[SECURITY] Android Security for Conscious Mind

[traceless]

Thanks guys for your reply. I'm asking because I'm not willing to use Ubuntu (did you know it git the big brother award for using Amazon ads?).

Cross-platform secure voice and text communication application, BitTorrent Bleep, launches with public alpha.

http://blog.bittorrent.com/2014/09/...-goes-public-introduces-mac-and-android-apps/

I've received the email just a few minutes ago

 

[polonordo]

What a shame that AOSP Browser is so bad on the privacy front!! Because it is literally the fastest browser out there
Does disabling javascript solve the flaws?

 

[Ultramanoid]

What a shame that AOSP Browser is so bad on the privacy front!! Because it is literally the fastest browser out there
Does disabling javascript solve the flaws?

The problem is the AOSP browser is not the only issue, but its engine ( part of the OS ) on anything below KitKat ( Android 4.4.x ) is affected. It means not just the browser, but ANY application using pre-KitKat WebKit is affected.

The only sure solution right now is upgrading to KitKat and not installing any browser or application that uses an old version of Android's WebKit.

This is a tremendously serious security issue, not just about privacy. The flaw means a malicious site can steal and use any info from the browser. If you're logged into something in another page or tab, anything, they can access it too.

More info :

http://thehackernews.com/2014/09/new-android-browser-vulnerability-is.html

This article points to patches from Google for developers, carriers or anyone who wants to fix this in an older system ( which means 99% of users won't, can't, don't know how to use this code, but whatever... ) :

http://blog.digicert.com/android-browser-bug-allows-origin-policy-bypass/

 

[sancho_panzer]

Ubuntu still is violating your privacy: http://www.gnu.org/philosophy/ubuntu-spyware.en.html
Also it's unfortunate that you promote CyanogenMod in your signature as it does not respect privacy as well.

Hum, let's see. If you take a privacy modded ROM like Omni will be fine, but if I take CyanogenMod and mod it myself like EXPLAINED on OP you find it unfortunate! Ok, I can't agree. Even so the dangers of CyanogenMod are very limited.

You also will see on OP that I'm using a Chinese browser as default and I didn't mentioned but my secondary browser is a well known Korean beast. Even knowing the dangers I still prefer them over the Chrome crap because I know and I'm able to control them much better than many others. I'm still waiting to see Atlas grow up.

In the end it's how you use your tools what determines who you are and what you're doing. Instead of criticizing CyanogenMod you should respect them for being the first one to take measures against big G.

Finally I'll remind you that this thread it's about using your devices with privacy, safely and to HAVE PLEASURE doing it. If you want be REALLY incognito use your old Nokia 3310 and buy a disposable SIM.

Peace.

EDIT: Click here and on the top left click on "CM11 Nightlies Changelog"... guess who's link below. Meanwhile I'll be waiting for your suggestions about good and safe ROM's and WHY (don't forget to tell us where are the changelogs and security audits).

 

[sancho_panzer]

@Ultramanoid

Congratulations, this is a rare moment!

 

[Ultramanoid]

@Ultramanoid

Congratulations, this is a rare moment!

 

[Ultramanoid]

After iOS 8 strengthens encryption on devices, Android L will be implementing encryption by default.

http://www.washingtonpost.com/blogs...-offering-default-encryption-blocking-police/

This is competition where we all win. It's good that OSs copy each other's good features. But we need more than two major players in the game...

 

[jcase]

After iOS 8 strengthens encryption on devices, Android L will be implementing encryption by default.

http://www.washingtonpost.com/blogs...-offering-default-encryption-blocking-police/

This is competition where we all win. It's good that OSs copy each other's good features. But we need more than two major players in the game...

The android encryption feature has been in the works for some time, wasn't a result of copying, but logical maturing of an os

 

[snapper.fishes]

Encryption is only as strong as the password. A 4 digit pin code is way too easy to crack.

 

[Ultramanoid]

Encryption is only as strong as the password. A 4 digit pin code is way too easy to crack.

There's a funny discussion about that over at Slashdot. Wrench mentions included. ( The post is originally about Apple's warrant canary though. )

http://slashdot.org/story/207407

The android encryption feature has been in the works for some time, wasn't a result of copying, but logical maturing of an os

Agreed. Plus it's obvious that software development and hardware design are both done months and years in advance. Was making more of a general comment about healthy competition and innovation prompted by an "arms race', and we might as well thank Snowden too. Suddenly everyone is encrypting everything.

Well, about time. (ノ￣ー￣)ノ

 

[aelmahmoudy]

Thanks guys for your reply. I'm asking because I'm not willing to use Ubuntu (did you know it git the big brother award for using Amazon ads?).

Try Debian.

 

[aguaz]

... if I take CyanogenMod and mod it myself like EXPLAINED on OP you find it unfortunate!

