About installing and using LineageOS 16, F-Droid
I bring to your attention instructions on how to optimally (in my opinion) switch to free software when using a smartphone using the example of the LineageOS operating system (hereinafter abbreviated LOS) and applications from F-Droid.
I think this article will be of interest to you even if you can’t install LOS for yourself, since this article also discusses the standard Android settings, settings and methods for using useful applications, the F-Droid app store, Android permissions that cannot be limited and other nuances that may be useful to you.
Table of contents:
general information
Reasons to upgrade to free firmware
Device selection
- The main factors to consider when choosing a device
- Device selection
Install LOS firmware
- Firmware update
- Unlock bootloader (unlock bootloader)
- LOS installation example
- What could go wrong
- Pre-launch preparation
- About device encryption
LineageOS
- Standard LOS settings
- Root / root / superuser rights / superuser
- Bootloader (bootloader)
F-droid
VPN slot
AFWall + (Android Firewall +) and built-in Firewall
- Built - in Firewall
- AFWall +
Adway
Orbot, Tor Browser and proc / net problem
- Orbot
- proc / net problem
- tor browser
Fennec and bromite
- fennec
- bromite
Google Apps (Google Apps / Gapps)
Yalp store / Aurora Store
Trackers in applications
Permission Control, PrivacyGuard, AppOpsX
- Types of permissions
- Tools to restrict permissions
—— Android standard permission mechanism
—— Privacy Guard
—— AppOpsX (com.zzzmode.appopsx)
- List of permissions
- What can not be limited
- Level API / sdk
- Regarding the need to track permissions
SD-card / usb-storage
Work profile and Shelter (net.typeblog.shelter)
XprivacyLua
ADB (Android Debug Bridge)
Complete abandonment of Google in LOS
- DNS
- Captive Portal
- A-GPS
- AOSP Webview
- Project Fi
Backup (backup) or backup
Separate encryption of personal files
Radio module firmware and low-level bookmarks
Other firmware
- replicant
- GrapheneOS
- Not Android devices and firmware
- What about the iPhone?
Prospects
General recommendations
Why is it better to use the latest version of LOS and current devices
My experience
Potential question is my answer
Transition techniques and partial (temporary) solutions
Questions for IT people
List of links
I advise you to pre-read these articles here (or after reading my article):
→ About LineageOS, MicroG
→ List of interesting programs in F-Droid (and not only in F-Droid)
→ About Android architecture in a less clear language, I advise you to read all 4 parts from the cycle. Everything is described there a bit in technical terms, but still I advise you to delve into it if you want to roughly understand the device and architecture of Android.
I will try to supplement these articles with such things as device selection, firmware, security and privacy settings, some software settings, and I will also provide methods for risk identification, which arise even in free firmware without proprietary components.
In the instructions, I will refer to the English and Russian names of the settings items for the operating system and programs, since at the moment the most complete help on issues can be obtained in English-speaking forums, and it will be more familiar to look for a solution to your questions.
The version of LineageOS 16 will be considered (in part, some points from version 15.1 will also be considered) and based on Android 9 Pie, respectively. Some of the described methods (more precisely, almost everything except Privacy Guard) are applicable not only to LineageOS, but also to other firmware on Android 9 Pie.
I tried to write the article “linearly” so that I could perceive the information without having to “jump” from point to point. But since many things are interconnected, the sendings were completely avoided. If at some point you find something incomprehensible, try reading the article to the end. If there is any obvious gap even after reading the entire article, please indicate where I did not look.
LineageOS [ 1 ], [ 3 ] - firmware based on AOSP (Android Open Source Project), which is done by enthusiasts. LineageOS is a continuation of the CyanogenMod project. This firmware is not for all devices, since the creation of such firmware for each device is the work of enthusiasts.
I offer you a methodology for selecting a new device for installing LineageOS based on my experience. These tips are purely advisory in nature and I do not pretend to be absolutely objective.
Next, I offer you one of the possible methods of selecting a smartphone for the purchase and installation of LineageOS. Suppose you need a smartphone in the middle price category up to 15,000 rubles without any frills.
As a result, if I chose devices up to 15,000 rubles, I would choose something between Xiaomi Redmi 4 (X), Xiaomi Redmi Note 4 and Xiaomi Mi A1.
ATTENTION: this is only one of the possible methods for selecting the device, I am not responsible for the fact that at some point the LOS team will stop releasing updates on your phone or that you cannot unlock the bootloader. Read everything carefully and make an informed decision.
I advise you to first read all the installation instructions for a specific LOS device on the LOS website, additionally read the topics on w3bsit3-dns.com, xda-developers, reddit.com/r/LineageOS and from this article (some warnings).
After purchasing the device, you need to update the stock (original) firmware of the smartphone to the latest version. The fact is that Google is gradually dividing Android into different layers so that the top layer can be updated separately, which will increase the ease of developing new firmware for older devices (for any version of Android). The LOS team also took advantage of this opportunity, updating only the top layer. But for correct operation, it is better to install updates of the original firmware in order to update not only the upper layer, but also the lower layers (firmware). To do this, you will have to connect to Wi-Fi and find the “firmware update” item in the settings. You may have to do this several times in a row.
Manufacturers often hide the menu item “firmware upgrade” if you unlocked the bootloader. Therefore, it is recommended that you update the original firmware before unlocking the bootloader.
Attention: Huawei (including the Honor brand), at the moment, have closed the ability to unlock the bootloader. But for different devices of this company, there are different workarounds for unlocking the bootloader, which only work on older firmware. If you still decided to purchase a device from Huawei for firmware with alternative firmware (for example, LOS), then read the w3bsit3-dns.com, xda-developer and others forums on a specific device in advance on unlocking the bootloader. For these devices, it may be better to first unlock the bootloader, and then update the firmware.
For some devices, you need to unlock the bootloader through a special program.
On the example of Xiaomi devices (example instruction [ 23 ]):
There are a lot of such instructions on the Internet. I brought this procedure in order to warn about some of the nuances.
Attention: when unlocking the bootloader, all data on the device will be deleted, so if you used the device and you have some data left, then you need to worry about saving it separately (we make a backup).
Next, we are looking for installation instructions for a specific device.
For example, Xiaomi Redmi 4 (X) [ 25 ]. Or, if you have a device with an unofficial version of LOS, then on xda-developer and w3bsit3-dns.com. In any case, even if you have the official version of LOS, it is better to check for nuances in all forums. Separately, I want to note that if some other alternative firmware is already installed, then you may have to perform other actions, especially if you want to save some settings and application data. The same applies to major (major) updates from LOS (for example, from version 15.1 to version 16).
TIP: if you can’t find information on your device in forums (especially foreign ones), try searching by device code. For example, for Galaxy A7 (2017), the code name is a7y17lte. Often the information you are interested in is on the forums, but you need to look better.
Let's go through paragraphs [ 25 ] with some comments from me.
BASIC REQUIREMENTS
UNLOADING THE LOADER
This item I have already described above, I will not repeat it.
INSTALLING A MODIFIED RECOVERY
1. Download TWRP for a specific device. Sometimes the manufacturer produces devices with slightly different versions of the parts of the device, whether it be a touch screen or something else, and then TWRP from the official website may not work (or work crookedly). This is solved by searching for an alternative (or newer) TWRP for this device on w3bsit3-dns.com or xda-developer forums.
2. Connect the device to your computer via USB.
3.1. In the computer at the command line, or in the terminal in Linux / macOS, type:
A window should pop up on the smartphone screen asking you to connect a specific computer to the smartphone for debugging. If an error occurs on the command line (or Linux terminal), then on Windows, try to run the command line as administrator, or sudo adb devices in the Linux / macOS terminal.
Next, make sure that 1 device is shown.
3.2. We type:
The smartphone should restart to fastboot mode. Also restart in fastboot mode by simultaneously holding down the power button + volume down button.
A splash screen should appear on the smartphone screen.
4. We collect:
Get the list of devices. Make sure 1 device is shown.
5. Flash the recovery (previously downloaded TWRP) to the device. Better yet, temporarily download (described below what is the difference).
Where "twrp-xxx-x-santoni.img" is the TWRP file that you downloaded.
