Related
I recently bought Android phone HTC ONE V and i am suprised how business work around Anroid OS + apps. I see some major problems :
1) Is there any trusted authority which inform users that application is 'safe' ? (see article : android-malware-spreads-via-website-injection-campaigns) Malware apps are even on Google Play market. I suppose that solution for this problem is to download just from e.g. TOP 10 apps from each category and just *hope* and *believe* that there is no malware contained just because these apps are soo much popular.
2) How to control permissions/app starts/firewall is there any good app for that ? I have unrooted phone. (I cant have Cyanogenmod 7/9 installed on my HTC One V because it was not ported yet) What would you recommend to me ? I see a lot of recommendations for "LBE Privacy Guard" app but then i found thread here on xda forum that this application is maybe suspicious/dangerous etc... I just want to have full control over my phone, why is that choice so difficult ?
List of apps, often recommened by 'The Internet', are these ok or not ? :
Wifi Protector
Droidwall
WhisperCore
WhisperMonitor
SSH Tunnel
Titanium Backup
ROM Manager
Tasker
Perfect App Protector Pro
This exactly describes my situation, many choices -> i expect to get the best from the Android :
The opportunity costs associated with a decision and the time and effort that go into making it are "fixed costs" that we "pay" up front, and those costs then get "amortized" over the life of the decision. The more we invest in a decision, the more satisfaction we expect to realize from our investment. If the decision provides substantial satisfaction for a long time after it is made, the costs of making it recede into insignificance. But if the decision provides pleasure for only a short time, those costs loom large. Spending four months deciding what stereo to buy is not so bad if you really enjoy that stereo for 15 years. But if you are excited by it for six months and then adapt, you may feel like a fool for having put in all that effort.
Dont you feel the same about these Android 'choices' sometimes ?
Tell Me What Kind Of Apps You Are Looking For And I'll Give you Some Recommendations
From the list of apps you have provided I can see that all of them are trusted and reliable.. so go ahead..
1. Well google aded some security in market so before they upload app they check if it is malware-free. But for more security you can download antivirus
(I RECOMMEND AVAST!)
2. For managing apps permisions im using LBE Privacy Guard is the top app for permisions and firewall managment.
Titanium Backup, Tasker-- awesome apps 100% excelent!
Have a nice day
+1 for avast! excellent at keeping viruses out, keeping data secure, doesn't slow the phone down and has an awesome anti-theft feature which if you're rooted is even better!
Did anyones avast actually find anything that is not a false positive?
Just wondering if this is really necessary...
My avast detected the one click root and androot files on my sd card as malware, which I mean they could be lol but the process of identifying them as false positives was a pain. Other than that... Avast is amazing.
Sent from my myTouch_4G_Slide using XDA
onebornoflight said:
My avast detected the one click root and androot files on my sd card as malware, which I mean they could be lol but the process of identifying them as false positives was a pain. Other than that... Avast is amazing.
Sent from my myTouch_4G_Slide using XDA
Click to expand...
Click to collapse
Yes, sometimes it does its an antivirus so... he thinks that third-party apps are suspicious, but there is nothing to worry about when it comes to root.
antivirus is no good for performance
Antivirus overrated
Antivirus is and will never be any good for performance. You have to decide what risk you are willing to take. With good common sense, you can filter out the obvious threats. Review apps permissions and (try to) install only apps you and the community trust. If you don't trust it, ask around in this forum
Also - obviously - don't visit suspicious sites, click on links in emails and never download programs you don't know.
Personally, i do not use virus protection. I do use DroidWall and LBE Privacy guard for a few apps, but more for data and performance issues.
But i also regularly whipe my phone to install new ROM's and let my (trusted) apps freshly reinstall and restore only game user data.
rilorolo said:
Antivirus is and will never be any good for performance. You have to decide what risk you are willing to take. With good common sense, you can filter out the obvious threats. Review apps permissions and (try to) install only apps you and the community trust. If you don't trust it, ask around in this forum
Also - obviously - don't visit suspicious sites, click on links in emails and never download programs you don't know.
Personally, i do not use virus protection. I do use DroidWall and LBE Privacy guard for a few apps, but more for data and performance issues.
