Related
Hi,
Sometimes an app (.apk) is either simply not available through Google's store, or it might say "not compatible with your device", etc. There can be various reasons why a person might download a .apk from somewhere other than a "trusted" source.
If this was a file for my PC I could test it in a "sandbox", and I could scan it with both Microsoft Security Essentials and Malware Bytes Antimalware.
On my Android phone(s) I'm not aware of something like the "sandbox" option, and I don't really want to run an "antivirus" program on my phone. Is there an easy way to scan .apk files on the PC to see if they are rogue apps, might send SMS, "phone home", or otherwise mess with other applications or the system software installed on my phone?
Lets give another example: say I thought 15 minutes was not long enough to evaluate a relatively expensive Android game (it certainly isn't!) and I want to test it out first. Let's assume my only option in that case might be an illegally downloaded copy from unknown sources. Of course, we shouldn't do that. But if we did, how could we know if the file is safe and not risk installing some Chinese spyware?
About Android AV programs: anybody know how effective they are? Do some defend against "trojans" - I would think these days trojans are 99% of problems and viruses mostly a relic of the past?
My biggest concern is actually just unwanted crap that runs in the background which eats up battery, makes my phone warm (which I hate), or, perhaps even sends SMS message [this would be even worse because I don't have a text message plan].
EDIT: I see web pages with tiles like "new study finds Android antivirus apps not effective" and articles like this one: http://www.zdnet.com/blog/hardware/...bouncer-does-it-offer-enough-protection/17981
Do we have an easy way to boot Galaxy S3 off of "external" SDCARD instead of internal memory?
Search play store for avast antivirus, completely free, updates daily and works really well (firewall. Anti theft. And many more Features
sony xperia ray ics 4.0.4
stock rom unrooted
I found this website, maybe it can help someone.
h t t p://scan.netqin.com/en/
Maybe someone can post another one...
an easy way to check for safe apk
The easiest way to check for safe apk is to have one gmail account and another "whatever" email account. Then just send the apk from the gmail one to the second account, gmail always find viruses in any apk and stop the process to join the file (virus alert). Bad point is you are limited with the size of the file you wanna send.
Nowadays, even pc antiviruses can detect viruses in apks. I would rather not burden my phone with any android antivirus,since they are literally battery hogs.
sent using my HTC One S
Go here and upload the APK
http://anubis.iseclab.org/
Anubis is a service for analyzing malware.
Submit your Windows executable or Android APK and receive an analysis report telling you what it does. Alternatively, submit a suspicious URL and receive a report that shows you all the activities of the Internet Explorer process when visiting this URL.
Andrubis executes Android apps in a sandbox and provides a detailed report on their behavior, including file access, network access, crypto operations, dynamic code loading and information leaks. In addition to the dynamic analysis in the sandbox, Andrubis also performs static analysis, yielding information on e.g. the app's activities, services, required external libraries and actually required permissions.
Found a good one too
apkscan.nviso.be - give it a try. Drag and drop - wait for the upload - than click SCAN . Wait for a few minutes. That`s all. Unlike ANUBIS it has a resolution at the end of the analysis . Usually helpful.
You can also email the file to [email protected] and it will email the report back in about ten minutes. Virustotal can display some interesting info, for example it said that Lucky Patcher is a "Potentially Infected Hosts File (v)", as reported by VIPRE and AVware.
Virustotal also has an official android app.
The Netqin scanner is also an android mobile app.
Late answer, sure, but I think ClamAV is what you want. You also want its bytecode signature file, and to speed things up, you only want that single file (speeds up things quite a bit).
It is the only offline apk scanner i know of, and as for its efficiency i cannot say, but it seems like it is what you are asking for.
An alternative would be to install something like BlueStacks and remap your "Windows shared folder" (through registry) to the folder you have your apk files in, and then run BitDefender on it. BD is by far the most pernickety AV app out there for Android.
I'll have to check out bitdefender (it's also included on virustotal.com)
apkscan.nviso.be seems to be pretty good at analyzing files for suspicious activity, and it also uploads the file to virustotal for you. Then you can copy the sha256 hash into the virustotal's search, to get all the gory details.
anubis.iseclab.org limits files to 8 megabytes.
Another way to avoid malware is:
when installing an update to an already-installed version of an application, it will 99% of the time prompt you to update an existing app. There's been rare instances where some apps do use a new digital signature (for example when spotify had a big security hole, and for awhile there were two apps by spotify in the app store).
One other way to tell, as a final check when launching the apk for installation on the phone: the icon will not have the right icon. I've installed apps before that I thought came from a trusted source, but the icon was not right. In fact, I was considering not posting this publically, so the "bad dudes" would not update their methods.
