Related
Hi,
the Replicant team made me aware of something.
Replicant is an Android fork ROM that emphasizes on security and privacy (e.g. they removed all Google services from Android).
This is their article I'm talking about:
http://replicant.us/2013/11/fairphone/
I think all the software is free now (correct me if it isn't). Links in benkxda's thread.
But what about the modem being embedded in the SoC? I guess that's the case?
That would mean the Fairphone is not completely secure.
So let's make ourselves heard that we would be happy to see the next device without a modem embedded on the SoC.
What the Fairphone has achieved in regard to openness and fairness so far is considerable and great! I'd like that to continue, so that's why I bring this up.
some security possible?
Unrelashade said:
That would mean the Fairphone is not completely secure.
Click to expand...
Click to collapse
Hi Unrelashade,
thank you for bringing this topic up. I think complete security is not possible - even the encrypted blackberry of cancellor Merkel was hacked.
But "some" security should be possible - and I think the main problem is me: The things I do wrong, the rights I give to apps and the way I do backup and data storage. So I kindly would like to aks you guys for some advice - How can I save my private data and also my companies data from data selling companies or a theft?
So I try a combination of:
* active sync of my data (e-mails, contacts, ...) with my own server (egroupware) - no sync with google or other free services
* encryption of phone storage with good password
* possibility to wipe my phone remotely in the case I loose it (not testet yet)
* Xposed & Xprivacy to limit data distribution by some apps
Now I have the feeling, that Xprivacy could kill the remote wipe - that would be very bad.
Furthermore, I am not familiar with the settings in egroupware - I did not find the remote wipe function yet or other active sync security features.
And I am missing a good backup methode - save and practical. Finally there may be a lot of things I do not know yet but I should take care of.
Could you help me to improve security in a reasonable way? Could you point me to a how-to with android and the egroupware ?
sidingFP said:
Hi Unrelashade,
thank you for bringing this topic up. I think complete security is not possible - even the encrypted blackberry of cancellor Merkel was hacked
Click to expand...
Click to collapse
You're right, secure is not the right word. What I mean is that most phones might be used as a remote spying device. There is a way to build them so that this is not possible and that's worth working towards as a goal, imo.
On security with Android in general there are probably a lot of good threads/ websites, e.g. see the posts of the xda portal (news) tagged with "say sayonara" (to google services):
http://www.xda-developers.com/tag/say-sayonara/
To me it sounds like the only step you need to take to protect your data is to uninstall/ not install Google Services. They're deeply embedded into Android but there are people who work for a Google free Android system, see my link from the OP to replicant or e.g. this thread by Marvin
http://forum.xda-developers.com/showthread.php?t=1715375
I'm not sure if the fairphone system that is downloadable is completely free of Google Services, you may want to check that.
The only thing left then is that the Fairphone is still a smartphone with the modem embedded on the SoC. That still makes it possible to be used as a remote spying device (see my OP) if I understand it correctly.
Hi,
Stock ROMs aren't really trustworthy by default (e.g., phandroid.com/2014/11/06/carrier-iq-settlement).
Some manufacturers' devices aren't really trustworthy, even with stock ROMs removed (e.g., theepochtimes.com/n3/830922-chinas-xiaomi-smartphones-may-be-spying-on-you).
Cyanogenmod went donwhill:
We may collect information such as occupation, language, zip code, area code, unique device identifier, location, and the time zone where your product or device is used so that we can better understand customer behavior and improve our products, services, and advertising.
Click to expand...
Click to collapse
(from cyngn.com/legal/privacy-policy) They started on this path long ago, but I won’t go there now.
I would like to buy a new Android phone. I won’t have national secrets on it, but I still don't want any Google-style spying. Assuming I don't add GApps, is Paranoid Android a good choice for me? Does it respect the privacy of its users? Does it contain any components that would ever connect anywhere to trunsmit any information like GApps do. Obivously, I'm not talking about user initiated events.
One more thing, does it have a permission manager? Ideally, something that allows the user to choose for each permission for each apps whether real, fake or blank data is shared, but a bit cleaner than XPrivacy.
Thanks!