But i also regularly whipe my phone to install new ROM's and let my (trusted) apps freshly reinstall and restore only game user data.
Click to expand...
Click to collapse
+1 here. I think that there is no need to use an Antivirus. Just have a look on the permissions when installing an app and you will be OK.
Dear users,
Considering all 3C apps are now based on the same source code, they all behave the same way, and will exhibit the same issues. Any queries will also likely applies to all apps.
To make my life easier while continuing to provide support here (and start with a clean slate), I decided to close all my app threads and open a fresh new thread here.
With your continuous help and support, the past 4 years have been a great adventure and experience. Let's take a fresh start and continue this amazing adventure.
Thank you all!
*** See at the end of this post on how to get support for any issues ***
The most comprehensive toolbox to save battery, tweak, tune, backup, secure and monitor any Android devices running any ROMs, any kernels.
What is 3C Toolbox
Replaces 20+ apps easily worth 30€ for the price of a couple of beers!
NB: Starting with version 1.0.3, Android 2.2.x and 2.1.x are no longer supported. App supports Android 2.3 and above, including Android L preview.
Safest root app on Play Store: I run the app and all its features on at least 4 devices every day, and change 3 of them frequently for testing purposes. With about 250.000+ actual users, it's pretty safe to assume the app is very safe. App can create a reset package to disable all system tweak features from CWM/TWRP at any time. App has automatic fallback in case of boot loops while re-configuring the CPU.
See signature for download links.
☺ App Features
☺ 3C Apps Feature Comparison
☺ More app screenshots
☺ Low CPU consumption, please check benchmarks
☺ Get started guide
☺ Online help
♦♦ Unique features not available elsewhere ♦♦
◊ Track your ROM, kernel and battery performance (%/h or mA, screen on or standby)
◊ Battery milli-amp (mA), mW and %/h consumption reporting
◊ Automatic backup of installed and updated applications
◊ Highly configurable graphical monitoring widgets
◊ Advanced script editor
♦♦ Unique features not available elsewhere (root required) ♦♦
◊ Clean and safe reboots, without data loss
◊ Turn on/off APN, BT discovery, tethering, GPS & WiFi Localization
◊ Logcat reader for Android JellyBean 4.1.x
◊ Easiest Link2SD / App2SD capabilities ever
◊ More about permissions requested
◊ Issues with CPU temperature or battery current mA or capacity mAh?
Please explain this in a support request from app settings, help and support so we can provide the appropriate option to use in 'mA retrieval method' of battery / monitoring settings and add out-of-the-box support for your device. All necessary information is provided in the request's attachments.
◊ How to get support for any other issues
Please send a support request from app settings, help and support. You need to clearly explain your issue, attach any relevant screenshots showing where and how the issue occurs. I will not provide any support here.
All I ask is to provide reasonable details for me to be able to help, empty requests are mostly trashed, I keep one requests per device for the sake of a possible source of information for how the app supports things, to possibly fix things too or compare between variants of the same device.
For example a support request contain the following (you can check the content before sending it!),
all discovered SD cards, very useful for any related issues, including the mentioned read cache stuff.
app installation path and configuration, for xposed, battery, cpu, tweaks, apps or task managers problems.
battery history and configuration for any battery problems.
CPU configuration for CPU problems, including thermal, mp, voltage, etc
The idea is that you explain the observed issue, possibly add a screenshot so that I know exactly where to look for (app has 100+ screens and sometimes words don't mean the same for you and me), and there I can really do a good job at helping you.
PS: And so you know, I hate liars, insults, disrespect and myself. So please try to avoid those when requesting support.
Actually if you want support, posting the whole support request content, the screenshot and details here should be ok. Doing otherwise, I'll either ignore you completely or send you elsewhere very quickly, you want to leave me a one star rating, so be it: developing is my passion and I love it, you want my help, do it the right way or don't at all. I don't develop for stars, I develop for fun.
Attention !!!! Installs an apk to /system/ dosnt know what it does !!! Apk is there when uninstalled too !!!!
Will the users of BMW pro and system tuner pro get a discount or count this as an upgrade?
Amazing! Downloading now.