Another tool I found:
http://andrototal.org/
Although it might be a duplicate of virustotal.
nintendo1889 said:
Another tool I found:
http://andrototal.org/
Although it might be a duplicate of virustotal.
Click to expand...
Click to collapse
I just tried out this site. To me, it appears to be the most thorough virus testing site that I have seen. It takes some time for it to complete the scans. mainly because it scans the file with about 7 or 8 different scanning engines. Just just have to keep refreshing the page every few minutes to see if the results have updated.
I will be using this one as my go to site for apk scanning.
Just install it on the default emulator in the Android SDK
You can also install your apps on other emulator live bluestacks(best for games), jar of beans(best for rooted app) and windroy(the lightest)
Hit thanks if this helps
nintendo1889 said:
I'll have to check out bitdefender ...
Click to expand...
Click to collapse
Your signature photo ... awesome ... Bad Dudes
By using GDATA security , When you want to install an app the GDATA will scan it befor installing
Sent from my LG-D855 using Tapatalk
Use google scanning service VirusTotal to scan any app, secondly always use secure source. There are many well reputed apk sites but I personally use apklink.com , on this site required apk file is just a click away and its quite easy as well...
be safe & secure
This threads out of date, but it has me thinking I want to use something as mentioned in several replies to OP.
Are there any sites, or apps that can warn me if an .apk (for example) has malware etc.?
Thanks in advance for any help, including a link to another discussion that may have my answer
denise1952 said:
This threads out of date, but it has me thinking I want to use something as mentioned in several replies to OP.
Are there any sites, or apps that can warn me if an .apk (for example) has malware etc.?
Thanks in advance for any help, including a link to another discussion that may have my answer
Click to expand...
Click to collapse
Malwarebytes can detect malware.
Sent from my LGL84VL using Tapatalk
I tried this site and I like it because it goes into a lot of detail after analyzing and sends me a report in email. It was mentioned, and it is still available to use: https://apkscan.nviso.be/
Thank you for the heads up on MB, I use that on my PC and works great
You can use virustotal.
In order to check whether an app has a new version, we have to send HTTP request to some server where a .txt file is located, and compare its content with the current app version. So, we need a static URL for that purpose. I found that dropbox.com and box.com are very good places to store the file and modify its content without changing the URL.
1st question: Are there any other alternatives for dropbox and box?
2nd question: Does it comply with Google Play Policy if we send http requests periodically to these servers without a user's notice?
Look forward to your responses. Thanks.
To your first question: There are a lot of services. You can go to a simple shared hosting. There are some providers who offers you a small amount of storage for zero costs. You can use Google's Appengine, too, or as you suggested use Dropbox.
But, what do you want to do, if you see, the app on the user's device isn't the newest. If you want to redirect to an update in the play store, don't use such a method. Just wait until the play store notify the user. If you want to provide a link to the new version outside of the play store, store the file at the same place.
As a short idea: Use JSON or XML to provide the data on server side instead of some custom plain text structure.
pbeckmann said:
To your first question: There are a lot of services. You can go to a simple shared hosting. There are some providers who offers you a small amount of storage for zero costs. You can use Google's Appengine, too, or as you suggested use Dropbox.
But, what do you want to do, if you see, the app on the user's device isn't the newest. If you want to redirect to an update in the play store, don't use such a method. Just wait until the play store notify the user. If you want to provide a link to the new version outside of the play store, store the file at the same place.
As a short idea: Use JSON or XML to provide the data on server side instead of some custom plain text structure.
Click to expand...
Click to collapse
Thanks for you reply, I appreciate it. Yes, I use JSON format to store data about an app version. The app will send periodically HTTP requests to that file and if there is an app version difference I will show a dialog to a user indicating that there is a newer version. The dialog will contain 2 buttons: UPDATE (which will redirect to Play Store) and CLOSE. I don't have issues with how to implement. The interesting moment is where to store that file. You mentioned that "There are some providers who offers you a small amount of storage for zero costs", can you please note how to find such providers? I have some fears about it, because I could have many HTTP requests and it can be suspicious for such free of charge providers.
SaQada said:
Thanks for you reply, I appreciate it. Yes, I use JSON format to store data about an app version. The app will send periodically HTTP requests to that file and if there is an app version difference I will show a dialog to a user indicating that there is a newer version. The dialog will contain 2 buttons: UPDATE (which will redirect to Play Store) and CLOSE. I don't have issues with how to implement. The interesting moment is where to store that file. You mentioned that "There are some providers who offers you a small amount of storage for zero costs", can you please note how to find such providers? I have some fears about it, because I could have many HTTP requests and it can be suspicious for such free of charge providers.
Click to expand...
