I am a brand new owner of a OP 8. First thing I did was flash it to OOS 11, then installed Magisk. The phone is now up and running and rooted.
I am coming from a galaxy S5 that I have owned and used for more than 7 years, and for most of that time it has been running Lineage OS. I am used to the control that Lineage gives me, and I would expect that I could exercise the same degree of control with a rooted OOS.
But, this appears to not be true.
On the S5, I had 3C System Tuner Pro which is now an obsolete app, so I have replaced it with the current variant; 3C All-In-One toolbox. This package should allow me to control which apps start at boot, but it seems I cannot turn any of the apps off; when I uncheck them, the app fails to actually remove them from the startup list.
Also, I expect the 3C tool to allow me to uninstall pretty much any app, but there are a lot of google apps that I just can't remove.
I also use greenify (the paid version) and mostly it seems to be working OK, except that I cannot seem to access system apps from it, which makes it very hard for me to shut down things that I don't want running.
I also use afwall (the paid version) and it seems to work as expected. Which is good.
My focus is security and privacy, and my mantra is: "on android, the app that is not running is the app that is not spying". Thus, I want everything that is not needed to satisfy my purposes to not be running, and I only want apps running when *I* say that they can run.
Now, my S5 was running Lineage 17.1 which is android 9. I did not update it past that. And now I am running android 11, and I note that there is a lot of new hardware-based validation in android 11. So possibly I can't remove some things without disabling this validation (which I would prefer not to do). But even if I can't remove, I can disable (which, fortunately, I AM able to do). But I should be able to remove things from the startup list so they don't get started automatically at boot time. Right now, the way it works is they all start, then greenify shuts them down (and that isn't always completely reliable). I need more to make this phone genuinely secure and private.
So.
Does anyone here know how I could gain the capability to remove apps (including system apps) from the startup list and have it stick? Does anyone know what I need to do to get greenify to recognize system apps so I can shut them down when they are not needed, or failing that, can anyone steer me to a different app than greenify that will do that?
Perhaps I would gain by adding the xposed framework? I have not used it in a very long time (since I move to lineage) and I recall it being a bit of a pain.
I suppose I could move to Lineage from OOS, but I would prefer to not do that because of the camera software. This device seems to have a fine camera and not a lot of bloatware, so I would much prefer to stay with OOS for as long as the device is supported by the manufacturer.
But I do insist on being able to completely control it, and disabling apps that I can't stop from running is a much bigger hammer than I would like to use; some of those apps I might actually want to use from time to time.
OK, after some work I have successfully taken full control of the OnePlus 8 and have been able to configure startups as I want them. I installed xposed through Magisk.
I also installed the latest greenify (3.7.8) and afwall, and have those set up too. Since I did purchase greenify, I am able to greenify system apps as well. So, generally, I have full control over the device.
But there remains a problem.
I have disabled wifi and data connections in settings for all apps that I don't want to have accessing a network. I have also blocked those apps in afwall. And yet, my pihole DNS server that services my LAN shows me some of my apps are trying to call home, even when their capability to talk on the internet is denied.
Specifically, greenify is denied network access and is firewalled off, yet there is an attempt to connect to oasisfeng.com.
Also, I use an old version of ES File Explorer (from before it was sold and turned into something very like malware) and it is allowed LAN access but denied any access beyond the LAN...and I see it trying to call its old home domain (estrongs.com).
Similarly, I use an old version of UB Reader (later versions again approach malware status), and it is completely denied network access. But, I see a connection to mobisystems.com.
This clearly indicates that there is a proxy in use somewhere in the system, that is allowing these guys past my blocks. I am using adaway to block these specific domains, but it would be far better to just block that proxy.
However, I don't know where the proxy is and what it is called. Can someone here tell me?
If not, it will be trial and error, which is painful because functionality will break when I turn something off to see if this is it.
jiml8 said:
OK, after some work I have successfully taken full control of the OnePlus 8 and have been able to configure startups as I want them. I installed xposed through Magisk.
I also installed the latest greenify (3.7.8) and afwall, and have those set up too. Since I did purchase greenify, I am able to greenify system apps as well. So, generally, I have full control over the device.
But there remains a problem.
I have disabled wifi and data connections in settings for all apps that I don't want to have accessing a network. I have also blocked those apps in afwall. And yet, my pihole DNS server that services my LAN shows me some of my apps are trying to call home, even when their capability to talk on the internet is denied.
Specifically, greenify is denied network access and is firewalled off, yet there is an attempt to connect to oasisfeng.com.
Also, I use an old version of ES File Explorer (from before it was sold and turned into something very like malware) and it is allowed LAN access but denied any access beyond the LAN...and I see it trying to call its old home domain (estrongs.com).
Similarly, I use an old version of UB Reader (later versions again approach malware status), and it is completely denied network access. But, I see a connection to mobisystems.com.
This clearly indicates that there is a proxy in use somewhere in the system, that is allowing these guys past my blocks. I am using adaway to block these specific domains, but it would be far better to just block that proxy.
However, I don't know where the proxy is and what it is called. Can someone here tell me?
If not, it will be trial and error, which is painful because functionality will break when I turn something off to see if this is it.
Click to expand...
Click to collapse
If you are concerned about security, you should stay away from Xposed.
First of all, Xposed requires disabling Selinux, otherwise, it won't work. So during the installation, your Selinux status is turned to 'permissive'. That, coupled with the fact that almost every custom rom sets 'ro.secure to Zero', exposes your System partition to third party apps. So, basically, anything can exploit your phone.
Second, Greenify, with all due respect to its great developer, is not needed anymore, since Android 10, because now we have builtin sleep mode that does the same thing as Greenify.
Third, even if Xposed didn't require disabling Selinux, it is still an exploit that creates a back door to your system.
optimumpro said:
If you are concerned about security, you should stay away from Xposed.
First of all, Xposed requires disabling Selinux, otherwise, it won't work. So during the installation, your Selinux status is turned to 'permissive'. That, coupled with the fact that almost every custom rom sets 'ro.secure to Zero', exposes your System partition to third party apps. So, basically, anything can exploit your phone.
Second, Greenify, with all due respect to its great developer, is not needed anymore, since Android 10, because now we have builtin sleep mode that does the same thing as Greenify.
Third, even if Xposed didn't require disabling Selinux, it is still an exploit that creates a back door to your system.
Click to expand...
Click to collapse
Device security is only one aspect of security, and I handle that mostly through device configuration and usage policy anyway.
Overall security involves many other factors, which include maintaining full privacy and control over all data that gets out of the device and goes...elsewhere. To maintain this level of privacy requires reconfiguring any android device to prevent the release of that information. If this requires setting Selinux to permissive, then that tradeoff is quite acceptable. I might prefer it not be the case, but so long as all android devices sold into the marketplace represent the interests of google, the manufacturer, and any third-party that pays the manufacturer ahead of my interests then I will make that tradeoff.
As for Greenify, I have not found the sleep mode that is available in Android 11 to be adequate because it does not allow me to control system apps. You can take it as a maxim that the only android app that does not spy is the android app that is not running - and this includes lots of system apps that I might not want to delete or disable but also don't want running unless I say so, and then only while I am satisfying MY purpose for them.
As for the problem I was asking about, I added the specific URIs to the adaware blocklist and that suppressed them. Prior to that, I was seeing the DNS requests on my LAN DNS. I suspect the network utility I am using to monitor the phone's traffic is reporting requests ahead of the iptables FILTER table, and the packets were being suppressed prior to leaving the device, but I am not certain of that. The only way I could tell would be to monitor the device traffic as it went through the upstream VPN gateway on my LAN, and I did not do that.
Adaware works adequately for this, and I am not seeing any other unexpected/unacceptable traffic from my phone. The one remaining thing I need to check for will involve monitoring from the VPN gateway, as I look for any DoH or DoTLS traffic. I hope I don't find any; that will be a ***** to block. I do block it on the IOT VLAN on my network, but it requires a separate device running a script I wrote. To block DoH/DoTLS on my phone, while allowing appropriate DNS will be...fun.
Edit: And, actually, I just took a quick look. The sestatus command returns that my selinux status is "enforcing". The xposed framework I installed, actually, is lsposed, which is a systemless install using magisk. It implements the xposed framework but in a systemless way; I was just lazy when I wrote about it in my previous post.
jiml8 said:
Device security is only one aspect of security, and I handle that mostly through device configuration and usage policy anyway.
Overall security involves many other factors, which include maintaining full privacy and control over all data that gets out of the device and goes...elsewhere. To maintain this level of privacy requires reconfiguring any android device to prevent the release of that information. If this requires setting Selinux to permissive, then that tradeoff is quite acceptable. I might prefer it not be the case, but so long as all android devices sold into the marketplace represent the interests of google, the manufacturer, and any third-party that pays the manufacturer ahead of my interests then I will make that tradeoff.