Note: for convenience, you can specify the full path to a file of the type "C: \ Users \ Vasya Pupkin \ Desktop \ twrp-xxx-x-santoni.img" with quotes in the file path.
Sometimes TWRP is not installed on some devices (especially for devices with A / B function) and some tricks need to be done. In any case, I do not advise you to flash TWRP into the device, since installing TWRP still installs the application on a smartphone with trackers trackers. There is a way out - you can simply run TWRP once through a command like:
6. If you requested TWRP, but did not start it one-time, then you will have to re-enter recovery by simultaneously holding down the power button + volume down button.
INSTALLING LOS THROUGH THE RECOVER
1. Download the LOS firmware from the official page or build from the source yourself. Optional: download Google Apps (for arm64 architecture). [ 33 ]
This is a Google app installation. I don’t see much point in this action, since one of the goals of installing LOS is to get rid of Google's endless surveillance. Previously, LOS, when it was also called CyanogenMod, was popular because this firmware made it possible to support old devices and introduced some functions. Now according to official polls [ 35 - item Features] The majority of users who choose LOS have done so for the Privacy Guard function. And the number of users who do not install Google Apps (Gapps) at all is slowly but surely growing.
The MicroG project [ 37 ] and its implementation for LOS [ 39 ] stand apart . This is a rather successful attempt to rewrite Google applications, leaving the main functionality, but at the same time limit the transfer of data to Google servers as much as possible. I will not stop much even on this project, because I decided for myself to 100% refuse the services of Google (and not only Google). I will write about the pros (and cons) of such a decision separately in one of the points.
2.If you are not in recovery mode, reboot into recovery by simultaneously holding down the power button + volume down button. If you did not install TWRP, then you will need to temporarily restart TWRP again through:
3. In the main menu, select Wipe
4. Select Format Data, enter “yes”. This will remove the encryption and all your personal data on the device.
5. In the same Wipe menu, go to Advanced Wipe.
6. Check the box ONLY opposite Cache and System, and by dragging the slider to end this action.
7. Next, you need to load the LOS firmware into the device through the ADB Sideload mechanism. To do this, select “Advanced” in the smartphone, then “ADB Sideload”. After that, run on the computer:
where “C: \ Users \ Vasya Pupkin \ Desktop \ filename.zip” is the path to the LOS firmware in the “zip” format. The firmware
log will be displayed on the smartphone screen. On some devices, in some versions of the firmware, something like “firmware not installed” is displayed in the log at the end. Often this is a false inscription and the firmware will still be installed. But just in case, check on the forums (w3bsit3-dns.com, reddit, xda-developer) if others have the same problems with your device.
8. Optional. ATTENTION: If you still want to install Google Apps, then this must be done immediately without restarting the smartphone! It will be necessary to go back to the menu, then again select “Advanced” on the smartphone, then “ADB Sideload” and launch it on the computer
where "C: \ Users \ Vasya Pupkin \ Desktop \ gapp.zip" is the path to Google applications on your computer. If you accidentally restart the smartphone after LOS firmware, then you will have to do Factory reset, otherwise Google applications will practically not work.
9. Optional: root the device by installing a specially prepared LOS AddonSU (package for version arm64) [ 41 ] or another root addon that you like.
Note: getting root (root) to achieve the goal of real device control is simply necessary. Without root, unfortunately, it is impossible to install the main programs firewalls and powerful restrictions on accessing data and sensors on the device to other programs (permission manager). Therefore, I highly recommend rooting your device. The standard add-on is the aforementioned LOS AddonSU, but many users use an add-on like Magisk. I personally use the standard LOS AddonSU. The reasons, cons and pros I will describe in a separate paragraph.
Congratulations, at this point you installed the LOS firmware on your device.
But that's not all. Not including a smartphone:
On the computer from the official F-Droid website [ 43 ], download the F-droid application itself. This is an app store. The store is called, but there all applications are free and are in open-source status.
Download from the same site:
You can do all this in advance.
If you want to transfer SMS - install QKSMS [ 55 ] on your old phone and backup SMS.
If you want to transfer the call list - install Slight backup [ 57 ] on your old phone and backup the call list. Make better backup of only calls and contacts, otherwise then there may be problems with the transfer. Do not select items such as “Settings” or “Bookmarks”.
If the contacts cannot be transferred this way, you can usually transfer them simply via a vcf file, or transfer via bluetooth. Well, or if you set up Nextcloud storage for yourself, then everything will be simple and easy.
Next, turn on the smartphone and you will be prompted to configure it.
. Setting the password or pattern at first power-up does not automatically mean that the device will be encrypted. Especially on older versions of Android or on cheap devices. Also, the device may not be encrypted when you turn on the device for the first time, if you previously had some other non-native (non-stock) firmware. You can check for encryption in the settings (look for Encryption). Not the whole device is encrypted, but only applications, their data and your data. Android system data is not encrypted, since by default it should not be accessible (if the bootloader is blocked). In fact, this encryption is not very reliable in the sense that there are often flaws in such encryption and workarounds. But the newer the phone and the newer the Android version, the less likely it is to hack. More precisely,the harder it will be and more time will be required by highly qualified specialists to circumvent encryption. On modern phones (not the lowest price category) on the latest versions of Android, encryption will definitely protect you from the average cracker.
In order not to get into a situation that you will find out that there is no encryption after you have configured the device, it is better to immediately check the encryption for the first time you turn it on. Because in rare cases, to enable encryption, it will be necessary to do manipulations, in which you have to erase all the data (for example, install the stock / original firmware) and you will lose time on reconfiguring the device.
Regarding the encryption of the SD card in LOS - this is only possible if you make it in Adoptable Storage format. The first time you use an external SD card, you will be asked if you want to use its internal storage, or as portable. It will be necessary to choose the “internal”. In this case, the deterioration of the SD card will increase and it is undesirable to store important data there due to the increased risk of a card failure in operation.
I do not use SD cards, so I can not advise you how to verify that it is securely encrypted.
Encryption is imperative if you have ill-wishers specifically targeted at you. Having stolen your phone without encryption, they will be able to extract ALL data from your device - correspondence, passwords, photos, and so on.
But even if you do not have such ill-wishers, then you can simply lose your device, and those who find it will be able to do much harm to you. Or if the device breaks down (for example, the screen breaks), then in the repair shop the receiver can also easily pull out all your data. And these guys are not always clean at hand.
So again: ENCRYPTION MUST BE INCLUDED !!!
Let's go through the LOS settings, which concern mostly security and privacy. Many of them apply to the clean version of Google AOSP. I will consider the version of LOS 16.
In Settings, there is a search for the settings.
- Wi-Fi
- Wi-Fi preferences (
Turn Wi-Fi settings) - Turn on Wi-Fi automaticaly (Turn Wi-Fi on automatically) - no.
- - Open network notification - no.
Also in the Wi-Fi settings you can add a hidden network (I hope you have hidden your Wi-Fi network at home).
- Mobile network
- Wi-Fi calling - Disable.
- Carrier video calling - disable.
- Access Points Names (APN)
Here in the settings of the access point (in fact, the settings for the Internet via the cellular network) can be a proxy. If it is, then AdAway may not work when using mobile Internet. Check if you can disable this proxy at your OPSOS and whether your tariffing will change. If possible, disable this proxy.
- NFC - Disable NFC and try not to use it. I can’t say anything on this topic, since there is no NFC on my device, and also because there is little information on this topic regarding privacy and security.
- Use Bluetooth only when necessary, turning it off when not in use. Pair (first connect) devices only in a place where there are no strangers.
- Notifications
- On lock screen
I have Hide sensetive content. This setting allows you to remove the notification text on the locked screen, and leaves only the name of the application from which the notification arrived. No one accidentally sees the text of a message intended only for you.
- Default apps.
Carefully review what is installed on different types of applications. Select trusted applications.
