Develop Bugs

Security

Please can anyone expand on some of the security issues that are worrying me. I have been a pocket PC user up till now (HTC HD).
Every time I download an application I am informed that the application will may access one of the following:
1. SD card
2. The internet
3. The local network
As I keep many private things on my Desire I am worried that I am unknowingly "opening doors" for people to steal information.
What should I turn off or on to secure my Desire?
Are items downloaded from the Market secure?
Are items downloaded from other places secure?
Thanks
Sams

Don't worry about those security warnings, I just ignore them

samcory said:
As I keep many private things on my Desire I am worried that I am unknowingly "opening doors" for people to steal information.
Click to expand...
Click to collapse
Essentially, yes you are!
When you install an app, it requests certain permissions so it is in your interest to review that list and make sure that the permissions that the application is asking for reconcile with what the application is supposed to do.
For example, if I'm installing a video player, I don't expect that it should need access to my contacts, emails, or SMS messages, so if I installed one that asked for those permissions I would refuse it.
Are items downloaded from the Market secure?
Are items downloaded from other places secure?
Click to expand...
Click to collapse
Unlike the Apple AppStore, applications on the Market are not vetted so there is always the potential that someone could post up some malware - it is one of the few downsides of being an open platform.
Regards,
Dave

security
Virtually every other app seems to want acces to the internet, that does seem a bit dangerous!!
What we need is a nice site setup that vets the apps and makes a small charge for the service. I certainly would be happy to pay for such a service toavoid having my Exchange contacts and notes being used by some nasty stranger.
Sam

^ but then every other app needs internet access. Even if it was just to post a high score. More worrying is when an app wants access to contacts/SMS/ or wants read AND Write access to something.
I was unaware the apps were not vetted.

[Q] New Rom / missing features of basic apps

Hi!
I just installed the KITKANG rom (cf. http://forum.xda-developers.com/showthread.php?t=2549776) and a the first glance, it is pretty nice. But then I noticed a few things I really dislike such as
- The Web Browser does not reformat text (to make it fitting on the screen) if you zoom in manually by gesture. The browser I had on my previous image (caynogenmod 7) did this. And I don't want to miss that feature anymore.
- The contacts application seems to work by syncing contacts tothe Google cloud, only. My old contacts app had the choice to store contacts locally on the phone without Google sync.
I have no idea how to get this missing features back, again. Any comments / pointers?
I.

- Install another browser that has this feature
- The newer 'people' app may not have the option to store locally, but why do you want this? The whole point of an Android phone is to sync with your Google account.
It is dangerous to only store your contacts on the phone, because if you ever lose the phone, you lose all your contacts.
If you sync your contacts to your Google account and you lose your phone, your contacts are still safe :good:

eddiehk6 said:
- Install another browser that has this feature
- The newer 'people' app may not have the option to store locally, but why do you want this? The whole point of an Android phone is to sync with your Google account.
It is dangerous to only store your contacts on the phone, because if you ever lose the phone, you lose all your contacts.
If you sync your contacts to your Google account and you lose your phone, your contacts are still safe :good:
Click to expand...
Click to collapse
@ browser issue: I meanwhile learned that the issue cause by a change of the the rendering engine in Android to WebView. So, almost all browsers are affected by this. (For details, google "Text Reflow Removed From WebViews In KitKat, Probably Not Coming Back"). Opera is an exception, because it comes alone with its own machinery. However, I tried Opera and is is slow on my HTC Desire. As many, many other people complaining, I cannot understand why the Android development folks dropped such a fundamental feature. The Android Browser of Kitkat tends to be unusable now! And I consider a smartphone without a proper browser as unusable as well. Which at the end might prevent me from buying another Android smartphone...
@ contacts: I totally disagree. Well, yes, from Googles perspective, your statement might be true. But for the user, Android is at first just an operating system to run your smartphone. Think about why Google wants your data...! - I want to *own* my data, so I don't want to use cloud services. Strange that you think syncing of data is equivalent to syncing to Google! Of course I sync all my data. To my own PC. If I'd loose my phone, I won't loose my data, just re-install it to my new phone from my PC.
It is nice that Google offers syncing. But enforcing to sync *is* evil...

