Related
http://www.artfulbits.com/Android/antipiracy.aspx
If your a Dev please support them, if you need assistance msg me i can send u code that will allow your app to automatically send a message to this company with a users information that has stolen your app or tried to steal it.
pentace said:
http://www.artfulbits.com/Android/antipiracy.aspx
If your a Dev please support them, if you need assistance msg me i can send u code that will allow your app to automatically send a message to this company with a users information that has stolen your app or tried to steal it.
Click to expand...
Click to collapse
I'm all for cracking down hard on piracy, but there are three big flaws with this solution:
1) How would Artfulbits verify that an app reporting a device is a "dark" device is making that report in good faith? If a bunch of pirates wanted to render this service pointless, they could just create apps that flood the service with false positives.
2) It is possible (although difficult) to link IMEI to a user/owner. This makes a publicly accessible database of "dark" IMEIs somewhat shady in terms of being a breach of privacy.
3) Finally, if this service is to be useful, apps have to have some way of acting on the information in the database. That is just going to lead to folks "cracking" apks to remove the IMEI-checking routines, or simply using leakproof firewalls to prevent the app from accessin the IMEI database.
Thoughts?
There is not going to be a way to completely stop piracy. Google just needs to step up the way the market works to prevent some of the piracy.
I understand devs deserve money for their hard work (and the log of my google checkout shows I support them) but I personally dont want any app reporting any information about myself or my phone. If there is a list of which apps do I will find an alternative for better or worse and not use the app. Not to knock on those who support this method, I just personally dont like it.
rondey- said:
There is not going to be a way to completely stop piracy. Google just needs to step up the way the market works to prevent some of the piracy.
I understand devs deserve money for their hard work (and the log of my google checkout shows I support them) but I personally dont want any app reporting any information about myself or my phone. If there is a list of which apps do I will find an alternative for better or worse and not use the app. Not to knock on those who support this method, I just personally dont like it.
Click to expand...
Click to collapse
Well considering my app has been pirated 3x as much as it has been downloaded legally i would be willing to let go of the few that are not comfortable with their imei being registered on a website which only happens if u are stealing an app, most apps out there gather more information from you than that without you even knowing.
I don't get why people would install this program. If it detects pirated software on your phone then who the hell are you letting you use your phone? Lets say you know you have pirated software well then of course you wont install this program. If you know your running a clean rom and have no reason to suspect pirated software your giving up a lot of information for a false sense of security. So unless this is forcibly installed on everyone's phone I don't see what's the point.
psychoace said:
I don't get why people would install this program. If it detects pirated software on your phone then who the hell are you letting you use your phone? Lets say you know you have pirated software well then of course you wont install this program. If you know your running a clean rom and have no reason to suspect pirated software your giving up a lot of information for a false sense of security. So unless this is forcibly installed on everyone's phone I don't see what's the point.
Click to expand...
Click to collapse
It's not a program you install. It is a database. App developers write routines into their programs which access the database. If an application suspects that it was illegally pirated, then it will send the user's IMEI to the database.
This is stupid idea. Go to the source of piracy if you want to fight it.
Give people access to paid apps on market and they won't download illegal copies form rapidshare...
su27 said:
Give people access to paid apps on market and they won't download illegal copies form rapidshare...
Click to expand...
Click to collapse
Riiiight... because if you give pirates the option to pay they'll definitely all pay right?
This database thing bothers me.
Not because I might be stealing programs..
but because I might find one and not know its "dark"
Suddenly I'm on some blacklist because I thought an app was cool?
I just did a search on one of the torrent sites, and found a file to DL.
It has 231 apk files and 2 .bak files. (I'm assuming the bak files are for a cracked version of the paid apk) but many of these files are a)old versions or b) free already.
Normally I would say SCORE! I don't have to DL to the g1, then back up, uninstall, transfer to the pc, and store.
Last time I tried a file like that, more than half were for cupcake, and would not work on my donut. Recycle bin.
With this Database I would get tagged as a cheater the first time I tried to install any of those files that were marked. But I have no idea they are "dark" before hand.
While I thank the Dev's for the work they do.
{Seriously, Thank you Developers!}
I'm a student, and I'm poor, which means I'm cheap.
I have several free apks stored away. Hell, I still used youtube downloader 1.2...until it quit working last week. Why, because I don't want to spend money just to have a cool phone.
If you really want to make it hard on the thieves... someone make a program that cripples another program, until the user requests the full version. Then it reads the Imei number from the phone and sends an upgrade request to a server. The server requests payment. Server verifies payment. The server issues a hashed password based on the Imei, which is then sent back to the phone as a password. Customer never sees the password.
This is what Doc to go appears to do. I could be wrong.
Now make it so that program can be imbedded in any other program.
Now thieves need a whole crap load of hacking to find enough hashed passwords to find the hash.
If the hash is added to at random intervals, or a different hash is used based on the Imei number, they might never find the hash.
Besides that, how the heck does a program know if it has been stolen?
How can it tell between a stolen program and a wiped phone that is getting reinstalled with backed up apk's?
jashsu said:
I'm all for cracking down hard on piracy, but there are three big flaws with this solution:
1) How would Artfulbits verify that an app reporting a device is a "dark" device is making that report in good faith? If a bunch of pirates wanted to render this service pointless, they could just create apps that flood the service with false positives.
Click to expand...
Click to collapse
Exists several strategies, for example the most popular is "honey pot" strategy. When vendor especially making leak of software or prepare specially application to track piracy.
jashsu said:
2) It is possible (although difficult) to link IMEI to a user/owner. This makes a publicly accessible database of "dark" IMEIs somewhat shady in terms of being a breach of privacy.
Click to expand...
Click to collapse
For example in our country sufficient IMEI of the phone to find it owner and it location, of course if you have police under your shelders. That is why I am thinking that IMEI is a good identifier.
jashsu said:
3) Finally, if this service is to be useful, apps have to have some way of acting on the information in the database. That is just going to lead to folks "cracking" apks to remove the IMEI-checking routines, or simply using leakproof firewalls to prevent the app from accessin the IMEI database.
