is the key problem with Telegram. They keep trying to pass themselves off as secure, but when asked hard questions about their crypto etc, they revert to "we're math people, we know what we're doing" etc. Read this.. Or this (note that is written by Moxie Marlinspike, a very well respected cryptographer, but also the author of TextSecure)

They've designed a lovely looking app, but instead of using trusted, well known crypto methods, they've reverted to the "we'll roll our own" which as those articles show, isn't such a great idea.

If you want feel good fluffy crypto, use Telegram. If you want "my life depends on this message not being read by a 3rd party" then don't use it, use TextSecure.
[Nexus 6  General] Utini:
Thanks for that !

Changelog:

01.08.2015 - Removed Telegram and replaced it with TextSecure
[Nexus 6  General] :
Could not have posted better myself. Thanks.

Meanwhile this is the best Diceware article I've ever seen:

http://boingboing.net/2015/07/31/dice.html
[Nexus 6  General] :
https://www.goldenfrog.com/take-back-your-internet/articles/myths-about-vpn-logging-and-anonymity
[Nexus 6  General] :
http://karlgrz.com/2fa-gpg-ssh-keys-with-pass-and-yubikey-neo/

I'm beginning to slide this way myself on the Keepass debate. Pass needs and iOS client though.
[Nexus 6  General] gravitywell:
I've been following this thread for a while, and while it's extremely interesting... I have to agree with the last article.

There has to be a better way. I'm a security newb. My passwords aren't terribly complex, and a few are repeats. I used Lastpass for a while, but I feel more secure just with my tried and true memorized passwords with minor variations.

What's the solution for the everyday user that doesn't involve 30 minutes of prep to get into your email or bank account online?
[Nexus 6  General] Utini:
KeePass has officially replied to that thread and it seems like most of that stuff has been fixed or is about to get fixed?

http://sourceforge.net/p/keepass/discussion/329220/thread/2eac8c83/

Before someine could even crack my keepass databse he would first need to get access to it (unlike lastpass and others it is not mass-online-stored), as well as my key file which I transfer with myself physically and not online, and then start cracking it :P

As everyday soltuion I find keepass still the best (automatically syncing my database to phone, laptop, work,... While using a master key file).

And now I have a question: Anyone knows if you can set a different encryption pw and lock screen pw?
[Nexus 6  General] downtimeguy:
SQRL (Secure Quick Reliable Login) is a recent development by GRC proposing to abandon passwords altogether. It incorporates scanning QR codes and effectively reverses the authentication process as I understand it. With SQRL, users no longer create passwords or store private encryption keys with a service that could end up potentially getting hacked. Instead, users retain a single master key across their own devices which is then used to create a unique hash ID for every website. So far, SQRL has yet to see much adoption alongside of password logins, so it's hard to tell if it will breakout. But I will certainly try it out if it does.

The specifics of the SQRL process are beyond my explanation abilities, but there's a non-technical graphic explanation found here: http://sqrl.pl/guide/

