Related
Greetings everyone.
Ill just start off with asking the question: How many of you give 2nd, 3rd or nth thoughts about using a rooted (or, rooted and ROM'd) phone?
Now, let me explain why I am asking this question.
Earlier this week, my Google account was broken into. The attacker mass-emailed everyone on my contact list a link to a Viagra ad, of all things. It could have been worse, since my contacts and emails were left in-tact. In a furious, chaotic, post-incident rush, I was scrambling in an attempt to figure out how they obtained my password. At the time of this writing, I have come up with nothing. The first thing I thought, naturally, was a worm/trojan/virus on my PC. Several anti-virus / anti-malware / anti-root-kit scans proved to be clean.
So, I turned my sleuthing efforts towards my phone -- a Samsung Captivate, which had been rooted and ROM'd to Captivate 3.04. I had Lookout installed the entire time, and I have been using Cognition ROMs since late December of 2010. In assuming the worst, I nuked my phone, reverted back to stock and re-rooted and re-ROM'd. While rooting my phone, my virus scanner pleasantly informed me that the One Click rooting solution contained an exploit (Lotoor, I believe). Now, I completely understand that its necessary to use these exploits in order to gain access. However, it kinda got me thinking -- what else could be going into the phone that I dont know about?
Note that all ROMs and Rooters were obtained from links available from this website. I did not get them from "shady" locations.
I am realistic about this. I download and install applications from the internet frequently. I put a some faith in my virus scanners / anti-malware applications. This little incident, however, is making me a little more skeptical about what applications I run, as its difficult and time consuming to monitor every application for "phone home" activities.
The bottom line is that I do not want to sound like that I am placing blame on any of the Cognition developers (or any ROM developer). In fact, I am probably going to donate to them because the 3.04 version finally allowed me to use my GPS normally. I honestly feel like I have a smart phone now, as everything works as it should and the phone is alot snappier compared to the stock version. I am saying this even after I tried out the official Samsung Kies Froyo update, which still leaves me hanging for GPS service.
And yes, I completely understand that I could have very well downloaded something on the Android market that was infected. Even though I did not download any of the applications mentioned on the latest hotlist (really, I just dont care about "screaming sexy Japanese girls"), I could have obtained an undiscovered beast. It could also be the case that I have something on my PC that scanners just arent picking up. I may never know.
Where do you all stand on this issue? Do most ROM creators have more than one set of eyes looking at the packages that get deployed, or is that too unpractical?
Thanks in advance!
(P.S. I have searched the forum and looked at the suggested links before posting. I just didnt find anything that quenched my thirst)
nope 10 chars
Mobile security is becoming a concern and should be. Regardless of stock or rooted, there is a risk.
I don't bank on my phone, use my 'real' gmail or put sensitive info on my phone. Mobile is becoming a huge platform to mine information from.
qwertyaas said:
Mobile security is becoming a concern and should be. Regardless of stock or rooted, there is a risk.
I don't bank on my phone, use my 'real' gmail or put sensitive info on my phone. Mobile is becoming a huge platform to mine information from.
Click to expand...
Click to collapse
Isn't that the truth? I definitely have not done any mobile banking over mobile, and I don't think that I ever will. Its just scary that the attacker probably could have dug up more information about me in my emails than I care to think about.
I switched over to Google's 2-step verification system, so hopefully that will deter future attempts. Notice how I didnt say "prevent," as I dont think anything can actually stop a determined attacker short of getting rid of the phone and my gmail account. Obviously, if my phone falls into the wrong hands, I could be potentially hosed.
Check this out
http://www.engadget.com/2011/03/06/google-flips-android-kill-switch-destroys-a-batch-of-malicious/
cappysw10 said:
Check this out
http://www.engadget.com/2011/03/06/google-flips-android-kill-switch-destroys-a-batch-of-malicious/
Click to expand...
Click to collapse
Dilli already released a fix for this vulnerability for his 7.0 ROM. Maybe u cud get a similar one on ur custom ROM too.
While your concerns are rational and I await the answers, I believe they are borne out of a false understanding of what happened to you. When a spam e-mail is sent "from" your e-mail account it is not always the case that the attacker has gained access to your machine or your e-mail account. Most e-mail spam is sent via smtp "spoofing" whereby an attacker can make an e-mail look like it is from anyone else. These are done by automated scripts that can find and/or generate random "from" e-mails and then send to other recipients that have been found or randomly generated. If many of your friends received the e-mail, it IS POSSIBLE your computer or account was compromised, or that other friends' accounts have been compromised such that the automated spam bot gained access to a similar address book to yours.
Just wanted to let you know that you may not have been compromised.
Anyway, I too, am interested in the vulnerabilities of these custom ROMS.
sircaper said:
While your concerns are rational and I await the answers, I believe they are borne out of a false understanding of what happened to you. When a spam e-mail is sent "from" your e-mail account it is not always the case that the attacker has gained access to your machine or your e-mail account. Most e-mail spam is sent via smtp "spoofing" whereby an attacker can make an e-mail look like it is from anyone else. These are done by automated scripts that can find and/or generate random "from" e-mails and then send to other recipients that have been found or randomly generated. If many of your friends received the e-mail, it IS POSSIBLE your computer or account was compromised, or that other friends' accounts have been compromised such that the automated spam bot gained access to a similar address book to yours.
Just wanted to let you know that you may not have been compromised.
Anyway, I too, am interested in the vulnerabilities of these custom ROMS.
Click to expand...
Click to collapse
He said the email was sent to every one if his contacts. He was compromised.
That said. Use a secondary junk gmail account if at all possible on your phone. Don't install any app that asks for stupid permissions. Be very leary of any app that wants internet access regardless of who developed it. Android virus scanners are a joke, do not trust them.
P.s. "(really, I just dont care about "screaming sexy Japanese girls")" = blasphemy
whiteguypl said:
He said the email was sent to every one if his contacts. He was compromised.
That said. Use a secondary junk gmail account if at all possible on your phone. Don't install any app that asks for stupid permissions. Be very leary of any app that wants internet access regardless of who developed it. Android virus scanners are a joke, do not trust them.
P.s. "(really, I just dont care about "screaming sexy Japanese girls")" = blasphemy
Click to expand...