As for Greenify, I have not found the sleep mode that is available in Android 11 to be adequate because it does not allow me to control system apps. You can take it as a maxim that the only android app that does not spy is the android app that is not running - and this includes lots of system apps that I might not want to delete or disable but also don't want running unless I say so, and then only while I am satisfying MY purpose for them.
As for the problem I was asking about, I added the specific URIs to the adaware blocklist and that suppressed them. Prior to that, I was seeing the DNS requests on my LAN DNS. I suspect the network utility I am using to monitor the phone's traffic is reporting requests ahead of the iptables FILTER table, and the packets were being suppressed prior to leaving the device, but I am not certain of that. The only way I could tell would be to monitor the device traffic as it went through the upstream VPN gateway on my LAN, and I did not do that.
Adaware works adequately for this, and I am not seeing any other unexpected/unacceptable traffic from my phone. The one remaining thing I need to check for will involve monitoring from the VPN gateway, as I look for any DoH or DoTLS traffic. I hope I don't find any; that will be a ***** to block. I do block it on the IOT VLAN on my network, but it requires a separate device running a script I wrote. To block DoH/DoTLS on my phone, while allowing appropriate DNS will be...fun.
Edit: And, actually, I just took a quick look. The sestatus command returns that my selinux status is "enforcing". The xposed framework I installed, actually, is lsposed, which is a systemless install using magisk. It implements the xposed framework but in a systemless way; I was just lazy when I wrote about it in my previous post.
Click to expand...
Click to collapse
I have been building Android roms for multiple devices for 9 years. When I started, I also gave a significant positive weight to Xposed, etc... . But the more I learned Android code, the more I became convinced that all those 'privacy' layers are mostly useless and even harmful, because they create a false sense of security.
Vanilla Android roms, actually, contain very little advertising/spying, and it makes a perfect sense: why would Google open-source their spying/advertising machine?
The only thing that might be considered spying (in vanilla Android) is captive portal detection that checks the internet connection and a few other network tools/tests that periodically connect to the internet, but not necessarily with nefarious purposes. But even these could be disabled or changed to other servers.
Android becomes an advertising tool only when you install Google Apps/Google Services Framework, register a Google account, etc. Once you have that, and 100% of stock roms do, no amount of tweaking can prevent spying, because these Google 'structures' sit lower than any systemless layer. In other words, they can go around Magisk/Xposed tricks. Moreover, on devices with stock roms, one doesn't even need encryption and the use of apps like Signal/Telegram/Silence etc.. Google Services Framework can see your outgoing messages before they are encrypted, and incoming messages after decryption. In other words, they can see what your eyes see on the screen.
So, the only way to prevent Google interests from taking over your phone is never install Google 'things', which is the case with my rom and my phone.
optimumpro said:
I have been building Android roms for multiple devices for 9 years. When I started, I also gave a significant positive weight to Xposed, etc... . But the more I learned Android code, the more I became convinced that all those 'privacy' layers are mostly useless and even harmful, because they create a false sense of security.
Vanilla Android roms, actually, contain very little advertising/spying, and it makes a perfect sense: why would Google open-source their spying/advertising machine?
The only thing that might be considered spying (in vanilla Android) is captive portal detection that checks the internet connection and a few other network tools/tests that periodically connect to the internet, but not necessarily with nefarious purposes. But even these could be disabled or changed to other servers.
Android becomes an advertising tool only when you install Google Apps/Google Services Framework, register a Google account, etc. Once you have that, and 100% of stock roms do, no amount of tweaking can prevent spying, because these Google 'structures' sit lower than any systemless layer. In other words, they can go around Magisk/Xposed tricks. Moreover, on devices with stock roms, one doesn't even need encryption and the use of apps like Signal/Telegram/Silence etc.. Google Services Framework can see your outgoing messages before they are encrypted, and incoming messages after decryption. In other words, they can see what your eyes see on the screen.
So, the only way to prevent Google interests from taking over your phone is never install Google 'things', which is the case with my rom and my phone.
Click to expand...
Click to collapse
I don't really program Android, though I am a kernel developer in both Linux and Freebsd. I also am one of the principal architects of a network infrastructure appliance that is getting a lot of attention in the industry.
So, while I do not know android in detail at a low level, I know linux thoroughly and I am fully equipped to completely monitor and control what access that android (or any other computer) has to any network. And that has been my dilemma; I can see what my device is doing and I am determined to stop it.
I agree with you about vanilla Android, absent all the google stuff. It is just linux with a different desktop on it, and the connections it makes to google are just for network management functions; the network device I have built also contacts google (and a few others) for network maintenance only and not any information transfer.
Unfortunately, the google apps infrastructure is required for some things that I use the phone for. Google maps is required by both Uber and Lyft; without Maps, I can't use those apps - and there are times when I am traveling where I really need to be able to use those apps.
Also, unfortunately, the company I am contracted to (where I am part-owner) for which I have built this network appliance makes heavy use of google tools. I have not been able to convince my partners to move away from google, and they can outvote me.
I have to allow Meet, and Chat to run on my device; I don't have a practical alternative. So I have spent a lot of time determining exactly which google components are the minimum required to allow those apps to run, and I have disabled or blocked or restricted permissions for all other google components - and both greenify and afwall play key roles in this activity.
With my old Galaxy S5, I just would install the smallest google package that supported Maps onto my Lineage OS on that device, but on this OnePlus 8, I have elected to stick with OOS for as long as it receives updates. So, tying google's hands is a lot more work.
My monitoring tells me I have it now as good as it will be. There are a few connections to google, as expected, but the frequency of those connections is not high and very little data is being transferred in either direction. I believe most of the traffic is administrative. The only thing I have not yet checked is whether there is any DoH or DoTLS traffic. My IOT VLAN watches for and blocks such traffic (my IOT VLAN exists to isolate and completely control my Android TV), and I have connected the phone to the IOT VLAN for a short while to see if any DoH/DoTLS was detected and none was - but I really need to connect it to that VLAN for an extended period.
I do root around in the phone's databases (which reveals what Google is doing, and Google can't stop that...) and the result is that I know Google is not doing much.
So, it isn't perfect. I would be much happier if the company would move away from google. But it is as good as its going to get, and I don't believe google is sneaking anything by me; I would have detected it. I do block a LOT of google URIs.
Also, as far as google open-sourcing their spying machine...that, quite explicitly, is the purpose of Android. It is open-sourced spyware for google.
They open-sourced it partly because they had to (the gnu licensing ties their hands) and partly to gain acceptance; its open source nature is why it is now the dominant architecture. It greatly reduces development costs for device manufacturers while providing a standardized framework upon which they can build.
Those of us who put in the effort to exploit that open-source nature to stop the spying are a small fraction of the total marketplace, and google can easily tolerate us.
Android has increased google's reach and ability to collect data about individuals to an enormous extent. From the standpoint of knowing everything about everybody (which is google's explicit goal) it is an enormous win for them.
Related
DroidWall in the marketplace allows full WiFi access to all apps.
Is it possible to code an application for Android (perhaps with root access) that can:
- deny all outbound data access per app basis
- specify the rules (ip-range/port-range) per app basis
Like a real alternative to a desktop software firewall?
Way too many apps are leaking all sorts of information (in plain text!) from the user account database to the Internet.
The android security makes me really scared to use the platform for anything requiring security. The privacy/security model is basically a swiss cheese that can be poked through by almost any app that just asks for certain rights at install time.
I'm hoping a firewall would be able to limit this issue, no?
I don't know about the other stuff you mentioned, but my version of DroidWall has a block/allow option for wifi and 3g, separately. It's the latest version from the market place, 1.4.2
Thanks, I just checked it out and it seems DroidWall indeed has a Wifi side blocking by app basis as well. I'm still testing though.
Ah, just tried it. Force closes on Galaxy S (rooted). Sigh.
Hello,
I think about rooting my device.
However I also think about how secure the custom roms builds or rooting apps are.
E.g.
In the modaco forum there is a tool called Superboot r2 to root the motorola moto g device.
How can I know/trust that this tool doesn't contain any spyware/malware or other malicous code?
How do you guys look at the security of custom roms and other apps which root your device?
Customizing and rooting one's phone can be done very securely. Even more now than a few years ago. I would be wary about apps that can root your phone with a buttoon press. Unless, of course, there is a really long thread about it on xda. The same with apps not from the Google store. You should run a virus scan on any apks you get in general. They can contain malicious code that can mess up your device and steal your information.
Once you root your device, it's a good idea to look into the XPrivacy app. You can use it to control the individual permissions of all of your installed app. There are a lot of other security measure you can take too. Do research on what would be relevant to your device.
kbntk said:
Hello,
I think about rooting my device.