Most importantly, in the “Browser app” section, select either “None” or “Tor browser”. This is necessary so that if you were sent some kind of link, then you would choose in which browser to open (in the case of “None”) or so that it opens in the “Tor browser”. I’ll explain why - you can click on the link in some messenger that will look adequate, such as “example.com”, but in fact there will be a link like “vk.com/away.php?to=example.com” and if you open this link in your standard browser, Vkontakte will be able to understand that someone on this IP opens a specific page. If you were logged in to VKontakte in this browser, then you will immediately immediately understand which sites you go to (not just the general name of the site, but a specific page). But even if the link doesn’t contain such “meannesses,” you may still not like it,so that your Internet provider knows what sites you open and if you accidentally open a link in a specific browser, this information will be sent immediately to the provider.
- Advanced (
App ) - App permissions. I will describe this item separately in conjunction with PrivacyGuard and AppOpsX.
- Special app access (
Battery access)
In Android, the control for automatically closing applications changes from version to version. All sorts of Doze features, machine learning, application usage statistics, and so on. The rules change, something is added, something is removed. I'm just tired of guessing Google’s next steps. At the moment I do not use these functions, more precisely: I do not rely heavily on them. In this paragraph, I just add mail services and other applications that need to work in the background.
- - Device admin apps This application
should not have any applications other than those in which you are 100% sure. This is a very dangerous permission. In fact, this permission makes it possible to change any setting in the device. For example, I have only Shelter allowed in this paragraph. Yes, in general, the request for this permission is already very suspicious, even if you did not issue this permission.
- - Display over other apps
I don’t have applications that would need this feature. This function is used in some cases by virus applications, for example, to intercept entered passwords.
- - Do Not Disturb access - DND (Do Not Disturb)
This is necessary for fine tuning the silence modes. I do not use this feature. But this function is sometimes needed by viruses to turn off alerts and sound from bank SMS when they steal money from the account.
- - Modify system settings.
This is the permission to change the screen brightness, volume. This feature is needed mainly by media players.
- - Notification access (Access to the notification)
Access is required only to the launcher. You can not give other applications to read notifications, which may contain texts of codes from SMS and so on.
- - Picture-in-picture (Picture in Picture)
Similar to Display over other apps. This function is only needed for video players, and browsers through which you also want to output video separately. Cool feature, by the way. Now not even all TVs support it.
- - Premium SMS access (access to paid SMS) - ANYONE
- Unrestricted data (Unlimited mobile Internet)
For each individual application, you can remove the ability to download / upload something to / from the network. (I will write about this separately) But when you turn on the settings for saving traffic ("Settings" - "Network and Internet" - "Data Transfer" - "Saving traffic") all applications in the background (except for some system ones) cannot "knock" on the Internet . This setting acts as an exception specifically for the mode of saving traffic.
- Install unknown apps (
Ability to certain programs to offer the installation of other programs. Previously, this setting was only for all third-party applications at once, but now in the latest versions of Android there is a separation of access to each individual application. In any case, no application (except Google Play, which I do not recommend installing) can install applications in the background. A window with a request for installation will certainly pop up. At this point, I have the opportunity only for Shelter and for F-Droid. (more will be below). To send a request for installation, the system file manager is by default.
- - Usage access
Access to general device usage history data. Do not give to anyone. Well, or special programs that make up an analysis of the use of the device for you. Carefully give access to this feature.
- - VR helper service (VR helper services)
I don't know anything about this. I do not use VR, respectively, I do not give access to anyone.
- - Directory access
A very interesting new restriction on access to folders such as “Pictures”, “Movies”. This is a new limitation that only appeared in Android 9 Pie. The fact is that now, in order to get the application the ability to save pictures in “Pictures”, the application requests full access to all files !!! Google decided to make a separate restriction on the above folders. BUT practically no application developer is in a hurry to limit himself and asks for full access to all folders. Currently, Android users 2.5 billion [ 67 ]. Of these, 10% use the latest version of Android Pie [ 69]. That is, for 250 million potential users (the number of which will only grow), you could remake your application and show at least some commitment to privacy. But no, they spat on us.
It is clear why applications need access to these folders. The same messengers save the pictures there, in case the pictures remain when you delete the application (random or special). People do not want to lose memorable photos. But why practically no application makes it possible to save their data in the internal memory of the application itself? Take the notorious Telegram. There is no such setting. He himself chooses what and where to save (even files from secret chats are visible to other applications, I will write about this). I began to think about how best to ensure the possibility of using such applications (which need access to memory), but do not give them this same access. Found an article [ 71] in which the file structure and the policy of restricting access to the file structure are described in detail. It turned out that you can share files with the application without giving access to the data itself. For example, you want to send a file to a friend through a messenger, but you do not want to give access to files to this messenger. In theory, in the messenger it would be possible to implement file selection through a standard file manager (and this is an old function). Unfortunately, application developers do not. And when Telegram restricts access to the store, even the Share button from Telegram itself does not work. Here you have a private messenger!
In Android 10, Q will still change in this part. I don’t understand how exactly this restriction will work. If you give access to the repository, but do not give access in this setting, will access to other folders be given? Or vice versa.
In any case, I believe that this approach is still insufficient in terms of maintaining confidentiality. I restrict access to ALL storage applications that have access to the Internet. This is one of the lines of protection for my data.
As far as I understand this function is preparation for the scoped storage function, which will appear in Android 10 Q, but will become mandatory only in Android 11. In the meantime, I restrict access to the store to all applications with the Internet (or launch it in the work profile).
- - Wi-Fi control
New setting from Google. The fact is that in Android 9 (and in LOS 16), for the application to be able to scan / switch / connect to Wi-Fi, ALL conditions must be met
1) For the application to have access to Wi-Fi control (Manage Wi-Fi networks Fi). (CHANGE_WIFI_STATE)
2) For the application to have access to geolocation (ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION)
3) Geolocation is turned on (not for a separate application, in general) And only then the application will be able to scan networks and connect to them.
Earlier in Android 8.1 (LOS 15.1), either the 1st point or the 2nd + 3rd was enough. Now all items are required. On the one hand, Google is hinting to users that if the application has access to Wi-Fi scanning, then it automatically has the ability to calculate the location.
On the other hand, everything is too much. I don’t want to enable geolocation (access to which other applications can use), but I want to be able to scan Wi-Fi with a third-party application.
This setting must be disabled for all applications except those for which this permission is necessary for operation.
- Battery manager (Battery manager)
- Manage apps automaticaly (
I have this function enabled. But I do not hope for this feature in terms of privacy. Android decides what to limit and what not. Therefore, I use this function only to reduce energy consumption, but not as not for security or privacy.
- Battery saver and perfomance (Energy Saving and Performance)
- Extreme power saver (Aggressive Energy Saving).
In principle, this function, if you enable it, should completely kill / freeze all applications running in the background. I do not hope for it, since I am not sure that applications will not be able to circumvent these restrictions. Earlier on another device with Android 7 Nougat I had a similar function enabled, but especially cunning applications from giants (not only from Google) managed to show something in notifications. Apparently they started some kind of combination of background services that supported the operability.
This function is not turned on for me, since the necessary applications will be immediately closed, and especially tricky ones can slip through.
If someone used this function (in Android 8.1.9 or LOS 15.1, 16) and knows exactly the result of this function, please inform in the comments.
- Automatic power saver
This feature enables aggressive power saving when a certain charge level is reached. Due to the use of Orbot, VPN and due to the lack of Google Play (which can hold one Internet connection for all applications), applications such as mailers / instant messengers each have to individually "go" to the Internet at certain intervals. Sometimes with hard use of the device you don’t notice how the battery sits down. This is what this setting is for. But in the section “Apps & notifications (Applications and notifications) -> Battery optimization” I set the main applications (Orbot and mailer) to exceptions. To be honest - I do not know why these settings are divorced in different points. If someone knows exactly how they are connected - please describe in the comments.
- Performance profile
In addition to unloading applications from the background, it is also possible to limit the processor speed to increase battery life. I set the “Balanced” profile, as I 1) do not play games, I have enough speed and so on.
2) I try to ensure that the device does not overheat, since in this case the battery becomes unusable much faster. Given that now no one is just releasing devices with a removable battery in the middle price segment (and even LOS 16 on it), you have to monitor the health of the battery. By the way, because of the same reasons, I do not bring the battery charge below 20% and do not charge above 85% s.