Click to collapse
Point taken. I don't disagree, but the odds say no. I figured he was using hyperbole and didn't really validate with every single person in his address book. The majority of spam e-mails are via spoofing.
sircaper said:
While your concerns are rational and I await the answers, I believe they are borne out of a false understanding of what happened to you. When a spam e-mail is sent "from" your e-mail account it is not always the case that the attacker has gained access to your machine or your e-mail account. Most e-mail spam is sent via smtp "spoofing" whereby an attacker can make an e-mail look like it is from anyone else. These are done by automated scripts that can find and/or generate random "from" e-mails and then send to other recipients that have been found or randomly generated. If many of your friends received the e-mail, it IS POSSIBLE your computer or account was compromised, or that other friends' accounts have been compromised such that the automated spam bot gained access to a similar address book to yours.
Just wanted to let you know that you may not have been compromised.
Anyway, I too, am interested in the vulnerabilities of these custom ROMS.
Click to expand...
Click to collapse
Thanks for the input.
As much as I would like to believe it was spoofed (and inherently making me feel better at the same time), I can say with a high degree of certainty that whoever did this had my password. How can I be somewhat sure of this? The "recent activity" list on gmail.com had an entry from a web browser access in Brazil. I do not have a proxy in Brazil, nor have I traveled there in.. well... ever. Also, the recipients' email headers claimed the email originated from gmail.com. Now, you're completely right that this part could have been spoofed, but I am not so sure about the first part. Upon doing some research, I've found that alot of other people who also had their accounts compromised had the same log entries and same origin in the email headers sent to the recipients.
Digression. Anyways, what they did is not as important as how they did it. Even to this day I am not sure. I really dont want to place blame on the ROM, because honestly the Cognition people did a fantastic job with it.
Bottom line is that I was curious as to everyone's security concerns, or lack thereof, when using custom ROMs.
How can you tell if your phone has been infected? What are some of the signs?
Hondo209 said:
How can you tell if your phone has been infected? What are some of the signs?
Click to expand...
Click to collapse
Well, I am no expert in this area, but the first place to look would be at an anti-virus, anti-malware application (such as Lookout). However, that probably wont do you any good if the virus/trojan/worm/whatever is still unknown.
Second place you might want to look is at your data usage. Excessive amounts might indicate something is up.
Other than that, maybe one of the sure-fire ways is to see which system files have changed and how. For some reason, a software package like Tripwire comes to mind. Although, I dont know how useful something like that would be on a mobile device.
Someone much more versed in this topic should have some better ideas
EggplantWizard said:
Thanks for the input.
As much as I would like to believe it was spoofed (and inherently making me feel better at the same time), I can say with a high degree of certainty that whoever did this had my password. How can I be somewhat sure of this? The "recent activity" list on gmail.com had an entry from a web browser access in Brazil. I do not have a proxy in Brazil, nor have I traveled there in.. well... ever. Also, the recipients' email headers claimed the email originated from gmail.com. Now, you're completely right that this part could have been spoofed, but I am not so sure about the first part. Upon doing some research, I've found that alot of other people who also had their accounts compromised had the same log entries and same origin in the email headers sent to the recipients.
Digression. Anyways, what they did is not as important as how they did it. Even to this day I am not sure. I really dont want to place blame on the ROM, because honestly the Cognition people did a fantastic job with it.
Bottom line is that I was curious as to everyone's security concerns, or lack thereof, when using custom ROMs.
Click to expand...
Click to collapse
Hmm.. Interesting.... I may take back my argument then!
As far as the concerns? I am also on Cognition 3.04 and up until now, I brushed aside the security issues. I had concerns, but hoped the community was strong enough to expose them. There definitely is an inherent risk downloading files authored by the developers. I know that some of them add in their own signature files just to track the programs and see if they are being altered. I'm not sure what can be done. Maybe you can run the ROM zips through a virus scanner on your pc before installing?
whiteguypl said:
P.s. "(really, I just dont care about "screaming sexy Japanese girls")" = blasphemy
Click to expand...
Click to collapse
HA! Now that's just funny.
sircaper said:
I figured he was using hyperbole and didn't really validate with every single person in his address book.
Click to expand...
Click to collapse
Well, I didnt validate with *every* single person in my address book, but I talked with a few that I speak with on a daily basis. They all had the same headers originating from gmail.com
Although, I do have to admit that one of the bizarre after-effects of such a compromise is that I have been "reunited" with people I haven't spoken to in a very long time. Take the good with the bad, I suppose.
I agree that security is a concern especially so when one is rooted. There are so many things to take into account. Even using wifi hotspots where hackers can hijack your logged in sessions whether it be Gmail, websites or banking. There are other methods where they can intercept packets with password and account information. For myself, I try and keep antivirus apps like Lookout running and scan often as well as am very cautious as to what hotspots I connect to. It doesnt look like your virus scanner helped you much. However, there may the possibility that you received malware on your PC where you may also be checking gmail from and it spoofed your account using information from there. Its all a guessing game though as there is probably no way to tell how this happened to you. I'd be thankful that it was just an ad that was sent out and nothing more serious came as a result...and change my passwords damn fast (lol)
Oh yeah, I only use wifi networks that I know. I don't log onto public wireless or random networks...
1.9 Are there things I can’t do on the Services? You must not use the Services to harm others or the Services. For example, you must not:
•Use unauthorized software or hardware to access the Services or modify an Authorized Device in any unauthorized way (e.g., through unauthorized repairs, unauthorized upgrades, or unauthorized downloads). You agree that we have the right to send data, applications or other content to any software or hardware that you are using to access the Services for the purpose of detecting an unauthorized modification and/or disabling the modified device; or
•Attempt to disassemble, decompile, create derivative works of, reverse engineer, modify, further sublicense, distribute, or use for other purposes the Services, any game, application, or other content available or accessible through the Services, or any hardware associated with the Services or with an Authorized Device. If you do, we may cancel your account and your ability to access the Services, and pursue other legal remedies. We may take any legal action we deem appropriate against users who violate our systems or network security, this Agreement or any additional terms incorporated or referenced in it. Such users may also incur criminal or civil liability.
Click to expand...