Thoughts?
Click to expand...
Click to collapse
Solution is not perfect, but can be easily enhanced. HTTPS protocol with certificate checks will make firewalls and redirections useless.
What functionality exactly you have in mind?
[email protected] said:
While I thank the Dev's for the work they do.
{Seriously, Thank you Developers!}
I'm a student, and I'm poor, which means I'm cheap.
I have several free apks stored away. Hell, I still used youtube downloader 1.2...until it quit working last week. Why, because I don't want to spend money just to have a cool phone.
Click to expand...
Click to collapse
Leave according to your money. what can I say... spend less, work more.
[email protected] said:
Besides that, how the heck does a program know if it has been stolen?
How can it tell between a stolen program and a wiped phone that is getting reinstalled with backed up apk's?
Click to expand...
Click to collapse
Several simple steps:
- install software only from well known web sites, Android Market, Handagoo, SlideMe, etc.
- try to use trials and if it does not exists but you want to try, contact with developers. In most cases developer will provide you version for testing.
- if your phone is placed into black list, then you can contact "blacklist" vendor for explanation and fixing.
jashsu said:
Riiiight... because if you give pirates the option to pay they'll definitely all pay right?
Click to expand...
Click to collapse
You see - that's your problem - you want to fight the enemy instead of prevent war.
In my country there are many people who would pay for android programs because they are quite cheap. But we have no access to paid market. That is why we download apps illegaly.
Now, what do you think will faster stop us from stealing apps:
A. Calling us pirates and thieves
B. Giving us access to paid apps
su27 said:
Now, what do you think will faster stop us from stealing apps:
A. Calling us pirates and thieves
B. Giving us access to paid apps
Click to expand...
Click to collapse
You are making the incredibly flawed assumption that piracy only happens because people have no access to the paid market. Are some people put in this situation? Yes, probably. But the majority of pirates likely DO have access to the paid market and simply don't want to pay.
I am a bit confused, what does this ban people from? The market in it's entirety?
If that is the case, I would think you'd see an outburst of pirating once people couldn't access the market anymore. And that would also prevent people who may not feel like dishing out $100 for a navigation solution from purchasing numerous $1-10 programs that they would actually use on a daily basis. I think this methodology is flawed.
Piracy will never be completely stopped. However, making it harder for people to pirate your software is the best prevention. Instead of saying "Oh, you might have installed a pirated copy of XXX on your device, so now you can't purchase any more programs legitimately, so keep on stealing!". Due diligence falls on the hands of the software creators. If piracy is something you want to prevent (or at least inhibit) for your software, create an IMEI checking device key required to be granted after receipt (and clearance) of payment. Similar to CoPilot, granted it still gets cracked - it is much harder and much less widespread, and a simple update renders it useless to those who used the cracked version (check all over these forums for people complaining about it).
Also, implement trials that don't require the user to pay for them, giving them only 24 hours to try something out before they decide they need their money back. Even Microsoft lets users go 30 days without activation (last I checked) to try out Windows. They do not (to the best of my knowledge) make great attempts to prevent their software from being copied, but instead make it harder on those who do pirate it. Blocking system updates (of course everything has a workaround or crack, but making it harder on someone is oftentimes a great deterrent), preventing new feature installation, etc.
I am not condoning piracy, nor am I condemning software publishers. Just trying to make a point, which is this:
If you take someone who has stolen a program (for whatever reason/justification they may think of) and punish them by revoking their access to purchase said program (or any other program), you have thus reinforced their reason/justification to not purchase any programs.
Now, i may be wrong here, but looking at their source code to integrate into applications, there seem to be 2 things: 1) the device has to have a data connection, otherwise the code doesnt know whether the device is blacklisted or not, at which point it defaults to assuming it isnt, which overall is a good thing for users who have paid but for whatever reason dont have network at that time, however it is easy enough to stop an application from accessing the network, or even a specific site (ie the site for your imei number on their page).
secondly, is this meant to run on the first run of an app, or every run? if it is every run then i can see people getting annoyed by the unnecessary data usage, whereas if it is only on the first run then someone still has access to all their pirated apps from before they were on the database.
please note the only coding i have done is some fairly simple C, so i could be wrong, but anyone can check this if they want: http://www.artfulbits.com/Articles/Samples/Piracy/Integration.aspx
I think that by now most people know that I don't honeycoat things, so I'll just say it... this idea is RETARDED.
1) The application needs to use the API to get the IMEI. If you start using the IMEI to blacklist phones, a minor modification to the API causes the application to always read a string of 0's. Defeated.
2) The application needs PERMISSION to read the IMEI (android.permission.READ_PHONE_STATE). If you start requiring programs to have this permission, people will simply DENY it this permission (yes, it IS possible to block a permission)... this is ESPECIALLY the case when the application has *no good reason* to read the phone state.
3) As has been mentioned before in this thread, HOW DO YOU KNOW that an application you are downloading is pirated? Many applications are FREE to download, and virtually NONE of the pirated apps are labeled as "THIS IS PIRATED".
4) Connection to the internet can be EASILY blocked. Lots of ways... firewall, hosts, permissions, etc. Again, defeated.
Oh, and to those saying crap like access to paid market won't stop piracy, NOBODY SAID IT WOULD!!! It *WILL* reduce it though, since there ARE people out there who WOULD buy apps *IF THEY COULD*.
daveid said:
I am a bit confused, what does this ban people from? The market in it's entirety?
Click to expand...
Click to collapse
Read the description again more carefully. This does not impact a user's ability to access the Market, as it is not a Google product. In case your comprehension is lacking, i'll explain it very simply:
1. A developer decides to use the Artfulbits Anti Piracy Database (shortened AAPD) with its app.
2. A user downloads this AAPD-enabled app from the market.
3. When said app is run, it sends the IMEI of the device to the Artfulbits server. The server returns a color code corresponding to the number of times that IMEI has been reported by other AAPD-enabled apps for piracy. The app can then do whatever it wants with that information. This can be anything from deleting itself to crippling its own functionality.