We don't track users or data in the ROM. The only thing that will initiate a connection is with the OTA app, when it connects to our API and asks for any updates. ( you can control this by just turning off the OTA app checks for updates within the app)
Pirateghost said:
We don't track users or data in the ROM. The only thing that will initiate a connection is with the OTA app, when it connects to our API and asks for any updates. ( you can control this by just turning off the OTA app checks for updates within the app)
Click to expand...
Click to collapse
Excellent. This is the exact response I was hoping for. Thank you.
Saw this yesterday on xda tv and found article at UK info site concerning Chainfire.
Apparently Chainfire has come up with a whole new different approach to rooting once marshmallow becomes the standard.
At this point in time we will wait and see after we get marshmallow.
http://www.ibtimes.co.uk/supersu-v2...-marshmallow-without-modifying-system-1526678
Pp.
I wonder if it'll mean we can avoid tripping knox.
From what I read it sounds like this method circumvents firmware and security protocols.
It could be a knoxless process.
Pp.
The latest scoop, Chainfire has gone to the dark side.
He has sold out to some big entity (no name mentioned) and is pouring his recourses into this entity.
This is one way to stop tampering with your product, hire the person with the smarts to hack your product and make him work for you.
Rooting is going to have to wait for the next root savant.
Pp.
PanchoPlanet said:
The latest scoop, Chainfire has gone to the dark side.
He has sold out to some big entity (no name mentioned) and is pouring his recourses into this entity.
This is one way to stop tampering with your product, hire the person with the smarts to hack your product and make him work for you.
Rooting is going to have to wait for the next root savant.
Pp.
Click to expand...
Click to collapse
Where'd you see this?
The Root said:
Where'd you see this?
Click to expand...
Click to collapse
Reading in the link I posted in op, followed some comments and links I came across what appeared to be a disgruntled modder.
Read for about 15min before I can across the post.
Edit***
It was in the Nexus 6 link taking you to xda.
Pp.
I do not see what you're talking about. Can you be more specific? Maybe supply the link?
njdevils28 said:
I do not see what you're talking about. Can you be more specific? Maybe supply the link?
Click to expand...
Click to collapse
Will find and post, it could have been a link to the Nexus 6 thread where I read it .
》》》 Edit 《《《
Here's something else I found, not the same article but it spells it out for you.
http://www.androidpolice.com/2015/0...n-involved-in-the-project-for-two-more-years/
Pp.
Here's a link and a copy of op where I found info on Chainfire defection.
WARNING: This is not a place for you to come to say how great you think Chainfire is. I'm not calling his character into question, only his methodologies and the character of the outfit he sold out to (and I don't question the act of selling out, that's business, pays the bills, and puts kids through college). The debates about what people prefer and why are as old as the first software. And of course, I will not tell you what to do, no matter how much I disagree with you. If you UNDERSTAND what I have to say, then THIS software is for you. If you don't, you are probably better off with binaries.
The root situation on Android 5.x left a lot to be desired. There was basically just one distributor of a functional substitute user command (su), and it was binary. Recently, ownership of that binary and all of its history has become the property of a previously unknown legal entity called "Coding Code Mobile Technology LLC". While it was presented as a positive thing that that entity has a great involvement with android root control, this is actually a VERY frightening development.
There are precisely two motives I can imagine for buying up all the root control software for Android;
1) monetizing it, which is contrary to the user's best interests,
2) something very frightening and dangerous involving the potential exploitation of everybody's devices.
You don't know the owners, and they are distributing a binary, so who the heck knows WHAT is going on.
Now a few important considerations with respect to your security and privacy;
1) Obfuscated binary cannot be sanely audited.
2) Function of this binary depends on the ability to manipulate selinux policies on the fly, including RELOADING the policy altogether and replacing it with something possibly completely different. Frankly, I've never heard a single reason why this should be necessary.
3) While a root control application may give you nice audits over other software that is using its service, it can *EASILY* lie about what it is doing itself. It can delete logs, it can share root with other applications that they have made deals with, it can directly sell you out to spammers, etc.
That is WAY too dangerous, and not worth the risk.
Frankly, you are safer if you disable selinux AND nosuid, and just run the old style of root where you set a copy of sh as 6755. And that is FRIGHTENINGLY dangerous.