Sent from my Nexus 7 using xda premium
Hi 3c,
Not a bad idea to make an "all in one", just need to see about memory, battery and CPU usage... but I am pretty confident about that
No more update for System Tuner pro?
In all cases I buy it! (although slightly damage the impressive increase in the price ).
Thanks and congratulations for your new app
DJxSpeedy said:
Attention !!!! Installs an apk to /system/ dosnt know what it does !!! Apk is there when uninstalled too !!!!
Click to expand...
Click to collapse
I've updated the first post with more information about that. Will publish an updated APK to ask user permission before installing it within the next hour.
EDIT: Didn't expected you guys to be so quick while I finalize the publishing of all required information.
By the way, the uninstall process can't uninstall other stuff, but as a rooted device, you should have no problem getting rid of this APK.
Please try the new APK published a minute ago (available in a couple of hours) that will allow you to refuse the APK installation.
dirtyreturn said:
Will the users of BMW pro and system tuner pro get a discount or count this as an upgrade?
Click to expand...
Click to collapse
Yes, just contact me with the order lists (bmw, system tuner and the new android tuner) and I'll refund old apps. This is the migration plan I'm working on.
EDIT: As of December 20th, 2013, direct refunds on Play Store are no longer possible. This was the only available way to offer discounts in a decent way. PayPal was an alternative available until February 2014, but it was abandonned because of the complexity, 30+% extra fees and the lack of global support (some countries could not receive refunds).
viking37 said:
Hi 3c,
Not a bad idea to make an "all in one", just need to see about memory, battery and CPU usage... but I am pretty confident about that
No more update for System Tuner pro?
In all cases I buy it! (although slightly damage the impressive increase in the price ).
Thanks and congratulations for your new app
Click to expand...
Click to collapse
Yes, high price for now to avoid users who just try any apps and put comments after a few minutes of testing. And also to be able to offer discounts by refunding old apps paid version.
Nevertheless there will be updates on existing apps (not everyone wants an all in one app) with existing improvements, except features that require additional permissions.
Do you think youll ever add ability to spoof app permissions? And let user input the value... This would be an ultimate feature!
Sent from my Nexus 7 using xda premium
NicholasQ said:
Do you think youll ever add ability to spoof app permissions? And let user input the value... This would be an ultimate feature!
Sent from my Nexus 7 using xda premium
Click to expand...
Click to collapse
I'm looking into this actually, along with a smart "renicer", but both requires hacking Android or every APK to monitor and it turns out to be very complex.
There's 3 existing solutions on Market today:
- Hacking of Android class loader, as done by LBE Security app.
- Hacking of APK installed, as done by SRT Guard
- Patching the ROM like PDroid does.
They all have their advantages and problems, but the APK hacking seems the best option to go for as it results in a more stable experience, not as dependent on Android version as the 2 others and probably less disruptive as LBE can be when it messes up one's device. But then I'm not sure an APK can actually be installed properly
That said, I'm still looking into the first solution hacking app loading directly.
3c said:
I've updated the first post with more information about that. Will publish an updated APK to ask user permission before installing it within the next hour.
EDIT: Didn't expected you guys to be so quick while I finalize the publishing of all required information.
By the way, the uninstall process can't uninstall other stuff, but as a rooted device, you should have no problem getting rid of this APK.
Please try the new APK published a minute ago (available in a couple of hours) that will allow you to refuse the APK installation.
Yes, just contact me with the order lists (bmw, system tuner and the new android tuner) and I'll refund old apps. This is the migration plan I'm working on.
Yes, high price for now to avoid users who just try any apps and put comments after a few minutes of testing. And also to be able to offer discounts by refunding old apps paid version.
Nevertheless there will be updates on existing apps (not everyone wants an all in one app) with existing improvements, except features that require additional permissions.
Click to expand...
Click to collapse
We are Quick we are fast...we are xda !
DJxSpeedy said:
We are Quick we are fast...we are xda !
Click to expand...
Click to collapse
Not at removing bad comment on Market though
So i take it you find this app extremely bad to rate it one star, right?
yes iam that i dosnt have it installed atm.. but one is good that you are here.. i have another bug for you
why does it make an backup of build.prop when i change nothing at it ?