Click to collapse
It shouldn't be to much calls in a short period of time, cause you shouldn't ask the server for the file too often. If you plan to make monthly updates, its possible enough to query the file, one time in a week. In such a case, the amount is not so big even with thousands of installations. The other point with providers, is afaik they're looking about traffic, not hits, so a small file, won't create really much traffic, even with thousands of calls. If you care, look for something like cloudflare, cause dropbox is limiting too. They are shutting down public links, if they think, you abuse their service, then your file wouldn't be downloadable anymore.
But the problem you always have with those ways is, that the user possible gets the notification and opens the playstore, but Google hasn't proceed your update, or the local cache is too old, so they just got the information, that they have the newest version of your App.
pbeckmann said:
It shouldn't be to much calls in a short period of time, cause you shouldn't ask the server for the file too often. If you plan to make monthly updates, its possible enough to query the file, one time in a week. In such a case, the amount is not so big even with thousands of installations. The other point with providers, is afaik they're looking about traffic, not hits, so a small file, won't create really much traffic, even with thousands of calls. If you care, look for something like cloudflare, cause dropbox is limiting too. They are shutting down public links, if they think, you abuse their service, then your file wouldn't be downloadable anymore.
But the problem you always have with those ways is, that the user possible gets the notification and opens the playstore, but Google hasn't proceed your update, or the local cache is too old, so they just got the information, that they have the newest version of your App.
Click to expand...
Click to collapse
Actually my current app has more than 100.000 active users and I plan to send HTTP requests at least once a day. It means 100.000 requests to a file in a day. That's why I worry about dropbox like sites, as you said they can simply restrict to access the file. I will take a look at cloudflare, maybe this is what I need.
Another solution would be for me to have several servers to store a file and distribute HTTP requests among them. I think this is more reliable way.
SaQada said:
Actually my current app has more than 100.000 active users and I plan to send HTTP requests at least once a day. It means 100.000 requests to a file in a day. That's why I worry about dropbox like sites, as you said they can simply restrict to access the file. I will take a look at cloudflare, maybe this is what I need.
Another solution would be for me to have several servers to store a file and distribute HTTP requests among them. I think this is more reliable way.
Click to expand...
Click to collapse
In my opinion, it is better to leave it to Google to notify the users that there is a new update available.
As the previous user mentioned, how will you handle the situation where you notify the user that there is a new update, but Google did not process and push your update?
Hi all,
I had the suspicion for some time now that my Android phone is somehow collecting private information without my knowledge and using it to bombard me with ads but I wasn't sure how. I know that google is reading my emails, my calendars and has access to my data stored on Google Drive but today something totally weird happened. I was watching a video clip on YouTube when suddenly the clip paused and an ad show up about a salve I was discussing about the night before with my girlfriend. This cannot be a coincidence! The phone was during the conversation on Standby mode.
I've found some articles and even some videos on YouTube regarding this topic so I'm not paranoid.
Has anyone else experienced this?
Meanwhile I have deactivated microphone permission for all google apps but I doubt this is enough. What else can I do to stop it if it is really true?
I have stock ROM from Honor installed, would it be helpful to install a custom ROM?
droidis said:
Hi all,
I had the suspicion for some time now that my Android phone is somehow collecting private information without my knowledge and using it to bombard me with ads but I wasn't sure how. I know that google is reading my emails, my calendars and has access to my data stored on Google Drive but today something totally weird happened. I was watching a video clip on YouTube when suddenly the clip paused and an ad show up about a salve I was discussing about the night before with my girlfriend. This cannot be a coincidence! The phone was during the conversation on Standby mode.
I've found some articles and even some videos on YouTube regarding this topic so I'm not paranoid.
Has anyone else experienced this?
Meanwhile I have deactivated microphone permission for all google apps but I doubt this is enough. What else can I do to stop it if it is really true?
I have stock ROM from Honor installed, would it be helpful to install a custom ROM?
Click to expand...
Click to collapse
Google, Amazon, etc do pay a lot of attention to what you do online, which can seem a little intrusive. But we're not quite at the stage yet of people being listened to for the purposes of advertising.
It would be very labour-intensive, kill your battery and wreck your data. Not to mention the massive backlash from the public if and when it was discovered.
It's not impossible that some malware could be made which does listen to you, but it's not going to be an official Google app.
But, if you're still worried, deactivating microphone permission will stop the apps from being able to hear anything. There's no way to sidestep this to my knowledge. If an app doesn't have permission to use the mic, it can't use it.
Ticklefish said:
Google, Amazon, etc do pay a lot of attention to what you do online, which can seem a little intrusive. But we're not quite at the stage yet of people being listened to for the purposes of advertising.
Click to expand...
Click to collapse
I disagree. If you know someone who has a Google Home or Amazon Alexa product, ask them if they've had a similar experience. I know people who have those products, and they had a similar experience as OP.