So not satisfied with this state of root, and especially now with a new unknown entity trying to control the world, we bring you the rebirth of the ORIGINAL Superuser:
https://github.com/phhusson/Superuser
https://github.com/lbdroid/AOSP-SU-PATCH (this one is mine)
From the history of THAT Superuser:
http://www.koushikdutta.com/2008/11/fixing-su-security-hole-on-modified.html
Yes, look at the Superuser repo above and see whose space it was forked from.
Note: This is a work in progress, but working VERY well.
Use my patch against AOSP to generate a new boot.img, which includes the su binary.
Features:
1) selinux ENFORCING,
2) sepolicy can NOT be reloaded.
3) It is NOT necessary (or recommended) to modify your system partition. You can run this with dm-verity!
The source code is all open for you to audit. We have a lot of plans for this, and welcome suggestions, bug reports, and patches.
UPDATE NOVEMBER 19: We have a new github organization to... "organize" contributions to all of the related projects. It is available at https://github.com/seSuperuser
UPDATE2 NOVEMBER 19: We have relicensed the code. All future contributions will now be protected under GPLv3.
*** Regarding the license change; according to both the FSF and the Apache Foundation, GPLv3 (but not GPLv2) is forward compatible with the Apache License 2.0, which is the license we are coming from. http://www.apache.org/licenses/GPL-compatibility.html . What this means, is that it is *ILLEGAL* for anyone to take any portion of the code that is contributed from this point onward, and use it in a closed source project. We do this in order to guarantee that this VITAL piece of software will remain available for EVERYONE in perpetuity.
http://forum.xda-developers.com/showthread.php?p=63436951
Pp.
i want a 5.1.1 root without tripping knox.
ourfear said:
i want a 5.1.1 root without tripping knox.
Click to expand...
Click to collapse
Don't think it's possible after last update.
Back in the beginning with 502 and first 511 update it was possible but updates patched exploits in kernel , not now. You either windup with tripped Knox or brick.
I'm a diehard rooter but have learned to live /like factory stock on this super phone.
With over 20 disable junk apps I get fenomenal battery life and trouble free functions on my phone the way root would make it in the past.
And that's all I want from this device.
Pp.
Hello. I am using a Samsung Galaxy S20+ 5G, Model SM-G986U
Android Version 11
Kernel version 4.19.113-20290031
Build number RP1A.200720.012.G986USQS1CTL1
I did both a Google search and a search using the xda-forum search bar.
First off: Kudos to whoever worked on the forum search feature. It is infinitely better today than it was years ago.
Unfortunately, while the question I have has been asked several times, it looks like no clear answer is given to any of the inquirers.
I would like to be able to bypass or override whatever flag or feature it is that lets app developers disallow users to take screenshots. I would like to be able to take screenshots in apps like Microsoft Teams (and a few other apps), even when the organization has chosen not to permit it. This is something I need to do for work. I can take screenshots in Teams just fine from a Windows PC regardless of policy. I am trusting there exists some method of doing the same from an android device.
What I would not like to do is have a discussion about the merits of enabling or disabling this security feature. Some of the previous users that have inquired were met with discussion about the wisdom of their decision instead of answering their questions directly. This time, I'd like for replies to assume that my mind is already made up and that it isn't changing. If this is something that simply cannot be done, I can accept that answer. Though I don't readily believe it. I believe that just like with a PC, there exists some method of capturing all data sent to the phone, regardless of the sender's intention.
Thank you.
Try any third party app to capture what is on screen, I think you can't do it with stock method of taking screenshot. From android 7 or 8 , they introduced new Methods to not to capture what is available on screen so that any hackers can't capture our passwords using banking apps. I think ms have implemented same strategy. So you can't do it until you have root permissions
I am 100% willing to root the device if necessary, but do want some confirmation beforehand that rooting it will enable me to screen capture from whatever app I want.
r0b126 said:
Hello. I am using a Samsung Galaxy S20+ 5G, Model SM-G986U
Android Version 11
Kernel version 4.19.113-20290031
Build number RP1A.200720.012.G986USQS1CTL1
I did both a Google search and a search using the xda-forum search bar.
First off: Kudos to whoever worked on the forum search feature. It is infinitely better today than it was years ago.
Unfortunately, while the question I have has been asked several times, it looks like no clear answer is given to any of the inquirers.