However I also think about how secure the custom roms builds or rooting apps are.
E.g.
In the modaco forum there is a tool called Superboot r2 to root the motorola moto g device.
How can I know/trust that this tool doesn't contain any spyware/malware or other malicous code?
How do you guys look at the security of custom roms and other apps which root your device?
Click to expand...
Click to collapse
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
Elzbach said:
Customizing and rooting one's phone can be done very securely. Even more now than a few years ago. I would be wary about apps that can root your phone with a buttoon press. Unless, of course, there is a really long thread about it on xda. The same with apps not from the Google store. You should run a virus scan on any apks you get in general. They can contain malicious code that can mess up your device and steal your information.
Once you root your device, it's a good idea to look into the XPrivacy app. You can use it to control the individual permissions of all of your installed app. There are a lot of other security measure you can take too. Do research on what would be relevant to your device.
Click to expand...
Click to collapse
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Thank you for your replies guys.
jcase said:
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Click to expand...
Click to collapse
I agree rooding the device decreases the overall secruity of the device.
On the other hand, rooting the device gives access to the apps that give you control over the system and data on it. For example as Elzbach wrote, with the app XPrivacy I can control what apps have access to my personal information.
Now - without root - when I instal a new keyboard or launcher with widgets, I'm warned that these apps can have access to my personal information and can use them malicously. For me that means, that even without root using normal apps I can get big security risk when using some apps from play store.
Do you build the custom android version by yourself from the source or use builds provided on this forum or modaco or use another way?
kbntk said:
Thank you for your replies guys.
I agree rooding the device decreases the overall secruity of the device.
On the other hand, rooting the device gives access to the apps that give you control over the system and data on it. For example as Elzbach wrote, with the app XPrivacy I can control what apps have access to my personal information.
Now - without root - when I instal a new keyboard or launcher with widgets, I'm warned that these apps can have access to my personal information and can use them malicously. For me that means, that even without root using normal apps I can get big security risk when using some apps from play store.
Do you build the custom android version by yourself from the source or use builds provided on this forum or modaco or use another way?
Click to expand...
Click to collapse
XPrivacy, and apps like them introduce additional security concerns of their own. Android is not designed to work the way they force it too, introducing many new unknowns.
New keyboard, launchers introduce an infinitely smaller risk than any root app, and unlike with root apps you are warned and privileges are handled by an established well tested permission system. Comparing the two is completely silly.
Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all.
A completely valid scenario (one we have seen in the wild): An app with 0 permissions, but the ability to use su could download and dynamically execute new code to perform the malicious activities. IE Google bouncer, and any anti virus software would be @#[email protected] out of luck on that one. All because a user decided to completely break the basic security model, by installing su.
The only customized version of Android I use, is a customized emulator I use for analysis, and that only used when I suspect something could damage an actual test device.
I do not mess with customized versions of Android on real hardware, I only build when testing patches I plan to push to the AOSP gerrit for review.
jcase said:
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Click to expand...
Click to collapse
jcase said:
XPrivacy, and apps like them introduce additional security concerns of their own. Android is not designed to work the way they force it too, introducing many new unknowns.
New keyboard, launchers introduce an infinitely smaller risk than any root app, and unlike with root apps you are warned and privileges are handled by an established well tested permission system. Comparing the two is completely silly.
Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all.
A completely valid scenario (one we have seen in the wild): An app with 0 permissions, but the ability to use su could download and dynamically execute new code to perform the malicious activities. IE Google bouncer, and any anti virus software would be @#[email protected] out of luck on that one. All because a user decided to completely break the basic security model, by installing su.
The only customized version of Android I use, is a customized emulator I use for analysis, and that only used when I suspect something could damage an actual test device.
I do not mess with customized versions of Android on real hardware, I only build when testing patches I plan to push to the AOSP gerrit for review.
Click to expand...
Click to collapse
Well I stand corrected.
Apologize if I'm resurrecting an oldie but this is a topic I've been contemplating for a while now. I used to root, looking back to my old OG Droid days. But I find newer devices sufficient as to not root anymore (mostly). I'm currently debating rooting a Samsung Tab S 8.4 to remove Touchwiz and hopefully speed some things up and maybe further control the CPU.
If the user is rooted and they only install apps from the marketplace that are known to be safe (I assume)- i.e.- not downloaded from some misc internet site and from "non-trusted sources," would this still be able to happen?
- "Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all."
I guess I'm just not sure how google approved apps, or if they even do. And what's the process of showing app permissions in the Play Store these days, since permissions are front and center when you download an app. Do dev's just flag permissions on their own will or is it built into the Android code? I would ASSUME the android code when posting to Play Store decides permissions for the dev. I would be horrified if Android relied on good will for people to post permissions solely from the dev's input.
I could be completely wrong
But as I understand dev a pick the permissions they need for the app to work correctly. They declare the permissions they need to the Android system. And then they can only use those permissions and no others. However they don't need to use all of the permissions but they can if they want to.
Btw apps from google play are in no way safe.it has no bearing if you do or don't have apps from unknown sources on your device. fact is google in no way checks the source code of apps on the play store.now maybe the run a virus checks but honestly that means nothing as moron could code in malicious code that would not trigger a scanner (and Trojans are far more prevalent for Android than viruses). If the source code is not available then no one knows what an app could be doing.
90% of my apps come from fdroid, who builds everything from source.
In the discussion above I should also note (but could be wrong about this completely) that system apps (the ones that come with your phone) all have root(administrator) permissions by virtue of being system components.
So rooting may decrease your security but personally I think factory roms are far too unsecure to start with and will never have a device that is not rooted. The benefits far out weight the risks for the careful user. Until such time as the source code is released.
Unless you trust google, face book, Samsung, Twitter, and a host of other baked in developers who get to put apps on your phone at the factory.
Or Apple who has their own way of making money off your every move, or microsoft with win 10 that also sells your habits.
jcase said:
Rooting a device greatly decreased the overall security of the device. You are breaking the basic security design of Android, you are incorporating new code (mods etc) from developers who may not be properly trained, many who jsut copy past code from elsewhere without understanding what exactly is going on. Potentially (almost certainly with most custom roms) introducing new vulnerabilities.
I'm going to have to flat out disagree. Once you have rooted your device, security has greatly been decreased. What would be a minor vulnerability in a normal app, can become a huge vulnerability in an application that has been granted permission to use root. Same goes for the Superuser control application.
Click to expand...
Click to collapse
This alone is enough for me to stay away from root and its capability to make things worse in my end. Thank you for the professional input on this.
Without root you can't add any security to Android. Which has very little security to start with. Permissions are vague and can't be denied on a per app basis short of not installing the app.
System apps have no way of being removed without root unless you do it before flashing, and without root you can't do a complete backup of your system.
Even if you don't root a device yourself Trojans can gain root with many of the same exploits, root themselves and cause whatever havoc they desire.
An app only gets root if you allow it even after rooting your device. It will pop up and ask you if you want to allow or deny or always allow or deny. a Trojan that can create root will do can do it regardless if you root your device yourself, I have no idea if such a Trojan tried to get root if supersu, or superuser will pop up and ask.
A firewall requires root and that alone is worth rooting for me.
But then I have very few apps that I allow online.
Can root cause serious damage to your device? Yes
Can you administrator your device without root? No
Every Linux has root capabilities,
if you own it you should be able to administer it to the best of your abilities and to do that you need root.
Custom Roms are updated far more often that oem roms and as such generally have the newest fixes and updates for security.come that to factory roms that may update once or twice in their expected lifetime, regardless of how many security holes are found in the rom.older devices(read older as a synonym for 2 years old) may never get another update and the only way to protect yourself with out a custom Rom is to buy a new device.
For example Android 5.01 has a major memory leak.and even with that and other bugs and security issues Samsung had not updated the north American galaxy s5 (just over a year old,) above 5.01 yet and may not until marshmallow comes out (Which will mean almost a year after the security and memory leak were found). And until then you walk around using a device with major security issues and a major memory leak.
XPrivacy is not about Security. "Security" is never linked to Xprivacy on Github. "XPrivacy can prevent applications from leaking privacy-sensitive data". Saying the opposite is a lie.
Whether you have root access or not you can almost do nothing against serious attacks BUT having root access allows you to control some things like Internet connection, restricted access,...
Finally do not confuse Custom ROMs and Root. You can run a custom rom without root and vice versa. As explained above custom ROMs are more updated so you can enjoy more patches and new security features like SElinux.
Kayak83 said:
Apologize if I'm resurrecting an oldie but this is a topic I've been contemplating for a while now. I used to root, looking back to my old OG Droid days. But I find newer devices sufficient as to not root anymore (mostly). I'm currently debating rooting a Samsung Tab S 8.4 to remove Touchwiz and hopefully speed some things up and maybe further control the CPU.