- Screen lock
Here you can choose how to protect the device —None, Swipe, Pattern, PIN (PIN), Password. If you selected something from Pattern, PIN or Password when installing LOS 16, then encryption of the device should have started. Here you can change the type of lock. I strongly recommend leaving any of the Pattern (Pattern), PIN (PIN), Password.
- Lock Screen Preferences (
On the locked screen) - about this item was already in the "Apps & notifications (Applications and notifications)." Some settings may be available from different points, do not be surprised.
- Add users from lock screen
The ability to add new users directly from the lock screen. Do not enable this feature.
- Work notifications The
same as in “On lock screen”. Only for applications in the so-called Work profile. I will separately describe about the “Work Profile”, how to activate it, how it can be useful and other interesting things.
- Fingerprint
I can not say anything about fingerprints, since my device does not have such a function. I don’t know how it works in terms of encryption, bundles with other security features (Password, PIN, pattern). If anyone has information - please share.
On the Internet they write that even if you add a fingerprint unlock, then when you reboot the device you will still be asked to enter a Password (or graph. Key or PIN). In my opinion this is correct. I would like these settings to be even tougher (but customizable), for example, asking for a password after 1 hour of not using the device, and after rebooting, so that it asks for the fingerprint and password.
Actually, I don’t really trust this functionality. In theory, the fingerprint scanner is not transmitted further than its separate chip. But this is all closed functionality, no one can check. It is also assumed that fingerprint scanners can be used on cheap phones to verify fingerprints programmatically, which means that the impression goes to the device, and then the grass does not grow further.
In any case, if you install fingerprint unlock, turn on the Lockdown function (see the description below).
- Trust (Trust)
- SELinux
An additional mechanism to ensure the correct operation of access control on the device. The status must be Enforcing and the icon on the left is green. If this is not the case, then look for solutions on the forums. Make sure you download the normal firmware (highly recommended official LOS). Sometimes you just need to update the firmware.
- Root access (superuser mode)
In this menu item you can’t change anything, it only shows who is given root. You can change these settings in System → Developer options → Root access. I’ll write about root later. Running ahead of time, I’ll say that it’s better to have Apps only in this section.
- Android security patch (Anrdroid security packages)
This menu shows whether you have eliminated the latest known vulnerabilities. Shows two items:
-Platform (Platform)
-Vendor (Manufacturer)
If at this point it is displayed that everything is not in order, then look for a solution on the forums. Usually it’s enough to just put the updates “over the air” (OTA updates) if you have the official version of LOS. Sometimes you need to separately download firmware (update from the manufacturer) and install it. The monthly security updates that Google is preparing are included in the LOS firmware very quickly. Much faster than on most other firmware, even stock (original).
- Encryption. Must be included.
- Privacy Guard. I will describe this setting separately in sufficient detail, where I will also consider other mechanisms for restricting access rights.
- LineageOS statistics (sending statistics)
Ability to send statistics to the LOS server. You are free to decide whether to send them this data or not. (when you first turned on the firmware, you should also be asked about this) There you can also see what data is sent. I do not like the unique fingerprint of the device and the mobile operator in this list. On the other hand, more accurate statistics on the use of devices will help to understand the preferences of users, and may help others when choosing a device. You decide.
- SMS message limit.
Restriction on sending SMS messages per minute. Apparently all sorts of viruses use this feature so often that they introduced a separate limitation. Or users accidentally sent huge SMS (every 70 characters in SMS is counted as a separate SMS).
-Location
The default setting for enabling location.
- “Battery saving mode” - disables GPS positioning and uses location via Wi-FI, bluetooth and cellular networks. I did not check how exactly this restriction works. I generally do not have a module for determining location via Wi-FI, bluetooth and cellular networks (since Gapps or microg are not installed). Apparently the restriction works as it is written. Although in the curtain you can select 3 points - 1) by GPS, 2) Wi-FI, bluetooth and cellular networks 3) by all sources. Throughout Android, the settings for location and access to Wi-Fi scanning (which in fact also gives access to location) are scattered in different angles. It’s easier for me to turn off geolocation for everything except Osmand instead of understanding these settings. There can be many tricks in these settings. For example,in normal Android (with Gapps) there are some hidden functions that make it hard to completely turn off Wi-Fi.
- “Scanning” - allows applications to scan Wi-Fi or Bluetooth networks even when Wi-Fi or Bluetooth is turned off. Again, some crazy settings. To be honest, it seems to me that either Google is full of scumbags, or it was specially made so that the user could not figure it out. I can collect and write down all these settings related to geolocation separately, compare them, try to understand how exactly they intersect - but these will be just my guesses. In the end, I turned off this feature for both Wi-Fi and Bluetooth.
- App-level permissions (
Convenient permissions for applications) Convenient list in the native way (from Android) to control application access to the location in a list.
- Show passwords
Setting to show each character entered for a very short time when entering passwords. I advise you not to include this item. Now CCTV cameras have begun to shoot in high quality and resolution, and also someone can stand behind. It is hard to understand which letters you press when entering the password due to overlapping fingers, but if the letter itself is displayed on the screen (even a split second), then this is bad. If you have thumbs and you often miss, then you can enable this setting, but then when entering the password, make sure that no one is shooting you and no one is peeping.
- Device admin apps - the same setting as in “Apps & notifications” - “Special app access”
-SIM card lock
Normal SIM card lock / unlock by PIN code. This method of protection is more than 20 years old, I think you should know all about it. (If you do not know, then read this article [ 73 ]). If you have any services tied to verification by mobile phone (for example, banking applications), then I recommend using this function and setting a lock. Yes, this is inconvenient, yes, there are ways to bypass the PIN, but it will take a significant amount of time, and if you have stolen a SIM card (with or without a phone), you will have time to find another phone and call SIM card.
- Trust agents
This is an application to unlock the device bypassing a password or fingerprint scanner. The standard firmware usually gives access to the Google Smart Lock application. This allows the phone to be unlocked in a specific place or next to a specific Wi-Fi router. I recommend that you do not use this feature and disable all programs in this setting. They can steal the device and unlock it near your house (or next to the place that you registered as a trusted one).
- Screen pinning (Lock in the application)
This function does not work in LOS 16 (although on some devices this function may still work). This function is intended so that only 1 application can be fixed, without the ability to switch to another application. Useful if you need to give the device to children by including only one program.
List of accounts from different programs. Functionality dangerous in terms of privacy. Any program that has access to the list of accounts can instantly link your accounts from different services. Starting with Android 6 Marshmallow, an application does not need to request a list of accounts in order to have access to its account. As far as I understood from “if an app shares the signature of the authenticator” [ 75 ]
It is not clear if the company is developing two applications with one “signature of the authenticator”, then when installing the second application from the same company the second application will be automatically will get information that the first application is installed from the same company and even get access to information about this account? Please comment on those who are knowledgeable in this area.
As a matter of fact, access to the list of accounts (in addition to the account from the application itself) cannot be limited by standard means of Android. Google believes that we - scum (with which Google apparently represents us) should not think about this. I will describe further on the topic of access rights restrictions (you can and will need to limit it in Privacy Guard or AppOpsX). In advance, I’ll just say that carefully monitor which applications create accounts and which have access to view a list of accounts.
- Languages & Input
- Virtual keyboard (- Virtual keyboard)
- - Android keyboard (AOSP) (Android keyboard (AOSP))
- Advanced (Advanced settings) - turn on the Show app icon. This is necessary so that later it is convenient to quickly restrict keyboard access to the Internet and contacts from the list of applications using standard Android tools.
Also in the keyboard settings you can remove sentences of frequently used words
- “Text correction” - “Personal suggestions”
This is in case you give someone a phone for a while, or if bandits force them to unlock the device - then by the frequency of the words you can very easily understand your preferences. ATTENTION: do not underestimate this setting. I personally know the case in an unfavorable family when the aggressive head of the family, finding nothing on the wife’s phone, nevertheless realized that she was going to report to the police, according to the suggested words like “state”, “police” and so on. Even if you delete all correspondence, all unnecessary evidence of contacts with someone, traces will settle on the keyboard. In general, you can periodically clear the cache and keyboard data.