DJxSpeedy said:
yes iam that i dosnt have it installed atm.. but one is good that you are here.. i have another bug for you
why does it make an backup of build.prop when i change nothing at it ?
Click to expand...
Click to collapse
So far you didn't find any bugs.
changed my play store entry about it
Is this [really] compatible with gingerbread? It lags, 'freezes' on screen and I have to long click the home button. I am using a sensation 4g 2.3.4. I'll get a logcat if you will find that that will help.
DJxSpeedy said:
changed my play store entry about it
Click to expand...
Click to collapse
Thanks, appreciated. I'm sure your new entry will be more useful to new users.
So I still hope you can enjoy my new app and report any of your findings, directly here or best is using the 'support request' from the app settings, it provides a lot of useful information for debugging
dirtyreturn said:
Is this [really] compatible with gingerbread? It lags, 'freezes' on screen and I have to long click the home button. I am using a sensation 4g 2.3.4. I'll get a logcat if you will find that that will help.
Click to expand...
Click to collapse
Yes it is compatible. When did it lag? After requesting to install the system app or at some other times?
When lagging, the OS usually creates a file in /data/anr/traces.txt. If you experience a new lag, you can send it to me, possibly using the support request feature in the app settings. You can then attach a file to the newly created email.
When it comes to lags (or ANRs for that matter), logcat is useless. It only mentions a reference to the traces.txt file
3c said:
Yes it is compatible. When did it lag? After requesting to install the system app or at some other times?
When lagging, the OS usually creates a file in /data/anr/traces.txt. If you experience a new lag, you can send it to me, possibly using the support request feature in the app settings. You can then attach a file to the newly created email.
When it comes to lags (or ANRs for that matter), logcat is useless. It only mentions a reference to the traces.txt file
Click to expand...
Click to collapse
To me (if I'm wrong it's all user error) the system apk it was requesting to install (it appeared to me) was for ics/jb, so I refused the install. Your app kept requesting to install the extras. After a little thought - is the extra apk mandatory? No intention to cause any concern if what I'm experiencing is nonsense. I have not rated your app on the play store.
It lagged randomly.
dirtyreturn said:
To me (if I'm wrong it's all user error) the system apk it was requesting to install (it appeared to me) was for ics/jb, so I refused the install. Your app kept requesting to install the extras. After a little thought - is the extra apk mandatory? No intention to cause any concern if what I'm experiencing is nonsense. I have not rated your app on the play store.
It lagged randomly.
Click to expand...
Click to collapse
The extra APK is now only for specific toggles as I manage to find a different work around for the JB logcat issue. Those toggles include the APN (mobile data), background data (this one's obsolete), debug mode, unknown sources, gps and wifi localization. The 1 useful toggles is for GPS though.
Until you press 'do not ask again', the app would continue to request the APK installation ;(
As for the lags you're experiencing that seems like a bug. Have you found any trace.txt in /data/anr directory by any chance?
It's just fair to be concerned with things like that, I can understand. But installing an app requesting 35 permissions, then granting root access to that app and then being scared about a 40Kb APK being installed on /system folder is quite funny actually.
If I may make this comparison, it's like letting a heavily armed man (the 35 permissions+root) in your home and then being worried being he is hiding a wallet (the 40Kb apk) in your home!
Anyway, bad comments always call for improvements
3c said:
The extra APK is now only for specific toggles as I manage to find a different work around for the JB logcat issue. Those toggles include the APN (mobile data), background data (this one's obsolete), debug mode, unknown sources, gps and wifi localization. The 1 useful toggles is for GPS though.
Until you press 'do not ask again', the app would continue to request the APK installation ;(
As for the lags you're experiencing that seems like a bug. Have you found any trace.txt in /data/anr directory by any chance?
It's just fair to be concerned with things like that, I can understand. But installing an app requesting 35 permissions, then granting root access to that app and then being scared about a 40Kb APK being installed on /system folder is quite funny actually.
If I may make this comparison, it's like letting a heavily armed man (the 35 permissions+root) in your home and then being worried being he is hiding a wallet (the 40Kb apk) in your home!
Anyway, bad comments always call for improvements
Click to expand...