Click to collapse
Source : Xbox Live Terms of Usage
I'm getting a popup that I should accept the new end users agreement when trying to install a new app or check my Xbox Achievements, I have however a few questions about this paragraph above (I have honestly never seen this before) :
- Is it safe to accept if I have interop-unlocked my Samsung Ativ S, installed the BootStrapper.xap and EnableAllSideLoading.xap, WP8Tools and WP Tweaks from -W_O_L_F- and GoodDayToDie and jessenic.
- I'd used proxies provided by reker and others on XDA-Developers to access some manufacturing exclusive apps (like Nokia apps)
- Should I be worried if I accept that they can block and/or delete my Xbox account, I have saved a fair amount of temporally free store apps and I don't want to lose them.
If so, should I be better off to switch back to Android because they "allow" (turning a blind eye to) rooting your phone or tablet?
Please help me guys, I'm starting to freak out (I haven't accepted the new version of the EULA yet).
Terms like that have traditionally been part of the XBL EULA, but in the past they've always related to cheating or piracy on the console itself. People certainly have gotten their accounts banned for that, which is part of why I have nothing to do with such things. As for whether it's "safe" to accept... eh. If they want to, they can easily argue that you broke the EULA (and forfeited your account) when you interop-unlocked your phone, but they haven't - so far as I know - ever tried to attack individuals or their devices. I'm pretty sure they wouldn't do anything so foolish, either. Both Google and Apple have disabled peoples' accounts in the past for EULA/TOS violations - Apple for iOS hacks, Google for incredibly stupid <REDACTED> like breaking the Real Name Policy on G+ - and so for that matter has Microsoft, for something almost as idiotic (if you want to take risqué photos with your phone, make damn sure auto-upload is off even if your SkyDrive profile is set to private; they've called it a TOS violation and suspended, though not quite completely disabled, peoples' accounts for that). Every single one I've heard of resulted in a flood of bad PR, and not in the "all PR is good PR" sort of way... more like calls for lawsuits, and accusing anybody who uses that platform of being an idiot.
If there's one thing Microsoft cannot afford to do with regard to Windows Phone right now, it's give people another reason *not* to buy it. We are probably safe.
Yes, but WP8 is gaining popularity so maybe they won't do it now but in the future they probably will. Was this clause also present at the time of the interop-unlocking of WP7? If so, you are probably right. But as a precaution is it possible to lock out Microsoft from checking if modifications are made to the system (like you did with the relock solution redirect the data to a different proxy)?
GoodDayToDie said:
if you want to take risqué photos with your phone, make damn sure auto-upload is off even if your SkyDrive profile is set to private; they've called it a TOS violation and suspended, though not quite completely disabled, peoples' accounts for that
Click to expand...
Click to collapse
Are you sure of that? It means they watch the photos we take? I don't think so... maybe they used it as an image hosting and shared the link everywhere in the internet...
It's supposedly automated scanning that recognizes anything that looks like it needs to be flagged for human review...
http://wmpoweruser.com/microsoft-monitoring-censoring-skydrive-uploads/
http://wmpoweruser.com/watch-what-you-store-on-skydriveyou-may-lose-your-microsoft-life/
http://www.neowin.net/news/microsofts-ban-of-nudity-on-skydrive-questioned
etc...
i got a lumia 520, i really need to change the 3G DNS to block my carrier from draining my credit visitin some domain...
i readed someting about ProvXML and these values
<parm name="DnsAddr" value="0.0.0.0" />
<parm name="AltDnsAddr" value="0.0.0.0" />
Click to expand...
Click to collapse
but where i can find and change it!?!
Unless Nokia has a special app for it, you can't change things like that. The DNS servers aren't user-configurable on WP8 in general, unless you connect to a WiFi network that doesn't use DHCP. Processing provxml requires capabilities that third-party apps aren't allowed to have.
feherneoh said:
Carrier checks for IPs, so changing the DNS is useless
Sent from my MyAudio using xda app-developers app
Click to expand...
Click to collapse
Probably, but all "pay to view" domains are not resolved with google DNS for example ... So without a connection to these domain (is impossibile to have a full list they are changing and adding new too often) i will solve my credit draining problem.
Already tested on an android device.
...so, help on how to on Windows Phone?
... out of curiosity, since when does any such thing as a "pay to view" domain even exist? I'm pretty sure that's illegal under ICANN rules and, in the US and many other countries, net neutrality (which is unfortunately under attack here...)
GoodDayToDie said:
... out of curiosity, since when does any such thing as a "pay to view" domain even exist? I'm pretty sure that's illegal under ICANN rules and, in the US and many other countries, net neutrality (which is unfortunately under attack here...)
Click to expand...
Click to collapse
is not exactly a paytoview domain, or better, it is but carrier is advising you about it (are some newspaper or ****ty ads website, and sometime a wrong click cause some cents go away from your credit).... i simply don't want to fall in this domains and the DNS trick is the only "easier" way i found
Yeaaaah that's definitely not supposed to exist. IP addresses (or even domain names) aren't like phone numbers, where different ones can charge different amounts, and for good reason: you don't know what the address is before you connect to it, usually (as opposed to, say, a 1-900 number in the US). If your carrier is charging you extra to connect to certain domains, that is your carrier being evil (and, while I still don't know where you live, unlawful in much of the world). There is literally no way that any domain can itself enforce that kind of behavior.
Have you tried just calling the carrier and asking them to block things that would charge you like that? *Most* US carriers (despicable scum though most of them are) will let you do things like block premium-rate SMS or calls.
GoodDayToDie said:
Yeaaaah that's definitely not supposed to exist. IP addresses (or even domain names) aren't like phone numbers, where different ones can charge different amounts, and for good reason: you don't know what the address is before you connect to it, usually (as opposed to, say, a 1-900 number in the US). If your carrier is charging you extra to connect to certain domains, that is your carrier being evil (and, while I still don't know where you live, unlawful in much of the world). There is literally no way that any domain can itself enforce that kind of behavior.
Have you tried just calling the carrier and asking them to block things that would charge you like that? *Most* US carriers (despicable scum though most of them are) will let you do things like block premium-rate SMS or calls.
Click to expand...
Click to collapse
I'm in italy, blocked all premium SMS and and all stupid things that i can block like this.. But the carrier is giving me no way to block these domains (lot of people have this issue with this carrier because is not easy to know where exactly you clicked and payed...no doubt that the carrier want to be evil)
Btw, having google DNS can also help me in a better response time opening new site, and phishing things for example...No problem if i need to "root" the device, but for me its a must have
I'll bear that in mind should I find myself in Italy, then. By the way, don't get me wrong: I support what you're trying to do, even though I'm shocked that it's needed.