4. App can also detect if has been pirated (by checking to see if the app has an entry in the user's personal Market account or some other method). If the app detects it is pirated, it will send a report to AAPD.
Another point Artfulbits failed to consider is that not all Android devices will have IMEIs to report.
Is piracy really that much of a problem? I mean most apps cost <3€ and I don't think I am the only one who values his time higher than saving 3€. I rather pay once and get updates via Market than check warez-sites for updates, and I think that most think that way?
There are just two apps that I ever considered to pirate. One was a dictionary for 20$ but I ended up buying it. The other is CoPilot which I would never buy since I don't own a car, but since it is not cracked anyway, I was not forced to really think about it.
I don't see anything good coming from that database. I.e. if my phone would be entered by mistake, you can imagine what problems that would cause for devs whose apps I bought, which I assume would suddenly stop working then.
You really need to think about whether the negative side-effects of such measures like this database are worth the (presumably very small) benefit.
Greetings everyone.
Ill just start off with asking the question: How many of you give 2nd, 3rd or nth thoughts about using a rooted (or, rooted and ROM'd) phone?
Now, let me explain why I am asking this question.
Earlier this week, my Google account was broken into. The attacker mass-emailed everyone on my contact list a link to a Viagra ad, of all things. It could have been worse, since my contacts and emails were left in-tact. In a furious, chaotic, post-incident rush, I was scrambling in an attempt to figure out how they obtained my password. At the time of this writing, I have come up with nothing. The first thing I thought, naturally, was a worm/trojan/virus on my PC. Several anti-virus / anti-malware / anti-root-kit scans proved to be clean.
So, I turned my sleuthing efforts towards my phone -- a Samsung Captivate, which had been rooted and ROM'd to Captivate 3.04. I had Lookout installed the entire time, and I have been using Cognition ROMs since late December of 2010. In assuming the worst, I nuked my phone, reverted back to stock and re-rooted and re-ROM'd. While rooting my phone, my virus scanner pleasantly informed me that the One Click rooting solution contained an exploit (Lotoor, I believe). Now, I completely understand that its necessary to use these exploits in order to gain access. However, it kinda got me thinking -- what else could be going into the phone that I dont know about?
Note that all ROMs and Rooters were obtained from links available from this website. I did not get them from "shady" locations.
I am realistic about this. I download and install applications from the internet frequently. I put a some faith in my virus scanners / anti-malware applications. This little incident, however, is making me a little more skeptical about what applications I run, as its difficult and time consuming to monitor every application for "phone home" activities.
The bottom line is that I do not want to sound like that I am placing blame on any of the Cognition developers (or any ROM developer). In fact, I am probably going to donate to them because the 3.04 version finally allowed me to use my GPS normally. I honestly feel like I have a smart phone now, as everything works as it should and the phone is alot snappier compared to the stock version. I am saying this even after I tried out the official Samsung Kies Froyo update, which still leaves me hanging for GPS service.
And yes, I completely understand that I could have very well downloaded something on the Android market that was infected. Even though I did not download any of the applications mentioned on the latest hotlist (really, I just dont care about "screaming sexy Japanese girls"), I could have obtained an undiscovered beast. It could also be the case that I have something on my PC that scanners just arent picking up. I may never know.
Where do you all stand on this issue? Do most ROM creators have more than one set of eyes looking at the packages that get deployed, or is that too unpractical?
Thanks in advance!
(P.S. I have searched the forum and looked at the suggested links before posting. I just didnt find anything that quenched my thirst)
nope 10 chars
Mobile security is becoming a concern and should be. Regardless of stock or rooted, there is a risk.
I don't bank on my phone, use my 'real' gmail or put sensitive info on my phone. Mobile is becoming a huge platform to mine information from.
qwertyaas said:
Mobile security is becoming a concern and should be. Regardless of stock or rooted, there is a risk.
I don't bank on my phone, use my 'real' gmail or put sensitive info on my phone. Mobile is becoming a huge platform to mine information from.
Click to expand...
Click to collapse
Isn't that the truth? I definitely have not done any mobile banking over mobile, and I don't think that I ever will. Its just scary that the attacker probably could have dug up more information about me in my emails than I care to think about.
I switched over to Google's 2-step verification system, so hopefully that will deter future attempts. Notice how I didnt say "prevent," as I dont think anything can actually stop a determined attacker short of getting rid of the phone and my gmail account. Obviously, if my phone falls into the wrong hands, I could be potentially hosed.
Check this out
http://www.engadget.com/2011/03/06/google-flips-android-kill-switch-destroys-a-batch-of-malicious/
cappysw10 said:
Check this out
http://www.engadget.com/2011/03/06/google-flips-android-kill-switch-destroys-a-batch-of-malicious/
Click to expand...
Click to collapse
Dilli already released a fix for this vulnerability for his 7.0 ROM. Maybe u cud get a similar one on ur custom ROM too.
While your concerns are rational and I await the answers, I believe they are borne out of a false understanding of what happened to you. When a spam e-mail is sent "from" your e-mail account it is not always the case that the attacker has gained access to your machine or your e-mail account. Most e-mail spam is sent via smtp "spoofing" whereby an attacker can make an e-mail look like it is from anyone else. These are done by automated scripts that can find and/or generate random "from" e-mails and then send to other recipients that have been found or randomly generated. If many of your friends received the e-mail, it IS POSSIBLE your computer or account was compromised, or that other friends' accounts have been compromised such that the automated spam bot gained access to a similar address book to yours.
Just wanted to let you know that you may not have been compromised.
Anyway, I too, am interested in the vulnerabilities of these custom ROMS.
sircaper said:
While your concerns are rational and I await the answers, I believe they are borne out of a false understanding of what happened to you. When a spam e-mail is sent "from" your e-mail account it is not always the case that the attacker has gained access to your machine or your e-mail account. Most e-mail spam is sent via smtp "spoofing" whereby an attacker can make an e-mail look like it is from anyone else. These are done by automated scripts that can find and/or generate random "from" e-mails and then send to other recipients that have been found or randomly generated. If many of your friends received the e-mail, it IS POSSIBLE your computer or account was compromised, or that other friends' accounts have been compromised such that the automated spam bot gained access to a similar address book to yours.
