Database Info

Blackphone opinions???

I ran into this article today and I wanted to see what the people on XDA think about it. This company is working on a Android phone that it's primary purpose is to protect the users privacy.
Here's the link: http://mobile.theverge.com/2014/1/1...nn-silent-circle-geeksphone-blackphone-launch
Read the article, watch the video and let me know what you think.
Sent from GNote 3 rooted with kingo.

Saw news about this and came here to seek out does any1 have opinions about it.
i wonder, does the safety come from hardware or is it the OS what makes this so safe.. if it is the OS, i hope some1 smart enough makes custom rom for this.

I really don't see how this phone is gonna change anything. Apps and websites have keyloggers, You still need a carrier to get service from and they have control of all your traffic. What about radio frequencies that can be intercepted, IP addresses, GPS chips sending signals to satellites, baseband and firmware are connected thru the cell towers of the carrier. I'm starting to think this phone is a scam.
They said nothing about how they're dealing with all this. They are probably using the whole NSA scandal momentum to fool people into believing they are safe if they buy this phone.
Sent from GNote 3 rooted with kingo.

I saw an article about this venture also. This is a good thing. If he gets press about this phone, maybe other venders will take notice and start building in privacy features as well. :good:

I don't see the need for new hardware here. If they really want to secure something, they could create a mod for Android, that could be installed on a variety of devices for example.
Besides, if they encrypt telephony, messages and stuff, they will need to be decrypted again - but the question is where and how? I bet they won't have any hardware encryption module and even if they do, it will make communication with other phones impossible. Software encryption means other phones will need to install some additional software to communicate with the Blackphone and it might be a bit inconvenient.

orangek3nny said:
I don't see the need for new hardware here. If they really want to secure something, they could create a mod for Android, that could be installed on a variety of devices for example.
Besides, if they encrypt telephony, messages and stuff, they will need to be decrypted again - but the question is where and how? I bet they won't have any hardware encryption module and even if they do, it will make communication with other phones impossible. Software encryption means other phones will need to install some additional software to communicate with the Blackphone and it might be a bit inconvenient.
Click to expand...
Click to collapse
That's a good point. how a non blackphone device is gonna decipher the encryption? how is it going to get the key? How can a non blackphone device even a establish the same "secure" connection?
Sent from GNote 3 rooted with kingo.

Andronote3 said:
That's a good point. how a non blackphone device is gonna decipher the encryption? how is it going to get the key? How can a non blackphone device even a establish the same "secure" connection?
Sent from GNote 3 rooted with kingo.
Click to expand...
Click to collapse
I think you are missing the point. As you or I may not NEED this kind of security, I'm sure you can think of someone who does.
Obviously, there would be two levels of privacy/security... Connections between 2 black phones and everything else. So who utilize a black phone? How about corporations and governments? Law offices, professional sports teams, or doctors and hospitals.
Now, even though I do not NEED this, if it was affordable, I would heavily consider it.
Sent from my Nexus 5 using XDA Premium 4 mobile app

JamieFL said:
I think you are missing the point. As you or I may not NEED this kind of security, I'm sure you can think of someone who does.
Obviously, there would be two levels of privacy/security... Connections between 2 black phones and everything else. So who utilize a black phone? How about corporations and governments? Law offices, professional sports teams, or doctors and hospitals.
Now, even though I do not NEED this, if it was affordable, I would heavily consider it.
Sent from my Nexus 5 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
I understand what you are saying and I completely agree with you. It looks like a device that corporations and the government would "benefit" more than regular users. Either way, It won't fix 90% of all the problems people face when it comes to staying safe against privacy/security breaches. I truly believe that they are using the whole NSA scandal momentum to make people believe that they are safe/secured if they buy this phone.
P.S: Nice quotes.

I saw this phone.
It isn't an answer to every privacy issue.
What its an answer to is, not having to agree to an android apps permissions to gain access to the app.
These apps don't make their money off the app sales, they make their money sending information to retailers.
Retailers own the world.
The question I still pose is... What's wrong with retailers knowing where you are?
There's nothing you can do about the government. They won't let us make things that are government proof, nor would they (The retailers ) want to.
But, what's wrong with these apps fine tuning my specific desires to my Location?
You can't stop people from stealing your identity. The hacker/firewall paradox is, for every walk you build, they will build a taller ladder.
The only thing really close to full privacy in data sending is, that light source that sends data. It's a light bulb, and the light has data in it, a sensor receives it. It can be held within the walls of a room. But that only effects a closed circuit type system. If that light source is connected to the Internet, then game over.
Why do you think record companies and movie companies keep their computer systems offline and deal in only physical media? A hacker will get into anything I'd you give him the tools and time.
This phone gives a sense of security that is non existant
You've Just Been Tapatold ♧♢dbombROMv3.4♤♡
My Theme ( Taking Requests )
http://forum.xda-developers.com/showthread.php?t=2658527

SaintCity86 said:
I saw this phone.
It isn't an answer to every privacy issue.
What its an answer to is, not having to agree to an android apps permissions to gain access to the app.
These apps don't make their money off the app sales, they make their money sending information to retailers.
Retailers own the world.
The question I still pose is... What's wrong with retailers knowing where you are?
There's nothing you can do about the government. They won't let us make things that are government proof, nor would they (The retailers ) want to.
http://forum.xda-developers.com/showthread.php?t=2658527
Click to expand...
Click to collapse
nailed it