Unfortunately, I don't know if it's possible on WP8 right now, at least not on Lumias. I could look up the required APIs and write an app to call them, but
A) It probably wouldn't have enough permission (ID_CAP_NETWRKING probably won't cut it; that would be a *huge* security threat if it could).
B) There isn't any way to "root" or jailbreak a WP8 Lumia phone right now, so you can't use any higher privileges for third-party apps.
It is vaguely possible there might be a Nokia app that gives this ability somewhere, but I don't know of one. I have a Samsung phone, though, not a Lumia.
GoodDayToDie said:
I'll bear that in mind should I find myself in Italy, then. By the way, don't get me wrong: I support what you're trying to do, even though I'm shocked that it's needed.
Unfortunately, I don't know if it's possible on WP8 right now, at least not on Lumias. I could look up the required APIs and write an app to call them, but
A) It probably wouldn't have enough permission (ID_CAP_NETWRKING probably won't cut it; that would be a *huge* security threat if it could).
B) There isn't any way to "root" or jailbreak a WP8 Lumia phone right now, so you can't use any higher privileges for third-party apps.
It is vaguely possible there might be a Nokia app that gives this ability somewhere, but I don't know of one. I have a Samsung phone, though, not a Lumia.
Click to expand...
Click to collapse
Thanks for your interesting
Hope we can find a way
Assuming I was an expert user who knew every single Note 9 device option, samsung account setting, and google account setting.... If I were to configure EVERY single one of them to limit the data it collects, set every app permission to be in its most restricted state, disable every usage access setting, and configured my google and samsung accounts to be the most limited data collection accounts as possible, .... it is even possible to get to IOS level privacy on my Note 9? Is Android just sending everything it can back to google's servers as possible, such as when i turn the phone on, when i walk, move, open an app, browse the web, or whatever? I know some have already setup network analyzers to see the traffic going out, but I can never tell what configuration they do that with. I want to know if getting the privacy to IOS levels is impossible, or is it just a matter of very careful configuration....?
It's impossible. I'm not a fan of Apple devices, but I applaud them from a business perspective and that trickles down from the fundamental ideals of Steve Jobs.
Numerous studies show that Google sucks up information 10x as much as Apple which relies in differential data that doesn't exactly pinpoint the person, but more so the general interests of the person. Google identifies the person and their location. Unless you're walking around with your phone off or granting no permissions to every app, you can't match the security of an Apple device. The doesn't only include Google. Remember we have to deal with our specific manufacturers that are collecting data on us as well since Android is open source. So we just have to hope Googles intentions are good or move to an Apple device.
brainysmurf said:
Assuming I was an expert user who knew every single Note 9 device option, samsung account setting, and google account setting.... If I were to configure EVERY single one of them to limit the data it collects, set every app permission to be in its most restricted state, disable every usage access setting, and configured my google and samsung accounts to be the most limited data collection accounts as possible, .... it is even possible to get to IOS level privacy on my Note 9? Is Android just sending everything it can back to google's servers as possible, such as when i turn the phone on, when i walk, move, open an app, browse the web, or whatever? I know some have already setup network analyzers to see the traffic going out, but I can never tell what configuration they do that with. I want to know if getting the privacy to IOS levels is impossible, or is it just a matter of very careful configuration....?
Click to expand...
Click to collapse
No fanboi of any company/mfg/OS,but,they all do virtually the same thing with your personal information/usage habits.
The differences are mere semantics & they collect/sell user information.
The following is a 2yr old article,but,I'm guessing the points they make still hold true:
https://decentralize.today/apple-vs...company-handles-your-data-better-a7022bd452b1
Arguably,Android users can control their sharing of personal data usage,but,that has its caveats,such as limited functionality on some apps/etc...
Best advice I can give is the following:
1) Carefully comb through every setting on the phone,most are self-explanatory.
2) Go to every apps internal settings & the phone's setting under SETTINGS > APPLICATIONS & fine tune as best as possible.
Even after all of that,Google/Samsung (or most other mfgs) have settings that are inaccessible or cannot change (greyed-out),so,you're still not in the clear as far as total control/privacy.
This is one of the major attractions to rooting/ROMs for your Android device.
A rooted &/or ROM'd Samsung device is the ideal for gaining control of privacy/permission control,but,it breaks KNOX & Samsung Pay,no going back once rooted,even if restored to a stock state.
You gain more granular control of such permissions & if you want to go all-in on privacy, a ROM such as Lineage gives you the best you can hope for in personal security/privacy. A brief summary,but,that's the gist.
Outside of root/ROMs,If privacy/security is of utmost importance,I'd dare say a Blackberry would be a decent choice. I myself only briefly owned a Blackberry (Android device),so,I can't attest to how private/secure you personal usage/data is,but,I've rarely,if ever,heard of any major concerns in the matter w/Blackberry.
@brainysmurf
Another step you can take to regain some control of your Samsung device is using a package disabler app & the nice thing about these is no root access is required (AppFreeze/Package Disabler Pro/Adhell3).
https://play.google.com/store/apps/details?id=com.wakasoftware.appfreezer&hl=en_US
https://play.google.com/store/apps/details?id=com.powermanager.batteryaddon&hl=en
https://amp.reddit.com/r/GalaxyS8/comments/8nmrfq/how_to_install_adhell_3_a_video_guide/
Use the XDA site search feature or Google for more info on the above mentioned disabler apps.
You can also use ADB Commands to disable apps as well,but,please read the following link carefully before proceeding:
https://www.xda-developers.com/uninstall-carrier-oem-bloatware-without-root-access/
I have never had an apple device, But I would like to say that android as a system is opensource and the google apps that are put on top are non opensource and are probably where you lose your privacy but as a system it is transparent which attracts devs and rooting (i.e. getting access to the system partitions) is what makes android so customizable. Versus apple which you have to blind trust ios and trust that these options are 100% do what they say..
Yes it is more secure because it is closed source but at the same time For actual privacy you never know. Saying that how do you get your privacy with android needs some setup which koliosis did good explaining. But the difference between the two OSs I believe is because of (opensource)ness of android the amout of customizablity with android is really deep. To which I believe if you invest good time researching, you can get a way better state than iOS. Again not an expert but putting my opinion
For the rest
Koliosis said it all.
that_same_guy said:
Yes it is more secure because it is closed source.