Just wanted to let you know that you may not have been compromised.
Anyway, I too, am interested in the vulnerabilities of these custom ROMS.
Click to expand...
Click to collapse
He said the email was sent to every one if his contacts. He was compromised.
That said. Use a secondary junk gmail account if at all possible on your phone. Don't install any app that asks for stupid permissions. Be very leary of any app that wants internet access regardless of who developed it. Android virus scanners are a joke, do not trust them.
P.s. "(really, I just dont care about "screaming sexy Japanese girls")" = blasphemy
whiteguypl said:
He said the email was sent to every one if his contacts. He was compromised.
That said. Use a secondary junk gmail account if at all possible on your phone. Don't install any app that asks for stupid permissions. Be very leary of any app that wants internet access regardless of who developed it. Android virus scanners are a joke, do not trust them.
P.s. "(really, I just dont care about "screaming sexy Japanese girls")" = blasphemy
Click to expand...
Click to collapse
Point taken. I don't disagree, but the odds say no. I figured he was using hyperbole and didn't really validate with every single person in his address book. The majority of spam e-mails are via spoofing.
sircaper said:
While your concerns are rational and I await the answers, I believe they are borne out of a false understanding of what happened to you. When a spam e-mail is sent "from" your e-mail account it is not always the case that the attacker has gained access to your machine or your e-mail account. Most e-mail spam is sent via smtp "spoofing" whereby an attacker can make an e-mail look like it is from anyone else. These are done by automated scripts that can find and/or generate random "from" e-mails and then send to other recipients that have been found or randomly generated. If many of your friends received the e-mail, it IS POSSIBLE your computer or account was compromised, or that other friends' accounts have been compromised such that the automated spam bot gained access to a similar address book to yours.
Just wanted to let you know that you may not have been compromised.
Anyway, I too, am interested in the vulnerabilities of these custom ROMS.
Click to expand...
Click to collapse
Thanks for the input.
As much as I would like to believe it was spoofed (and inherently making me feel better at the same time), I can say with a high degree of certainty that whoever did this had my password. How can I be somewhat sure of this? The "recent activity" list on gmail.com had an entry from a web browser access in Brazil. I do not have a proxy in Brazil, nor have I traveled there in.. well... ever. Also, the recipients' email headers claimed the email originated from gmail.com. Now, you're completely right that this part could have been spoofed, but I am not so sure about the first part. Upon doing some research, I've found that alot of other people who also had their accounts compromised had the same log entries and same origin in the email headers sent to the recipients.
Digression. Anyways, what they did is not as important as how they did it. Even to this day I am not sure. I really dont want to place blame on the ROM, because honestly the Cognition people did a fantastic job with it.
Bottom line is that I was curious as to everyone's security concerns, or lack thereof, when using custom ROMs.
How can you tell if your phone has been infected? What are some of the signs?
Hondo209 said:
How can you tell if your phone has been infected? What are some of the signs?
Click to expand...
Click to collapse
Well, I am no expert in this area, but the first place to look would be at an anti-virus, anti-malware application (such as Lookout). However, that probably wont do you any good if the virus/trojan/worm/whatever is still unknown.
Second place you might want to look is at your data usage. Excessive amounts might indicate something is up.
Other than that, maybe one of the sure-fire ways is to see which system files have changed and how. For some reason, a software package like Tripwire comes to mind. Although, I dont know how useful something like that would be on a mobile device.
Someone much more versed in this topic should have some better ideas
EggplantWizard said:
Thanks for the input.
As much as I would like to believe it was spoofed (and inherently making me feel better at the same time), I can say with a high degree of certainty that whoever did this had my password. How can I be somewhat sure of this? The "recent activity" list on gmail.com had an entry from a web browser access in Brazil. I do not have a proxy in Brazil, nor have I traveled there in.. well... ever. Also, the recipients' email headers claimed the email originated from gmail.com. Now, you're completely right that this part could have been spoofed, but I am not so sure about the first part. Upon doing some research, I've found that alot of other people who also had their accounts compromised had the same log entries and same origin in the email headers sent to the recipients.
Digression. Anyways, what they did is not as important as how they did it. Even to this day I am not sure. I really dont want to place blame on the ROM, because honestly the Cognition people did a fantastic job with it.
Bottom line is that I was curious as to everyone's security concerns, or lack thereof, when using custom ROMs.
Click to expand...
Click to collapse
Hmm.. Interesting.... I may take back my argument then!
As far as the concerns? I am also on Cognition 3.04 and up until now, I brushed aside the security issues. I had concerns, but hoped the community was strong enough to expose them. There definitely is an inherent risk downloading files authored by the developers. I know that some of them add in their own signature files just to track the programs and see if they are being altered. I'm not sure what can be done. Maybe you can run the ROM zips through a virus scanner on your pc before installing?
whiteguypl said:
P.s. "(really, I just dont care about "screaming sexy Japanese girls")" = blasphemy
Click to expand...
Click to collapse
HA! Now that's just funny.
sircaper said:
I figured he was using hyperbole and didn't really validate with every single person in his address book.
Click to expand...
Click to collapse
Well, I didnt validate with *every* single person in my address book, but I talked with a few that I speak with on a daily basis. They all had the same headers originating from gmail.com
Although, I do have to admit that one of the bizarre after-effects of such a compromise is that I have been "reunited" with people I haven't spoken to in a very long time. Take the good with the bad, I suppose.
I agree that security is a concern especially so when one is rooted. There are so many things to take into account. Even using wifi hotspots where hackers can hijack your logged in sessions whether it be Gmail, websites or banking. There are other methods where they can intercept packets with password and account information. For myself, I try and keep antivirus apps like Lookout running and scan often as well as am very cautious as to what hotspots I connect to. It doesnt look like your virus scanner helped you much. However, there may the possibility that you received malware on your PC where you may also be checking gmail from and it spoofed your account using information from there. Its all a guessing game though as there is probably no way to tell how this happened to you. I'd be thankful that it was just an ad that was sent out and nothing more serious came as a result...and change my passwords damn fast (lol)
Oh yeah, I only use wifi networks that I know. I don't log onto public wireless or random networks...