The problem is Android itself. Thanks to Xprivacy, it's a lot easier to control what leaks out of your device. Personally I'd rather see more encryption mechanisms than this. FFOS seems to be on the right path

There Is nothing you can do to stop identity theft.
Nothing.
And there is nothing you can do to do the government from tapping your lines.
You want a safer form of communicating, send Voice recordings over text.
That's an entirety separate warrant, and harder to get. Other than that. It's hopeless
You've Just Been Tapatold ♧♢dbombROMv3.4♤♡
My Theme ( Taking Requests )
http://forum.xda-developers.com/showthread.php?t=2658527

d1rX said:
FFOS seems to be on the right path
Click to expand...
Click to collapse
I think you mean FOSS[1] = Free and Open Source Software. Anyway, I fully agree, in fact, that is the ONLY way. Closed source encryption programs can't be 100% trusted by definition. There might be security flaws, intentional or not.
Anyway. the NSA has backdoors to every operating system[2], so if you're really a target, they get you. Also, there are more than enough security holes in the layers under the operating system[3].
I think what these phones are supposed to do is bring end-to-end encryption for e.g. industry users so they don't get spied on. The NSA and the US government can get their hands on encryption keys for servers like in Lavabits case[4]. But this is the transport encryption. The data is, if not otherwise secured, available in plain text on the servers of providers. This also means, the officials can decrypt ANY data that comes in, not just the one of actual targets.
Now, end-to-end encryption makes sure even the provider can't see your data in plain text because you encrypt and decrypt it on your device. What Blackphone does is, it uses the apps from Silent Circle, a closed source encryption programm for VoIP and messages. Although the owner of that company is the well trusted cryptographer Phil Zimmerman, one can never be sure.
That's a good point. how a non blackphone device is gonna decipher the encryption? how is it going to get the key? How can a non blackphone device even a establish the same "secure" connection?
Click to expand...
Click to collapse
You can install and use Silent Circle on any(ok, a lot of) phone(s). Just make sure you don't have additional malicious software installed. Any yes, it costs $100/year or so. And you get a subscription for SpiderOak, sort of a Dropbox but they encrypt the data before uploading. Any you get a better overview over what app uses what permissions. A few extra tweaks basically.
Alternative: Android Phone with CyanogenMod/Replica. TextSecure for messages, RedPhone for VoiP and owncloud for files. Way cheaper too, and open source, also made by well respected cryptographers like Moxie Marlinspike[5]
[1] de.wikipedia.org/wiki/Free/Libre_Open_Source_Software
[2] zerohedge.com/news/2013-09-08/nsa-has-full-back-door-access-iphone-blackberry-and-android-smartphones-documents-re"]backdoors to every operating system
[3] forum.xda-developers.com/showthread.php?t=2530044
[4] techdirt.com/articles/20131002/17443624734/lavabit-tried-giving-feds-its-ssl-key-11-pages-4-point-type-feds-complained-that-it-was-illegible.shtml
[5] thoughtcrime.org

if they want to spy on us they can ... that's it...

More info?
Hi all - looking for more info on this phone - just joined XDADev to post this.
Specifically, what brands might this hardware be found under? Know it's a Tinno S8515 but have yet to find out anything about that; seems like Tinno generally makes phones for other companies?
Any help is appreciated!
Best,
-Cx
:cyclops::cyclops::cyclops:

The greatest challenge to securing a phone is not the OS or the apps running on it, it's the baseband. We have known for well over 30+ yeasr how to harden a *nix based system (like AOS), but we haven't even started to question WTF is going on in the closed source 10-100 MB baseband RTOS, which have fulll access to your entire FS and the most important phone operations, like SIM, RF, EMMC etc etc.
Only forcing the corrupt modem OEM's to release the sources of the Baseband firmware could improve the situation. This will never happen, unless there is another baseband Snowden out there somewhere...
We already know that the BP/CP FW is extremely insecure, and relies almost solely on obscurity as their main mechanism of protection. If this was not the case, the iPhone unlock developers would have been fekked long time ago, and the rest of us would sit around with SIM/network locked bricks filling up our bookshelves.
Unfortunately the greatest majority of the millions of XDA members are completely carefree about this issue and are only happy as long as they can "tweak some ROMs". So this will never be the place to find/see any serious baseband reversing, no matter how important it would be from a security standpoint.
So to summarize, your Qualcomm baseband will continue to send your exact GPS coordinates to the network provider at will, without you ever knowing, and without anyone (here) caring. So goes for the FM transmitter that is part of the baseband FW in both Intel and Qualcomm based phones. Do you have control over that? Never.
Only a serious long term spectrum analysis study could reveal whats going on there, where and when you're not (able) to watch.