If the user is rooted and they only install apps from the marketplace that are known to be safe (I assume)- i.e.- not downloaded from some misc internet site and from "non-trusted sources," would this still be able to happen?
- "Any developer, in a matter of minutes, put together a root app requesting 0 permissions, that can gain permissions or otherwise use APIs requiring permissions at runtime without declaring them, and disable or work around any "security" any XPrivacy type app claims to provide. Once rooted, apps like XPrivacy provide a complete false sense of security. Given you need root to use them... they provide no real security at all."
I guess I'm just not sure how google approved apps, or if they even do. And what's the process of showing app permissions in the Play Store these days, since permissions are front and center when you download an app. Do dev's just flag permissions on their own will or is it built into the Android code? I would ASSUME the android code when posting to Play Store decides permissions for the dev. I would be horrified if Android relied on good will for people to post permissions solely from the dev's input.
Click to expand...
Click to collapse
Go to F-Droid or fossdroid instead of Google Play to avoid crappy apps and unwanted connections. Apps on F-Droid are safer. Google has an automatic system to scan apks when they are uploaded but it doesn't detect everything... Be sure that if you didn't update the version number of your apk you will be blocked though lol
Permissions are stored in the AndroidManifest.xml. If the developer doesn't want to state the permissions he needs then nothing will be shown into the Manifest. That's why it's important to use 3rd party apps to control what apps really do.
Would never use my phone without a firewall installed. I want to have control over what apps can access the net and which cannot.
So rooting is a must for me.
Have no gapps installed and privacy is important to me.
Semseddin said:
This alone is enough for me to stay away from root and its capability to make things worse in my end. Thank you for the professional input on this.
Click to expand...
Click to collapse
And you'll be 100% wrong. You are getting a bad advice from someone who sounds like he works for Google. He is wrong and he knows it...
Your system apps have root whether you like it or not. So, they can do whatever Google wants them to do. And they can do it silently. So, the question is are you going to have control over your device or google? Without root you can't; with root you can if you know what you are doing. Your main security threat comes from Gapps and the infamous google services framework, which spies on you and regularly transmits home (google servers) your every activity. That has to go and for that you need root. Custom rom vs stock. Custom roms don't have Gapps and gsf, so that puts them on pedestal, as compared to stock. Stock rom is android plus manufacturer's bloat which also spies on you and wastes battery. Custom roms don't have gapps and they are open source (like Linux). Have you ever heard about viruses on Linux? Maybe 2 or 3, but thousands in other OSs. As another user noted, linux (on which android is based) has root. So is any major OS. Root is just a key to control your device. It can be set up to restrict everything, even system apps, so the point that having root reduces security is invalid except for one situation, when you don't know what you are doing. Do you want incompetent and malicious evil Google to own your phone? If you do, stay away from root.
optimumpro said:
And you'll be 100% wrong. You are getting a bad advice from someone who sounds like he works for Google. He is wrong and he probably knows it...
Your system apps have root whether you like it or not. So, they can do whatever Google wants them to do with your device. And they can do it silently. So, the question is are you going to have control over your device or google? Without root you can't; with root you can if you know what you are doing. Your main security threat comes from Gapps and the infamous google services framework, which spies on you and regularly tramsmits home (google servers) your every activity. That has to go and for that you need root. Custom rom vs stock. Custom roms don't have Gapps and gsf, so that puts them on pedestal, as compared to stock. Stock rom is android plus manufacturer's bloat which also spies on you and wastes battery. Custom roms don't have gapps and they are open source (like Linux). Have you ever heard about viruses on Linux? Maybe 2 or 3, but thousands in other OSs. As another user noted, linux (on which android is based) has root. So is any major OS. Root is just a key to control your device. It can be set up to restrict everything, even system apps, so the point that having root reduces security is invalid except for one situation, when you don't know what you are doing. Do you want incompetent and malicious evil Google to own your phone? If you do, stay away from root.
Click to expand...
Click to collapse
Thank you for your detailed answer but if i am not mistaken, are you suggesting that a custom rom made by a 3rd party hobbiest developer is more secure than oem's firmware ? If so, i will continue to be mistaken.
Semseddin said:
Thank you for your detailed answer but if i am not mistaken, are you suggesting that a custom rom made by a 3rd party hobbiest developer is more secure than oem's firmware ? If so, i will continue to be mistaken.
Click to expand...
Click to collapse
Most of the time the answer is yes. Also, you could be a developer yourself meaning you can compile your rom from sources with your own modifications. OEMs have user's security on the back burner. Their goal is to monetize the user and in case of mobile devices, there is no way to monetize the user without compromising security. The beauty of a published source code is that anyone could examine it and they do (even if it is not you yourself). Look at businesses: the majority of them use neither windows nor apple. They use Linux, because linux does not monetize the user and it is open sources and by the way, it is maintained by "hobbiest" developers. And naturally, because of this Linux has a vastly superior security and virtually no viruses.
Google is malicious and incompetent, but luckily, Android is based on linux and most of the code there is from linux.
This is of course a separate from root issue, which remains simply an issue of control: whether you want to be in control of your device or not. You can't name any OS that does not provide root to the user out of the box... Just because some (or most) smart phone dumb users don't know what they are doing does not mean that everyone should be denied root on their devices... And by the way, most Google engineers also don't know what they are doing and had it not been for Linux and the community at large, google wouldn't be able to produce anything that moves...
Scoped storage introduced in Android 11 is good, but RESTRICTED Storage would be an even better option.
On Android, at the moment, apps that have access to internal storage for their own files, also have access to every other file in the system. This is not only a privacy risk, but also a security concern. With the introduction of Scoped Storage, some of that is being addressed. Yet, there is still scope for misuse if apps have malicious intent.
I would like to have a system where every app that needs access to a file must go through the built in file manager to prevent misuse. What that means is no app has permanent access to files that are not created by them, and can only access files each time with explicit user consent and interaction. This would completely address the privacy concerns with regards to files.
This is how the Files app in iOS is designed and is an extremely well thought out one. Let me illustrate with an example:
We all know how Facebook is notorious when it comes to privacy. Let's assume you have a Facebook account and the Facebook app is installed on your phone. If you want to share a picture on Facebook, you have to grant the app access to your internal storage. On Android, this effectively grants Facebook access to every file on your storage. Given the reputation, it won't be surprising if Facebook app scans all your pictures/ videos for its AI/ ML, or even uploads them without your knowledge.
On iOS, the permission screen looks like this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You have the choice of either granting permanent access (Option 1), or limit the access to just the file(s) you want (Option 2). This permission can be set per app.
On Android, it is essentially Option 1 alone. You have to grant access to the entire file system for you to be able to upload your pics to Facebook.
On iOS, you have the choice of uploading just the pic you want, without giving the app access to any other file in your internal storage. This is a huge privacy boon.
In this case, Facebook app has to make a request to the built in file manager (which obviously has access to every file in the system), and you browse your media library using the built-in file manager (with which the built-in Photos app is integrated) to grant access. Facebook app sees absolutely nothing. It only makes a query, and everything else is handled by the built-in file manager. So even without granting blanket access, you are able to upload the file you want!
Same holds true for every app. An app should only have permanent access to its own files, and not any other file. For access to any other file, the app has to go through the built-in file manager route and access only the file that the user wants it to see.
Alternatively, ALL folders will be 'Restricted' by default. However, users will have the option to selectively relax the restrictions (per folder) for one or more apps (under folder properties) to give just those apps full access.
Hope Google (and custom ROM makers) can design something like this keeping in mind the privacy needs of its users, and the abusive intents of large corporations and malicious actors.
Here is an app that achieves the objective defined above:
Storage Isolation
Load trusted, vetted apps only; you are what you load. Don't allow apps to update; they may pass Playstore security only to update latter installing their payload. Firewall block all apps that don't need an internet to do their job. Most don't need access once activated.
Never load social media or shopping apps on the device, they are malware and an ongoing high security risk. If the social media site can't be fully logged onto and accessed by browser, ditch it.
Nothing can protect you from yourself, actions have consequences.
blackhawk said:
Load trusted, vetted apps only; you are what you load. Don't allow apps to update; they may pass Playstore security only to update latter installing their payload. Firewall block all apps that don't need an internet to do their job. Most don't need access once activated.
Never load social media or shopping apps on the device, they are malware and an ongoing high security risk. If the social media site can't be fully logged onto and accessed by browser, ditch it.
Nothing can protect you from yourself, actions have consequences.
Click to expand...
Click to collapse
The implementation suggested above would address privacy concerns related to user files and I'm not sure why Google hasn't yet done so.
Buying a smartphone and limiting it's usability severely as you say isn't practical.