- Buttons
- Power button
- Lockdown
If you have fingerprint unlock, then enable this feature. It works like this - if you hold down the power button, in addition to “Turn off / restart / take a screenshot”, there will also appear “Lockdown”, which will lock the device so that the next time the device can be unlocked, it will only be possible with a password or a graphic key. This is in case the villains on the street break you and try to put your finger on the fingerprint scanner. Yes, of course this is for rare cases, but a function may come in handy at some point. Turn on - there is no asking.
- Status bar
- Network traffic monitor
Turn on the Display mode the ability to view the speed of the current Internet for downloading and uploading. This will help you understand if at some point some application in the background starts to download something intensively to the device, or upload your data to the server. It will also help prevent the consumption of mobile traffic.
Also in the Status bar (Status Bar) there are other interesting settings. For example, the percentage of battery power, so as not to remain with a discharged device at the wrong time, and so that you do not have to use other people's devices of neglected people (in which all devices are crammed with viruses and "snoopers").
- Date & time
We remove "Automatic date & time (Network date and time)", we remove "Automatic time zone (Network time zone)". In theory, these settings should disable automatic time setting from Google servers. But it was not there. Anyway, even with disabled settings, the system tries to periodically reach Google servers with ntp. This can be seen from the logs AFWall + and Adaway.
ATTENTION: You will have to manually set the date and time. When you download TWRP, the date and time may go astray. When you remove the battery, the date and time may also go astray. The fact is that Orbot and Tor browser cannot start if you have the wrong date and time. You can take the effort to find out what the problem is, but most often the problem is the wrong time in the system.
- Developer options (For developers)
Use these settings carefully, especially pay attention to those that relate to interference with the hardware of the device. That is, do not change what you do not know. For example, all sorts of "acceleration", "experimental" and so on.
- Advanced restart (Restart options)
Allows you to reboot into recovery mode without holding the volume button down. Useful if physically this button is broken.
- Running services A
native Android tool for viewing the list of running applications and the list of applications in the cache. You can immediately stop the application. If for some reason an application is running, although it should not be, then this should be dealt with. Either restrict autorun, or restrict the launch of some applications to others.
- WebView Implementation (WebView Service)
In order not to embed a browser or JavaScript handler in every application, there is an implementation from Google. This is more convenient for application developers, and should also save space on your smartphone. For example, a developer can make a version for mobile browsers and palm off the same version in his application. Or in order to quickly view the link in some messenger without going to any browser. LOS has a Chromium-based WebView AOSP implementation. I described below what “merges” WebView and how to avoid it (install WebView from Bromite). I had to leave it on, as some applications (for example, K-9 Mail) use WebView. But my hands will reach and I will switch to Bromite WebView.
- Root access (Superuser mode)
Who should be granted superuser rights:
Disabled
Apps only
ADB only (ADB only)
Apps and ADB (Apps and ADB)
It is desirable that the item only in the normal state is only Applications only). About root I will describe later.
- Manage root access (
List of superuser rights) A list of applications that have root (root) rights in the Privacy Guard interface with the ability to revoke rights. Route should be provided only to those applications in which you are sure.
- Android debugging (Android debugging)
Enabling the ADB interface for connecting from a computer or from some programs of the device itself (for example, for some cases in AppOpsX). It is advisable to turn it on only when necessary and turn it off when not needed.
- Debugging notify
It’s better to turn it on to see that some application is trying to connect via the ADB interface when connected to the computer
- Revoke USB debugging authorization.
It is advisable, after manipulating ADB, to revoke access to all devices so that attackers cannot steal your smartphone + computer and connect to your smartphone via ADB with the screen locked.
Next, the most recent settings related to managing the operation of applications in the background. You can immediately find restrictions and change the status of applications. I prefer to limit the work in the background of the application for sure. And especially unpleasant applications, generally close.
- Kill app back button (
Setting the back button) The setting allows you to close (or rather forcefully close) the application by long pressing the back button. I use this functionality when it is necessary to temporarily launch an application that I do not trust, and then close this application after use.
In addition to the settings presented, there are also other interesting settings in different sections, such as redefining buttons, forcing the application to work in full screen mode (without a system line at the top and without buttons at the bottom) and other cool things.
As the name implies, this is access to all the software internals of the device. Initially, on most Android devices (except for very rare devices), the root is not provided. Firstly, with inept handling, you can break the firmware (soft brick), and secondly, you can even overclock the processor and physically damage the device.
Thirdly, if you are an insecure user and do not follow what programs you install, which rights and whom you give to, then the risk of installing a virus that very deeply puts its tentacles in the system will be quite large.
But do not be scared if you are an accurate user. Unfortunately, Google does not provide convenient options for fine-tuning the device, especially regarding privacy. Gradually, let's say “rather slowly”, Google adds opportunities to limit access to programs, but this is not enough. Sometimes it even removes useful settings (it made it difficult to deactivate the Captive Portal, removed support for Miracast in order to promote its Chromecast device working only through Google and so on). Therefore, you have to root the device in order to install useful programs that increase privacy. For example, such as Afwall +, Adaway, AppOpsX.
I want to immediately notice that basically there are 3 types of
root : Temporary root - temporary root . It disappears upon reboot.
Full root- Full permanent rights that allow you to change all sections and folders, including the system folder.
Shell root - partial permanent permissions that allow you to read all files, but cannot change files in the system folder. That is, there are no rights r / w (read and write), but only read. This happens if the manufacturer specifically set a restriction on writing to this section, as well as on devices with an A / B system of slots [ 77 ]. In different cases, the issue is resolved in different ways.
Actually, for only one application that I use, it is necessary to write to this section: Adaway. This program changes the hosts file.
Some devices on A / B with Android 9 (LOS 16) now allow you to modify files in the system (at least the system / etc / hosts file can be changed) with a native root (with addonSU from the LOS command), although this is possible in LOS 15.1 was not. For most other cases, usually there is a special version of Magisk that changes the structure so that there is write access to the system.
There are many modules for root. For LOS firmware, 2 modules are usually used:
1) addonSU- native to LOS module. I use this particular module, since it is developed for all devices by the LOS team, and the remaining modules, although open-source, are often made enthusiastic for each individual device (and I don’t have confidence in the cleanliness of these enthusiasts). Also Magisk is too powerful a module. Please note that payment via phone will not work with root through addonSU, Netflix will work only with low resolution, most applications of foreign banks will not work. Most applications of large Russian banks work with any root, but payment with a device via NFC will not work. True, there is a workaround for passing SafetyNet and device payment: iSU [ 79 ], [ 81], but I don’t use it and can’t say anything about the performance of iSU.
2) Magisk. A very powerful module, can wedge so deep that it can somehow replace the system folder, making it changeable even for cases where it is not provided by the manufacturer. It has different compatible modules. It can hide the fact that it is installed from programs, and after hiding, you can even configure payment by the device via NFC. But most of the modules at the moment do not make sense, since many functions are in Android 9 (Energy Saving, DoH), or can be configured using regular root. This module is too powerful and therefore dangerous. If you are a very confident user and 100% understand what and where you are installing, then you can use this module, especially if there is no choice (for example, if you have a closed system for recording and you want to use AdAway). In any case, it’s better to install Magisk in core-only mode,to replace only system and not wedge into processes.
If you need a full root just to change hosts, and your device does not support full root with AddonSU, then in some rare cases (devices from A / B to LOS 15.1) you can still change the hosts file through TWRP without Magisk installation. You need to read about each individual device.
Here's an explanation of why some of the LOS team do not recommend using Magisk and explain why this can be dangerous: [ 83 ].
Separately, it should be mentioned:
a) You can not install 2 addons from the root at the same time. Or "native" addonSU, or Magisk, or some other.
b) Do not useSuperSU (it was previously popular), because at the moment it is being developed by a Chinese commercial company (I am extremely alarmed by the word Chinese and the word commercial).
c) To install another root, you must first delete the previous one. It is also done as it is installed - by means of adb sideload through a special zip archive.
In the end, I settled on addonSU, since I don’t use contactless payment, I don’t have subscriptions to Netflix or Ivi, on my device I have access to the system for change and I can use Adaway without Magisk.