This phone is the biggest scam lol.

hyshys said:
Saw news about this and came here to seek out does any1 have opinions about it.
i wonder, does the safety come from hardware or is it the OS what makes this so safe.. if it is the OS, i hope some1 smart enough makes custom rom for this.
Click to expand...
Click to collapse
I was wondering this too. If it is only the rom (just like the $1300 pwnphone). It should be port-able

iliass01 said:
I was wondering this too. If it is only the rom (just like the $1300 pwnphone). It should be port-able
Click to expand...
Click to collapse
Blackphone. - no hardware security, just software, and most of it is NOT open source. Some here (@SaintCity86 , @repat) has their points, and they are mostly right! If you want some security (and I said some!!!), then get rid of most of your apps (permission check and some common sense), all Google apps (yes, all of them), install a paid (not free) and high quality VPN software, don't use the phone feature (only data sim-prepaid), get an internet phone number (with no personal details), use end to end encrypted apps to make calls and send and receive texts, install Xposed and Xprivacy (or any other variant) and limit even more the apps you have on your phone. Don't use it as your only phone, but as a secure device and share your number and other infos with trusted people! In this case, maybe, you will be able to add some layer of security and actually be able to use it. And most important, don't give your phone in the hands of anyone! It is a bit paranoid, but it's the only way! But, don't be fooled! You can have some security, only if you stay under the radar, and don't gain some attention. If yes, then you have no luck! Personally, I have seen the Blackphone, and tested it for some time, and I am not really convinced it can be trusted.
Good luck!

Andronote3 said:
I really don't see how this phone is gonna change anything. Apps and websites have keyloggers, You still need a carrier to get service from and they have control of all your traffic. What about radio frequencies that can be intercepted, IP addresses, GPS chips sending signals to satellites, baseband and firmware are connected thru the cell towers of the carrier. I'm starting to think this phone is a scam.
They said nothing about how they're dealing with all this. They are probably using the whole NSA scandal momentum to fool people into believing they are safe if they buy this phone.
Sent from GNote 3 rooted with kingo.
Click to expand...
Click to collapse
Would just like to correct this common misconception, GPS is one way.
GPS receivers as found in your phones, or navigation systems, receives GPS signals only. Nothing gets sent to satellites in this process, the algorithm is purely one way.

Verizon Refuses Telephone Support Based on Installed Apps

I don't know if this is general knowledge here, but I figured I'd relate my experience here in case it's informative for others. I've been having a ton of trouble with dropped calls on Verizon at my home. It's always been a marginal signal, but the last couple of months it's been impossible to use my phone at all. So I finally called Verizon and quickly was transferred to Level 2 support. The Level 2 support immediately jumped down my throat about having a rooted phone. When I asked them how they determine that I have a rooted phone the agent proceeded to list every app installed on my phone and explained that some of them only work on rooted phones. He was adamant that the reason for dropped calls was having a rooted phone and refused to provide any support.
It was news to me that our Verizon phones phone home and keep them informed as to what apps are installed on our phones, and that now Verizon is refusing to provide support to people that even have apps that require root privileges.

Depends on the state that you live in. The warranty is to protect against hardware defects and in some states Verizon will have to show that rooting or one of your installed apps is the cause of your issues.
You can always flash back to full stock and see if you still have drops. If so, call them up again...

I *am* full stock. I have literally changed nothing except to root the phone. Everything is pure stock ... even the Verizon apps and recovery are all still there.

GNRDuncan said:
I *am* full stock. I have literally changed nothing except to root the phone. Everything is pure stock ... even the Verizon apps and recovery are all still there.
Click to expand...
Click to collapse
It is not uncommon for carriers to refuse to support anything other then fully stock devices. You have to remember that root is a security risk as well and most will not support this.

Thanks. I get that. What surprised me wasn't that they wouldn't support a rooted phone, but that Verizon had a list of apps I'd installed (even apps installed directly by ADB). I wasn't aware that they had spyware on my phone that was monitoring what I do on the phone.

GNRDuncan said:
Thanks. I get that. What surprised me wasn't that they wouldn't support a rooted phone, but that Verizon had a list of apps I'd installed (even apps installed directly by ADB). I wasn't aware that they had spyware on my phone that was monitoring what I do on the phone.
Click to expand...
Click to collapse
That is part of the info that is sent to all carriers when they collect info for troubleshooting and stats. Some of that info is they grab a list of apps in the system and data/app partitions.

I wasn't aware they could read anything on my phone without my permission. I wonder what other information they can grab at will without me knowing?

It's legal in the US for providers to look at what their customers are using and installing on their phone?
Bloody hell... Over here a provider isn't even allowed to see which apps use up your data, all they can report is how much you used in total. The very idea that they'd be allowed to look inside your phone is... inconceivable in Europe.

GNRDuncan said:
I wasn't aware they could read anything on my phone without my permission. I wonder what other information they can grab at will without me knowing?
Click to expand...
Click to collapse
Thats the thing is you give them permission. No one ever reads it but it is in the TOS. You even agree to it when you first sign in to an android device about it collecting data from your device. As for other info they can get. Pretty much any and every website you go to, and things like that. Your contacts and stuff are pretty safe. If you consider storing them on google safe.

ShadowLea said:
It's legal in the US for providers to look at what their customers are using and installing on their phone?
Bloody hell... Over here a provider isn't even allowed to see which apps use up your data, all they can report is how much you used in total. The very idea that they'd be allowed to look inside your phone is... inconceivable in Europe.
Click to expand...
Click to collapse
You might not have noticed but you agree to it on every android device. ITs all part of troubleshooting system issues. Heck Google can even remotely remove apps from your device. Carriers in the US have far more control over the device because you dont tech own the device until you pay off your contract or unless you buy the device at full retail price.

An agreement that says "we may collect data about your phone" is not the same thing as "You give us permission to enter your phone at any time for any reason and collect whatever we want from your phone."
What app allows this one the phone? I will happily remove it.