TheMystic said:
The implementation suggested above would address privacy concerns related to user files and I'm not sure why Google hasn't yet done so.
Buying a smartphone and limiting it's usability severely as you say isn't practical.
Click to expand...
Click to collapse
Why has Google or Samsung not integrated a native firewall to Android? I use Karma Firewall, it uses almost no battery. Unfortunately it's valuable logging feature doesn't work on Android 10 and higher. Works fine with Pie though. I have apps like the 6yo free version of WPS office that wouldn't load on 11, pleasantly surprised it loaded on 10. It has no drop in replacement today that's not cloud or free. I simply firewall block it so it doesn't want to update to the current paid version. Doesn't effect usability.
What Google did with scoped storage kills a lot of useful and trusted apps while giving a false sense of security. Hackers never sleep and will always find workarounds to get your data.
Google is one of the worst data miners and purveyors of disinformation, trust them?
blackhawk said:
Why has Google or Samsung not integrated a native firewall to Android? I use Karma Firewall, it uses almost no battery. Unfortunately it's valuable logging feature doesn't work on Android 10 and higher. Works fine with Pie though. I have apps like the 6yo free version of WPS office that wouldn't load on 11, pleasantly surprised it loaded on 10. It has no drop in replacement today that's not cloud or free. I simply firewall block it so it doesn't want to update to the current paid version. Doesn't effect usability.
What Google did with scoped storage kills a lot of useful and trusted apps while giving a false sense of security. Hackers never sleep and will always find workarounds to get your data.
Google is one of the worst data miners and purveyors of disinformation, trust them?
Click to expand...
Click to collapse
This is why I prefer Oxygen OS, Colour OS and MiUI, all of which offer a native firewall within their OS. Since OOS 12, Oxygen OS is now showing a popup everytime a blocked app is launched. This is extremely annoying.
Karma Firewall appears to be an abandoned project with no update. It isn't working properly on Android 12 and newer. Netguard is currently the best.
Giving the user ability to setup which folders/ files each app can access would greatly enhance privacy. Scoped Storage is a half baked implementation, even though something is better than nothing. The implementation suggested above will address many of the current shortcomings.
Nothing is foolproof or failsafe. But bringing in improvements is always welcome.
Google may be the biggest data miner, but unfortunately their apps and services do not have competing alternatives. Users have to make lots of compromises when choosing alternatives.
The other reason I prefer Google/ Microsoft apps is because they help me be platform independent, since their apps are also available on iOS, Windows and Mac.
Mind sharing that cloud free version of WPS?
TheMystic said:
This is why I prefer Oxygen OS, Colour OS and MiUI, all of which offer a native firewall within their OS. Since OOS 12, Oxygen OS is now showing a popup everytime a blocked app is launched. This is extremely annoying.
Karma Firewall appears to be an abandoned project with no update. It isn't working properly on Android 12 and newer. Netguard is currently the best.
Giving the user ability to setup which folders/ files each app can access would greatly enhance privacy. Scoped Storage is a half baked implementation, even though something is better than nothing. The implementation suggested above will address many of the current shortcomings.
Nothing is foolproof or failsafe. But bringing in improvements is always welcome.
Google may be the biggest data miner, but unfortunately their apps and services do not have competing alternatives. Users have to make lots of compromises when choosing alternatives.
The other reason I prefer Google/ Microsoft apps is because they help me be platform independent, since their apps are also available on iOS, Windows and Mac.
Mind sharing that cloud free version of WPS?
Click to expand...
Click to collapse
Developers come and go. Karma Firewall is great app. After what Google did with scoped stoirage I don't blame them for bailing.
I have nothing against added security per se but it should be an option if it causes loss of functionality or uses resources. Knox is another one I hate. Gmail is the only Google app I regularly use. All my apps are backed up as installable copies on the data drive so no Playstore needed to reload. Completely self contained and self sufficient.
Make sure you firewall block it. It may not load on 11 or higher. To save docs you may have to play with it a bit but it will create, modify and save Word (doc x too) documents. More versions are found on APKmirror. About 81.37mb installed.
blackhawk said:
Developers come and go. Karma Firewall is great app. After what Google did with scoped stoirage I don't blame them for bailing.
I have nothing against added security per se but it should be an option if it causes loss of functionality or uses resources. Knox is another one I hate. Gmail is the only Google app I regularly use. All my apps are backed up as installable copies on the data drive so no Playstore needed to reload. Completely self contained and self sufficient.
Make sure you firewall block it. It may not load on 11 or higher. To save docs you may have to play with it a bit but it will create, modify and save Word (doc x too) documents. More versions are found on APKmirror. About 81.37mb installed.
Click to expand...
Click to collapse
I was using Karma, until it stopped working reliably. So went back to Netguard which is really good, and with some very useful feature not available in Karma.
Where do you install new apps from? APK backups help in going back to an older version. But for newer versions, you need Google Play Store, unless you are happy with apkmirror or similar.
I have a MS 365 subscription, so this is just a backup of a clean version of WPS, whose newer version destroys all context menus by showing up everywhere. I wish Android provided a way to customise context menus as well as share menus.
Thanks for the apk though.
TheMystic said:
I was using Karma, until it stopped working reliably. So went back to Netguard which is really good, and with some very useful feature not available in Karma.
Where do you install new apps from? APK backups help in going back to an older version. But for newer versions, you need Google Play Store, unless you are happy with apkmirror or similar.
I have a MS 365 subscription, so this is just a backup of a clean version of WPS, whose newer version destroys all context menus by showing up everywhere. I wish Android provided a way to customise context menus as well as share menus.
Thanks for the apk though.
Click to expand...
Click to collapse
That's one reason this N10+ is still running on Pie. I've been wanting to try out netguard.
Rarely from Playstore. I try not to same apps as they can potentially damage the system or worse. Some of my copies date back 6 years, most 2-3, many over the years from Playstore. They run well. Playstore also uses battery, every bit counts.
I do a few side loads that are always scanned with online Virustotal. If they look even a little iffy I don't install them. I use F-Droid too. No issues with the side loaded apps, yet...
You're welcome. I get tired of renting apps and a capable office app is absolutely essential.
blackhawk said:
That's one reason this N10+ is still running on Pie. I've been wanting to try out netguard.
Rarely from Playstore. I try not to same apps as they can potentially damage the system or worse. Some of my copies date back 6 years, most 2-3, many over the years from Playstore. They run well. Playstore also uses battery, every bit counts.
I do a few side loads that are always scanned with online Virustotal. If they look even a little iffy I don't install them. I use F-Droid too. No issues with the side loaded apps, yet...
You're welcome. I get tired of renting apps and a capable office app is absolutely essential.
Click to expand...
Click to collapse
Netguard is very good, actually much better than Karma (it will reactivate itself if the OS kills it, automatically blocks new apps, etc). The one very good thing about Karma is that it has no internet permissions. But Netguard says it doesn't collect any data or track anything.
Personally, i prefer to have the latest versions of both OS and apps, so I'm surprised that you are not updating the OS just to use an app, especially when a better alternative is already available.
I too have sideloaded a few apps (after checking them on VirusTotal), but i stick with Google Play Store mostly. It is rare that an update breaks something or takes away a useful feature, so this works for me. Besides, i do keep a backup of the important APKs with me, should it be required.
TheMystic said:
Netguard is very good, actually much better than Karma (it will reactivate itself if the OS kills it, automatically blocks new apps, etc). The one very good thing about Karma is that it has no internet permissions. But Netguard says it doesn't collect any data or track anything.
Personally, i prefer to have the latest versions of both OS and apps, so I'm surprised that you are not updating the OS just to use an app, especially when a better alternative is already available.
I too have sideloaded a few apps (after checking them on VirusTotal), but i stick with Google Play Store mostly. It is rare that an update breaks something or takes away a useful feature, so this works for me. Besides, i do keep a backup of the important APKs with me, should it be required.
Click to expand...
Click to collapse
Rule #1 - if an OS is fast, stable and fulfilling its mission, let it be!
Upgrades/updates can and do break things. It's mostly all play time with this old load. No surprises, it just runs. I spent a lot of time optimizing it and changing the firmware or updating apps changes my manicured playing field into a sinkhole of trouble.
Android 11, 12, and 13 bring nothing I want to the table and are trying to steal the silverware. Google seeks to stay relevant like the lame big sister it is. Their improvements don't make my device run better or even any more secure but they do waste my time. Plus I don't like the way it looks. It's the smell.
TheMystic said:
Scoped storage introduced in Android 11 is good, but RESTRICTED Storage would be an even better option.
On Android, at the moment, apps that have access to internal storage for their own files, also have access to every other file in the system. This is not only a privacy risk, but also a security concern. With the introduction of Scoped Storage, some of that is being addressed. Yet, there is still scope for misuse if apps have malicious intent.