Click to expand...
Click to collapse
Have to correct that one. That is a myth spread by some big companies in order try to gain some customers over from the cheaper/free competition. In reality, open vs. closed source has no other effect on how secure the result is than with open source there can be more eyes looking at the code (for both good and bad intentions). As an example, simply compare a decent linux distro (from which only similar applications are installed that would come with corresponding Windows installation) to M$ Windows. Open source (and free at that) wins many times over in overall security (while neither is free from issues).
The biggest effect on the code quality (thus often also how secure it is) is on how many (real) experts work on it, and this in turn depends on popularity (open source) and/or money (company's/organization's income and policies/ideals). For the last part 'policies/ideals' just compare M$ and Apple, both have the money to throw at development if they choose to do so; former makes mostly insecure crap, latter makes half-decent stuff. (And note, I'm not a fanboy of either, or pretty much of any company, except one little local camera shop, so do read the previous with some weight on that "half-" before the "decent".)
As for small input on the privacy squeezing on Samsung devices:
I have so far managed to avoid to use a samsung-account, and that might help a tiny bit, although some features of the phone are then not working, but mostly useless features. Though there are some seemingly useful features that require Samsung-account for some weird reason, but I've manage to live without them. Like the "protected folder" (or whatever it is in English), why on earth would that need an account or anything external for that matter?!?
(Well, technically, I do have a Samsung-account, as that was required to get the phone cheaper, but after that order, I've not used that account anywhere.)
ErebusRaze said:
It's impossible. I'm not a fan of Apple devices, but I applaud them from a business perspective and that trickles down from the fundamental ideals of Steve Jobs.
Numerous studies show that Google sucks up information 10x as much as Apple which relies in differential data that doesn't exactly pinpoint the person, but more so the general interests of the person. Google identifies the person and their location. Unless you're walking around with your phone off or granting no permissions to every app, you can't match the security of an Apple device. The doesn't only include Google. Remember we have to deal with our specific manufacturers that are collecting data on us as well since Android is open source. So we just have to hope Googles intentions are good or move to an Apple device.
Click to expand...
Click to collapse
This actually goes to my point... If indeed I did remove all permissions from all apps, does this mean Android tracking would be completely disabled? Or if I removed google play services, or disabled it, or removed all permissions from it? Technically, would that give it an IOS level of privacy? I'm just wondering if the OS itself is prone to just phoning home and letting it know everything I'm doing, or if it's possible at all to tame it....
Thanks for your repsonse.
ErebusRaze said:
It's impossible. I'm not a fan of Apple devices, but I applaud them from a business perspective and that trickles down from the fundamental ideals of Steve Jobs.
Numerous studies show that Google sucks up information 10x as much as Apple which relies in differential data that doesn't exactly pinpoint the person, but more so the general interests of the person. Google identifies the person and their location. Unless you're walking around with your phone off or granting no permissions to every app, you can't match the security of an Apple device. The doesn't only include Google. Remember we have to deal with our specific manufacturers that are collecting data on us as well since Android is open source. So we just have to hope Googles intentions are good or move to an Apple device.
Click to expand...
Click to collapse
Yeah I saw those same studies. And they never seem to provide specific configuration data. For instance, the study showing that android gathers as much as 10x more data specifically mentioned that Chrome was constantly phoning home sending data. However, what if the user didn't log into their chrome account? I think it's much more limited in that case... Or what if the user disabled chrome, and perhaps all google apps? Is it android doing the privacy damage, or google apps/play services? If I disabled those, or removed all permissions from those, would it be equivalent to IOS? I'm an engineer in the business working at a major silicon valley company, and even with high expertise in the design of these things I'm finding it impossible to get basic understanding of what it actually going on. It is either trying to read through legalize of privacy agreements, or reading blogs and studies with claims such as 10x more data, while not providing specifics...
Are you someone who uses a free or modded/hacked VPN service & do you feel safe doing so?
I subscribe to tor***** VPN & proxy services & pay quarterly for a great rate. Tor***** is a paid service but offers things that I don't see mentioned in the free VPN provider apps. Tor***** is a zero log service that doesn't record what you do nor do they care, this is why I trust & pay them. Their speeds aren't capped either. This is not a promo, just a true to life description of who I use & why, you can research your own to use, I'm not pointing or guiding or suggesting anyone go to a particular provider. With mine You can use any ip address they provide whick is like ten in every country in the world (bit of exaduration) but they have 3000+ IPs in 50+ countries.
They even have stealth vpn mode which will allow you to connect, share, play, whatever you want even from oppressed countries like North Korea. Your connection can be seen but is encrypted and sent in a way that looks like normal legit everyday internet packages being sent/received as someone just casually browsing. You can even subscribe to a dedicated ip address in say the US so you can watch Hulu here in CAN. these ips aren't blacklisted I guarantee.
My question is do you think free VPN apps/services are free because the company wants to be kind? I have a sneaky suspicion that they are making money off of your info. I can't tell you for sure what they see or what the collect or track but I believe they track your sights visited, the content you prefer, your connection location, your ISP, & it could go as deep as banking info, screenshots, key logging, anything because all your data runs through them. They are a middle man. just because their a VPN company does not give them credit & honesty. They have to make money somehow & as the "free" VPN provider/middleman they can track, see, record, and sell your private info to anyone or any country or law enforcement and I believe this is how they fund their business, the selling of your info.
My point is Do you trust these so called free VPN apps because I'm seeing more & more popping up than ever and if they are free where are they making the money to stay up & running free. If you use free VPN providers what do you use them for? I figured vpn's were for privacy, security, & anonymity and I can't think of a valid argument for using a free VPN if it's for one of those things I mentioned.
Just trying to spark some Q&A on this topic because it is important to me and many others. I think free providers are keeping a lot in the dark & we as citizens with the right to privacy & freedom of speech need to know the truth about our online activity & the monitoring of it, especially if we are doing nothing wrong, just trying to protect our information that is sensitive to our lives, & the way we live. We have the right to privacy & I feel the free VPN providers are lying by omition, not all but a good many.