GNRDuncan said:
An agreement that says "we may collect data about your phone" is not the same thing as "You give us permission to enter your phone at any time for any reason and collect whatever we want from your phone."
What app allows this one the phone? I will happily remove it.
Click to expand...
Click to collapse
Thats the thing. It does. Collecting data about the device, pretty much says that you give them the right to collect data about the device. This does include apps installed. IT is not as simple as an app. IT is built into the OS.

zelendel said:
You might not have noticed but you agree to it on every android device. ITs all part of troubleshooting system issues. Heck Google can even remotely remove apps from your device. Carriers in the US have far more control over the device because you dont tech own the device until you pay off your contract or unless you buy the device at full retail price.
Click to expand...
Click to collapse
Google is not the same thing as a Telecom provider.
Google makes your OS, a Telco just provides you with access to the network. There's a very large difference.
It's like the Ministry of Infrastructure being able to see your car's logs. The manufacturer can read out the car's system for troubleshooting, as they should, but the government branch that pours asphalt on roads has no business seeing what kind on music I listen to in my car!
Who am I kidding, the US Ministry of Infrastructure probably has recordings from how awful people sing in their cars synced to the exact GPS coordinate for every word.
Maybe I should explain that European devices are not truly Branded? The only branding they have are logos, tunes and a few apps that you can freely remove or add through the online appstores as well.
A lot of users have a SIMonly contract (just a SIM) and buy their devices, without any connection to their provider, in an independent store.
The whole system US providers have with their own privately locked devices that don't even allow eachother's 4G network, that's illegal here.
zelendel said:
Thats the thing. It does. Collecting data about the device, pretty much says that you give them the right to collect data about the device. This does include apps installed. IT is not as simple as an app. IT is built into the OS.
Click to expand...
Click to collapse
Your laws are very, very terrifying. No wonder the USA is such a bloody mess....
I thought the spying on citizens for money, corruption and dirty business practises wasn't that bad, but it seems I've had a very naive view of the USA. I'm utterly grateful I never followed my childhood dream of emigrating to the USA. They're one step away from a totalitarian corporate government... I'm starting to see why so many people keep referencing Skynet... The plot in Continuum (the TV show) is far more present-day and far less futuristic, it seems...
Over here "we may collect data about your phone" does not mean "We have the complete legal right to read everything you do, watch, install and write on your phone".
They must specify exactly what data, how they collect it and what they use it for, and any deviation from those specifications results in a hefty fine or even a suspension of business rights.
They're only allowed to look at your phone, not in it. They can't even connect your dialed numbers to your in-phone contacts on the bill. Even in their own app, you have to give explicit permission for that link.

zelendel said:
Thats the thing. It does. Collecting data about the device, pretty much says that you give them the right to collect data about the device. This does include apps installed. IT is not as simple as an app. IT is built into the OS.
Click to expand...
Click to collapse
Your interpretation of the term differs radically from my own.
Luckily we have AOSP, so if we know where the code that allows this is located we can remove it. Any ideas where to start looking? I'm new to all of this, but it would be worth getting into it if we really have to waste our time protecting ourselves from the businesses we have to patronize in order to function in a modern society.

ShadowLea said:
Google is not the same thing as a Telecom provider.
Google makes your OS, a Telco just provides you with access to the network. There's a very large difference.
It's like the Ministry of Infrastructure being able to see your car's logs. The manufacturer can read out the car's system for troubleshooting, as they should, but the government branch that pours asphalt on roads has no business seeing what kind on music I listen to in my car!
Who am I kidding, the US Ministry of Infrastructure probably has recordings from how awful people sing in their cars synced to the exact GPS coordinate for every word.
Maybe I should explain that European devices are not truly Branded? The only branding they have are logos, tunes and a few apps that you can freely remove or add through the online appstores as well.
A lot of users have a SIMonly contract (just a SIM) and buy their devices, without any connection to their provider, in an independent store.
The whole system US providers have with their own privately locked devices that don't even allow eachother's 4G network, that's illegal here.
Click to expand...
Click to collapse
Oh I know. I generally dont buy US based devices even though I live here. Also our carriers here put their own version of the OS on the device. Loaded down with bloat ware and added code.
GNRDuncan said:
Your interpretation of the term differs radically from my own.
Luckily we have AOSP, so if we know where the code that allows this is located we can remove it. Any ideas where to start looking? I'm new to all of this, but it would be worth getting into it if we really have to waste our time protecting ourselves from the businesses we have to patronize in order to function in a modern society.
Click to expand...
Click to collapse
Not that simple. AOSP is alot different then what comes on carrier devices. Carrier roms are closed sourced just like OEM roms like touchwiz, HTC sense and all the others.
Why do you think Verizon goes through such great pains to lock the bootloader. There is no way that I am aware of as they would just get the info from google as they collect the same info.

zelendel said:
Not that simple. AOSP is alot different then what comes on carrier devices. Carrier roms are closed sourced just like OEM roms like touchwiz, HTC sense and all the others.
Why do you think Verizon goes through such great pains to lock the bootloader. There is no way that I am aware of as they would just get the info from google as they collect the same info.
Click to expand...
Click to collapse
Google can't collect the data if the code that collects the data is removed.