Eavesdropping via Google Home/Amazon Alexa is a little different than eavesdropping on private phone conversations, because you must give Google Home/Amazon Alexa explicit permission to listen in order for it to work. However, I would not be surprised if Google monitors phone calls/texts in some manner to tailor advertisements.
answers
Google, Amazon, etc do pay a lot of attention to what you do online, which can seem a little intrusive. But we're not quite at the stage yet of people being listened to for the purposes of advertising.
http://qz.com/1145669/googles-true-...nd-nsa-research-grants-for-mass-surveillance/
http://www.theverge.com/2018/8/13/17684660/google-turn-off-location-history-data
https://video.foxnews.com/v/5731183327001/
Ads are being fed to users based on their voice content, online searches, etc. It is easy for machines to convert voice to text nowadays. That text is analysed for any text or phrase. Been going on for years with our spied-on phone calls and emails. Just see some YouTube videos for realtime subtitles in various languages for proof that this is done routinely.
Cameras, wifi, cellular and GPS are activated without our knowledge or permission routinely by OS, games and apps. Info is sent to Google and third parties when online. If your device is filled with Google's own battery-sucking apps, forget any semblance of privacy, I reckon. If your front camera is not covered...you are probably a sitting duck. You can buy camera covers on ebay if you want to be selective about when it's OK, these have a slider, otherwise consider taping it over. Same with your laptop.
If you are using Google Services or using Google Apps then I think you are a sitting duck ready to take some bullets. Much like Apple and Microsoft users are. To be fair, that is probably 99.99% of device owners.
Third-party apps and games do it too. So there's that. Your data is siphoned-off and sent over the interwebs by them.
Is your device rooted? If not, I'd recommend using a device that has TWRP for it, so you can more cleanly root it without resorting to more questionable root software with its own spyware. I'd recommend making a TWRP back-up before heavily uninstalling apps.
I'd recommend downloading open-source apps on f-droid.org. With a root uninstaller you can uninstall many things they normally don't let you: like all the Google spyware apps and components. Also things that you don't see listed under your Apps. Disabling Google apps doesn't stop them running. Uninstalling them then removing leftover files is a far better approach. For that you'll want a root uninstaller and a root file manager. Some uninstallers are better than others.
Trusting Google's own Permissions thing was always a bit like entrusting your kid to the local paedophile, to me. Google have CIA origins (and backing) and NSA funds keeping them primed. Do you know what just these 2 do worldwide? Unspeakable horrors. Consult William Blum or Susan Lindauer for starters.
I'd consider an open-source keyboard from f-droid.org. Like AnySoftKeyboard. I'd.consider replacing all default stock apps, including the Launcher.
The following has been safely removed by me after rooting my devices (various Mediatek-based Lenovo tablets):
Android Live Wallpapers, Android Work Assistant, Basic Daydreams, Black Hole, BSPTelephonyDevTool, Bubbles, Calculator, Calendar, Calendar Storage, Certificate Installer, Chrome, Clock, com.android.backupconfirm, com.android.browser.provider, com.android.providers.partnerbookmarks, com.android.sharedstoragebackup, com.android.wallpaper.holospiral, com.huaquin.factoryservice, com.mediatek, com.mediatek.voiceexztension,ConfigUpdater, Contacts, Contacts Storage, Device Service, dongle,Drive, DRM Protected Content Storage, Email, Exchange Services, FactoryKit Test, FM Radio, FTPrecheck, Fused Location, FwkPlugin, FWUpgrade, Gallery, Gamestore, Gmail, Google Account Manager, Google Backup Transport, Google App, Google Calendar Sync, Google Keyboard, Google One Time Init, Google Partner Setup, Google Play Movies, Google Play Music, Google Play services, Google Play Store, Google Services Framework, Guvera Music, Hangouts, Launcher3, Lenovo ID, Maps, Market Feedback Agent, McAfee Security, MmsService
Mobile Data, Mobile Network Configuration, MTKFloatMenu, MTK Logger, MTK NLPService, Music Visualisation Wallpapers, MusicFX, PacProcessor, Permission Control, Phone, Photos, RawDataTEst, RunInRebootSystem, Schedule power on & off, Search Applications Provider, Setup Wizard, SHAREit, Skype, SmartcardService, Sound Recorder, SYNCit HD, System Update, Tap the Frog HD, Tedongle Settings, Twitter, UC Browser HD, UpgradeSys, Vcalendar, VoiceCommand, Volidation Tools, YGPS, YouTube
Some of thistuff might be needed for phones but I use a tablet. All the telephony stuff is uninstalled.
If i need an app from Google's Spyware Play Store I use sites like https://apps.evozi.com/apk-downloader/ to download the APK directly without signing in to Google's Spyware Store infrastructure (since no Google apps are installed on my device). Otherwise f-droid.org caters to 95+% of my needs.