I would like to have a system where every app that needs access to a file must go through the built in file manager to prevent misuse. What that means is no app has permanent access to files that are not created by them, and can only access files each time with explicit user consent and interaction. This would completely address the privacy concerns with regards to files.
This is how the Files app in iOS is designed and is an extremely well thought out one. Let me illustrate with an example:
We all know how Facebook is notorious when it comes to privacy. Let's assume you have a Facebook account and the Facebook app is installed on your phone. If you want to share a picture on Facebook, you have to grant the app access to your internal storage. On Android, this effectively grants Facebook access to every file on your storage. Given the reputation, it won't be surprising if Facebook app scans all your pictures/ videos for its AI/ ML, or even uploads them without your knowledge.
On iOS, the permission screen looks like this:
View attachment 5183183
You have the choice of either granting permanent access (Option 1), or limit the access to just the file(s) you want (Option 2). This permission can be set per app.
On Android, it is essentially Option 1 alone. You have to grant access to the entire file system for you to be able to upload your pics to Facebook.
On iOS, you have the choice of uploading just the pic you want, without giving the app access to any other file in your internal storage. This is a huge privacy boon.
In this case, Facebook app has to make a request to the built in file manager (which obviously has access to every file in the system), and you browse your media library using the built-in file manager (with which the built-in Photos app is integrated) to grant access. Facebook app sees absolutely nothing. It only makes a query, and everything else is handled by the built-in file manager. So even without granting blanket access, you are able to upload the file you want!
Same holds true for every app. An app should only have permanent access to its own files, and not any other file. For access to any other file, the app has to go through the built-in file manager route and access only the file that the user wants it to see.
Alternatively, ALL folders will be 'Restricted' by default. However, users will have the option to selectively relax the restrictions (per folder) for one or more apps (under folder properties) to give just those apps full access.
Hope Google (and custom ROM makers) can design something like this keeping in mind the privacy needs of its users, and the abusive intents of large corporations and malicious actors.
Click to expand...
Click to collapse
So lol
blackhawk said:
Rule #1 - if an OS is fast, stable and fulfilling its mission, let it be!
Upgrades/updates can and do break things. It's mostly all play time with this old load. No surprises, it just runs. I spent a lot of time optimizing it and changing the firmware or updating apps changes my manicured playing field into a sinkhole of trouble.
Android 11, 12, and 13 bring nothing I want to the table and are trying to steal the silverware. Google seeks to stay relevant like the lame big sister it is. Their improvements don't make my device run better or even any more secure but they do waste my time. Plus I don't like the way it looks. It's the smell.
Click to expand...
Click to collapse
Updates also bring in security improvements, along with the excitement of new and improved features. I always install them when available, with very rare exceptions.
Ideally, they shouldn't require users to make any changes to their setup, and that has also largely been my personal experience.
TheMystic said:
Updates also bring in security improvements, along with the excitement of new and improved features. I always install them when available, with very rare exceptions.
Ideally, they shouldn't require users to make any changes to their setup, and that has also largely been my personal experience.
Click to expand...
Click to collapse
Unfortunately that is more marketing hype than fact. One reason I run this N10+ on Pie with no updates is to test that statement. This 3yo device and firmware is a cleaner running and a more capable device than the S22U. How can that be? Poor design from both Samsung and Google Android.
I use to always buy new cars, but I learned better and the folly of my ways 25 years ago as new car quality steadily declined. Now Android is reminding me of that bs. For over a $1G it better out perform my N10+ in every especially with SOT and storage. It should be lighter and slimmer. Yes, well...
blackhawk said:
Unfortunately that is more marketing hype than fact. One reason I run this N10+ on Pie with no updates is to test that statement. This 3yo device and firmware is a cleaner running and a more capable device than the S22U. How can that be? Poor design from both Samsung and Google Android.
I use to always buy new cars, but I learned better and the folly of my ways 25 years ago as new car quality steadily declined. Now Android is reminding me of that bs. For over a $1G it better out perform my N10+ in every especially with SOT and storage. It should be lighter and slimmer. Yes, well...
Click to expand...
Click to collapse
There are definitive improvements in hardware: CPU, GPU, RAM, Storage, etc. And most importantly the Cameras. The cameras on the S22U are really very good.
I don't have too many complaints with this device, except for the recent battery drain which I hope to solve.
I don't agree with your used car statement, unless you buy one from someone you know has taken care of it very well. Newer cars are definitely more safe than the old cars, both in terms of material used and in terms of safety features. Lighter alloys can be stronger and safer than heavier metals, so don't go by how strong a material feels.
But it is also true that companies are increasingly designing products that would fail within a certain time period, and this applies to gadgets, consumer durables, components used, etc.
It comes down to your experience over the useful life of the product that the company designs them for. And this is the area where newer products usually excel.
TheMystic said:
There are definitive improvements in hardware: CPU, GPU, RAM, Storage, etc. And most importantly the Cameras. The cameras on the S22U are really very good.
I don't have too many complaints with this device, except for the recent battery drain which I hope to solve.
I don't agree with your used car statement, unless you buy one from someone you know has taken care of it very well. Newer cars are definitely more safe than the old cars, both in terms of material used and in terms of safety features. Lighter alloys can be stronger and safer than heavier metals, so don't go by how strong a material feels.
But it is also true that companies are increasingly designing products that would fail within a certain time period, and this applies to gadgets, consumer durables, components used, etc.
It comes down to your experience over the useful life of the product that the company designs them for. And this is the area where newer products usually excel.
Click to expand...
Click to collapse
The SOC is faster, has better bandwidth and is more capable as is the ram, but is only marginally faster by milliseconds for most tasks.
The battery is huge but it gets significantly less SOT
The display can run brighter, but because of variable refresh rate it lacks the color/gamma accuracy/calibration of the N10+. It's pixels will suffer if used at higher brightness levels, they aren't immune to that.
No expandable storage means no 1tb dual (data) drive and no onboard redundancy. 5G isn't as useful as it was hyped up to be in practice and is less efficient for many tasks. It's still power hungry even today.
Its all about balance, functionality and form factor, something Samsung has forgotten how to do. They are completely hype driven now and their insanity is showing. The components look like great but the result doesn't equal the sum of the parts. It even doesn't exceed the N10+/Pie is some important specs.
The N10+ running on Pie is snappy fast, get great SOT/screen off times, has maybe the best display there is in terms of color accuracy etc, more storage that doesn't get wiped in a crash or factory reset. It's a powerful but well balanced device that's a reliable joy to use and weighs 30gms less. The N10+ is also cool running, I can use it for web browsing at 98F ambient for hours with no cooling without it overheating. Upper operating range is 102F ambient at which point I either cool it or stop using it.
Steel is still the best crash material for absorbing massive amounts of impact energy and maintaining it's integrity. I take a 89 Volvo 240 wagon in a crash of any type vs a newer car.
Even has no damage 5 mph impact no damage bumpers. Rock solid, reliable, easy to work on and gets at least 20 mpg no matter how you drive it. Best of all they're easy and fun to drive.
Or
A 89 F-250 Super Suspension 4×2 with a International naturally aspirated diesel with a C6. Fast off the line, minimum 20 mpg.
TheMystic said:
I would like to have a system where every app that needs access to a file must go through the built in file manager to prevent misuse. What that means is no app has permanent access to files that are not created by them, and can only access files each time with explicit user consent and interaction. This would completely address the privacy concerns with regards to files.
Click to expand...
Click to collapse
Glad to note that this is finally coming on Android 14.
I had made a post on this in Oct'20, and it is almost 2.5 years since then. Better late than never.
I get a daily "some processes are using cpu restart phone" prompt in my notification bar. I can't find what is causing the error. Dev options only shows ram usage. As the title says, what's up why did they remove this troubleshooting option for non root users? Any input on this error? Good to be back btw.
Meh, that's one reason I'm still running Pie on my 10+.
When it happens look to see what was cache last. I use Device Care for this but my version is the factory load one. The Developer options one may not be as useful as you can't clear them like you can in DC.
I've found the root cause for many nasties like this...
If you haven't done a factory reset after the 11 upgrade... it's time to.
Appreciate the advice. Will try what you recommend
demize! said:
Appreciate the advice. Will try what you recommend
Click to expand...
Click to collapse
This is one of the reasons I'll still running on Pie, I know 11 is a mess. Securing the phone from the user is bs... unless they're morons. No way to protect that sort of user anyway
Maybe you can use ABD to enable logging in Karma Firewall or other advanced features now blocked in other trusted apps.
You can use the trial and error approach, something which I use a lot in lieu of proper diagnostics. Be aware that dependencies can cause a ripple effect as well as false usage reporting. Especially with Google system apks
Disabling, firewall blocking, clearing their data, clearing system logs can be much more effective than rebooting the phone. I normally now keep Google Play Services package blocked except when needed; it's a known trouble maker to me.