GNRDuncan said:
Google can't collect the data if the code that collects the data is removed.
Click to expand...
Click to collapse
You could try but buy doing so you would lose all access to Google Apps. There is one project that I know of that is working to remove all Google stuff from Android. CM has the same plan but like I said you would lose all access to Google Apps in doing so. It's all part of just about every OS on the planet.

zelendel said:
Oh I know. I generally dont buy US based devices even though I live here. Also our carriers here put their own version of the OS on the device. Loaded down with bloat ware and added code.
Click to expand...
Click to collapse
Wise move!
They do add bloatware here, but all of it is just pre-installed apps that you can add and remove at your leisure. They're all apps that you can find on the Play Store (or Windows Marketplace, or Apple Store) and can install as a customer from another provider as well. The only code they're allowed to add is network optimisations.
They can't alter any of the system functions. Take the TNL firmware (T-Mobile NL), all it has is the My T-Mobile app and the T-Mobile logo+tune at boot. That's the entire branding. It's hardly worth the word 'Branding', all they did was slap a sticker on it and insert a businesscard, so to speak.
And you're free to just flash any other firmware, as flashing, rooting and using CustomROMS can't void the warranty due to the EU laws. Even KNOX 0x1 doesn't matter.
I do Samsung-based tech support for T-Mobile NL (which is why I know what they can and can't do here), and half my day consists of helping users flash the Unbranded firmware over the Branded one, through the official contact channels. Samsung will even do it for you if you take the device to a Service Center. Managed to wipe your IMEI? Take it to a Service Center with proof of purchase and they'll fix it for you in minutes. Sending in a device with a broken screen that has Cyanogenmod on it gets a new screen and returned to the customer under warranty.
The other half of my day is sometimes spend explaining to users why, due to privacy laws, a provider can't block an app or service from using up your data, and can't block malicious sms subscription services.
The EU council is filled with idiots, but they do have their moments. :laugh:

ShadowLea said:
Wise move!
They do add bloatware here, but all of it is just pre-installed apps that you can add and remove at your leisure. They're all apps that you can find on the Play Store (or Windows Marketplace, or Apple Store) and can install as a customer from another provider as well. The only code they're allowed to add is network optimisations.
They can't alter any of the system functions. Take the TNL firmware (T-Mobile NL), all it has is the My T-Mobile app and the T-Mobile logo+tune at boot. That's the entire branding. It's hardly worth the word 'Branding', all they did was slap a sticker on it and insert a businesscard, so to speak.
And you're free to just flash any other firmware, as flashing, rooting and using CustomROMS can't void the warranty due to the EU laws. Even KNOX 0x1 doesn't matter.
I do Samsung-based tech support for T-Mobile NL (which is why I know what they can and can't do here), and half my day consists of helping users flash the Unbranded firmware over the Branded one, through the official contact channels. Samsung will even do it for you if you take the device to a Service Center. Managed to wipe your IMEI? Take it to a Service Center with proof of purchase and they'll fix it for you in minutes. Sending in a device with a broken screen that has Cyanogenmod on it gets a new screen and returned to the customer under warranty.
The other half of my day is sometimes spend explaining to users why, due to privacy laws, a provider can't block an app or service from using up your data, and can't block malicious sms subscription services.
The EU council is filled with idiots, but they do have their moments. :laugh:
Click to expand...
Click to collapse
Yeah here that is not even close to being an option, I spent years working for Verizon Tech support. They try to void your warranty anyway possible. That is mostly due to the fact of the subsidized pricing for phones. Here you dont even really own the phone completely for almost 2 years after you get the device.
Service centers here are few and far between. All warranties go through the carrier. Carriers here love blocking apps. But then Like I said they have too much control over the devices.

zelendel said:
Yeah here that is not even close to being an option, I spent years working for Verizon Tech support. They try to void your warranty anyway possible. That is mostly due to the fact of the subsidized pricing for phones. Here you dont even really own the phone completely for almost 2 years after you get the device.
Service centers here are few and far between. All warranties go through the carrier. Carriers here love blocking apps. But then Like I said they have too much control over the devices.
Click to expand...
Click to collapse
The law changed here recently, nowadays the phone you buy with a subscription has to be charged separately. You basically buy the phone and split the payments over 2 years. You own it straight away, you can even sell it if you want, but you have to continue paying for it, even if you sell it, until you've paid it off. If you end the contract prematurely, you have to pay the remaining sum of the phone.
Warranty-based repairs here go through the shop you purchased it from. If you bought it directly from the provider, they handle the warranty. If you bought it from an independent shop or online store, (both of which also sell subscriptions with phones for the providers) they send it to Samsung. Even if you buy it with a subscription.
There are 12 Service Centers in the Amsterdam area alone. (They're not Samsung stores, we only have 2 of those (which is probably still quite a lot compared to the US, considering we only have 17 million inhabitants), but they're service points inside another store, often the stores of various providers. You can go there regardless of who you pay each months.)
(Sorry for the walls of text, I find these things very interesting xD)

TCL / Alcatel / Flash Secretly Phoning Home to China Server

There is an ongoing thread at the Official Flash Community about a possible "spyware" embedded in the firmware of TCL / Alcatel Flash Plus 2 and Flash 2 smartphones.
A local TV station might have also picked up on the story and is now following this as well.
You guys might want to check this out:
Code:
hxxp://community.flash3c.com/t/fp2-secretly-phoning-home-to-china-server/13708
Seriously though, is there still any Android smartphone manufacturer that we can still trust aside from Samsung?