I would like to be able to bypass or override whatever flag or feature it is that lets app developers disallow users to take screenshots. I would like to be able to take screenshots in apps like Microsoft Teams (and a few other apps), even when the organization has chosen not to permit it. This is something I need to do for work. I can take screenshots in Teams just fine from a Windows PC regardless of policy. I am trusting there exists some method of doing the same from an android device.
What I would not like to do is have a discussion about the merits of enabling or disabling this security feature. Some of the previous users that have inquired were met with discussion about the wisdom of their decision instead of answering their questions directly. This time, I'd like for replies to assume that my mind is already made up and that it isn't changing. If this is something that simply cannot be done, I can accept that answer. Though I don't readily believe it. I believe that just like with a PC, there exists some method of capturing all data sent to the phone, regardless of the sender's intention.
Thank you.
Click to expand...
Click to collapse
My simple reply,, is when I got that security
policy violation I was either A) trying to capture a
Kodak moment of my current bank balance in hopes of an securing an outcome, that while only temporary was nonetheless a mutually desired and shared experience with a member of the opposite gender, also, FLAGGED AS GOOD TO GO, or, MAJORLY way less interesting, B) the never to miss a trick bastards just don't want me swiping an awesome wallpaper idea right from under their greedy noses! Dammit man, I'll always choose A)..habit, I guess? lol
'back in the day' i've used smalipatcher.
This disables the security flag completely.
Not sure if it works with android 11.
Requires root.
Easiest way; You could also mirror the screen to your pc, and make screenshots from your pc.
r0b126 said:
Hello. I am using a Samsung Galaxy S20+ 5G, Model SM-G986U
Android Version 11
Kernel version 4.19.113-20290031
Build number RP1A.200720.012.G986USQS1CTL1
I did both a Google search and a search using the xda-forum search bar.
First off: Kudos to whoever worked on the forum search feature. It is infinitely better today than it was years ago.
Unfortunately, while the question I have has been asked several times, it looks like no clear answer is given to any of the inquirers.
I would like to be able to bypass or override whatever flag or feature it is that lets app developers disallow users to take screenshots. I would like to be able to take screenshots in apps like Microsoft Teams (and a few other apps), even when the organization has chosen not to permit it. This is something I need to do for work. I can take screenshots in Teams just fine from a Windows PC regardless of policy. I am trusting there exists some method of doing the same from an android device.
What I would not like to do is have a discussion about the merits of enabling or disabling this security feature. Some of the previous users that have inquired were met with discussion about the wisdom of their decision instead of answering their questions directly. This time, I'd like for replies to assume that my mind is already made up and that it isn't changing. If this is something that simply cannot be done, I can accept that answer. Though I don't readily believe it. I believe that just like with a PC, there exists some method of capturing all data sent to the phone, regardless of the sender's intention.
Thank you.
Click to expand...
Click to collapse
very well put, i don't get it, what's wrong with these androids
actually considering getting an iphone for this stupid problem
youre best bet would be without rooting use this method, i used it, it worked on some apps and unfortunately some banking apps are just not cloneable, whatsapp is not too
Hi. Apologies for the noob question. Is it possible to get banking apps, PayPal etc to work on lineage ? I've installed magisk but don't know how to configure it, even if it will do what I need. Is there a guide somewhere? Thanks.
aneng64 said:
Hi. Apologies for the noob question. Is it possible to get banking apps, PayPal etc to work on lineage ? I've installed magisk but don't know how to configure it, even if it will do what I need. Is there a guide somewhere? Thanks.
Click to expand...
Click to collapse
First of all, you will harm the security of your transactions if you wanted to use banking apps on a rooted phone.
Secondly, if such a banking app will work on a phone with root hidden by magisk, I would advise you to give up such an app or bank for the reason I mentioned in the first sentence.
ze7zez said:
First of all, you will harm the security of your transactions if you wanted to use banking apps on a rooted phone.
Secondly, if such a banking app will work on a phone with root hidden by magisk, I would advise you to give up such an app or bank for the reason I mentioned in the first sentence.
Click to expand...
Click to collapse
Why.... precisely? Beyond the generic rubber-stamp warning that rooted/custom ROM devices lack the security of stock builds, what data do you have that proves that running banking apps on phones with root/custom ROMs is likely to result in theft of my money?
aneng64 said:
Why.... precisely? Beyond the generic rubber-stamp warning that rooted/custom ROM devices lack the security of stock builds, what data do you have that proves that running banking apps on phones with root/custom ROMs is likely to result in theft of my money?