Click to collapse
Seems permissions are about the same as some system apps. the taces.txt is up for you. Hope it does something helpful. Thanks for the app. I had sent a PM with the information about the purchases. I do not use google wallet.
Awesome news that you are working on user defined app permissions. I really hope you can find a good work around. And I do currently use SRT appguard in conjuction with Android Tuner and I did notice it seems to handle disabling app permissions pretty good. The only downside is that you won't get app updates from market but that's not a big deal to me. I think if you can get the spoofing action to work, a lot of people are going to want your app. There are plenty of times I haven't downloaded an app because I didn't like it's permissions. So being able to control them without breaking the app will be a dream come true.
Sent from my Nexus 7 using xda premium
Hello,
I think about rooting my device.
However I also think about how secure the custom roms builds or rooting apps are.
E.g.
In the modaco forum there is a tool called Superboot r2 to root the motorola moto g device.
How can I know/trust that this tool doesn't contain any spyware/malware or other malicous code?
How do you guys look at the security of custom roms and other apps which root your device?
Customizing and rooting one's phone can be done very securely. Even more now than a few years ago. I would be wary about apps that can root your phone with a buttoon press. Unless, of course, there is a really long thread about it on xda. The same with apps not from the Google store. You should run a virus scan on any apks you get in general. They can contain malicious code that can mess up your device and steal your information.
Once you root your device, it's a good idea to look into the XPrivacy app. You can use it to control the individual permissions of all of your installed app. There are a lot of other security measure you can take too. Do research on what would be relevant to your device.
kbntk said:
Hello,
I think about rooting my device.
However I also think about how secure the custom roms builds or rooting apps are.
E.g.
In the modaco forum there is a tool called Superboot r2 to root the motorola moto g device.
How can I know/trust that this tool doesn't contain any spyware/malware or other malicous code?
How do you guys look at the security of custom roms and other apps which root your device?
Click to expand...
Click to collapse
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
Elzbach said:
Customizing and rooting one's phone can be done very securely. Even more now than a few years ago. I would be wary about apps that can root your phone with a buttoon press. Unless, of course, there is a really long thread about it on xda. The same with apps not from the Google store. You should run a virus scan on any apks you get in general. They can contain malicious code that can mess up your device and steal your information.
Once you root your device, it's a good idea to look into the XPrivacy app. You can use it to control the individual permissions of all of your installed app. There are a lot of other security measure you can take too. Do research on what would be relevant to your device.
Click to expand...
Click to collapse
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Thank you for your replies guys.
jcase said:
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Click to expand...
Click to collapse
I agree rooding the device decreases the overall secruity of the device.
On the other hand, rooting the device gives access to the apps that give you control over the system and data on it. For example as Elzbach wrote, with the app XPrivacy I can control what apps have access to my personal information.
Now - without root - when I instal a new keyboard or launcher with widgets, I'm warned that these apps can have access to my personal information and can use them malicously. For me that means, that even without root using normal apps I can get big security risk when using some apps from play store.
Do you build the custom android version by yourself from the source or use builds provided on this forum or modaco or use another way?
kbntk said:
Thank you for your replies guys.
I agree rooding the device decreases the overall secruity of the device.
On the other hand, rooting the device gives access to the apps that give you control over the system and data on it. For example as Elzbach wrote, with the app XPrivacy I can control what apps have access to my personal information.
Now - without root - when I instal a new keyboard or launcher with widgets, I'm warned that these apps can have access to my personal information and can use them malicously. For me that means, that even without root using normal apps I can get big security risk when using some apps from play store.
Do you build the custom android version by yourself from the source or use builds provided on this forum or modaco or use another way?
Click to expand...
Click to collapse
XPrivacy, and apps like them introduce additional security concerns of their own. Android is not designed to work the way they force it too, introducing many new unknowns.
New keyboard, launchers introduce an infinitely smaller risk than any root app, and unlike with root apps you are warned and privileges are handled by an established well tested permission system. Comparing the two is completely silly.
Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all.
A completely valid scenario (one we have seen in the wild): An app with 0 permissions, but the ability to use su could download and dynamically execute new code to perform the malicious activities. IE Google bouncer, and any anti virus software would be @#[email protected] out of luck on that one. All because a user decided to completely break the basic security model, by installing su.