Yes, Adups has already been found doing this before (see previous thread about Blu phone etc), they claim it's nothing to worry about but in my opinion it's is (especially for some people eg my sisters work duties has put her up against Chinese SOE's) due to the data sent & the identifying data & ability to make changes without user knowledge and possible the tentacles of the CCP government reaching into the company if it so chooses it could then monitor her & put her and her colleagues at risk given some of the dodgy countries she's had to go to.
Some of the guys are getting worked up about this on the crackberry forum as TCL is Blackberry's subby (though the thread quickly veered off to Blackberry hardware, so unrelated to the Adups issue).
http://forums.crackberry.com/genera...ding-customers-data-china-1095845/index4.html
FWIW, I agree with Sorinv & DaFoxGrey that it's possible (well to some degree) without Blackberry noticing as they would not test every phone for this sort of thing from every production run, and it may not trigger any connection unless under specific conditions. It could be done via a compromised employee flashing dodgy firmware or amended wafer negative when running a batch, though would be hard to pull off even by government agents. But that's all on a whole different level to the Adups issue, besides I don't think Blackberry phones have that app or Baidu apks etc so for them it should be a none issue, but for Chinese phones .......
As for trusting Samsung ..... they are part of a huge conglomerate with close links to an opaque government who are susceptible to influences of a few powerful families & others, so they would not be immune. Nor their employees being immune to blackmail to make changes. That said they are who I have put my faith in for the time being. At the end of the day we all have to trust someone, as I'm sure you are aware.

Trust is a matter of perspective. Most devices from China oem are expected to have e this as their government requires it to monitor its citizens. Which is completely legal there and why most devices from China are banned to be owned by US government employees. It's just the way it is.
If trust us a big thing then the last thing you should be buying is an oem device. Get a nexus and then you can see every bit of code you put into your device.

Can i trust my chinese (Umidigi) phone for email, banking, passwords ? (Umidigi S2 Pr

Please help, I am unsure what to do now that I received my Umidigi S2 Pro unlocked phone that I purchased from GearBest and waited a month to receive-- booted it up and ran malwarebytes on it only to learn it has two adware programs built into the system. Norton did not find anything except a KRACK (some sort of Key reboot wifi vulnerability???) risk (not sure if it is on the phone or just an alert for my home wifi?). I thought I was getting a nice smartphone at a good price, but now I am very worried if I can trust such a phone from china-- would it be safe to set up the phone for online banking, for email with my email username and password? Should I just sell the phone on ebay and go back to using my ASUS phone that I bought in the USA where I live? The Umidigi is such a nice looking phone, but if it is a security risk I certainly will not use it, I would then sell it and take the loss and learn the lesson, ugh.
Quicktouch apparently contains the following adware as detected by Malwarebytes: Android/Adware.Xinyinhe.CJ
TouchPal 2017 apparently contains the following adware as detected by Malwarebytes: Android/Adware.Cootek
^^^They are both system apps so they are not so easily removed.
Thoughts, advice?