All cloud apps, Google Transport/Framework*, all carrier/Samsung/Google feedback as well Google Firebase are package blocked or disable.
Use this Package Blocker:
Home - Package Disabler
The only NON-root solution that let’s you disable any unwanted packages that come pre-installed / installed with your phone / tablet.
www.packagedisabler.com
Block Android Systems UID 1000 with Karma Firewall as it's almost never needed. It's not neccessary to firewall block Google Play Services if it's packaged blocked otherwise try doing so. Both of the above apks needlessly ping the internet constantly sucking up resources.
Karma Firewall uses virtually no battery, it's a gem.
Karma Firewall - Apps on Google Play
Karma Firewall app lets you block internet traffic to and from specific apps.
play.google.com
*Framework's dependencies still run in the background or is falsely reported as Framework albiet at a greatly reduced usage level with Framework being blocked.
Awesome I'm dl'ing it now. It's just beyond me on an octacore cpu any process would cause this error unless it's erroneous. But than how can you tell when they remove such a basic ability like monitoring app cpu usage.
demize! said:
Awesome I'm dl'ing it now. It's just beyond me on an octacore cpu any process would cause this error unless it's erroneous. But than how can you tell when they remove such a basic ability like monitoring app cpu usage.
Click to expand...
Click to collapse
Google sucks elephant balls bad. It was hard with Pie but now it's even worse.
Google doesn't care because you aren't the customer, you're the product.
The lack of user monitoring makes Google's data mining easier than ever for them to do.
Makes MS look like saints... one look at the Google Firebase data on my Google account made me puke; all 6700 whatever of my songs -were- listed there. It just did it even though nothing on my device I use need it to function properly. Meanwhile it's sucking up cpu cycles to build and maintain it... or it was
Out of such frustrations comes WhatsRunning - my response to Android's denial of low-level access. See if it helps: https://mirfatif.github.io/WhatsRunning/help/cpu_usage_per_process_android
Situation:
I have somewhat of a "love-REALLY HATE" relationship with Google apps and ecosystem.
On one hand, they are great at what they do.
On the other, it's like having a spy satellite overhead, given how much telemetry it does.
Question:
I'd like to cut all of the Google apps' internet, location, sensor and background activity access for good when not in use. Or at least spoof whatever personal data is being sent (Device info, location, activities, etc). Any way to do that?
What I've done so far:
My current way-to-go method involves installing RethinkDNS+firewall, then blocking every single one of google apps including Gboard. It sort-of works, but very inconvenient, as I have to manually enable internet access for a particular app and/or service when needed. I also tried edXposed's XluaPrivacy module to cut off access to certain permissions. Again, cumbersome.
After going through F-Droid, I found an app called "Insular", that claims being able to put all of the "big brother" apps (such as Gapps) behind an isolated sandbox, a digital gulag of sorts.
Thanks for the pointer to Insular whose advertising on F-Droid says:
Insular is a FLOSS fork of Island.
With Insular, you can:
Isolate your Big Brother apps
Clone and run multiple accounts simutaniuosly
Freeze or archive apps and prevent any background behaviors
Unfreeze apps on-demand with home screen shortcuts
Re-freeze marked apps with one tap
Hide apps
Selectively enable (or disable) VPN for different group of apps
Prohibit USB access to mitigate attacks with physical access
Click to expand...
Click to collapse
Based on that, I suspect this XDA thread about "Island" may be useful.
[APP][5.0+][BETA] Island - app freezing, privacy protection, parallel accounts
"Island" is a sandbox environment to clone selected apps and isolate them from accessing your personal data outside the sandbox (including call logs, contacts, photos and etc) even if related permissions are granted. Device-bound data is still accessible (SMS, IMEI and etc).
Isolated app can be frozen on demand, with launcher icon vanish and its background behaviors completely blocked.
Click to expand...
Click to collapse
Totesnochill said:
Question:
I'd like to cut all of the Google apps' internet, location, sensor and background activity access for good when not in use. Or at least spoof whatever personal data is being sent (Device info, location, activities, etc). Any way to do that?
Click to expand...
Click to collapse
Like you, my relationship with Google is strained where I don't set up any Google Account on Android and it works just fine.
I don't have a contacts.db sqlite database for that reason too, so my favorite communication apps are all designed to store their own contacts db internally to the app itself.
I replace Google apps with FOSS equivalents such as NewPipe (or, more recently, Vanced YouTube) for example.
And I spoof my GPS location by default (using Lexa Fake GPS, for example).
Of course, given I don't have a Google Account on my phone, I use the Aurora Store instead of the Google Play Store. Of course, I strive for apps that don't require Google Framework Services (GSF) which Aurora neatly filters out for us.
Since I'm not rooted, I can't delete Google Play Store, but I can disable it, which is almost as good.
And, I use privacy-aware apps for my messenger, calendar, contacts, and dialer apps (many of which come from Simple Mobile Tools' suite which are available on F-Droid).
To keep my WiFi SSID/BSSID/GPS/Strength/etc. out of the hands of Google (& Mozilla and Kismet and Wigle, etc.), I add "_nomap" to the SSID and I turn off the SOHO router SSID broadcast (which "hinders" most cellphones from uploading my BSSID information to Google public servers); but then I have to also turn off "AutoReconnect" on Android 12 and also I have the Developer Options set in Android 12 to randomize the MAC address on EACH connection; however that means I need to set any "static" connections on my LAN from the phone and not with address reservation on the router (which typically utilizes the MAC address).
And it's not just Google we need to keep our data out of their hands, as I even use WhatsApp privacy aware tools such as the WhatsApp dialer and WhatsApp Click to Chat mechanisms (to keep my contacts out of Facebook's hands too).
For offline maps, I use a quick web browser lookup on a privacy browser (such as Tor or Epic or Opera), since the Google address lookup is still the best in the world... (which is the love/hate relationship, right?)... and then I paste the GPS coordinates that the privacy browser found on the maps.google.com web site into a local routing application (such as a shortcut to a browser to google maps on the phone or better yet, to a dedicated offline map program such as OSM And~), and even traffic can be gotten without Google (e.g., Sigalert & 511 apps).
I used to reset the Advertising ID with a homescreen shortcut that could be activated from Windows via a batch file over Wi-Fi, but now with Android 12 we can wipe out the Advertising ID altogether (i.e., reset it to all zeroes). However, I still periodically change my GSF ID and other supposedly unique identifiers.
I'm still trying to figure out the implication of "trackers", so if anyone has more information about them, please advise.
Off hand there must be scores more things I do for privacy, where we probably should have a main thread on this site of all the myriad things people can do to increase their privacy on Android (some of which I've screenshotted for you below).
GalaxyA325G said:
Like you, my relationship with Google is strained where I don't set up any Google Account on Android and it works just fine.
Click to expand...
Click to collapse
Thanks heaps for the very in-depth response. Really opens up on a lot of things I wasnt aware of, and I realized that unlike desktop, when it comes to mobile privacy I'm still a bit behind.
Are there any guides where I can do some reading on the concepts and techniques you've described? Especially regarding contacts.db sqlite database, GPS spoofing and privacy-aware options for accessing WhatsApp.
Also, what are your thoughts on MIcroG?
Totesnochill said:
Thanks heaps for the very in-depth response.
Click to expand...
Click to collapse
I try to put effort into the response so that others can benefit (but nobody ever presses the like button so maybe it's not worth the effort).
For example, when I mentioned I spoof my GPS, I looked up the app I used and linked to it so that you wouldn't have to test a score of apps like I did to find the best one.
Totesnochill said:
Really opens up on a lot of things I wasn't aware of, and I realized that unlike desktop, when it comes to mobile privacy I'm still a bit behind.
Click to expand...
Click to collapse
That was just off the top of my head where there has to be at least a hundred different privacy things I do on Android to distance me from Google that most people don't bother to do.
I admit, sometimes it feels like we're putting a dozen locks on the front door, but in the end, we LEARN a lot about Android in the process.
A lot of the protection is to protect ourselves from others who don't know how to configure their phone, so they are uploading our private information (like our contacts and home locations) to Google databases.
For example, the typical Android phone when it drives by your front door uploads to google your exact location, your signal strength, your unique BSSID and your SSID... where you'll note in my response above I had to do a half dozen things on my phone and router to prevent that from happening (i.e., just adding "_nomap" doesn't work but most people don't realize that because they don't think about it).
Totesnochill said:
Are there any guides where I can do some reading on the concepts and techniques you've described?
Click to expand...
Click to collapse
I'm sure there are plenty.
But I have been in MANY situations where there are none.
Take, for example, changing the GSFID... almost nowhere on the net is that described how to do it. Almost nobody does it, but it can be done if you know how.