The only customized version of Android I use, is a customized emulator I use for analysis, and that only used when I suspect something could damage an actual test device.
I do not mess with customized versions of Android on real hardware, I only build when testing patches I plan to push to the AOSP gerrit for review.
jcase said:
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Click to expand...
Click to collapse
jcase said:
XPrivacy, and apps like them introduce additional security concerns of their own. Android is not designed to work the way they force it too, introducing many new unknowns.
New keyboard, launchers introduce an infinitely smaller risk than any root app, and unlike with root apps you are warned and privileges are handled by an established well tested permission system. Comparing the two is completely silly.
Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all.
A completely valid scenario (one we have seen in the wild): An app with 0 permissions, but the ability to use su could download and dynamically execute new code to perform the malicious activities. IE Google bouncer, and any anti virus software would be @#[email protected] out of luck on that one. All because a user decided to completely break the basic security model, by installing su.
The only customized version of Android I use, is a customized emulator I use for analysis, and that only used when I suspect something could damage an actual test device.
I do not mess with customized versions of Android on real hardware, I only build when testing patches I plan to push to the AOSP gerrit for review.
Click to expand...
Click to collapse
Well I stand corrected.
Apologize if I'm resurrecting an oldie but this is a topic I've been contemplating for a while now. I used to root, looking back to my old OG Droid days. But I find newer devices sufficient as to not root anymore (mostly). I'm currently debating rooting a Samsung Tab S 8.4 to remove Touchwiz and hopefully speed some things up and maybe further control the CPU.
If the user is rooted and they only install apps from the marketplace that are known to be safe (I assume)- i.e.- not downloaded from some misc internet site and from "non-trusted sources," would this still be able to happen?
- "Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all."
I guess I'm just not sure how google approved apps, or if they even do. And what's the process of showing app permissions in the Play Store these days, since permissions are front and center when you download an app. Do dev's just flag permissions on their own will or is it built into the Android code? I would ASSUME the android code when posting to Play Store decides permissions for the dev. I would be horrified if Android relied on good will for people to post permissions solely from the dev's input.
I could be completely wrong
But as I understand dev a pick the permissions they need for the app to work correctly. They declare the permissions they need to the Android system. And then they can only use those permissions and no others. However they don't need to use all of the permissions but they can if they want to.
Btw apps from google play are in no way safe.it has no bearing if you do or don't have apps from unknown sources on your device. fact is google in no way checks the source code of apps on the play store.now maybe the run a virus checks but honestly that means nothing as moron could code in malicious code that would not trigger a scanner (and Trojans are far more prevalent for Android than viruses). If the source code is not available then no one knows what an app could be doing.
90% of my apps come from fdroid, who builds everything from source.
In the discussion above I should also note (but could be wrong about this completely) that system apps (the ones that come with your phone) all have root(administrator) permissions by virtue of being system components.
So rooting may decrease your security but personally I think factory roms are far too unsecure to start with and will never have a device that is not rooted. The benefits far out weight the risks for the careful user. Until such time as the source code is released.
Unless you trust google, face book, Samsung, Twitter, and a host of other baked in developers who get to put apps on your phone at the factory.
Or Apple who has their own way of making money off your every move, or microsoft with win 10 that also sells your habits.
jcase said:
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Click to expand...
Click to collapse
This alone is enough for me to stay away from root and its capability to make things worse in my end. Thank you for the professional input on this.
Without root you can't add any security to Android. Which has very little security to start with. Permissions are vague and can't be denied on a per app basis short of not installing the app.
System apps have no way of being removed without root unless you do it before flashing, and without root you can't do a complete backup of your system.
Even if you don't root a device yourself Trojans can gain root with many of the same exploits, root themselves and cause whatever havoc they desire.
An app only gets root if you allow it even after rooting your device. It will pop up and ask you if you want to allow or deny or always allow or deny. a Trojan that can create root will do can do it regardless if you root your device yourself, I have no idea if such a Trojan tried to get root if supersu, or superuser will pop up and ask.
A firewall requires root and that alone is worth rooting for me.
But then I have very few apps that I allow online.