AdAway is one of the first things I install, along with a decent firewall like AfWall+
Xprivacy deserves some of your attention as do these apps from Tibor Kaputa https://simplemobiletools.github.io/
I've looked at a lot of anti-spyware apps, but I can't find one that specifically says it can find stealth apps that someone installed when they got ahold of your phone. So it would look like an app that I personally wanted to have. They mostly talk about apps that were installed by a virus or link, etc.
It would be nice to be able to disable camera/mic functions too, or at least be notified when they are being accessed.
I don't mind paying to purchase the app, but most require a double digit monthly subscription, and I make next to nothing because I'm disabled so chances are even if I subscribed the money wouldn't be there to continue the subscription.
I've lurked here for many years without signing up, I love you guys! There are so many tutorials and apps that would never have known about if not for you guys. The developers here are geniuses. So thank you immensely in advance for your help!
Maybe try play store free app Bitdefender which has 5 million dl's & 4.7 rating. I have not tried it....
"Bitdefender Antivirus is one of the few actually free antivirus apps. It hasn’t changed much over the years. It offers a basic scanning feature, a simple interface, quick performance, and no configuration. This is a great one for super basic needs. All it really does is scan stuff ..." androidauthority
galaxys said:
Maybe try play store free app Bitdefender which has 5 million dl's & 4.7 rating. I have not tried it....
"Bitdefender Antivirus is one of the few actually free antivirus apps. It hasn’t changed much over the years. It offers a basic scanning feature, a simple interface, quick performance, and no configuration. This is a great one for super basic needs. All it really does is scan stuff ..." androidauthority
Click to expand...
Click to collapse
Thanks for the reply. Do anti-virus apps detect spyware though?
They can, just read some of the app playstore reviews and it's Developer app description for details....
Try ‘Malwarebytes for Android’.
If you really think there's spyware do a hard reset.
If you still aren't satisfied go full nuke and have the firmware reflashed.
No virus detection has a 100% detection rate and the worst trojans only a reflash can eradicate them.
A better question is why do you think there's spyware on the phone?
In over 6 years of using outdated OS's I've never had to do a reload because of malware.
Once found a nasty trojan preloader before it could be triggered with Malwarebytes.
I had a infected jpeg that damaged files in the download folder. Deleting the jpeg and some of the files ended it's brief rain of terror.
Be careful what apps you load, what you download*, what you click and never let others have unsupervised access to your device. React quickly to abnormal behavior to find it's cause.
Delete any file you suspect of being malware including jpegs and pngs.
Be prepare to do a hard reset at any time if you believe the device has been infected.
Always keep at least 2 complete isolated data backups for the device. Stagger syncs to them so a virus can't get embedded on both of them... hopefully.
Lol, paranoid yet?
*use only cloud based email apps like gmail
Google apps are spyware, Facebook is spyware, Whatsapp is spyware, Instagram is spyware. In principle all Social Media apps are spyware.
All apps what are designed to track your Internet browsing habits, such as frequented sites and favorite downloads, and then provide advertising companies with marketing data are spyware. All apps what can access your contacts data are spyware ...
Android, the spyware party mix...
You can try Bitdefender Free or Malwarebytes Premium. I have not used the second one before but have read a review at https://antivirusdoctor.net/ and think about using it on my smartphone.
Situation:
I have somewhat of a "love-REALLY HATE" relationship with Google apps and ecosystem.
On one hand, they are great at what they do.
On the other, it's like having a spy satellite overhead, given how much telemetry it does.
Question:
I'd like to cut all of the Google apps' internet, location, sensor and background activity access for good when not in use. Or at least spoof whatever personal data is being sent (Device info, location, activities, etc). Any way to do that?
What I've done so far:
My current way-to-go method involves installing RethinkDNS+firewall, then blocking every single one of google apps including Gboard. It sort-of works, but very inconvenient, as I have to manually enable internet access for a particular app and/or service when needed. I also tried edXposed's XluaPrivacy module to cut off access to certain permissions. Again, cumbersome.
After going through F-Droid, I found an app called "Insular", that claims being able to put all of the "big brother" apps (such as Gapps) behind an isolated sandbox, a digital gulag of sorts.
Thanks for the pointer to Insular whose advertising on F-Droid says:
Insular is a FLOSS fork of Island.
With Insular, you can:
Isolate your Big Brother apps
Clone and run multiple accounts simutaniuosly
Freeze or archive apps and prevent any background behaviors
Unfreeze apps on-demand with home screen shortcuts
Re-freeze marked apps with one tap
Hide apps
Selectively enable (or disable) VPN for different group of apps
Prohibit USB access to mitigate attacks with physical access
Click to expand...
Click to collapse
Based on that, I suspect this XDA thread about "Island" may be useful.