Any input or info or questions on this topic would be great. Let's see how many feel safe with free VPN providers & who did their research before picking one and what they found out. Also why they went with the provider they did.
Stay safe, Look for (VPN, ENCRYPTION, PROXY, ZERO LOGGING & READ USER AGREEMENTS FIRST) Please do your research I can't stress this enough.
Much love, Peace freedom & privacy!
nothing is ever free, it's just a fact of life for these companies to make money they have to do something or the cost of running all the servers would bankrupt them.
in general terms if you pay for a VPN with cash that is how they generate their money, obviously it's worth reading what the VPN claims to do and offer, some paid ones still track individual users and keep logs, but the vast majority don't. the same is true of speed, it's a balancing act between software and servers, if a VPN is running servers slower than your connection you are going to end up with a slower speed, the same is true of VPN's with few servers as the more load on the server the slower everyone will go, so it's all just about research.
as for region lock removal that is getting harder and harder it's why most paid VPN's can do it but don't advertise it, because places like netflix now have really good algorithms that can detect if too many people are connecting from a single server and will generally block the IP's so most VPN's using somewhat dynamic IP's can keep the regional locks off it is getting more and more expensive for services to keep so a lot are dropping advertising for it.
as for free VPN's, they have less security, they are public servers, the IP's are generally associated with toxic behaviour so often can be heavily blocked. also most lack true encryption and DNS masking so your ISP can still see exactly what you are doing, not to mention these free sites source their revenue through adverts, redirection and selling your info, including browsing history, they all generally keep logs and the first sign of trouble they will hand them over to whoever asks for them.
basically using a free VPN is like using free public wifi, yes it's there and does a job but ultimately you are going to want protection to stop other people connecting to the network getting your info or sending dodgy stuff.
Belimawr said:
nothing is ever free, it's just a fact of life for these companies to make money they have to do something or the cost of running all the servers would bankrupt them.
in general terms if you pay for a VPN with cash that is how they generate their money, obviously it's worth reading what the VPN claims to do and offer, some paid ones still track individual users and keep logs, but the vast majority don't. the same is true of speed, it's a balancing act between software and servers, if a VPN is running servers slower than your connection you are going to end up with a slower speed, the same is true of VPN's with few servers as the more load on the server the slower everyone will go, so it's all just about research.
as for region lock removal that is getting harder and harder it's why most paid VPN's can do it but don't advertise it, because places like netflix now have really good algorithms that can detect if too many people are connecting from a single server and will generally block the IP's so most VPN's using somewhat dynamic IP's can keep the regional locks off it is getting more and more expensive for services to keep so a lot are dropping advertising for it.
as for free VPN's, they have less security, they are public servers, the IP's are generally associated with toxic behaviour so often can be heavily blocked. also most lack true encryption and DNS masking so your ISP can still see exactly what you are doing, not to mention these free sites source their revenue through adverts, redirection and selling your info, including browsing history, they all generally keep logs and the first sign of trouble they will hand them over to whoever asks for them.
basically using a free VPN is like using free public wifi, yes it's there and does a job but ultimately you are going to want protection to stop other people connecting to the network getting your info or sending dodgy stuff.
Click to expand...
Click to collapse
Just a comment on your comment, you stated that...
the same is true of speed, it's a balancing act between software and servers, if a VPN is running servers slower than your connection you are going to end up with a slower speed, the same is true of VPN's with few servers as the more load on the server the slower everyone will go, so it's all just about research.
My response...
My provider does not cap speeds, that one big reason the free ones are garbage amongst other things. With The company that I use, I can run 150mbps easy & no issues. They have over 3000+ servers and for a cheap fee you can be guaranteed top speeds up & down where grabbing say a DVD or a 30min 4k video clip on a free VPN is damn near impossible.
Also you stated this....
places like netflix now have really good algorithms that can detect if too many people are connecting from a single server and will generally block the IP's
My Response...
That is true & also another reason to go paid is because, at least with my provider, the have many many dedicated IP addresses, so your guaranteed to be on zero ban/blacklists. After they banned they recycle them into the standard vpn's provided with the VPN packs, the dedicated streaming IPs before banned are bit extra coin/addon. I've yet to use one and be turned away from a streaming service where if your using a free VPN, good luck connecting to a region restricted service or even getting enough speed to stream in 1080p.
Random opinion....
Im just sick of seeing more & more free VPN services popping up, treating our privacy like its a joke, shoving ads down our throats & and offering very sub standard services. I've tested my provider well. Everything the promise is true & they are probably tops in true encryption methods & up to date security.
I'll post a few pics of what they offer (logos & details erased so I don't get called out as if I'm spamming or trolling for this, provider).... My regards, I enjoyed what you had to say, you had many valid points. Mine is free vpns have their purposes but their not security, privacy, speed, reliability, and so on. Basically they are just a way to change your ip address. A kids toy in my opinion.
My paid service Includes:
- Unlimited Speeds + Bandwidth
- 3000+ Servers in 55+ Countries
- 5 Simultaneous Connections
- Multiple Ciphers AES128/AES256
- OpenVPN/PPTP/L2TP/iKEv2/SSTP
- Supports All OS and Devices
- Stealth Proxy (ShadowProxy) allows you safe encrypted access through firewalled & deeply restricted country's with strong firewalls & network monitoring, like if you had family in North korea say.
- Advertisement and Malware Blocking
- Blocks WebRTC/DNS
- Guaranteed Dedicated Streaming IP Addresses
- No Logs Kept, 100% Private
- SOCKS5/SSH/HTTP/SSL
- Surf securely & Evade hackers
- Secure browser extensions
- Prevents IPv6 leaks
- FREE 24/7/365 support & online live support
CYPHERS:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
ENCRYPTION:
Can anyone explain to me what the basic differences are between VPN (encrypted) and proxy5 (which I think is encrypted but not sure). They both allow you to hide behind an ip other than yours probably hiding & protecting your ip from danger/hacking/trackers and such, but why chose one over the other? A proxy is probably a public used address and VPN also, unless paying for a dedicated IP address. Which one is better and for what situations? ?
I would never use a free VPN Service, cause you never know for (100%) Sure, where your data is exactly. I use PerfectPtivacy, one of the best but expensive VPN out there. There feauture List is long if you are interested..here it is.