Midiman55 said:
Please help, I am unsure what to do now that I received my Umidigi S2 Pro unlocked phone that I purchased from GearBest and waited a month to receive-- booted it up and ran malwarebytes on it only to learn it has two adware programs built into the system...
Click to expand...
Click to collapse
Your best bet is to post this question within one of the following threads that is specific to your question.
http://forum.xda-developers.com/showthread.php?t=1846277
http://forum.xda-developers.com/showthread.php?t=1620179
Good Luck!
~~~~~~~~~~~~~~~
I DO NOT PROVIDE SUPPORT VIA PM UNLESS ASKED/REQUESTED BY MYSELF.
PLEASE KEEP IT IN THE THREADS WHERE EVERYONE CAN SHARE

I also have a similar issue,
Have checked the threads recommended and they are totally irrelevant to the question asked, so here goes:
I bought a new Umidigi phone from an online store, now turns out it seems to be rooted, should I just throw it away or is there any resoanable explanation to why it is like that. Is there anything I can do to be able to use this phone with safety.
Thanks

Shmool said:
I also have a similar issue,
Have checked the threads recommended and they are totally irrelevant to the question asked, so here goes:
I bought a new Umidigi phone from an online store, now turns out it seems to be rooted, should I just throw it away or is there any resoanable explanation to why it is like that. Is there anything I can do to be able to use this phone with safety.
Thanks
Click to expand...
Click to collapse
Did a root checking or antivirus app say it's rooted? I knew these phones have adware & questionable issues around personal data, but didn't think they come rooted. Though maybe some third party with access to phone rooted it, was it sealed when you got it? ( Could also have been installed in factory by unauthorised person or at instructions of Chinese government (though probably only if you or your company is a high value target))

Don't waste your money.
I have Umidigi S2 Pro.
It has very low quality.
The touch screen is very hard to use.
Cheap plastic material with very poor build quality.
The battery real capacity is not 5000mah. The battery is not detectable by battery software. Perhaps only 3000mah
The camera is so blurry. You just get fuzzy pictures.
Too many applications crashed instead of 6GB RAM.
The worst thing it come without any guarantee.
It' nothing but wasting my valuable money.

Can you imagine the fallout for a company, trying to compete in the International Marketplace if just ONE of their products was found to be phishing? In fact it would be commercial suicide in their own countries too.
I have a Umidigi A3, bought for a third of the price of my similar spec Samsung, and I also found that certain apps stated the phone was rooted, but root checkers and superuser software all found this not to be the case. I always rooted my early phones to play around under the hood, but lately certain establishment apps would refuse to work stating security issues with root so I haven't rooted my last couple of phones.. I have had no such problems with my A3. My establishment apps check and wave my little A3 through with a smile. False positive? I'd say likely. The cost of the license to use the latest Google Android OS kind of negates the reasoning behind 'the phish' . I believe the tweaks needed to customise the OS to Umidigi products is what causes these false posies.
And the build quality is superb!! For the price I paid, it may be akin to a Mini in the vast world of mobile communications, but it's deck out with the shiny walnut dashboard and plush seats of a Mini Rolls Royce. Time will tell about it's reliability but so far I don't think I'll ever pay hundreds of pounds for a mobile phone again.

My whole take on this Chinese security question is this.
1st, Google is a bigger (biggest) privacy risk. They can access your phone anytime without you knowing (if they wanted to). But yet no one thinks twice about trusting them, plus most people allow them to save all their passwords and info. But yet it's no concern to most.
2nd, A lot of other phone companies have their internal chips produced in China. And if the Chinese really wanted to spy, it's gonna be built into the hardware.(backdoor) Heck the US government was doing this. Everyone forget?
A lot of these proprietary chips even have access to your internet so they can download their proprietary drivers in the background without your knowledge.
There is no true security. The backbone of the internet was built to share information not secure it. Security starts with you. Everytime you choose to have private information at a convenience, you sacrifice security.
And as far as post 1 which I know is a year old, but for anyone that stumbles across this. The adware that was detected was probably all from TouchPal keyboard. That app is so junk, it even installs apps on your phone. It's always preinstalled on provider phones and such.
Google shouldn't allow these apps to be approved and these companies need to be held accountable for allowing these practices.
Good luck and safe browsing!

aaron74 said:
...Security starts with you. Everytime you choose to have private information at a convenience, you sacrifice security.
...
Click to expand...
Click to collapse
Absolutely concur. Thanks very much for the very true statement. And I think especially that what I partially quoted above can't be stressed enough.
Maybe this falls into the same context?

thanks for your reply
IronRoo said:
Did a root checking or antivirus app say it's rooted? I knew these phones have adware & questionable issues around personal data, but didn't think they come rooted. Though maybe some third party with access to phone rooted it, was it sealed when you got it? ( Could also have been installed in factory by unauthorised person or at instructions of Chinese government)
Click to expand...
Click to collapse
HHi, thanks for replying. The bitcoin wallet app said it was rooted, so yeah. But there were other strange things, like the draw lines security lock already is set so that I can't change it or use it. I bought it on aliexpress "new". It came it its' package and everything in it only it had been opened. It was stuck at costumes for a while so it seemed as if they opened it and play with it a bit there, but then after I saw the rooted thing everything us looking phisy.
Honesty, regardless, having this device made me understand once and for all where all the money goes to with those top dollar phones and why it is so worth it. Cause yeah, you kind of have everything... But it all sucks. Screen sucks, camera sucks. Multitasking sucks. Battery sucks. Radiation feel sucks, and seems pretty sure security sucks. So yeah, you kind of have efrything, but the low quality is felt. Daily.

Chinese brand phones cannot be trusted. It's best to buy Japanese or American ones, at least they're more secure in terms of malware and Trojans.

Government finds spyware and censorship in Xiaomi Phone

Lithuanian government warns about secret censorship features in Xiaomi phones
The Lithuanian Defense Ministry published a security audit on Wednesday for three popular 5G smartphone models manufactured in China, recommending that citizens avoid or stop using at least two of the three devices, citing privacy infringements and secret censorship capabilities.
therecord.media
https://www.nksc.lt/doc/en/analysis/2021-08-23_5G-CN-analysis_env3.pdf
PDF analysis attached.

Yeah I saw that. No big surprise...
You can get a used Note 10+ now for $400-800.
Just ordereded up a new one for $800.
Either way a better deal and it's a flagship phone with great performance... and no CCP junk.

Cleary not for European / Global International users apparently. Answer from Xiaomi :
Following the publication of our article, Xiaomi asserted its right of reply. Here is the manufacturer's full statement: “Xiaomi devices do not censor communications to or from its users. Xiaomi has never restricted or blocked the personal behaviors of users of its smartphones, such as searching, calling, browsing the Internet or using third-party communication software, and never will. We respect and are committed to fully protecting the legal rights of our community. Xiaomi fully complies with the General Data Protection Regulation (GDPR) of the European Union ”.