1.9 Are there things I can’t do on the Services? You must not use the Services to harm others or the Services. For example, you must not:
•Use unauthorized software or hardware to access the Services or modify an Authorized Device in any unauthorized way (e.g., through unauthorized repairs, unauthorized upgrades, or unauthorized downloads). You agree that we have the right to send data, applications or other content to any software or hardware that you are using to access the Services for the purpose of detecting an unauthorized modification and/or disabling the modified device; or
•Attempt to disassemble, decompile, create derivative works of, reverse engineer, modify, further sublicense, distribute, or use for other purposes the Services, any game, application, or other content available or accessible through the Services, or any hardware associated with the Services or with an Authorized Device. If you do, we may cancel your account and your ability to access the Services, and pursue other legal remedies. We may take any legal action we deem appropriate against users who violate our systems or network security, this Agreement or any additional terms incorporated or referenced in it. Such users may also incur criminal or civil liability.
Click to expand...
Click to collapse
Source : Xbox Live Terms of Usage
I'm getting a popup that I should accept the new end users agreement when trying to install a new app or check my Xbox Achievements, I have however a few questions about this paragraph above (I have honestly never seen this before) :
- Is it safe to accept if I have interop-unlocked my Samsung Ativ S, installed the BootStrapper.xap and EnableAllSideLoading.xap, WP8Tools and WP Tweaks from -W_O_L_F- and GoodDayToDie and jessenic.
- I'd used proxies provided by reker and others on XDA-Developers to access some manufacturing exclusive apps (like Nokia apps)
- Should I be worried if I accept that they can block and/or delete my Xbox account, I have saved a fair amount of temporally free store apps and I don't want to lose them.
If so, should I be better off to switch back to Android because they "allow" (turning a blind eye to) rooting your phone or tablet?
Please help me guys, I'm starting to freak out (I haven't accepted the new version of the EULA yet).
Terms like that have traditionally been part of the XBL EULA, but in the past they've always related to cheating or piracy on the console itself. People certainly have gotten their accounts banned for that, which is part of why I have nothing to do with such things. As for whether it's "safe" to accept... eh. If they want to, they can easily argue that you broke the EULA (and forfeited your account) when you interop-unlocked your phone, but they haven't - so far as I know - ever tried to attack individuals or their devices. I'm pretty sure they wouldn't do anything so foolish, either. Both Google and Apple have disabled peoples' accounts in the past for EULA/TOS violations - Apple for iOS hacks, Google for incredibly stupid <REDACTED> like breaking the Real Name Policy on G+ - and so for that matter has Microsoft, for something almost as idiotic (if you want to take risqué photos with your phone, make damn sure auto-upload is off even if your SkyDrive profile is set to private; they've called it a TOS violation and suspended, though not quite completely disabled, peoples' accounts for that). Every single one I've heard of resulted in a flood of bad PR, and not in the "all PR is good PR" sort of way... more like calls for lawsuits, and accusing anybody who uses that platform of being an idiot.
If there's one thing Microsoft cannot afford to do with regard to Windows Phone right now, it's give people another reason *not* to buy it. We are probably safe.
Yes, but WP8 is gaining popularity so maybe they won't do it now but in the future they probably will. Was this clause also present at the time of the interop-unlocking of WP7? If so, you are probably right. But as a precaution is it possible to lock out Microsoft from checking if modifications are made to the system (like you did with the relock solution redirect the data to a different proxy)?
GoodDayToDie said:
if you want to take risqué photos with your phone, make damn sure auto-upload is off even if your SkyDrive profile is set to private; they've called it a TOS violation and suspended, though not quite completely disabled, peoples' accounts for that
Click to expand...
Click to collapse
Are you sure of that? It means they watch the photos we take? I don't think so... maybe they used it as an image hosting and shared the link everywhere in the internet...
It's supposedly automated scanning that recognizes anything that looks like it needs to be flagged for human review...
http://wmpoweruser.com/microsoft-monitoring-censoring-skydrive-uploads/
http://wmpoweruser.com/watch-what-you-store-on-skydriveyou-may-lose-your-microsoft-life/
http://www.neowin.net/news/microsofts-ban-of-nudity-on-skydrive-questioned
etc...
I received my much anticipated OnePlus 6T yesterday. Unboxed it, tapped "Start" button. Scanned through both "Agreements," turned it off, boxed it up, got an RMA and shipped it back. I'm no attorney, I'm a broadcast engineer, but in my job I have to navigate the whole alphabet soup of government agencies red tape so I've learned some "legalese." I' returned the 6T because of the language in the "Agreements". When you tap "I agree" to both, then activate and use the device, your granting OnePlus access to anything on the device or networks on which it connects (condensed Reader's Digest version). Like everybody in the broadcast business I have "a lot of irons in the fire," I make notes about projects and ideas on my phone. There's no way I'm giving anyone permission to cherry pick my creativity or access to my company & networks proprietary information. I'm offering this as my personal observation on this forum and suggest anyone who is just receiving theirs new, read the legalese very carefully before you tap "I Agree."
Who the **** reads those? ?
Still why I don't buy any device that doesn't have Lineage support... However what are you going to replace it with? Going to go buy another flagship? Have you glanced through other's privacy policies? This stuff is pretty boiler plate at this point, it's CYA. Not that I'm defending it, because it shouldn't be like that, but in today's "sue happy world", and "everything needs to be connected", guess what? The solution would be just to remove this these services, there are tons of posts of which OnePlus services to remove if you want to stay on OOS and protect your privacy.