inmado said:
@ browser issue: I meanwhile learned that the issue cause by a change of the the rendering engine in Android to WebView. So, almost all browsers are affected by this. (For details, google "Text Reflow Removed From WebViews In KitKat, Probably Not Coming Back"). Opera is an exception, because it comes alone with its own machinery. However, I tried Opera and is is slow on my HTC Desire. As many, many other people complaining, I cannot understand why the Android development folks dropped such a fundamental feature. The Android Browser of Kitkat tends to be unusable now! And I consider a smartphone without a proper browser as unusable as well. Which at the end might prevent me from buying another Android smartphone...
@ contacts: I totally disagree. Well, yes, from Googles perspective, your statement might be true. But for the user, Android is at first just an operating system to run your smartphone. Think about why Google wants your data...! - I want to *own* my data, so I don't want to use cloud services. Strange that you think syncing of data is equivalent to syncing to Google! Of course I sync all my data. To my own PC. If I'd loose my phone, I won't loose my data, just re-install it to my new phone from my PC.
It is nice that Google offers syncing. But enforcing to sync *is* evil...
Click to expand...
Click to collapse
I can see this descending quickly into a rather philosophical debate, but on the basis of your reasoning I wonder whether an Android smartphone is suitable for your needs in the first place. I didn't know your stance on personal data from your first post.
I agree with the text reflow browser, a really useful feature. Opera has it like you found out, though the Desire is just an old phone now which struggles to run it. Plenty of newer Android devices will run it just fine. The depth of the Play Store is such that you'll almost certainly find an alternative suitable for your requirements, so perhaps test and consider that for future smartphone purchases.
As for syncing with cloud services, it comes down to user trust and needs I guess. You're right you don't have to use Google, but an Android smartphone really does work best if you use their services.
No, I don't think that syncing of all my data is equivalent to syncing to Google, I use other other accounts too and don't sync everything. In my opinion I think it's possible to find a reasonable middle ground between paranoid tin hat and being ignorant about all personal data. For me, I disable all location tracking stuff and usage stats for any apps (not just Google ones), as I don't need them and feel uncomfortable sending this data. But I do sync other google services like Gmail / contacts because I find they work and are convenient for me. You believe it's evil, I believe it's useful and convenient, just a difference of opinion.
For your workaround, if you don't want to sync contacts, you could disable contact sync within the settings. Would be equivalent to local storage. Or install a different contacts app to manage and store contacts locally.

To avoid this philosophical debate, I'll try give a short answer.
I am using Android for about 5 years now. Without using Google cloud services. And have been a happy Android user. Sounds quite funny to me if someone wonders if Android would be the right thing for me.
Using cloud services is not really a matter of trust. I.e. I am not afraid that Google looks into single items and makes use out of it. But if you have heard about "big data", you can imagine what the result can be when all the data of some many people gets available for ... things you cannot even imagine..
I tried to add a contact with Google sync switched off. It just don't work. The app hangs...

inmado said:
To avoid this philosophical debate, I'll try give a short answer.
I am using Android for about 5 years now. Without using Google cloud services. And have been a happy Android user. Sounds quite funny to me if someone wonders if Android would be the right thing for me.
Using cloud services is not really a matter of trust. I.e. I am not afraid that Google looks into single items and makes use out of it. But if you have heard about "big data", you can imagine what the result can be when all the data of some many people gets available for ... things you cannot even imagine..
I tried to add a contact with Google sync switched off. It just don't work. The app hangs...
Click to expand...
Click to collapse
You're revealing more about your preferences and Android experience to date with each post...it's not just me wondering whether Android is right for you, in your second post you said so yourself
Anyway each to their own.
Have you tried installing a completely separate contacts/dialer application? You could sideload or use a different app store to find one. A few I know of:
- Contacts+
- Ex dialer
- RocketDial
- Go contacts ex
I'm certain at least one of them will be able to create phone contacts only.

Privacy in relation to Google

A while ago I came across this thread:
https://news.ycombinator.com/item?id=12016011
and I'd like to know whether the Google collecting stuff also applies to a default LineageOS install? Or does it start only after GApps is installed (even the smallest possible one)?

Personal info, the minute you enter your google email address.
Sent from my Sprint Note 3 running Lineage 7.1.1 on T-Mobile. using XDA-Developers Legacy app

When you put you email or use some Google app product you agree to share your personal data.
Enviado de meu Mi 5s Plus usando Tapatalk

OK, but that's limited to that app and the permissions you give it - and that goes pretty much for all apps, Google or not. I was thinking more about the system-wide "telemetry".