Click to expand...
Click to collapse
And in the pdf it's explain it's only with Mi Browser (no one use this ****)

With phone like Xiaomi (using M11 right now) I actually feel much safer rooting the phone, then use AdAway and AFWall+ plus to block suspicious system activities. This in addition to the usual debloating to get rid of as many Xiaomi related stuff as I can.
After implementation I did a quick check on pihole, no secret packets sent to Xiaomi it seems. Not comprehensive I know, but it gives me peace of mind.
Using the command line "iptables -nvL OUTPUT" I can see AFWall+ blocking all these system related traffic. My phone isn't impacted at all as everything remains operational. For the fun of it I also have this line executed whenever my phone boots:
iptables -I OUTPUT -m owner --gid system -j REJECT
"system" seems to be everything MIUI related. I can see this extra instruction blocking additional traffic, and nothing on my phone stops working with this. So it is there just for extra peace of mind.

seemebreakthis said:
With phone like Xiaomi (using M11 right now) I actually feel much safer rooting the phone, then use AdAway and AFWall+ plus to block suspicious system activities. This in addition to the usual debloating to get rid of as many Xiaomi related stuff as I can.
After implementation I did a quick check on pihole, no secret packets sent to Xiaomi it seems. Not comprehensive I know, but it gives me peace of mind.
Using the command line "iptables -nvL OUTPUT" I can see AFWall+ blocking all these system related traffic. My phone isn't impacted at all as everything remains operational. For the fun of it I also have this line executed whenever my phone boots:
iptables -I OUTPUT -m owner --gid system -j REJECT
"system" seems to be everything MIUI related. I can see this extra instruction blocking additional traffic, and nothing on my phone stops working with this. So it is there just for extra peace of mind.
Click to expand...
Click to collapse
One problem being the CCP's insidious goal of burrowing into all civilian devices and platforms.
The possibility of unknown hardware backdoors is real and virtually undetectable.
The CCP serves only it's own goals and interests.
One of their primary goals is to gather as much user data as possible by any means at their disposal. Still feel safe?

blackhawk said:
One problem being the CCP's insidious goal of burrowing into all civilian devices and platforms.
The possibility of unknown hardware backdoors is real and virtually undetectable.
The CCP serves only it's own goals and interests.
One of their primary goals is to gather as much user data as possible by any means at their disposal. Still feel safe?
Click to expand...
Click to collapse
Let's be realistic. And don't get me wrong. I strongly believe that CCP is as mean as it could be. But then, they have economic interests too. China is a country that significantly leans on export, and they don't want to be hurt more than they are (Huawei, other sanctions - India).
Therefore, I don't believe in hardware backdoors. Xiaomi and others even don't produce hardware themselves. Software is a different ballgame. Only evaluate the risk. Let's say that CCP would force companies to install spy software if it could be effectively covered. And what then? What's the difference? Do you trust non-Chinese phones considering that western Big Tech companies have autonomous power to spy everyone, censor everybody? They do it to the former US president, why you think that they won't do it to you?
And do you know that Apple is planning (maybe it is already implemented) to use AI to spy every iPhone pretending to seek children pornography? What is CCP different and how it can hurt you more than Big Tech which have been a long time unleashed and control your data as Orwell predicted without any restrictions or legal limitations?
The only solution are custom roms from transparent developers. And if it is not possible, totally debloated phone, no matter if it comes from east or west. With that kind of adjustment, I certainly trust any Chinese phone more than totally locked and nontransparent systems like iPhone.

Only relevant for Chinese users.
Also I prefer my data in the hands to people on other side of the world than in the hands of my own government.

As soon as you connect to the internet from any device, they have all your information already, it's just that they will use it for good or bad purposes.
nothing is safe

piskr said:
Let's be realistic. And don't get me wrong. I strongly believe that CCP is as mean as it could be. But then, they have economic interests too. China is a country that significantly leans on export, and they don't want to be hurt more than they are (Huawei, other sanctions - India).
Therefore, I don't believe in hardware backdoors. Xiaomi and others even don't produce hardware themselves. Software is a different ballgame. Only evaluate the risk. Let's say that CCP would force companies to install spy software if it could be effectively covered. And what then? What's the difference? Do you trust non-Chinese phones considering that western Big Tech companies have autonomous power to spy everyone, censor everybody? They do it to the former US president, why you think that they won't do it to you?
And do you know that Apple is planning (maybe it is already implemented) to use AI to spy every iPhone pretending to seek children pornography? What is CCP different and how it can hurt you more than Big Tech which have been a long time unleashed and control your data as Orwell predicted without any restrictions or legal limitations?
The only solution are custom roms from transparent developers. And if it is not possible, totally debloated phone, no matter if it comes from east or west. With that kind of adjustment, I certainly trust any Chinese phone more than totally locked and nontransparent systems like iPhone.
Click to expand...
Click to collapse
The CCP's primary target after its own citizens is the USA. Almost zero risk to a hardware backdoor; they could even blow it off as a vulnerability that was not anticipated or detected. A backdoor can lie dormant forever or be activated as needed.
The CCP is like that psycho b*tch gf that talks with demons.
You can't take a ride without getting stabbed
Apple just sucks. Aiding the enemy. They backed away from the user monitoring that their CCP masters taught them, for now.
Apple can't be trusted at all.
If if you're simple enough to buy an Apple...
you deserve what you get; a plain Jane you can't trust

blackhawk said:
Still feel safe?
Click to expand...
Click to collapse
Yes.
Because your profound statements didn't undo any safety measures I did to my phone, nor did they refute the validations of my tests that in fact showed the safety measures barred attempts to connect to Xiaomi servers.
They talk about this "MiAdBlacklistConfig" file that gets updated everyday and used by Mi Browser and other Xiaomi apps to check / censor "sensitive communications". It is there in my phone (funny content), but no update since the day I initially setup the phone. Also I erased Mi Browser. Even the core Xiaomi System Components is barred from reaching out to the internet etc etc etc.

seemebreakthis said:
Yes.
Because your profound statements didn't undo any safety measures I did to my phone, nor did they refute the validations of my tests that in fact showed the safety measures barred attempts to connect to Xiaomi servers.
They talk about this "MiAdBlacklistConfig" file that gets updated everyday and used by Mi Browser and other Xiaomi apps to check / censor "sensitive communications". It is there in my phone (funny content), but no update since the day I initially setup the phone. Also I erased Mi Browser. Even the core Xiaomi System Components is barred from reaching out to the internet etc etc etc.
Click to expand...
Click to collapse
If they did it right you'll never even know it happened... hardware embedded back doors aren't easily detectable when dormant.