No, in fact the opposite is the case, I appreciate your encouragement. As mentioned above I only find it unfortunate that you promote it in your sig along with "Privacy Matters", because people might not read OP and get a false sense of thinking CyanogenMod respects their privacy. Anyway I'm not here to attack you. It's just what came into my mind when I saw it.

I cut the rest of your post because it is way off-topic.

 

[jcase]

No, we are not going to link to nor discuss a piracy/piracy enabling site like aptoide in the security forum. No the APKs are not all "official", I have had to deal with pirated clients app through their service.

@polonordo
First you should go to <CENSORED>and install the <CENSORED> app. When you open the app for the first time it asks if you want to install the official store <CENSORED>and you say yes. THIS IS THE ONLY STORE YOU SHOULD USE, all apps downloaded from here are official, just like Play Store. Even so you should always confirm if the app you're installing have the green seal "TRUSTED".

Aptoide gives everybody the chance to have its own store (you may call it repository) where you can upload your apps and share them if you want. And this is where bad things can happen if you install something from a repository you don't know. Yes, everybody knows many of them are focused on piracy but then you use them if you want, just like guys on iPhone use Cydia if they choose.

Aptoide is the oldest alternative store, it's trusted by millions and always evolving. It's so good that was the only store that had the balls to file a European antitrust complaint over Google dominance. I'm using it for years, already compared several signatures and decompiled many apps and I assure you it's the real thing.

@CHEF-KOCH
So, as you can use Google to search and Drive to download piracy... Google is a evil pirate boat!

Once again you talk to much about subjects you don't have a clue. It's becoming a classic and a shame on several threads. Learn something or keep your mouth shut please.

Thank you.

Edit: please show us the results of the security audit to Raccoon.

Good reason not to trust them, you are hitting the head on the nail.

I wouldn't trust aptoide, most of the cracked apps come from there. You only need the "correct" uploader name/nick and bingo, you get a cracked app (with of course different signatures). I don't say all of the apps are cracked, but nobody would use it if there wouldn't be cracked apps (because you can download all from legit places and check yourself the "Top" stores, 99% are known cracker) Better stick with F-Droid or Raccoon and buy all apps you really need daily to help and motivate the developers.

 

[CHEF-KOCH]

@polonordo
First you should go to Aptoide website and install the Aptoide app. When you open the app for the first time it asks if you want to install the official store http://m.apps.store.aptoide.com/ and you say yes. THIS IS THE ONLY STORE YOU SHOULD USE, all apps downloaded from here are official, just like Play Store. Even so you should always confirm if the app you're installing have the green seal "TRUSTED".

Aptoide gives everybody the chance to have its own store (you may call it repository) where you can upload your apps and share them if you want. And this is where bad things can happen if you install something from a repository you don't know. Yes, everybody knows many of them are focused on piracy but then you use them if you want, just like guys on iPhone use Cydia if they choose.

Aptoide is the oldest alternative store, it's trusted by millions and always evolving. It's so good that was the only store that had the balls to file a European antitrust complaint over Google dominance. I'm using it for years, already compared several signatures and decompiled many apps and I assure you it's the real thing.

@CHEF-KOCH
So, as you can use Google to search and Drive to download piracy... Google is a evil pirate boat!

Once again you talk to much about subjects you don't have a clue. It's becoming a classic and a shame on several threads. Learn something or keep your mouth shut please.

Thank you.

Edit: please show us the results of the security audit to Raccoon.

My argument is valid and you gave us the proof, everyone can upload infected and modified apk's, and of course cracked apps. That doesn't have anything todo with google. As I said in there Top 10 are most known cracker placed well, and sure, million people doesn't want pay anything for good apps (it's no secret that android user not pay as much as ios users) and there is no control from Aptoide itself. Or do you think thousend of people use boards with cracked apps because there download only free apps?

If you report something on Aptoide the file will be re-uploaded (on other repos as mirror) or the cracker upload his stuff under different account, such behavior is not present in F-Droid because every upload will be checked with signature, source and such mechanism. So yes, there is no control, green shield or antivirus does not help here, most android av's only scan for signatures and not all files get a deep scan or generally a scan if uploader not checked that option.

Raccon is open source, so for what do you need an audit? Compile yourself from the source if you don't trust. I better use this than other sites that uploads cracked/infected apk's use ads or whatever, personally I prefer original files "untouched".

Everyone can use what they want, just saying but to say Aptoide is trusted is really wrong and sounds you not know what you are talking about, the client also comes with ads since some versions now.
So raccoon does not comes with ads, it use original market api and download only legit stuff from google, I think it's a good solution.


Back to topic:
Test if your Android device is affected by recent SOP vulnerability!

A bug discovered recently in Android's Stock Browser allows websites to retrieve cookies and other information from other origins. Test your device to find out if it is vulnerable.

Read the full story over here.

 

[jcase]

Thread closed at OP's request and due to behavior in this thread.