Multi-Hop VPN
Use Multi-Hop VPN to protect yourself from tracking and monitoring. In VPN Manager, you can create a cascade over four hops with the push of a button and thus connect up to four VPN tunnels in a cascade. Your data is end-to-end encrypted four times.
NeuroRouting™
NeuroRouting ensures that your data remains within the strongly encrypted VPN network of Perfect Privacy for as long as possible. A neural network and our algorithms constantly calculate the best routes for your destinations on the Internet. This happens dynamically - depending on the websites you visit.
TrackStop™
TrackStop is a filter that blocks content from untrusted or unwanted sources. Stop annoying advertisements. Defend yourself against social media tracking. Block harmful phishing and malware websites. Protect your children from inappropriate content. Individually adjust the filter settings according to your needs.
Stealth VPN
Stealth VPN is a method to counter against Deep Packet Inspection (DPI). In some restrictive networks and countries, it is used to detect and block VPN traffic. Stealth VPN masks the VPN packets and makes them look like regular HTTPS packets. Since this protocol is also used for secure data transmissions, most firewalls do not block it, and VPN can be used in restricted networks
Kill Switch
The kill switch functionality ensures that you are protected against IP leaks even if the VPN connection is interrupted. The Kill Switch prevents the connection to the Internet until the VPN connection has been reestablished. The automatic emergency disconnection is available in 3 different security levels and can be set conveniently in the VPN Manager according to your needs.
IPv6 Support
Benefit from full IPv6 support. There are more and more services on the Internet that offer their services over IPv6. But not every Internet provider offers IPv6 connectivity. With Perfect Privacy, you are automatically assigned an IPv6 address and can, therefore, use IPv6 at any time and anywhere in the world. Of course, the VPN Manager has protection that also prevents leaks over IPv6.
No Logs
We do not store any of your data. We have created our server infrastructure so that it is not possible to record data at all. The data, therefore, runs on ram disks to ensure that there is nothing left when a server is disconnected from power. If you are worried that a security agency could intercept a server while it is running, use a cascaded connection as mentioned above.
VPN Protocols
Perfect Privacy offers you a wide range of different protocols and services for your desired purposes. OpenVPN and IPsec for extra strong encryption, SSH2 tunnel for individual encryption, HTTP proxies and SOCKS5 proxies if you need extra high speeds, or forwarding a tunnel.
*Edit* Using this VPN Service on my Exynos Note 9, my Windows Pc & FireTv with no problems
Treasarion said:
I would never use a free VPN Service, cause you never know for (100%) Sure, where your data is exactly. I use PerfectPtivacy, one of the best but expensive VPN out there. There feauture List is long if you are interested..here it is.
Multi-Hop VPN
Use Multi-Hop VPN to protect yourself from tracking and monitoring. In VPN Manager, you can create a cascade over four hops with the push of a button and thus connect up to four VPN tunnels in a cascade. Your data is end-to-end encrypted four times.
NeuroRouting™
NeuroRouting ensures that your data remains within the strongly encrypted VPN network of Perfect Privacy for as long as possible. A neural network and our algorithms constantly calculate the best routes for your destinations on the Internet. This happens dynamically - depending on the websites you visit.
TrackStop™
TrackStop is a filter that blocks content from untrusted or unwanted sources. Stop annoying advertisements. Defend yourself against social media tracking. Block harmful phishing and malware websites. Protect your children from inappropriate content. Individually adjust the filter settings according to your needs.
Stealth VPN
Stealth VPN is a method to counter against Deep Packet Inspection (DPI). In some restrictive networks and countries, it is used to detect and block VPN traffic. Stealth VPN masks the VPN packets and makes them look like regular HTTPS packets. Since this protocol is also used for secure data transmissions, most firewalls do not block it, and VPN can be used in restricted networks
Kill Switch
The kill switch functionality ensures that you are protected against IP leaks even if the VPN connection is interrupted. The Kill Switch prevents the connection to the Internet until the VPN connection has been reestablished. The automatic emergency disconnection is available in 3 different security levels and can be set conveniently in the VPN Manager according to your needs.
IPv6 Support
Benefit from full IPv6 support. There are more and more services on the Internet that offer their services over IPv6. But not every Internet provider offers IPv6 connectivity. With Perfect Privacy, you are automatically assigned an IPv6 address and can, therefore, use IPv6 at any time and anywhere in the world. Of course, the VPN Manager has protection that also prevents leaks over IPv6.
No Logs
We do not store any of your data. We have created our server infrastructure so that it is not possible to record data at all. The data, therefore, runs on ram disks to ensure that there is nothing left when a server is disconnected from power. If you are worried that a security agency could intercept a server while it is running, use a cascaded connection as mentioned above.
VPN Protocols
Perfect Privacy offers you a wide range of different protocols and services for your desired purposes. OpenVPN and IPsec for extra strong encryption, SSH2 tunnel for individual encryption, HTTP proxies and SOCKS5 proxies if you need extra high speeds, or forwarding a tunnel.
*Edit* Using this VPN Service on my Exynos Note 9, my Windows Pc & FireTv with no problems
Click to expand...
Click to collapse
Sounds like a similar service in terms of what they offer, but I must say it sounds as if they offer a bit more if this is just a VPN package.
I usually purchase a VPN+SOCKS5 package. I use the socks5 on my android/Kodi tv boxes & VPN is set up through my router so all of our computers are encrypted. I must admit that I'm not up to date on encryption and I use blowfish as I've hear & read its almost as safe as they come. At my folks place I can bury my speed, cable net but at me & the wife's we are out in the country with 1 option. DSL at 7mb down & 1mb up so I think any company can handle that nitro speed haha.
If you don't mind me asking what do you pay for 1month service and what does it offer, strictly VPN? The service I get does VPN, SOCKS5/HTTPS Proxy, and Anon offshore email accounts. I'm not in need of any encryption on emails but VPN & PROXY are useful. How long have you been using your provider & have they ever gone above and beyond at any time of day/night for you?
Noob question here but is it possible to use VPN & PROXY at the same time? Just curious because some apps like OpenVPN let you add both but I've yet to see proof their bot functioning at same time.
Hope to hear back, I don't care if you mention your provider seeing as I'm basically spoon feeding my providers name. PM me if you want to know more but it sounds like your well looked after.
It's possible that a free VPN service is genuinely private. Companies may offer free limited services in an effort to recruit paying customers for advanced services. But it's hard to know.