So back to the replacement, lets take a Samsung, those are popular....., have you glanced at their privacy policy, because it's similar link
I didn't go over entirely, and I'm sure there's more details, but I'm guessing OnePlus's blurb, looked something similar to this (From Samsung's Website):
In addition to the information you provide, we may collect information about your use of our Services through software on your device and other means. For example, we may collect:
Device information - such as your hardware model, IMEI number and other unique device identifiers, MAC address, IP address, operating system versions, and settings of the device you use to access the Services.
Log information - such as the time and duration of your use of the Service, search query terms you enter through the Services, and any information stored in cookies that we have set on your device.
Location information - such as your device’s GPS signal or information about nearby WiFi access points and cell towers that may be transmitted to us when you use certain Services.
Voice information - such as recordings of your voice that we make (and may store on our servers) when you use voice commands to control a Service. (Note that if we work with a third-party service provider that provides speech-to-text conversion services on our behalf. This provider may receive and store certain voice commands.)
Other information about your use of the Services, such as the apps you use, the websites you visit, and how you interact with content offered through a Service.
Information from third-party sources
We may receive information about you from publicly and commercially available sources (as permitted by law), which we may combine with other information we receive from or about you. We also may receive information about you from third-party social networking services when you choose to connect with those services.
I'm not new to android or privacy by any means.
This kind of obscure language is no mistake or ctrl c/v standard.
All of these are poored over by lawyers on mass.
.
It is for this reason I exclusively run custom rims & mods and a majority of my devices are root/xposed with multiple layers of privacy in mind.
.
There used to be a much bigger crowd of developers and possibilities...
But we seem to be a dying breed.
.
I'm deeply saddened at the lack of true device level privacy or the concern for it.
And no
You'll not catch me trusting Google or an oem.
I barely trust open source.
.
Any links to further improve safety security and privacy on an Android device would be appreciated
If you think what the 6T collects is bad wait till you hear about Google.. Android is just a glorified data collection OS.. All they care about is profiling from us and learning everything to target ads and sell to 3rd parties after all Google is an Ad company.. If you want privacy compile AOSP and use MicroG avoid all Google services and use as much FOSS apps as possible.
---------- Post added at 10:35 PM ---------- Previous post was at 10:32 PM ----------
OhioYJ said:
Still why I don't buy any device that doesn't have Lineage support... However what are you going to replace it with? Going to go buy another flagship? Have you glanced through other's privacy policies? This stuff is pretty boiler plate at this point, it's CYA. Not that I'm defending it, because it shouldn't be like that, but in today's "sue happy world", and "everything needs to be connected", guess what? The solution would be just to remove this these services, there are tons of posts of which OnePlus services to remove if you want to stay on OOS and protect your privacy.
So back to the replacement, lets take a Samsung, those are popular....., have you glanced at their privacy policy, because it's similar link
I didn't go over entirely, and I'm sure there's more details, but I'm guessing OnePlus's blurb, looked something similar to this (From Samsung's Website):
In addition to the information you provide, we may collect information about your use of our Services through software on your device and other means. For example, we may collect:
Device information - such as your hardware model, IMEI number and other unique device identifiers, MAC address, IP address, operating system versions, and settings of the device you use to access the Services.
Log information - such as the time and duration of your use of the Service, search query terms you enter through the Services, and any information stored in cookies that we have set on your device.
Location information - such as your device’s GPS signal or information about nearby WiFi access points and cell towers that may be transmitted to us when you use certain Services.
Voice information - such as recordings of your voice that we make (and may store on our servers) when you use voice commands to control a Service. (Note that if we work with a third-party service provider that provides speech-to-text conversion services on our behalf. This provider may receive and store certain voice commands.)
Other information about your use of the Services, such as the apps you use, the websites you visit, and how you interact with content offered through a Service.
Information from third-party sources
We may receive information about you from publicly and commercially available sources (as permitted by law), which we may combine with other information we receive from or about you. We also may receive information about you from third-party social networking services when you choose to connect with those services.
Click to expand...
Click to collapse
Lineage also collects weird data like what device you installed on, Carrier etc.. Not sure why it needs this but I don't run it for that reason.
nima0003 said:
Who the **** reads those?
Click to expand...
Click to collapse
people who can read
Lebrun213 said:
people who can read
Click to expand...
Click to collapse
Did you return yours?
liam_davenport said:
If you think what the 6T collects is bad wait till you hear about Google.. Android is just a glorified data collection OS.. All they care about is profiling from us and learning everything to target ads and sell to 3rd parties after all Google is an Ad company.. If you want privacy compile AOSP and use MicroG avoid all Google services and use as much FOSS apps as possible.
---------- Post added at 10:35 PM ---------- Previous post was at 10:32 PM ----------
Lineage also collects weird data like what device you installed on, Carrier etc.. Not sure why it needs this but I don't run it for that reason.
Click to expand...
Click to collapse
So they can get an idea of which devices to develop for and their user base.
liam_davenport said:
Lineage also collects weird data like what device you installed on, Carrier etc.. Not sure why it needs this but I don't run it for that reason.
Click to expand...
Click to collapse
As soon as you install Lineage it asks if you want to share / participate in this program? You don't have to share this information. If you overlooked it the user can disable this sharing in the settings. They don't try and hide it at all.
I also don't know of any Lineage builds / trees that are hidden unlike other ROMs that are popular. So everything is out in the open.
Lineage has always been my first choice, so maybe I'm biased?
Caltinpla said:
Did you return yours?
Click to expand...
Click to collapse
custom OS and MicroG
got rid of oneplus & google spyware without loosing fonctionality (except fingerprint reader obviously)
Lebrun213 said:
custom OS and MicroG
got rid of oneplus & google spyware without loosing fonctionality (except fingerprint reader obviously)
Click to expand...
Click to collapse
So, you really believe custom roms and other phone makers don't spy on you? Good luck with that!!!
Caltinpla said:
So, you really believe custom roms and other phone makers don't spy on you? Good luck with that!!!
Click to expand...
Click to collapse
If you think custom roms (AOSP) are spying on you you're on the wrong website
Intrusive TOS suck big time, but, unfortunately, if you have a email address or cell phone, use the internet in any way shape or form, forget about any sense of privacy..