[APP][5.0+][BETA] Island - app freezing, privacy protection, parallel accounts
"Island" is a sandbox environment to clone selected apps and isolate them from accessing your personal data outside the sandbox (including call logs, contacts, photos and etc) even if related permissions are granted. Device-bound data is still accessible (SMS, IMEI and etc).
Isolated app can be frozen on demand, with launcher icon vanish and its background behaviors completely blocked.
Click to expand...
Click to collapse
Totesnochill said:
Question:
I'd like to cut all of the Google apps' internet, location, sensor and background activity access for good when not in use. Or at least spoof whatever personal data is being sent (Device info, location, activities, etc). Any way to do that?
Click to expand...
Click to collapse
Like you, my relationship with Google is strained where I don't set up any Google Account on Android and it works just fine.
I don't have a contacts.db sqlite database for that reason too, so my favorite communication apps are all designed to store their own contacts db internally to the app itself.
I replace Google apps with FOSS equivalents such as NewPipe (or, more recently, Vanced YouTube) for example.
And I spoof my GPS location by default (using Lexa Fake GPS, for example).
Of course, given I don't have a Google Account on my phone, I use the Aurora Store instead of the Google Play Store. Of course, I strive for apps that don't require Google Framework Services (GSF) which Aurora neatly filters out for us.
Since I'm not rooted, I can't delete Google Play Store, but I can disable it, which is almost as good.
And, I use privacy-aware apps for my messenger, calendar, contacts, and dialer apps (many of which come from Simple Mobile Tools' suite which are available on F-Droid).
To keep my WiFi SSID/BSSID/GPS/Strength/etc. out of the hands of Google (& Mozilla and Kismet and Wigle, etc.), I add "_nomap" to the SSID and I turn off the SOHO router SSID broadcast (which "hinders" most cellphones from uploading my BSSID information to Google public servers); but then I have to also turn off "AutoReconnect" on Android 12 and also I have the Developer Options set in Android 12 to randomize the MAC address on EACH connection; however that means I need to set any "static" connections on my LAN from the phone and not with address reservation on the router (which typically utilizes the MAC address).
And it's not just Google we need to keep our data out of their hands, as I even use WhatsApp privacy aware tools such as the WhatsApp dialer and WhatsApp Click to Chat mechanisms (to keep my contacts out of Facebook's hands too).
For offline maps, I use a quick web browser lookup on a privacy browser (such as Tor or Epic or Opera), since the Google address lookup is still the best in the world... (which is the love/hate relationship, right?)... and then I paste the GPS coordinates that the privacy browser found on the maps.google.com web site into a local routing application (such as a shortcut to a browser to google maps on the phone or better yet, to a dedicated offline map program such as OSM And~), and even traffic can be gotten without Google (e.g., Sigalert & 511 apps).
I used to reset the Advertising ID with a homescreen shortcut that could be activated from Windows via a batch file over Wi-Fi, but now with Android 12 we can wipe out the Advertising ID altogether (i.e., reset it to all zeroes). However, I still periodically change my GSF ID and other supposedly unique identifiers.
I'm still trying to figure out the implication of "trackers", so if anyone has more information about them, please advise.
Off hand there must be scores more things I do for privacy, where we probably should have a main thread on this site of all the myriad things people can do to increase their privacy on Android (some of which I've screenshotted for you below).
GalaxyA325G said:
Like you, my relationship with Google is strained where I don't set up any Google Account on Android and it works just fine.
Click to expand...
Click to collapse
Thanks heaps for the very in-depth response. Really opens up on a lot of things I wasnt aware of, and I realized that unlike desktop, when it comes to mobile privacy I'm still a bit behind.
Are there any guides where I can do some reading on the concepts and techniques you've described? Especially regarding contacts.db sqlite database, GPS spoofing and privacy-aware options for accessing WhatsApp.
Also, what are your thoughts on MIcroG?
Totesnochill said:
Thanks heaps for the very in-depth response.
Click to expand...
Click to collapse
I try to put effort into the response so that others can benefit (but nobody ever presses the like button so maybe it's not worth the effort).
For example, when I mentioned I spoof my GPS, I looked up the app I used and linked to it so that you wouldn't have to test a score of apps like I did to find the best one.
Totesnochill said:
Really opens up on a lot of things I wasn't aware of, and I realized that unlike desktop, when it comes to mobile privacy I'm still a bit behind.
Click to expand...
Click to collapse
That was just off the top of my head where there has to be at least a hundred different privacy things I do on Android to distance me from Google that most people don't bother to do.
I admit, sometimes it feels like we're putting a dozen locks on the front door, but in the end, we LEARN a lot about Android in the process.
A lot of the protection is to protect ourselves from others who don't know how to configure their phone, so they are uploading our private information (like our contacts and home locations) to Google databases.