Neuromancer said:
OK, but that's limited to that app and the permissions you give it - and that goes pretty much for all apps, Google or not. I was thinking more about the system-wide "telemetry".
Click to expand...
Click to collapse
Not really. Google has tentacles into so many things it's mind boggling.
For example: you may think that you are keeping your location data private by turning off that nice shiny location services toggle right at the top of your screen. But guess what? By default, various Google frameworks are set to override that whenever they feel like it, to ping your location silently anyway.
And even if you have the GPS chip disabled in hardware (or it doesn't exist at all), they will try to triangulate you based on other visible entities like WiFi and Bluetooth signals. (You know those Google Streetmap cars that drive around everywhere taking pictures of everything? They also are collecting a giant database of every single wireless signal they encounter, and linking them to the exact geo coordinates where they were detectable. And they also collect this data from every device running Android. So if your downstairs neighbor has a WiFi access point or bluetooth device in Google's location database, the simple fact your mobile device can see one of those signals means they've now got YOUR location, too.)
Neat, huh?
---------- Post added at 13:25 ---------- Previous post was at 13:21 ----------
Neuromancer said:
A while ago I came across this thread:
https://news.ycombinator.com/item?id=12016011
and I'd like to know whether the Google collecting stuff also applies to a default LineageOS install? Or does it start only after GApps is installed (even the smallest possible one)?
Click to expand...
Click to collapse
Even the "pico" Gapps - which includes (IIRC) just the Gplay services framework, Gplay app, PIM sync and Google Cloud Messaging components is enough.
On one of my devices I have pico Gapps installed on Lineage 14.1 and, as per usual, it is constantly trying to get my location. (I know this because I have Privacy Manager set to popup an approval prompt for both Gplay and Gplay services.) Another thing that the Google frameworks like to do is send/receive silent SMS messages. Once again, if it were not for the CM/Lineage Privacy Manager prompts, this would all be invisible.

Agree with Exabyter. Google is soo inside the apps and it's services that it's hard to predict if they can get your data or not. The Google Services Apps that give you access to lot of apps features have a lot of phone permission
Enviado de meu Mi 5s Plus usando Tapatalk

So using alternative markets such as F-Droid and Aptoide, and not installing GApps at all, can be a mitigating factor?

Neuromancer said:
So using alternative markets such as F-Droid and Aptoide, and not installing GApps at all, can be a mitigating factor?
Click to expand...
Click to collapse
Yes. And I was thinking along those lines myself for quite a while.
Unfortunately the big problem with those app sources is that they cannot handle paid apps/subscriptions.
F-droid is great if you are an open-source pedant, and as much as I like it (because among other things, generally speaking most of the stuff on there isn't doing sneaky stuff), the selection is very small.
Aptoide has a large percentage of the major apps on Gplay, but many of them are there without the developer's permission. Anyone can create an appstore there and upload any APK they want. (I actually have a private store there I intend to use at some point as a sort of APK repository for my various devices, but in practice I'm not sure how well this will work) And if you get apps from a personal user's store there there's a possibility there's something illegitimate about it. Aptoide checks APK signatures but I like to run a local A/V scanner anyway.
My current thinking is install the smallest possible open-source Gapps (eg pico), and then try to put a leash on what is left.
I'm still trying to work out how to accomplish that. Going to be posting a question in this forum shortly about location spoofing, for example. (In short: a recent AOSP patch may have really set us back here. )

LineageOS 14.1 - How to enable Email app for restricted user (for Exchange)?

Hi,
finally I found LineageOS as a suitable OS for the Moto G4 Plus in a work environment, where employees get an restricted user profile. In my test, everything seems to work fine up to now. But the problem is now that I cannot enable the "Email"App for the restricted profiles to connect to the Exchangeserver 2010.
Since k9-Mail does not work with Exchange, it could not work as a replacement.
I read, the reason is that a google account cannot be used in restricted accounts. That is fine. But I don't want to use a google but an exchange account. Does anyone has an idea how to solve this?