Can root cause serious damage to your device? Yes
Can you administrator your device without root? No
Every Linux has root capabilities,
if you own it you should be able to administer it to the best of your abilities and to do that you need root.
Custom Roms are updated far more often that oem roms and as such generally have the newest fixes and updates for security.come that to factory roms that may update once or twice in their expected lifetime, regardless of how many security holes are found in the rom.older devices(read older as a synonym for 2 years old) may never get another update and the only way to protect yourself with out a custom Rom is to buy a new device.
For example Android 5.01 has a major memory leak.and even with that and other bugs and security issues Samsung had not updated the north American galaxy s5 (just over a year old,) above 5.01 yet and may not until marshmallow comes out (Which will mean almost a year after the security and memory leak were found). And until then you walk around using a device with major security issues and a major memory leak.
XPrivacy is not about Security. "Security" is never linked to Xprivacy on Github. "XPrivacy can prevent applications from leaking privacy-sensitive data". Saying the opposite is a lie.
Whether you have root access or not you can almost do nothing against serious attacks BUT having root access allows you to control some things like Internet connection, restricted access,...
Finally do not confuse Custom ROMs and Root. You can run a custom rom without root and vice versa. As explained above custom ROMs are more updated so you can enjoy more patches and new security features like SElinux.
Kayak83 said:
Apologize if I'm resurrecting an oldie but this is a topic I've been contemplating for a while now. I used to root, looking back to my old OG Droid days. But I find newer devices sufficient as to not root anymore (mostly). I'm currently debating rooting a Samsung Tab S 8.4 to remove Touchwiz and hopefully speed some things up and maybe further control the CPU.
If the user is rooted and they only install apps from the marketplace that are known to be safe (I assume)- i.e.- not downloaded from some misc internet site and from "non-trusted sources," would this still be able to happen?
- "Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all."
I guess I'm just not sure how google approved apps, or if they even do. And what's the process of showing app permissions in the Play Store these days, since permissions are front and center when you download an app. Do dev's just flag permissions on their own will or is it built into the Android code? I would ASSUME the android code when posting to Play Store decides permissions for the dev. I would be horrified if Android relied on good will for people to post permissions solely from the dev's input.
Click to expand...
Click to collapse
Go to F-Droid or fossdroid instead of Google Play to avoid crappy apps and unwanted connections. Apps on F-Droid are safer. Google has an automatic system to scan apks when they are uploaded but it doesn't detect everything... Be sure that if you didn't update the version number of your apk you will be blocked though lol
Permissions are stored in the AndroidManifest.xml. If the developer doesn't want to state the permissions he needs then nothing will be shown into the Manifest. That's why it's important to use 3rd party apps to control what apps really do.
Would never use my phone without a firewall installed. I want to have control over what apps can access the net and which cannot.
So rooting is a must for me.
Have no gapps installed and privacy is important to me.
Semseddin said:
This alone is enough for me to stay away from root and its capability to make things worse in my end. Thank you for the professional input on this.
Click to expand...
Click to collapse
And you'll be 100% wrong. You are getting a bad advice from someone who sounds like he works for Google. He is wrong and he knows it...
Your system apps have root whether you like it or not. So, they can do whatever Google wants them to do. And they can do it silently. So, the question is are you going to have control over your device or google? Without root you can't; with root you can if you know what you are doing. Your main security threat comes from Gapps and the infamous google services framework, which spies on you and regularly transmits home (google servers) your every activity. That has to go and for that you need root. Custom rom vs stock. Custom roms don't have Gapps and gsf, so that puts them on pedestal, as compared to stock. Stock rom is android plus manufacturer's bloat which also spies on you and wastes battery. Custom roms don't have gapps and they are open source (like Linux). Have you ever heard about viruses on Linux? Maybe 2 or 3, but thousands in other OSs. As another user noted, linux (on which android is based) has root. So is any major OS. Root is just a key to control your device. It can be set up to restrict everything, even system apps, so the point that having root reduces security is invalid except for one situation, when you don't know what you are doing. Do you want incompetent and malicious evil Google to own your phone? If you do, stay away from root.
optimumpro said:
And you'll be 100% wrong. You are getting a bad advice from someone who sounds like he works for Google. He is wrong and he probably knows it...