For the deeper details: https://www.grc.com/sqrl/sqrl.htm
[Nexus 6  General] :
http://www.wired.com/2015/08/secure-way-communicate-ipod-touch/
[Nexus 6  General] downtimeguy:
Is it strange to find that a closed system like iOS is potentially more secure than a open based system like Android? In this particular case it is a hardware feature, or rather, the lack of any baseband phone communication channel which makes it more secure. But I suppose that centralized control over a final product does allow for the maker to maintain a rigorous security protocol. I am not certain how problematic this is for the open source cryptographic community who subsequently cannot evaluate a closed system like iOS. Thus it seems that the closed nature of iOS would still require users to have confidence that Apple has not constructed any backdoors for law enforcement purposes. However, my understanding to date is that the system level encryption on iOS is quite strong. The last major flaw I heard of was a hardware hack that is now patched.: https://www.youtube.com/watch?v=T43vOwxTRmA
[Nexus 6  General] :
http://arstechnica.com/gadgets/2015...yption-guide-protect-your-stuff-and-yourself/
[Nexus 6  General] gravitywell:
What do you guys think about 1Password? Work is offering to pay for the service for us, free of charge to us as employees.
[Nexus 6  General] :
Depends. What is your existing set up now? 1Password is closed source but if you aren't using anything up to this point, and your work is footing the bill? Why not use it as a roadtest? Later on you can easily move to Keepass...
[Nexus 6  General] :
http://motherboard.vice.com/read/even-the-inventor-of-pgp-doesnt-use-pgp
[Nexus 6  General] :
http://motherboard.vice.com/read/how-to-encrypt-your-twitter-dms
[Nexus 6  General] Utini:
Just in case anyone is using QuickPic: Delete it, it has been bought by Cheetah Mobile, the same guys who create the spying monster CM Security and CM Cleaner.
[Nexus 6  General] Trina9:
FYI, the Team Blackout version was done before it was bought, so it's safe.
[Nexus 6  General] Utini:
Where can I get that one? :)
[Nexus 6  General] :
Gotcha.

MY favorite story of the month:

http://motherboard.vice.com/read/why-security-experts-are-using-an-ancient-email-format-in-2015
[Nexus 6  General] Utini:
If anyone else is looking for a "safe" quickpic:

Download teamblackout updater apk from their xda thread. Within the app you can install their safe quickpic version which is not connect to play store and there for won't auto update. Afterwards you can uninstall the team blackout updater app again.
[Nexus 6  General] maigre:
Any thoughts about email apps on a Nexus 6 (or anywhere else, for that matter)? It strikes me that a lot of the apps may route mail through their servers and/or store credentials there. Are there apps or ways to keep our privacy protected, at least without great complication?
[Nexus 6  General] Utini:
I use K9. For gmail I use my own smtp server + encryption. I also use SSH-Tunnel / VPN when I am on a public wifi.

If you are afraid about where K9 will send mails credentials to:

Use a firewall and allow the mail app to only connected to the desired smtp/imap servers + ports. That way it cannot send anything anywhere else.

I am not sure if there is anything else besides k9 that I would trust. Webmail is another option maybe?
[Nexus 6  General] maigre:
I was thinking of going to K9, which I'd used a few years ago, even if it's not quite as up to date on user features. I get the sense that the more polished email apps, some of which have some very nice and usable features, are making their money by doing things with the data that passes through their servers. Clearly, some of them are storing credentials. None, that I'm seeing, are promoting plainly user friendly and protective privacy measures.

I do use a VPN when on public wifi and have for awhile now. Is there any need to do that when using mobile data?

---------- Post added at 02:25 PM ---------- Previous post was at 02:20 PM ----------

One other thing. I'm not that clear on the need for something like Override DNS. What does that protect us from?
[Nexus 6  General] Utini:
Tbh for me K9 has more features and options/settings than every other mail app. What are you missing? :)

VPN on mobile data could still offer some way of security by enhancing your privacy:

It would encrypt/hide all your network traffic from your mobile provider (t-mobile, at&t or whatever you use). But it is up to you if you trust your mobile provider or not :)

OverrideDNS lets you change the DNS Server/provider you use. The DNS server will look up any domain (e.g. www.bestmail.ws ) adress you are trying to open and forward you to the correct website. Different DNS providers have different servers + features such as phishing/malware protection (they will automatically block all phishing domains/websites or domains which contain malware) or even parental control. Besides that they might also be faster depending on where the DNS Provider has its servers located.

Without OverrideDNS you will use the DNS server of your mobile provider (e.g. at&t or t-mobile). That means every domain/website you try to open will go through your mobile provider, might get recorded/logged/etc.

Besides that you could bypass websites that are blocked by your country/mobile provider when using OverrideDNS.

For me it is OverrideDNS with NortonDNS Server (including malware/phishing protection).

Hope that helped :)