In LOS in the settings, it would be better if you had root only for applications (Apps only) without root for ADB. The fact is that if you connect your device to a computer, then an authorization window will pop up on your device to access a specific computer to ADB. And if you give access to this computer and if you check the box “Trust always” even worse, then through the computer you can fetch a lot of information or even install some programs. But if there is also a root for ADB, then in this case, you can generally introduce viruses deeply and make them hidden. Yes, you yourself in some cases may need a root for ADB, but you can temporarily turn it on for such cases, and then turn it off if not needed.
I strongly advise against using closed (proprietary) programs that require root. I install programs using root ONLY from F-Droid and only popular ones. Even if this is some kind of official application (for example, a banking application) that requires a root, if it detects that your device is rutted, it’s still better to get a separate device or use the web version.
If you still decided on Magisk (or because of circumstances), then be very careful with Magisk modules. Again, it’s better to install the official Magisk and only the popular open source modules.
Unlocking the bootloader (unlock bootloader) allows you to install custom firmware (Custom ROM), such as LOS. When you unlock the bootloader on some devices, you lose the guarantee, as some phones have special chips (for example, Samsung Knox) that, when unlocking the bootloader, forever remember that the bootloader was unlocked. Even if you then install the stock firmware and lock the bootloader, in any case it will still be impossible to hide that the bootloader was once unlocked.
Unfortunately, when installing LOS, in most cases it is impossible (technically possible, but the device will not work) to lock the boot boot (lock bootloader) back, except for a few devices from Google of the Pixel lineup.
What is bad unlocked bootloader? The fact that if cybercriminals steal your device, then they will have the opportunity to install some add-ons on your device. But they will not be able to access the current data if you have encryption enabled. And if then the device is returned / thrown to you with installed viruses, and you turn it on and unlock it, then your data is decrypted and the installed virus can immediately start sending data to attackers. There is a way out of this situation - if your device was in the hands of attackers aimed at you (for example, at the borders of some countries) for more than 20 minutes, then you have to demolish the firmware and reinstall it cleanly, without turning on the phone (well, or get a SIM card, turn off Wi-Fi Fi, download your latest data and only then reinstall the firmware). At all,It’s not known how savvy these very cybercriminals are, maybe they have knowledge of how to inject viruses even with a locked bootloader. In any case, if there is a suspicion that the device fell into the hands of attackers even with a locked bootloader, I would advise installing the firmware again. Especially at the border (for example, Chinese), as they install tracking applications and are not even shy about it.
But it is not all that bad. As you already understood from the description, they should be aimed at you and after they give the device to you, you will need to unlock it and enter the Internet and only then the data can "go to the side".
Warning: do not try to lock the bootloader on the LOS firmware if you are not 100% sure that this is supported on your device. (only supported by some Nexus and Pixel models)
F-droid is a program of the catalog (market) of applications for Android with its server (repository). That is, the F-droid project consists of two parts:
1) Application
2) Server (repository), from which this application can download other applications.
Both the application and the server are open source, i.e. open source. This means that you can look at all the program code, with the proper skills from these sources, make your own application or server. Or even add / remove something from the functionality of the application / server.
The first release of the project took place on September 29, 2010, that is, it is a rather elderly, proven project, only two years younger than Android itself.
Through their repository (server), only free open source applications are distributed without tracker trackers, without advertising (except for rare exceptions, they will warn you about this). The code of these applications you can see for yourself and make sure that there is no built-in muck.
Nobody knows the number of users of f-droid, since f-droid does not intentionally collect statistics, they even refused to harmlessly count the total number of application downloads. But recently, in connection with the global trend for privacy, this application catalog is rapidly gaining momentum, if you can judge by the number of applications in the repository itself, by the number of posts in specialized forums.
The official f-droid repository contains only free software, which is checked by the F-Droid team with special tools and manually for the presence of closed "pieces" of code, for the presence of tracker-trackers and "controversial" functions. If there are tracking elements in the application that the program doesn’t need, then such a program is simply not skipped. If some controversial functions are justified, but still dangerous in terms of privacy, then this is separately described and placed in the so-called “Antifeatures” (dubious functionality / anti-functions) [ 85 ]. Let's look at each warning:
Ads (This app contains advertising)- the presence of advertising. This means that there is advertising in this application. To display targeted advertising, the application needs to collect your data through the built-in tracker trackers, therefore applications with advertising and tracker trackers are NOT MISSED in f-droid. Non-targeted ads may be skipped in f-droid . That is, only with ads that are shown not based on your preferences and data, but simply the same for everyone.
Tracking (This app tracks and reports your activity / This app tracks and reports your activity)- the presence of tracker-trackers. If the application "silently" sends some data to its servers, then such an application will be labeled "Tracking", if by default tracking is disabled, or the application explicitly asks if it is possible to send data to its servers, then this there will be no shortcut. But even if the application asks for your permission, but at the same time collects completely redundant data, or contains “closed” trackers such as Google analytics, then such applications, in principle, are NOT MISSED in f-droid. For us, this means that the presence of the “Tracking” label is not something very dangerous, since tracking is either disabled by default, or we can disable it (but do not forget to do this).
In general, tracking here refers to the general collection of statistics and reports about the crash of the application. As already mentioned, if the application has clearly excessive data collection, then such an application will not be allowed into the f-droid repository at all.
NonFreeNet (This app promotes non-free network services / This application promotes non-free network services) - this means that the application depends on "closed" servers. For example, there is an applicationTelegram in f-droid, it is open source. But it works only through their server, and their server cannot be replaced, since the telegram command did not upload the server source codes. That is, using Telegram you are required to use only their servers. This label warns you that you are at risk. For example: there is another Conversations messenger in f-droid. Although he offers to create an account on their server, but right away at startup you can not create an account, but enter the data of an existing account on another server. And another server may be your own XMPP server. Therefore, Conversations does not have a “NonFreeNet” label, which Telegram cannot boast of (and Matrix Riot, too, by the way). In general, the presence of the “NonFreeNet” label does not automatically mean that the server will share your data with someone,but in the age of rampant information trading, the server owner has great temptations to sell information about you. Also, the absence of the “NonFreeNet” label does not mean that the f-droid project thoroughly tested the server implementation. For example, regarding the implementation of its XMPP server for Conversation, a check was made that it was possible to make your server from source (that is, there is an open source implementation of the server), but it was not tested for security (for example, regarding the possibility of hacking the server by villains). Choosing a secure third-party server (or creating your own) rests on your shoulders.as part of the implementation of its XMPP server for Conversation, a check was made that it was possible to make your server from source (that is, there is an open source implementation of the server), but was not tested for security (for example, regarding the possibility of hacking the server by villains). Choosing a secure third-party server (or creating your own) rests on your shoulders.as part of the implementation of its XMPP server for Conversation, a check was made that it was possible to make your server from source (that is, there is an open source implementation of the server), but was not tested for security (for example, regarding the possibility of hacking the server by villains). Choosing a secure third-party server (or creating your own) rests on your shoulders.
Pay attention to applications with this label (NonFreeNet). If possible, then avoid applications with such a shortcut. It is clear that you will never find a Facebook application without this shortcut. In such cases, it is best to opt out of using Facebook if you are ready for it.
NonFreeAdd (This app promotes non-free addons / This application encourages closed-source add-ons) - a warning that non-free add-ons (add-ons, extensions, and so on) can be downloaded from the application. For example, applications such as OSMand, Fennec f-droid. For us, this means that we must carefully watch what extensions we put in the application. This does not mean that all add-ons / extensions in Fennec violate your privacy (some protect on the contrary), but you need to be careful.
NonFreeDep (This app depends on other non-free apps / This application depends on other non-free applications) - this label means that the application relies on some other components / applications that are not free. For example, there is an “Open In WhatsApp” application that allows you to write to someone on WhatsApp without giving access to the address book to WhatsApp itself. It’s clear that this application is designed to work in conjunction with the proprietary (closed) WhatsApp application. With this label you are just once again warned about it. Although the Open In WhatsApp application itself allows you to at least somehow limit the WhatsApp appetites, if you cannot refuse it.