I make sure I dont do anything "iffy" on my cell phone; never use it for banking or bill paying, so I feel a little less paranoid, but there is really NO WAY, aside from not having an email address/cell phone/internet connection to keep your life from some prying eyes..
Lebrun213 said:
custom OS and MicroG
got rid of oneplus & google spyware without loosing fonctionality (except fingerprint reader obviously)
Click to expand...
Click to collapse
Root and block everything.
Caltinpla said:
So, you really believe custom roms and other phone makers don't spy on you? Good luck with that!!!
Click to expand...
Click to collapse
i trust open source, if there is a doubt with the code, anyone can check (not saying everyone does that).
Google service, oneplus, etc ... on the other hand are completely locked and you have no way to see what it really does.
Btw, i switched because of the much better battery and performance i get without these spyware constantly running, not much about privacy... Still use google.com everyday so they aren't missing anything :laugh:
The only one you have to agree to is the first one. The rest you can decline and still setup your phone. I agree with Micro G but, if go a step further and install NanoDroid. It comes with replacement Google apps and GPS and all sorts of things to disconnect you from Google but have a functioning phone.
Sent from my OnePlus6T using XDA Labs
liam_davenport said:
If you think what the 6T collects is bad wait till you hear about Google.. Android is just a glorified data collection OS.. All they care about is profiling from us and learning everything to target ads and sell to 3rd parties after all Google is an Ad company.. If you want privacy compile AOSP and use MicroG avoid all Google services and use as much FOSS apps as possible.
---------- Post added at 10:35 PM ---------- Previous post was at 10:32 PM ----------
Lineage also collects weird data like what device you installed on, Carrier etc.. Not sure why it needs this but I don't run it for that reason.
Click to expand...
Click to collapse
False. Google does not sell user data to third parties, or to anyone. It's never even been considered. Unfortunately due to a mix of people not understanding how technology works and assuming that every "tech company" operates in exactly the same way this particular piece of fake news just won't die. There are plenty of terrible things they actually do nowadays, better to focus on those anyway
tech_head said:
Root and block everything.
Click to expand...
Click to collapse
so much this
every manufacturer has some sort of logging / reading data.
root, and monitor everything that leaves your phone - block apk's that shouldnt be running - or create firewall rules in the iptables to block applications from accessing certain sites / internet.
partcyborg said:
False. Google does not sell user data to third parties, or to anyone. It's never even been considered. Unfortunately due to a mix of people not understanding how technology works and assuming that every "tech company" operates in exactly the same way this particular piece of fake news just won't die. There are plenty of terrible things they actually do nowadays, better to focus on those anyway
Click to expand...
Click to collapse
This argument would make Kellyanne Conway proud. Yes, Google does not sell user data directly. But it does so indirectly every day it is in business. By allowing advertisers to target ever smaller slices of the population and track them across websites they ARE providing advertisers with user data.
GroovyGeek said:
This argument would make Kellyanne Conway proud. Yes, Google does not sell user data directly. But it does so indirectly every day it is in business. By allowing advertisers to target ever smaller slices of the population and track them across websites they ARE providing advertisers with user data.
Click to expand...
Click to collapse
A truly moronic reply that shows you have no idea what you are talking about. Have your even seen the advertising interface to Google's ad products? Obviously not because you just described Facebook's, not Google's! ?????
Assuming I was an expert user who knew every single Note 9 device option, samsung account setting, and google account setting.... If I were to configure EVERY single one of them to limit the data it collects, set every app permission to be in its most restricted state, disable every usage access setting, and configured my google and samsung accounts to be the most limited data collection accounts as possible, .... it is even possible to get to IOS level privacy on my Note 9? Is Android just sending everything it can back to google's servers as possible, such as when i turn the phone on, when i walk, move, open an app, browse the web, or whatever? I know some have already setup network analyzers to see the traffic going out, but I can never tell what configuration they do that with. I want to know if getting the privacy to IOS levels is impossible, or is it just a matter of very careful configuration....?
It's impossible. I'm not a fan of Apple devices, but I applaud them from a business perspective and that trickles down from the fundamental ideals of Steve Jobs.
Numerous studies show that Google sucks up information 10x as much as Apple which relies in differential data that doesn't exactly pinpoint the person, but more so the general interests of the person. Google identifies the person and their location. Unless you're walking around with your phone off or granting no permissions to every app, you can't match the security of an Apple device. The doesn't only include Google. Remember we have to deal with our specific manufacturers that are collecting data on us as well since Android is open source. So we just have to hope Googles intentions are good or move to an Apple device.
brainysmurf said:
Assuming I was an expert user who knew every single Note 9 device option, samsung account setting, and google account setting.... If I were to configure EVERY single one of them to limit the data it collects, set every app permission to be in its most restricted state, disable every usage access setting, and configured my google and samsung accounts to be the most limited data collection accounts as possible, .... it is even possible to get to IOS level privacy on my Note 9? Is Android just sending everything it can back to google's servers as possible, such as when i turn the phone on, when i walk, move, open an app, browse the web, or whatever? I know some have already setup network analyzers to see the traffic going out, but I can never tell what configuration they do that with. I want to know if getting the privacy to IOS levels is impossible, or is it just a matter of very careful configuration....?
Click to expand...
Click to collapse
No fanboi of any company/mfg/OS,but,they all do virtually the same thing with your personal information/usage habits.
The differences are mere semantics & they collect/sell user information.
The following is a 2yr old article,but,I'm guessing the points they make still hold true:
https://decentralize.today/apple-vs...company-handles-your-data-better-a7022bd452b1
Arguably,Android users can control their sharing of personal data usage,but,that has its caveats,such as limited functionality on some apps/etc...
Best advice I can give is the following:
1) Carefully comb through every setting on the phone,most are self-explanatory.
2) Go to every apps internal settings & the phone's setting under SETTINGS > APPLICATIONS & fine tune as best as possible.
Even after all of that,Google/Samsung (or most other mfgs) have settings that are inaccessible or cannot change (greyed-out),so,you're still not in the clear as far as total control/privacy.