For example, the typical Android phone when it drives by your front door uploads to google your exact location, your signal strength, your unique BSSID and your SSID... where you'll note in my response above I had to do a half dozen things on my phone and router to prevent that from happening (i.e., just adding "_nomap" doesn't work but most people don't realize that because they don't think about it).
Totesnochill said:
Are there any guides where I can do some reading on the concepts and techniques you've described?
Click to expand...
Click to collapse
I'm sure there are plenty.
But I have been in MANY situations where there are none.
Take, for example, changing the GSFID... almost nowhere on the net is that described how to do it. Almost nobody does it, but it can be done if you know how.
I really should write a set of privacy tutorials so that everyone can do it but I have to find the time, and this web site doesn't like text tutorials I found out recently. So they make it a PITA in the end to help people. Sigh.
Totesnochill said:
Especially regarding contacts.db sqlite database, GPS spoofing and privacy-aware options for accessing WhatsApp.
Click to expand...
Click to collapse
If you look at the links I gave you in my response for contacts, gps spoofing and privacy-aware WhatsApp, you'll get a good start.
A quickie is to not have a contacts.sqlite database, which means you need your own contacts.csv or more likely contacts.vcf file, which you can maintain on the PC if you like (works with Excel for example).
Now that you don't have a contacts.db sqlite database, you need to find the contacts and dialer and mms/sms apps that can suck in their own contacts.vcf file, which I pointed you to in the Simple Mobile Tools suite.
For GPS spoofing, I didn't mention you need to turn "Mock Location" on in the Android Developer Options, but that's what most people already do so I assumed you knew that. Once you turn that on, you can just select the mock location app of your choice (where I suggested one above which isn't perfect but none of them are).
That particular app moves your location every few feet and it gets the altitude and it can easily be stopped and started, etc., but I'd like it if it didn't move just "west by 10 feet every minute" but instead if it would follow a pre-determined route that I could give it. So they need a lot more work to be as good as we'd like them to be.
For What'sApp privacy, look at the two apps I linked to in the prior post as they don't need the contacts.sqlite database to work.
Your WhatsApp should only have an icon in your folders for the people you contact and nothing else, IMHO. That's the best privacy you can get, although WhatsApp does decent hashing on the contacts file when it uploads it to their servers - but still - why give them your entire contacts when you only contact 10 people (or whatever) on WhatsApp. Right?
Totesnochill said:
Also, what are your thoughts on MIcroG?
Click to expand...
Click to collapse
Funny you mentioned microG since I installed it for the first time yesterday when I was setting up Vanced Youtube based on this thread.
I generally choose apps that don't use GSF but sometimes you have to use a GSF app (e.g., Zoom meetings), and then it's nice to use MicroG instead of Google Services Framework.
I only installed it yesterday so I really don't know how well it will work for me as I didn't even need to install it to install VancedYoutube. You just need it to log into YouTube but I never do that anyway.
In summary, there's probably a hundred things we do to our phones to set up privacy but I'd have to write each one up in detail to help everyone and that's a lot of work.
Especially if almost nobody reads these threads.
GalaxyA325G said:
I try to put effort into the response so that others can benefit (but nobody ever presses the like button so maybe it's not worth the effort).
In summary, there's probably a hundred things we do to our phones to set up privacy but I'd have to write each one up in detail to help everyone and that's a lot of work.
Click to expand...
Click to collapse
Thank you for doing God's work out there. Ethics like these are what creates the content that keeps the internet from becoming a dumpster fire otherwise. Tutorials and explanations that come from the fellow users are THE best and usually directly on-point.
When I was just starting setting up Linux environment, I wrote "how-to notes" on every successful step. At first it was more like the "sticky notes" to help me remember, but eventually (as the list grew) I started writing these tips in a way as if they were to be read by someone with little background in the subject. What used to be the "Linux notes" file became 10563 lines monstrosity now... So every time I need to answer someone's question I just copypaste from this file.
GalaxyA325G said:
That was just off the top of my head where there has to be at least a hundred different privacy things I do on Android to distance me from Google that most people don't bother to do.
I admit, sometimes it feels like we're putting a dozen locks on the front door, but in the end, we LEARN a lot about Android in the process.
Click to expand...
Click to collapse
Absolutely. I've spent about 2 weeks tweaking my new phone (Nokia X6), trying out different roms/recoveries and app setups. Pissed off a bunch of people in the process - most wouldn't understand that I'm setting up a system to last another 7 years, just like my previous phone (Galaxy Gprime). Not to mention that with the amount of sensitive info on the phone, security and privacy are a legit concern, and worth learning about just how one learns to install and use the lock on the front doors.
Phones became disposable both in software and hardware, and so have the general attitude towards the devices.