If you don't need to conceal your home IP address from the sites you contact, then I suggest running your own VPN server at home (for example, using PiVPN on a Raspberry Pi). That's good for keeping your data and metadata private from public WiFi and from your phone carrier, and for keeping your phone location private from sites you contact.
TWiiTCH said:
Sounds like a similar service in terms of what they offer, but I must say it sounds as if they offer a bit more if this is just a VPN package.
I usually purchase a VPN+SOCKS5 package. I use the socks5 on my android/Kodi tv boxes & VPN is set up through my router so all of our computers are encrypted. I must admit that I'm not up to date on encryption and I use blowfish as I've hear & read its almost as safe as they come. At my folks place I can bury my speed, cable net but at me & the wife's we are out in the country with 1 option. DSL at 7mb down & 1mb up so I think any company can handle that nitro speed haha.
If you don't mind me asking what do you pay for 1month service and what does it offer, strictly VPN? The service I get does VPN, SOCKS5/HTTPS Proxy, and Anon offshore email accounts. I'm not in need of any encryption on emails but VPN & PROXY are useful. How long have you been using your provider & have they ever gone above and beyond at any time of day/night for you?
Noob question here but is it possible to use VPN & PROXY at the same time? Just curious because some apps like OpenVPN let you add both but I've yet to see proof their bot functioning at same time.
Hope to hear back, I don't care if you mention your provider seeing as I'm basically spoon feeding my providers name. PM me if you want to know more but it sounds like your well looked after.
Click to expand...
Click to collapse
Yep you are right. They offer in the overall package a bit more. One Big Point is, that you can log in in endless device with one Account. Means you have for example lets say 6 devices. So you can use this Service on all Devices with no restrictions or else. This was the Point for me to test it back few years ago and stay till this day there.
What i pay for 1 Month ? 12,99 Euro for Germany and it offers in my opinion one of the best Privacy tool out there with all feautures in it from my First Posting. And the Option to use cascading over 4 Countrys is simple amazing. With 256Bit aesc encryption you go Safe in internet. But Overall you get the same package as u from your vpn Provider. Just with a few extra things. But if you hardley need them is your opinion.
You mean with my Provider my Internetprovider ? Thats Unitymedia fornaly known as KabelBW with 400 Mbit Down & 10 Mbit Uploadspeed. Nothing special but useful for large Filesharing etc. I also have full speed day and night, with and without vpn. It slows nothing Down cause most of their vpn Servers like Amsterdam has 5000MBit..so you can surf and load in internet like without vpn. This is the second Big point for me, cause most vpn Provider are slow in speed in my opinion.
Yes you can use VPN & Proxy in combination but would recommend to use vpn only. Another time..its in your usagecase if a Proxy gives you more security or not. Not in Every case a Proxy is good to go..
I hope i answer your questions right cause my english is not the best overall. If something is unclear or you want fourther Information pm me or Post in here. I would say you a few tips about encryption & stuff but im not Sure if you already know the things around encryption.
My personal opinion is don't use a free VPN service. I personally use Express VPN for the last 3 years or so and love it. Use it on my laptop, home computer, and phone.
Sent from my SM-N960U1 using Tapatalk
TWiiTCH said:
Are you someone who uses a free or modded/hacked VPN service & do you feel safe doing so?
I subscribe to tor***** VPN & proxy services & pay quarterly for a great rate. Tor***** is a paid service but offers things that I don't see mentioned in the free VPN provider apps. Tor***** is a zero log service that doesn't record what you do nor do they care, this is why I trust & pay them. Their speeds aren't capped either. This is not a promo, just a true to life description of who I use & why, you can research your own to use, I'm not pointing or guiding or suggesting anyone go to a particular provider. With mine You can use any ip address they provide whick is like ten in every country in the world (bit of exaduration) but they have 3000+ IPs in 50+ countries.
They even have stealth vpn mode which will allow you to connect, share, play, whatever you want even from oppressed countries like North Korea. Your connection can be seen but is encrypted and sent in a way that looks like normal legit everyday internet packages being sent/received as someone just casually browsing. You can even subscribe to a dedicated ip address in say the US so you can watch Hulu here in CAN. these ips aren't blacklisted I guarantee.
My question is do you think free VPN apps/services are free because the company wants to be kind? I have a sneaky suspicion that they are making money off of your info. I can't tell you for sure what they see or what the collect or track but I believe they track your sights visited, the content you prefer, your connection location, your ISP, & it could go as deep as banking info, screenshots, key logging, anything because all your data runs through them. They are a middle man. just because their a VPN company does not give them credit & honesty. They have to make money somehow & as the "free" VPN provider/middleman they can track, see, record, and sell your private info to anyone or any country or law enforcement and I believe this is how they fund their business, the selling of your info.
My point is Do you trust these so called free VPN apps because I'm seeing more & more popping up than ever and if they are free where are they making the money to stay up & running free. If you use free VPN providers what do you use them for? I figured vpn's were for privacy, security, & anonymity and I can't think of a valid argument for using a free VPN if it's for one of those things I mentioned.
Just trying to spark some Q&A on this topic because it is important to me and many others. I think free providers are keeping a lot in the dark & we as citizens with the right to privacy & freedom of speech need to know the truth about our online activity & the monitoring of it, especially if we are doing nothing wrong, just trying to protect our information that is sensitive to our lives, & the way we live. We have the right to privacy & I feel the free VPN providers are lying by omition, not all but a good many.
Any input or info or questions on this topic would be great. Let's see how many feel safe with free VPN providers & who did their research before picking one and what they found out. Also why they went with the provider they did.
Stay safe, Look for (VPN, ENCRYPTION, PROXY, ZERO LOGGING & READ USER AGREEMENTS FIRST) Please do your research I can't stress this enough.
Much love, Peace freedom & privacy!
Click to expand...
Click to collapse
Free VPNs will only get you doomed. If free VPNs were to rely on nobody would have been paying for paying subscriptions. The free ones are by no means to be relied upon when it comes to security and anonymity. Also, you would never find anything about their log policy. These providers can be the ones assisting law enforcement agenices to you. I know people who received DMCA notices for downloading copyright content using free vpns. So please restrain from using free vpns and educate others too. No money is too big when it comes to your privacy and security.