risaer said:
Hi, finally I found LineageOS as a suitable OS for the Moto G4 Plus in a work environment, where employees get an restricted user profile. In my test, everything seems to work fine up to now...
Click to expand...
Click to collapse
I don't have this device but, your best bet is to post this question within the following Official LineageOS thread for your device.
https://forum.xda-developers.com/showthread.php?t=3522101
If all else fails, and you don't receive any responses from the above thread, you can always try to obtain some member guidance within the following Q&A thread that's specific to your device.
https://forum.xda-developers.com/showthread.php?t=3526598
Good Luck!
~~~~~~~~~~~~~~~
I DO NOT provide support via PM unless asked/requested by myself. PLEASE keep it in the threads where everyone can share.

risaer said:
Hi,
finally I found LineageOS as a suitable OS for the Moto G4 Plus in a work environment, where employees get an restricted user profile. In my test, everything seems to work fine up to now. But the problem is now that I cannot enable the "Email"App for the restricted profiles to connect to the Exchangeserver 2010.
Since k9-Mail does not work with Exchange, it could not work as a replacement.
I read, the reason is that a google account cannot be used in restricted accounts. That is fine. But I don't want to use a google but an exchange account. Does anyone has an idea how to solve this?
Click to expand...
Click to collapse
So you have gapps installed. Do you really need it in this setup? Without gapps you get the default aosp mail. No Google account on the phone.

Hmm. I suppose it is not a device specific problem, but a general one.
Maybe even a general Nougat one? <-- UPDATE: Stock seems not to have the selection list **
And no. No GAPPs. It is the modified Version with MicroG. Email app is com.android.email (Version 7.1.2). I will try the unmodified version also.
If I go to the user page where I can allow, which apps can be used, more or less every app is listed but (UKW-Radio, Recorder AND E-Mail).
I also tried to move the Email from /system/app to /data/app which only caused force closes.
Maybe another reason could be that by entering exchange data you will be forced to add it as device administrator so it is not in the list?
Any help is apreciated.

I tested several mail-apps now, but either they do not support the Exchange server or they send a lot of data to other obscure servers so I have not found any alternative. I also installed the "Gmail" app (which is also usable with an exchange account) but this also does not appear in the share list and I absolutely do not understand why.

risaer said:
I tested several mail-apps now, but either they do not support the Exchange server or they send a lot of data to other obscure servers so I have not found any alternative. I also installed the "Gmail" app (which is also usable with an exchange account) but this also does not appear in the share list and I absolutely do not understand why.
Click to expand...
Click to collapse
Looks like you should install something from Microsoft.

kurtn said:
Looks like you should install something from Microsoft.
Click to expand...
Click to collapse
Sorry, if I do not understand if there is a hidden meaning behind this. If this is a serious tip I do not know what app? The android outlook app (which really looks neat) happily transfers AND STORES your account credentials and the content on their servers (see e.g. https://www.pcworld.com/article/288...s-new-outlook-apps-over-privacy-concerns.html , article is from 2015, but I suppose it is still valid. Some time ago I checked it and found out that there is no connection to my but only to some foreign servers). That is not only critical in my sense of privacy but also illegal in the sense of the GPDR. Funny that some people advertise certified Microsoft cloud products for the GPDR.
Nevertheless: Even if I would not use an MS server this would not solve the problem that I cannot select Email or GMail as an allowed app for an restricted user. I also tried the unmodified Lineageos but it has the same issue.
I really do not understand how all the companies work with android phones in working environments. All this fiddeling around just do protect the phones by encrypting the content in case of loss, to give the user restricted access so that they cannot install apps that must not be on the device and to care about privacy. Like on a usual work pc. Do they all use I-Phones?

possible Explaination (?)
(arrg. Always copy your text before you try to send your post) short summary of what I've written:
according to these links my understanding like this:
https://support.google.com/nexus/answer/3175031?hl=en and https://android.stackexchange.com/q...restricted-accounts-on-phone-running-lollipop
"Normal user" and "restricted user" is not equivalent to windows "admin" and "restricted user". "restricted users" are not allowed to use accounts so you need to use "normal user" which has some rights less than the owner. All allowed apps has to be installed again (but are just links, no duplicates).
The store and some other apps can be locked with a pattern.
I will test this. If you have further ideas or a suiable management solution for more than 10 phones to hesitate to write.

How to De-Google LineageOS?

So i've just seen this video with the title: How to De-Google LineageOS by Mental Outlaw
Content:
Changing the DNS server
Changing the Captive Portal
Changing the Android System WebView implementation
Changing the SUPL Host server
Changing the NTP server
Removing bloatware Google packages
What i already did on my phone running lineageos: set DNS to Quad9 and disable google SUPL, actually i'm not sure which term to use, is SUPL the same as google con check?
Steps taken:
• disable connectivitycheck.gstatic.com (google con check)
• rooted with magisk app
• install termux app
• run termux and type following commands one by one:
su
whoami (verify you are root)
settings put global captive_portal_mode 0
settings list global | grep portal
So instead of changing the "SUPL" server as the person in the video did, i've set it to 0, asuming this is good enough.