UpstreamNonFree (The upstream source code is not entirely Free / The original source code is not completely free)- this means that the application in f-droid was made by processing a regular application and removing proprietary (closed) components from it. This warning is necessary because you understand that the developer of the original application is not completely committed to the open source ideology and may add some more proprietary components / dependencies to the original application. As a result, “cleaning out” applications for uploading to f-droid will become more and more difficult over time, and enthusiasts will refuse to do this. But this is an indirect indicator that does not guarantee that this will happen. Attention: this does not mean that the application in f-droid has closed components, but means that the application in f-droid was created from an application with closed components that were deleted / replaced.
NonFreeAssets (This app contains non-free assets / This application contains non-free components) - the presence of some resources in the application, under a private license. In most cases, these resources are understood as such things as pictures, sounds, music and so on. Just if you download the application and “pick it up” and get, for example, an application shortcut, you cannot use it in your projects according to the law. That's all. Nothing wrong.
KnownVuln is a shortcut meaning that the application definitely has security vulnerabilities. Typically, such applications are removed from f-droid after a vulnerability has been identified, so you are unlikely to encounter such applications. But the absence of such a label does not mean that there are definitely no vulnerabilities, it means that there are no known vulnerabilities.
DisabledAlgorithm - a shortcut meaning that the application definitely has a weak encryption algorithm. This is practically the same as with KnownVuln .
NoSourceSince (The source code is no longer available, no updates possible / - Source codes are no longer available. The application will no longer be updated until the source codes become available again.
It seems to me that this is a very balanced policy. What contains obvious nasty things will not be missed in f-droid. What relies in part on closed components will have warning labels.
Since both the f-droid application and the f-droid server are open-source, you can use others both the application and the server. For example, there are other clients (applications) for the f-droid repository - M-Droid [ 87 ], G-Droid [ 89 ]. Also in f-droid itself you can connect your repository, or other people's repositories. Initially, the default is 1 repository: F-Droid. Let's walk through the most famous repositories.
There are other repositories that you can find on the Internet, for example [ 107 ], [ 109 ], [ 111 ], but you need to use these repositories carefully.
The official F-Droid repository is de facto becoming the main source of open-source applications on the Android platform for most interested users, including due to the support of deterministic compilation (Reproducible builds). Users very much ask open-source application developers to prepare their source code so that they can be used by f-droid (yes, some applications are hard to translate into a specific format suitable for f-droid). This can be seen in the issues of some applications on Github-e, Gitlab-e and other Git source servers.
A big plus of F-Droid is that their infrastructure is all open-source and at any time, any organization will be able to pick up this matter.
Additional settings
In Settings:
- Manage installes apps
(Repositories) - enable / disable known repositories, add new ones.
- Automaticaly fetch updates (allows you to download the update automatically. When to install the update - it's up to you
- Include incompatible versions - versions for old devices and for other architectures (you may have an x86 processor on which not all applications work).
- Include anti-feature apps (I do not know what this setting affects, I already show applications with antifeatures. Perhaps such a setting enables the display of an application with too dubious functionality. But I don’t know for sure. Who knows what exactly this setting does - please write in the comments.
- Use Tor - allows you to work through Tor as through a proxy (proxy) to the localhost address (127.0.0.1) with port 9050, and also redirects to the onion server. For work it is necessary that Orbot is launched. This is a useful feature that allows you to work through the Tor network, not including the pseudo-VPN mode (and allows you to use a real VPN) in Orbot, but I will write about this separately.
- Enable HTTP Proxy (Work through HTTP proxy), indicating the Proxy Host (Proxy Host) and Proxy Port (Proxy Port).
- Prompt to send crash reports - is it possible to ask you to send crash reports to the application. If this option is enabled, before sending data about the application failure, you should be asked whether such information can be sent. Choose at your discretion.
- Prevent Screenshots - prohibits another application (and even for the standard screenshot function built into LOS) to take screenshots when you are in the F-Droid application. In general, applications have a ton of other ways to find out the list of installed applications, so this can only be an additional way in a compartment with other means. But I don’t see much sense in this yet, since Android in the latest versions prohibits taking screenshots for ordinary applications that are not currently running.
- Hide with search button and Panic button settings - settings that allow you to hide the F-Droid application or delete repositories by clicking a specific button, as well as delete certain applications. The meaning of these points is not entirely clear to me. If someone gets access to an unlocked smartphone, then this villain will already have the opportunity to fish out a lot of information, which makes this point useless. It can only be, unless you have your own repository and there is no encryption on the device.
- Keep cached apps (the ability to store cached applications) - the ability to store downloaded versions of applications in memory for a specified period. I kept 1 month. This is in case you update any application and the new version will work unstably. This will be especially useful if this is some kind of Internet application (for example, VPN) and the new version will stop working. You can install the previous version. Unfortunately, in recent versions of Android there is a ban on downgrade (downgrade) applications. This means that you have to uninstall the application, and install an older version with a loss of settings. So you have to either export the settings from the application (if there is such a function), delete the application, install the previous version and import the settings.Or refine using other methods (copying the settings folder through a special file manager with root or through a special oandbackup application
(dk.jens.backup) with root).
Files of downloaded .apk applications are saved in the folder data / data / org.fdroid.fdroid / files or in mnt / sdcard / Android / data / org.fdroid.fdroid / cache / apks
Next, turn on Expert mode .
- Unstable updates (Unstable updates) - show and offer to install unstable application updates. I do not have this item turned on, since even when the setting is turned off, sometimes versions come across a little unstable. Although there were some applications that were already updated on Google Play, but in the F-Droid were listed as unstable. So, if there is some application that should have been updated, and the functions you need should appear there, then you can try to enable this item.
- Allow repos to install / uninstall apps (Allows repositories to install and uninstall applications) - allows repository owners to send a request to uninstall / install programs. It is useful if you made your repository for your friends and after a while it turned out that some application is too dangerous, and you can send a request to delete this application to everyone. Or vice versa, a new interesting application has appeared, you send to all your friends (who have your repository configured) a request to install a new application. It is also useful if you made a repository for your elderly parents.
But so far there is no distinction on which repository has the right to send such requests and which does not. Either you can enable this feature for all repositories, or not at all.
Also in the F-Droid application, it is possible to transfer applications (only apk, without settings and internal data) to other devices via Wi-Fi, bluetooth or a USB flash drive via a USB-OTG adapter. Useful if there is no internet nearby. This is done not in the settings, but in the main menu through the “Nearby (Near)” item.
Additional Information:
F-Droid Cons :
- Sometimes the speed of downloading applications and updating the list of applications can be low. This is normal, as the F-Droid lives on donations and does not have the ability to make high-speed servers and CDNs. In the settings of the main repositories there is a list of “mirrors” - auxiliary servers.
- Sometimes the application is buggy, but nothing critical. For example, an application tries to install an application update several times in a row. But still, the F-Droid itself has never broken anything for me.
- No application rating, slightly outdated interface, inconvenient search.
- It is not visible from which repository this or that application is presented. If you enable several repositories, it is not clear what is the archive / beta version, and what is stable and from which repository the application is.
-Sometimes, when an update for an application comes out, this update is visible when searching for this application in the F-Droid, but for some reason the F-Droid does not offer to update (it seems to be fixed, I have not seen such cases recently).
Pros :
-In the latest versions of Android, permission to install from third-party sources (not only from Google Play) is issued for each individual application. You can give permission to install only for F-Droid, which reduces the likelihood of installing from other sources. But this is a plus of new versions of Android, not F-Droid.
- F-Droid shows all the permissions that the application requires, including most of the "normal" ones. Google believes that some permissions (such as Internet access) are so insignificant that you can not talk about them. Google Play does not show these permissions, considering that you do not need to know that the application wants to have Internet access !!!
-In the F-Droid, the application page provides links to the source code and the application website. It's easier to look for discussions of issues, recommendations, and so on.
About the completeness and quality of applications in F-Droid.
The number and quality of applications is gradually, but inexorably growing. Read the article (if you have not already read it) [ 113 ]. But in addition to this article, I would like to draw attention to such applications as:
In general, the F-Droid has a whole set of applications from simplemobiletools. And a calendar and notes and contacts and a flashlight and so on. These applications differ in that they ask for minimum permissions. Each application performs only its function.