This is one of the major attractions to rooting/ROMs for your Android device.
A rooted &/or ROM'd Samsung device is the ideal for gaining control of privacy/permission control,but,it breaks KNOX & Samsung Pay,no going back once rooted,even if restored to a stock state.
You gain more granular control of such permissions & if you want to go all-in on privacy, a ROM such as Lineage gives you the best you can hope for in personal security/privacy. A brief summary,but,that's the gist.
Outside of root/ROMs,If privacy/security is of utmost importance,I'd dare say a Blackberry would be a decent choice. I myself only briefly owned a Blackberry (Android device),so,I can't attest to how private/secure you personal usage/data is,but,I've rarely,if ever,heard of any major concerns in the matter w/Blackberry.
@brainysmurf
Another step you can take to regain some control of your Samsung device is using a package disabler app & the nice thing about these is no root access is required (AppFreeze/Package Disabler Pro/Adhell3).
https://play.google.com/store/apps/details?id=com.wakasoftware.appfreezer&hl=en_US
https://play.google.com/store/apps/details?id=com.powermanager.batteryaddon&hl=en
https://amp.reddit.com/r/GalaxyS8/comments/8nmrfq/how_to_install_adhell_3_a_video_guide/
Use the XDA site search feature or Google for more info on the above mentioned disabler apps.
You can also use ADB Commands to disable apps as well,but,please read the following link carefully before proceeding:
https://www.xda-developers.com/uninstall-carrier-oem-bloatware-without-root-access/
I have never had an apple device, But I would like to say that android as a system is opensource and the google apps that are put on top are non opensource and are probably where you lose your privacy but as a system it is transparent which attracts devs and rooting (i.e. getting access to the system partitions) is what makes android so customizable. Versus apple which you have to blind trust ios and trust that these options are 100% do what they say..
Yes it is more secure because it is closed source but at the same time For actual privacy you never know. Saying that how do you get your privacy with android needs some setup which koliosis did good explaining. But the difference between the two OSs I believe is because of (opensource)ness of android the amout of customizablity with android is really deep. To which I believe if you invest good time researching, you can get a way better state than iOS. Again not an expert but putting my opinion
For the rest
Koliosis said it all.
that_same_guy said:
Yes it is more secure because it is closed source.
Click to expand...
Click to collapse
Have to correct that one. That is a myth spread by some big companies in order try to gain some customers over from the cheaper/free competition. In reality, open vs. closed source has no other effect on how secure the result is than with open source there can be more eyes looking at the code (for both good and bad intentions). As an example, simply compare a decent linux distro (from which only similar applications are installed that would come with corresponding Windows installation) to M$ Windows. Open source (and free at that) wins many times over in overall security (while neither is free from issues).
The biggest effect on the code quality (thus often also how secure it is) is on how many (real) experts work on it, and this in turn depends on popularity (open source) and/or money (company's/organization's income and policies/ideals). For the last part 'policies/ideals' just compare M$ and Apple, both have the money to throw at development if they choose to do so; former makes mostly insecure crap, latter makes half-decent stuff. (And note, I'm not a fanboy of either, or pretty much of any company, except one little local camera shop, so do read the previous with some weight on that "half-" before the "decent".)
As for small input on the privacy squeezing on Samsung devices:
I have so far managed to avoid to use a samsung-account, and that might help a tiny bit, although some features of the phone are then not working, but mostly useless features. Though there are some seemingly useful features that require Samsung-account for some weird reason, but I've manage to live without them. Like the "protected folder" (or whatever it is in English), why on earth would that need an account or anything external for that matter?!?
(Well, technically, I do have a Samsung-account, as that was required to get the phone cheaper, but after that order, I've not used that account anywhere.)
ErebusRaze said:
It's impossible. I'm not a fan of Apple devices, but I applaud them from a business perspective and that trickles down from the fundamental ideals of Steve Jobs.
Numerous studies show that Google sucks up information 10x as much as Apple which relies in differential data that doesn't exactly pinpoint the person, but more so the general interests of the person. Google identifies the person and their location. Unless you're walking around with your phone off or granting no permissions to every app, you can't match the security of an Apple device. The doesn't only include Google. Remember we have to deal with our specific manufacturers that are collecting data on us as well since Android is open source. So we just have to hope Googles intentions are good or move to an Apple device.
Click to expand...
Click to collapse
This actually goes to my point... If indeed I did remove all permissions from all apps, does this mean Android tracking would be completely disabled? Or if I removed google play services, or disabled it, or removed all permissions from it? Technically, would that give it an IOS level of privacy? I'm just wondering if the OS itself is prone to just phoning home and letting it know everything I'm doing, or if it's possible at all to tame it....
Thanks for your repsonse.
ErebusRaze said:
It's impossible. I'm not a fan of Apple devices, but I applaud them from a business perspective and that trickles down from the fundamental ideals of Steve Jobs.
Numerous studies show that Google sucks up information 10x as much as Apple which relies in differential data that doesn't exactly pinpoint the person, but more so the general interests of the person. Google identifies the person and their location. Unless you're walking around with your phone off or granting no permissions to every app, you can't match the security of an Apple device. The doesn't only include Google. Remember we have to deal with our specific manufacturers that are collecting data on us as well since Android is open source. So we just have to hope Googles intentions are good or move to an Apple device.
Click to expand...
Click to collapse
Yeah I saw those same studies. And they never seem to provide specific configuration data. For instance, the study showing that android gathers as much as 10x more data specifically mentioned that Chrome was constantly phoning home sending data. However, what if the user didn't log into their chrome account? I think it's much more limited in that case... Or what if the user disabled chrome, and perhaps all google apps? Is it android doing the privacy damage, or google apps/play services? If I disabled those, or removed all permissions from those, would it be equivalent to IOS? I'm an engineer in the business working at a major silicon valley company, and even with high expertise in the design of these things I'm finding it impossible to get basic understanding of what it actually going on. It is either trying to read through legalize of privacy agreements, or reading blogs and studies with claims such as 10x more data, while not providing specifics...