Your system apps have root whether you like it or not. So, they can do whatever Google wants them to do with your device. And they can do it silently. So, the question is are you going to have control over your device or google? Without root you can't; with root you can if you know what you are doing. Your main security threat comes from Gapps and the infamous google services framework, which spies on you and regularly tramsmits home (google servers) your every activity. That has to go and for that you need root. Custom rom vs stock. Custom roms don't have Gapps and gsf, so that puts them on pedestal, as compared to stock. Stock rom is android plus manufacturer's bloat which also spies on you and wastes battery. Custom roms don't have gapps and they are open source (like Linux). Have you ever heard about viruses on Linux? Maybe 2 or 3, but thousands in other OSs. As another user noted, linux (on which android is based) has root. So is any major OS. Root is just a key to control your device. It can be set up to restrict everything, even system apps, so the point that having root reduces security is invalid except for one situation, when you don't know what you are doing. Do you want incompetent and malicious evil Google to own your phone? If you do, stay away from root.
Click to expand...
Click to collapse
Thank you for your detailed answer but if i am not mistaken, are you suggesting that a custom rom made by a 3rd party hobbiest developer is more secure than oem's firmware ? If so, i will continue to be mistaken.
Semseddin said:
Thank you for your detailed answer but if i am not mistaken, are you suggesting that a custom rom made by a 3rd party hobbiest developer is more secure than oem's firmware ? If so, i will continue to be mistaken.
Click to expand...
Click to collapse
Most of the time the answer is yes. Also, you could be a developer yourself meaning you can compile your rom from sources with your own modifications. OEMs have user's security on the back burner. Their goal is to monetize the user and in case of mobile devices, there is no way to monetize the user without compromising security. The beauty of a published source code is that anyone could examine it and they do (even if it is not you yourself). Look at businesses: the majority of them use neither windows nor apple. They use Linux, because linux does not monetize the user and it is open sources and by the way, it is maintained by "hobbiest" developers. And naturally, because of this Linux has a vastly superior security and virtually no viruses.
Google is malicious and incompetent, but luckily, Android is based on linux and most of the code there is from linux.
This is of course a separate from root issue, which remains simply an issue of control: whether you want to be in control of your device or not. You can't name any OS that does not provide root to the user out of the box... Just because some (or most) smart phone dumb users don't know what they are doing does not mean that everyone should be denied root on their devices... And by the way, most Google engineers also don't know what they are doing and had it not been for Linux and the community at large, google wouldn't be able to produce anything that moves...
Until a few months ago I used LBE to prevent apps from giving away my privacy. Since the language updates stopped working, I searched for an alternative and found XPRIVACY. It seems very power, so I even bought the licence for automated community blocking suggestions for apps.
Unfortunately it turns out that XPRIVACY is not very good in the sense of usability. It quite often happens that apps stop working, because the community provided suggestions are far to restrictive and it is quite complicated to find the source of the problem. Then on every update I am asked again for configuring the privacy settings of an app. I finally gave up and just removed any restrictions on apps which I could not get working. Obviously not a good solution.
Now I am looking for an alternative. I already discovery Cyanogenmods integrated "Privacy Settings". The main thing I am missing here is blocking of access to device-ID and IMEI. Is there a way to add this? Or can someone point me to an alternative, easier to handle privacy solution? I should be one which would also allow to restrict google apps on the rom.
Samba
Hi,
I also faced many problems with Xprivacy. I tried Donkey Guard, but main feature I miss there is sorting via access right (e.g. list all apps who want to read contacts).
So now I try LBE, it seems rather straight forward.
The language issue can be solved to a certain (for me sufficient) extent by installing the Xposed Module LBE Security Master.
Since starting to set up my OP7 a few days ago, I've been noticing that Greenify finds far fewer background applications than on my previous phone. Wondering if the ecosystem has improved.
Does it still make sense to install a wakelock detector? Which one do you recommend on a rooted OP7 with Magisk?
Thanks!
I find restricting some apps using the native option inside settings does a good enough job.
I still occasionally install Greenify just for experimentation purposes but I find myself needing it less nowadays.
Thank you, I'll stick to the defaults then.