Click to expand...
Click to collapse
Generally speaking, this is how money can be stolen at the very least, but also more, since identity verification can also be done with bank accounts.
Do not combine "rooted" with "custom", as there is no close relationship.
Oh... I see. Thank you. I have no need for root to be honest. I just need to be running Lineage OS. Is that safe to use unrooted?
aneng64 said:
Oh... I see. Thank you. I have no need for root to be honest. I just need to be running Lineage OS. Is that safe to use unrooted?
Click to expand...
Click to collapse
Root does not increase the level of safety. It's good for you to use the original LineageOS, if it exists for your phone, and not use TWRP. It's likely that the bank's app won't object.
Just started to using LineageOS official last release from there website ((lineage-19.1-20230302-nightly-pioneer-signed)) . i have there mindtegapps for google integration. the problem is my carrier money transfer app crashs and doesn't starts. before i changed to LineageOS. this app was working on my phone original rom. is there any thing i can do to try to fix it? like crash logs or something i can try? i tried Google Carrier Services and Android System WebView. but nothing changed. it still crashs. is there away i can know which is the last supprted OS for that app? i mean they could just have not updated there app to newest google framework. idk for sure i am just guessing.
the app name " Orange Cash "
PC is rooted by default. People use banking sites and programs on PCs.
Phone will require same steps to prevent money steal.
Generally it is not the rooted phone by itself is source of trouble but user actions.
If user installs shady autocraticker from google play and give permissions to it thief would not need root to steal money.
To send a link by email or messanger and ask to enters credit card information thief does not need root permissions.
Criminals don't expect phone to be rooted. They pray on inattentive users.
It is often possible to have control of your own device with root and use banking.
Some banks allow to use browser instead of app.
Bank usually would call on the phone to accept login and transactions for additional security.
Decision depends on how much money user has on banking account, and how careful he is.
veseihaty said:
PC is rooted by default. (...)
Click to expand...
Click to collapse
That's why there are no PC banking applications/programs.
Using banking applications increases the security of transactions, which using only a web browser does not.
Thanks to apps, banks have the ability to continuously improve security on phones that have stopped getting security patches from the phone manufacturer. The use of push technology makes banking apps a cheap token.
The banks' action on this issue is beneficial to customers.
ze7zez said:
Generally speaking, this is how money can be stolen at the very least, but also more, since identity verification can also be done with bank accounts.
Do not combine "rooted" with "custom", as there is no close relationship.
Click to expand...
Click to collapse
What are you talking about? Rooting means *the user* has control over the device, vs the manufacturer. Not giving the user root privileges is all about the manufacturing retaining control over what you do with the device, and being able to push its bloatware on you, and nothing to do with security.
HOW exactly does giving the user root access damage security in any way?
I'm gonna go ahead and say that not only having root access does NOT threaten security, but the other way around, it improves it, as I can remove all the unsafe apps the manufacturer bundled with my phone.
You are wrong, you were asked to back up your claims, and you did not actually do so.
almafuerte said:
What are you talking about? Rooting means *the user* has control over the device, vs the manufacturer. Not giving the user root privileges is all about the manufacturing retaining control over what you do with the device, and being able to push its bloatware on you, and nothing to do with security.
HOW exactly does giving the user root access damage security in any way?
I'm gonna go ahead and say that not only having root access does NOT threaten security, but the other way around, it improves it, as I can remove all the unsafe apps the manufacturer bundled with my phone.
You are wrong, you were asked to back up your claims, and you did not actually do so.
Click to expand...
Click to collapse
Read the "Payment Services Directive 2", analyze, understand and acknowledge.
The XDA forum is for discussion, not for answering every question asked. That's what google is for, for example.
Yes, just use magisk delta.
ze7zez said:
Read the "Payment Services Directive 2", analyze, understand and acknowledge.
The XDA forum is for discussion, not for answering every question asked. That's what google is for, for example.
Click to expand...
Click to collapse
Why should I care about a European regulation, considering I'm not in Europe, and my bank is not European?
Regardless, said spec doesn't really give ANY justification either as to *why* a rooted phone would actually be unsafer in any way.
You didn't say "Because a stupid spec says so", you said "because of security concerns", of which there aren't any.