I really should write a set of privacy tutorials so that everyone can do it but I have to find the time, and this web site doesn't like text tutorials I found out recently. So they make it a PITA in the end to help people. Sigh.
Totesnochill said:
Especially regarding contacts.db sqlite database, GPS spoofing and privacy-aware options for accessing WhatsApp.
Click to expand...
Click to collapse
If you look at the links I gave you in my response for contacts, gps spoofing and privacy-aware WhatsApp, you'll get a good start.
A quickie is to not have a contacts.sqlite database, which means you need your own contacts.csv or more likely contacts.vcf file, which you can maintain on the PC if you like (works with Excel for example).
Now that you don't have a contacts.db sqlite database, you need to find the contacts and dialer and mms/sms apps that can suck in their own contacts.vcf file, which I pointed you to in the Simple Mobile Tools suite.
For GPS spoofing, I didn't mention you need to turn "Mock Location" on in the Android Developer Options, but that's what most people already do so I assumed you knew that. Once you turn that on, you can just select the mock location app of your choice (where I suggested one above which isn't perfect but none of them are).
That particular app moves your location every few feet and it gets the altitude and it can easily be stopped and started, etc., but I'd like it if it didn't move just "west by 10 feet every minute" but instead if it would follow a pre-determined route that I could give it. So they need a lot more work to be as good as we'd like them to be.
For What'sApp privacy, look at the two apps I linked to in the prior post as they don't need the contacts.sqlite database to work.
Your WhatsApp should only have an icon in your folders for the people you contact and nothing else, IMHO. That's the best privacy you can get, although WhatsApp does decent hashing on the contacts file when it uploads it to their servers - but still - why give them your entire contacts when you only contact 10 people (or whatever) on WhatsApp. Right?
Totesnochill said:
Also, what are your thoughts on MIcroG?
Click to expand...
Click to collapse
Funny you mentioned microG since I installed it for the first time yesterday when I was setting up Vanced Youtube based on this thread.
I generally choose apps that don't use GSF but sometimes you have to use a GSF app (e.g., Zoom meetings), and then it's nice to use MicroG instead of Google Services Framework.
I only installed it yesterday so I really don't know how well it will work for me as I didn't even need to install it to install VancedYoutube. You just need it to log into YouTube but I never do that anyway.
In summary, there's probably a hundred things we do to our phones to set up privacy but I'd have to write each one up in detail to help everyone and that's a lot of work.
Especially if almost nobody reads these threads.
GalaxyA325G said:
I try to put effort into the response so that others can benefit (but nobody ever presses the like button so maybe it's not worth the effort).
In summary, there's probably a hundred things we do to our phones to set up privacy but I'd have to write each one up in detail to help everyone and that's a lot of work.
Click to expand...
Click to collapse
Thank you for doing God's work out there. Ethics like these are what creates the content that keeps the internet from becoming a dumpster fire otherwise. Tutorials and explanations that come from the fellow users are THE best and usually directly on-point.
When I was just starting setting up Linux environment, I wrote "how-to notes" on every successful step. At first it was more like the "sticky notes" to help me remember, but eventually (as the list grew) I started writing these tips in a way as if they were to be read by someone with little background in the subject. What used to be the "Linux notes" file became 10563 lines monstrosity now... So every time I need to answer someone's question I just copypaste from this file.
GalaxyA325G said:
That was just off the top of my head where there has to be at least a hundred different privacy things I do on Android to distance me from Google that most people don't bother to do.
I admit, sometimes it feels like we're putting a dozen locks on the front door, but in the end, we LEARN a lot about Android in the process.
Click to expand...
Click to collapse
Absolutely. I've spent about 2 weeks tweaking my new phone (Nokia X6), trying out different roms/recoveries and app setups. Pissed off a bunch of people in the process - most wouldn't understand that I'm setting up a system to last another 7 years, just like my previous phone (Galaxy Gprime). Not to mention that with the amount of sensitive info on the phone, security and privacy are a legit concern, and worth learning about just how one learns to install and use the lock on the front doors.
Phones became disposable both in software and hardware, and so have the general attitude towards the devices.
My final setup became AOSP PixelPlusUI Rom (comes with about openGapps nano worth of Google stuff) with most other stock apps (contacts , dialer, keyboards, msg etc) removed via ADB and replaced with F-Droid alternatives.
I've also used Rethink DNS with whitelist set up/AppInspector to put Google in the Goolag - no internet access for anything google-related at all times. So far my phone has 253 apps blocked (including almost all of the system apps). Surprisingly, all of the necessary apps off google play store (Whatsapp, FB messenger) still function well. Whenever I need a particular Gservice (like a translator), I just enable access for that (and only that) until I dont need it anymore.
GalaxyA325G said:
If you look at the links I gave you in my response for contacts, gps spoofing and privacy-aware WhatsApp, you'll get a good start.
A quickie is to not have a contacts.sqlite database, which means you need your own contacts.csv or more likely contacts.vcf file, which you can maintain on the PC if you like (works with Excel for example).
Click to expand...
Click to collapse
Thanks! I'm not sure why the links didnt show up at first. I'll give this a look. I've been using "simple mobile tools" for quite a while, and I must say I like how they are completely autonomous and transparent about what prems they need and why.
GalaxyA325G said:
For GPS spoofing, I didn't mention you need to turn "Mock Location" on in the Android Developer Options, but that's what most people already do so I assumed you knew that.
Click to expand...
Click to collapse
I definitely saw the option in the dev settings, but didnt experiment with it. Well, now I know, thanks!
Funny you mentioned microG since I installed it for the first time yesterday when I was setting up Vanced Youtube based on this thread.
I generally choose apps that don't use GSF but sometimes you have to use a GSF app (e.g., Zoom meetings), and then it's nice to use MicroG instead of Google Services Framework.
I only installed it yesterday so I really don't know how well it will work for me as I didn't even need to install it to install VancedYoutube. You just need it to log into YouTube but I never do that anyway.
In summary, there's probably a hundred things we do to our phones to set up privacy but I'd have to write each one up in detail to help everyone and that's a lot of work.
Click to expand...
Click to collapse
I will give microG a try (in a form of LineageOS for MicroG). In fact I did install this rom before but I was a bit confused about what it did and assumed that it is a regular LinOS repack with Gplay store and apps built-in. Time to test again.
Especially if almost nobody reads these threads.
Click to expand...
Click to collapse
Threads like these is how I passed my uni exams. Not even exaggerating XD. Thanks again for a very detailed insightful read!
Hello my friends, very happy to meet good hearted people who think alike about Gugle.
as my name suggests I'm noob still and didn't understand much of discussion but very happy to meet you friends. My love & warm regards to all here. Here is what I did uptill now before I saw this thread :
1> Load GSI/ROM.
2> Load TWRP
3> Load Magisk
4> Load microG
5> Install Service Disabler
5.1> Disable bunch of internal services like telemetry, analytics, location (FusedLocation not possible to disable) for every app (3-rd party & system app), contacts sync etc.
6> Install SD-Maid Pro
6.1> Freeze apps like Gugle Calendar Sync Adapter & Gugle Contacts Sync Adapter
7> Install CIAFirewall Fake VPN & configure it.
8> I use Opera browser for Banking, Youtube, Cab booking, Surfing, Gmail, Food Order etc.
9> Install Aurora Store for general app management & installation
10> For contacts I save all contacts in notepad app, and let all calls purposely bounce then I call back aftter checking whose call it was & state false apologies.
#FYI :- Gugle, Mycrowsowft , eFbee are not really to be blamed, rhey are having to comply with FBI, Phentagon, Central Intelligence Agencies, Interpol, etc. or they have to shut bizness.
GalaxyA325G said:
Like you, my relationship with Google is strained where I don't set up any Google Account on Android and it works just fine.
Click to expand...
Click to collapse
Hi, I’m glad to have found this thread as I’m not happy with how my normal Android phone is spied upon by google. But I’m not technically knowledgeable and I don’t want to risk bricking my phone by trying amateur attempts at rooting, or installing Insular, etc…
So far I have not signed in, I allow only minimum permissions, use Netguard, Aurora and FDroid, and have disabled bloatware. I also force-stop apps as much as possible when not in use, and enable Location and Bluetooth only when needed.
I know this is just an amateur, token attempt to reduce spying - so I may have to eventually buy a degoogled phone.
I’ve also done some of the privacy suggestions in the attachments you posted.
Could you help me with a couple of newbie questions…
1): I might have minimised some personal data harvested by most of the apps I use, but I guess my privacy precautions will have no significant effect on the amount of telemetry collected by google?
2): If my precautions really have no significant effect, I’m wondering if would it make any real difference if I was signed in as I don’t use any of the google backup services anyway?
Thanks.