My final setup became AOSP PixelPlusUI Rom (comes with about openGapps nano worth of Google stuff) with most other stock apps (contacts , dialer, keyboards, msg etc) removed via ADB and replaced with F-Droid alternatives.
I've also used Rethink DNS with whitelist set up/AppInspector to put Google in the Goolag - no internet access for anything google-related at all times. So far my phone has 253 apps blocked (including almost all of the system apps). Surprisingly, all of the necessary apps off google play store (Whatsapp, FB messenger) still function well. Whenever I need a particular Gservice (like a translator), I just enable access for that (and only that) until I dont need it anymore.
GalaxyA325G said:
If you look at the links I gave you in my response for contacts, gps spoofing and privacy-aware WhatsApp, you'll get a good start.
A quickie is to not have a contacts.sqlite database, which means you need your own contacts.csv or more likely contacts.vcf file, which you can maintain on the PC if you like (works with Excel for example).
Click to expand...
Click to collapse
Thanks! I'm not sure why the links didnt show up at first. I'll give this a look. I've been using "simple mobile tools" for quite a while, and I must say I like how they are completely autonomous and transparent about what prems they need and why.
GalaxyA325G said:
For GPS spoofing, I didn't mention you need to turn "Mock Location" on in the Android Developer Options, but that's what most people already do so I assumed you knew that.
Click to expand...
Click to collapse
I definitely saw the option in the dev settings, but didnt experiment with it. Well, now I know, thanks!
Funny you mentioned microG since I installed it for the first time yesterday when I was setting up Vanced Youtube based on this thread.
I generally choose apps that don't use GSF but sometimes you have to use a GSF app (e.g., Zoom meetings), and then it's nice to use MicroG instead of Google Services Framework.
I only installed it yesterday so I really don't know how well it will work for me as I didn't even need to install it to install VancedYoutube. You just need it to log into YouTube but I never do that anyway.
In summary, there's probably a hundred things we do to our phones to set up privacy but I'd have to write each one up in detail to help everyone and that's a lot of work.
Click to expand...
Click to collapse
I will give microG a try (in a form of LineageOS for MicroG). In fact I did install this rom before but I was a bit confused about what it did and assumed that it is a regular LinOS repack with Gplay store and apps built-in. Time to test again.
Especially if almost nobody reads these threads.
Click to expand...
Click to collapse
Threads like these is how I passed my uni exams. Not even exaggerating XD. Thanks again for a very detailed insightful read!
Hello my friends, very happy to meet good hearted people who think alike about Gugle.
as my name suggests I'm noob still and didn't understand much of discussion but very happy to meet you friends. My love & warm regards to all here. Here is what I did uptill now before I saw this thread :
1> Load GSI/ROM.
2> Load TWRP
3> Load Magisk
4> Load microG
5> Install Service Disabler
5.1> Disable bunch of internal services like telemetry, analytics, location (FusedLocation not possible to disable) for every app (3-rd party & system app), contacts sync etc.
6> Install SD-Maid Pro
6.1> Freeze apps like Gugle Calendar Sync Adapter & Gugle Contacts Sync Adapter
7> Install CIAFirewall Fake VPN & configure it.
8> I use Opera browser for Banking, Youtube, Cab booking, Surfing, Gmail, Food Order etc.
9> Install Aurora Store for general app management & installation
10> For contacts I save all contacts in notepad app, and let all calls purposely bounce then I call back aftter checking whose call it was & state false apologies.
#FYI :- Gugle, Mycrowsowft , eFbee are not really to be blamed, rhey are having to comply with FBI, Phentagon, Central Intelligence Agencies, Interpol, etc. or they have to shut bizness.
GalaxyA325G said:
Like you, my relationship with Google is strained where I don't set up any Google Account on Android and it works just fine.
Click to expand...
Click to collapse
Hi, I’m glad to have found this thread as I’m not happy with how my normal Android phone is spied upon by google. But I’m not technically knowledgeable and I don’t want to risk bricking my phone by trying amateur attempts at rooting, or installing Insular, etc…
So far I have not signed in, I allow only minimum permissions, use Netguard, Aurora and FDroid, and have disabled bloatware. I also force-stop apps as much as possible when not in use, and enable Location and Bluetooth only when needed.
I know this is just an amateur, token attempt to reduce spying - so I may have to eventually buy a degoogled phone.
I’ve also done some of the privacy suggestions in the attachments you posted.
Could you help me with a couple of newbie questions…
1): I might have minimised some personal data harvested by most of the apps I use, but I guess my privacy precautions will have no significant effect on the amount of telemetry collected by google?
2): If my precautions really have no significant effect, I’m wondering if would it make any real difference if I was signed in as I don’t use any of the google backup services anyway?
Thanks.