But what about the rest, are these steps important? For example is webview implementation permanently active and could it phone home to google or is it only active when viewing a webpage inisde of an app?

LineageOS is de-Googled by default.
Do a clean install of LineageOS, but don't flash your OpenGapps/MicroG zip, only your LineageOS zip.

catto_ said:
LineageOS is de-Googled by default.
Do a clean install of LineageOS, but don't flash your OpenGapps/MicroG zip, only your LineageOS zip.
Click to expand...
Click to collapse
Did you even read my post??? LineageOS isn't fully de-googled, zzz.

Privacydroid said:
So instead of changing the "SUPL" server as the person in the video did, i've set it to 0, asuming this is good enough.
Click to expand...
Click to collapse
you've probably broken something GPS related then since it cant ping for some data.
not sure what tho, and if you dont care about gps or dont use that specific gps feature it doesnt matter anyways, just anytime it tries to ping that site it'll time out since 0 isnt a dns/ip address
Privacydroid said:
But what about the rest, are these steps important? For example is webview implementation permanently active and could it phone home to google or is it only active when viewing a webpage inisde of an app?
Click to expand...
Click to collapse
nope, its not permanentally active
its just chromium
mental outlaw (and alot of other linux youtubers) antagonize chromium (for good reason, im a firefox user myself) but they blow it out of proportion, after all chromium isnt riddled with spyware (unlike chrome).
getting rid of the systemwebview is more of a "F** YOU" to google to disturb their market share
yes chromium has some google components (not sure if the webview has any tho) but afaik they dont phone home normally unless you connect to a google account
and yes, its only active while browsing the web using an app that utilizes webview. if you do all your web browsing on a different browser (eg. firefox, brave, bromite) then theres no webview to worry about.
pro-tip btw: use the web versions of all social medias, you avoid using the integrated web view and dont need extra bloat on your device. even the heavier javascript-riddled ones work okay on my 2014 galaxy s5 (72C cpu tho..)

RDS5 said:
you've probably broken something GPS related then since it cant ping for some data.
not sure what tho, and if you dont care about gps or dont use that specific gps feature it doesnt matter anyways, just anytime it tries to ping that site it'll time out since 0 isnt a dns/ip address
nope, its not permanentally active
its just chromium
mental outlaw (and alot of other linux youtubers) antagonize chromium (for good reason, im a firefox user myself) but they blow it out of proportion, after all chromium isnt riddled with spyware (unlike chrome).
getting rid of the systemwebview is more of a "F** YOU" to google to disturb their market share
yes chromium has some google components (not sure if the webview has any tho) but afaik they dont phone home normally unless you connect to a google account
and yes, its only active while browsing the web using an app that utilizes webview. if you do all your web browsing on a different browser (eg. firefox, brave, bromite) then theres no webview to worry about.
pro-tip btw: use the web versions of all social medias, you avoid using the integrated web view and dont need extra bloat on your device. even the heavier javascript-riddled ones work okay on my 2014 galaxy s5 (72C cpu tho..)
Click to expand...
Click to collapse
Well, "F** YOU GOOGLE" sounds great to me. Might just not be worth the time if webview doesn't phone anyways, but i rather be sure on that instead of guessing.
I wouldn't be so sure that google components don't phone home without a google account.
So an app utilizes webview means it'll phone home to google, then when is webview utilizesed, permanently while that specific app is in use or only while that app who has the capability of utilizeising webview does actually make use of the "feature".
Bromite is great, just falls behind on updates lately.. there aren't really other great options..
Yeah using services via webbrowser instead of installing an app is always preffered.
PS; most of social media is a cancer, i don't use any )

Privacydroid said:
Well, "F** YOU GOOGLE" sounds great to me. Might just not be worth the time if webview doesn't phone anyways, but i rather be sure on that instead of guessing.
I wouldn't be so sure that google components don't phone home without a google account.
So an app utilizes webview means it'll phone home to google, then when is webview utilizesed, permanently while that specific app is in use or only while that app who has the capability of utilizeising webview does actually make use of the "feature".
Click to expand...
Click to collapse
afaik it doesnt tho, thats why many use chromium. if it does its likely "anonymized" to some extent (still can be de-anonymized) but its minimal enough that most linux distributions (including those with stricter rules) allow plain chromium into their repos.
most apps i use are web-based anyways so i just use them in firefox..
Privacydroid said:
Bromite is great, just falls behind on updates lately.. there aren't really other great options..
Click to expand...
Click to collapse
i wish firefox supported webview (possible since geckoview exists) but there doesnt seem to be any work on that done. im not going to use bromite as the minor "im not phoning home the 0.3% of the time i actually need to use an app that uses webview" is too little for the "i have to flash new bromite versions as root any time i wanna update it"
Privacydroid said:
Yeah using services via webbrowser instead of installing an app is always preffered.
PS; most of social media is a cancer, i don't use any )
Click to expand...
Click to collapse
yeah
in general i only use youtube because of the educational and tutorial content on there (which they clearly dont realize is one of the most important parts of their platform, hence the removal of the dislike) but their algorithm is very in favor of clickbait and its ruining these channels..
i wish more would use something like newpipe