There are also a bunch of other interesting applications - game console emulators, VPN clients (OpenVPN, Wireguard, and so on), a bunch of small games (there are Tetris), notes, calendars, directories, a Wikipedia download tool for viewing offline (Kiwix), a periodic table scanning base stations of cellular networks for further assistance to geo-projects or to check attempts to listen to you (Tower collector [ 139]), applications for smart watches, meme collections, password managers, torrent clients, i2p clients, SIP clients, encryption of ordinary SMS during transmission - Silence (but only works if both interlocutors have an application installed), various shells (launcher), to-do lists and more. The quality of such applications is growing. In most cases, application functionality is no worse than its counterparts on Google Play (and sometimes even better). Fundamentally new applications almost do not appear on Google Play, mainly analogues of existing ones appear. Therefore, do not pay attention to the fact that the F-Droid repository has only 2000 applications - they are more than enough.
If you can read in English, then there is also a separate forum [ 141 ] with questions / answers, collections and news on applications in F-Droid.
In Android, it is possible to use a VPN. To do this, use a dedicated VPN slot, which can be used by various programs. Many good programs use their VPN slot to implement their functions and create pseudo-VPNs, for example, NetGuard (firewall + conditional ad blocker and tracker), Blokada, DNS66 (ad blocker and tracker). Realizing their function, unfortunately, these programs “clog” the VPN slot, but do not really create a secure connection to any server with a VPN. Using these good programs you lose the ability to use a real VPN. These programs are not bad if you do not have root (superuser rights) and you do not want to use a VPN, but want to additionally limit some programs + “cut” ads and trackers.
Programs in the work profile and devices connected to your smartphone through the distribution of the Internet (tethering) - DO NOT pass through the VPN, but pass directly. (although with the help of certain settings Orbot and iptables (through scripts in AFWall +) you can make sure that everything passes through the VPN).
Personally, I use programs that require root, but at the same time leaving the ability to use the VPN slot to create a real VPN.
Google believes that there are so-called “normal” permissions. These are permissions that cannot be limited by standard methods, and which you won’t be warned about in the Google Play description or when installing the application. One of these permissions is Internet access !!! .. You may not even know that the application has Internet access. Personally, I am trying to severely restrict Internet access to all applications that do not need it. I try, in principle, not to give access to Internet applications that have access to my files. For example, photography applications, PDF viewers, and so on. And vice versa, those applications that have access to the Internet (browsers) should not have access to the Storage, contacts and so on. To limit Internet applications, I use two tools:
Built-in Android - This is originally built-in in all recent versions of Android Firewall. But Android limits the ability to use these settings! In LOS, this feature is present (not removed). In the “Settings” - “Apps & notifications”, select the application, there is the setting “Data usage” and here in LOS 5 settings:
I try to limit the Internet to the fullest, starting with the built-in firewall. First of all, when I first start the device, I restrict access to the keyboard, the built-in browser. But I don’t really trust these settings, since they cannot restrict processes / applications from the “Core / Core” category, and I also read that some applications can bypass the restrictions on the “Background data” ban. I don’t know what kind of “holes” Google left unconsciously or intentionally in their system.
For those who do not have LOSthese settings may or may not be at all. Sometimes you need to install an additional application that will give access to hidden settings. There are applications that organize the interface for these settings (internal). But I do not use such applications - just know that if you do not have LOS, then you can still try to restrict Internet access by system methods without root and without applications using the VPN slot (using the VPN slot - NetGuard).
AFWall + - Firewall / Firewall based on the iptables tool [ 143 ]. This application requires root (root), but not necessarily with full access to change the system, so it will work on any device with superuser rights. The advantage of this application is that it does not use a VPN slot.
This is a very useful application that allows you to prohibit access to certain types of network access for each application separately.
On the main screen there is a division into
“All” - a list of all applications.
"Core" - a separate list of applications related to the Linux kernel.
“System” - a separate list of system applications.
"User" - a separate list of applications you installed.
Let's go through the
Preferences / Settings
-UI Preferences / User Interface
- Enable notifictations / Enable notifications - show a warning that a new application is installed and it needs to be given / taken away the rights to the Internet. It is useful if you have the “Block selected” strategy (more on that later) so that the new application does not have time to send something to the Internet until you have disabled access to it.
- Rules progress - I enable this setting to see what rules apply. In rare cases (in the latest versions less and less) the application of the rules can get stuck. In this case, I exit the application and re-run the Apply Rules.
- Show filters / Show filters for convenience in the interface filters for viewing the type "all / kernel / system / user".
- Show UID for apps / Show UID for applications - display the code of the installed UID application. I use this function for clarity. I advise you to enable it.
- Confirm AFWall + disable / Confirm disable AFWall + - I enable this function so as not to accidentally disable the firewall and for a split second not to allow any of the applications to “skip” to the Internet.
- Rules / Conectivity
Here I include in addition
“LAN control”, “VPN control”, “Tor control”. I don’t turn on the Roaming control, since as far as I know the Russian PPSOs are tricky, they sometimes somehow configure the interaction of the networks so that the phone does not understand that you are roaming. Therefore, I would not rely heavily on this feature.
The following are the settings for advanced users, but we will need to use them!
-Log / Magazine
- Turn on loh service / Turn on the log service - I turn on this service so that later I can see which application is breaking. Very useful feature. Using this function, I realized that even in LOS, even with time synchronization turned off and statistics sending turned off, the system still tries to get to some NTP servers, but not only to them (for example, to 1.1.1.1, to some other ip, which do not even “google.” Unfortunately, in the free application functionality (and there is also a paid version of AFWall +), the log is not very convenient and not very informative.
- Enable show toast - show notifications when an application tries to gain access, when access is blocked by AFWall. But this is not a notification in the upper curtain, but notifications with small pop-up inscriptions (toasts). Useful when setting up accesses. Sometimes some non-standard functionality (such as Tethering / distribution of the Internet via Wi-Fi) does not work and you cannot understand why. In this case, a message may appear which process is blocked and you can understand what needs to be turned on in order for the functionality to work. But this inscription is not always displayed, although it may be just that in AFWall + something is limited. Conversely, it may be that a ban on one process is displayed, but you need to give access to another (this rarely happens). But all this is not about ordinary applications,but some more systemic functions.
- Security
This menu is designed to set a password and a graphic key for access to open the application. I don’t use this functionality because I don’t give anyone the device in my hands and my device is encrypted. But if you give someone a device in your hands, you can put protection on this application. I believe that for such purposes it is more efficient to put separate protection against LOS itself on all applications that have root (and on other applications with sensitive data) than on just one application. (I do not use this built-in function in LOS and unfortunately I can not tell you exactly how).
- Experimental
- Fix startup data leak / IMPORTANT! The fact is that AFWall has a drawback: this program does not start very first when the device boots, and the restrictions set in the program disappear when the device is rebooted. In those few seconds when the device is already loaded, but AFWall has not yet started, + the device manages to connect to the Internet, and some programs manage to access the Internet for 1-2 seconds. To address this shortcoming, there is this proposed feature. You must first select the experimentally appropriate option in the "Startup directory path for script", and then enable "Fix startup data leak / Fix data leak at startup." But most likely this function will require full superuser rights with system r / w (read / write).
Also, this problem can be partially solved using the following actions:
1) Restrict access to applications that should never have access to the Internet through a system firewall (described above as). But this does not solve the problem of accessing applications / processes with the status of "Core / Kernel".
2.1) Turn off Wi-Fi and cellular network before rebooting / turning off the phone
2.2) Particularly skilled ones can write a script for “not turning on” Wi-FI and cellular communications when the device is turned on.
3) Block requests to sites that your phone is trying to "reach" through the hosts file (for example, through the AdAway program). The disadvantage of this method is that only attempts to access sites through the site name, not not through IP, are blocked through the hosts file. For example, in the first seconds, requests for IP type 1.1.1.1 crawl through. (DNS Cloudflare).
4) Disable “Run at startup / run at startup” for some applications in the Privacy Guard (called “Start at power up” in the Privacy Guard) or AppOpsX.
- Enable inbound connections - if you want to have access from the local network to the device (Samba, sshd, AirDroid and so on), you will need to enable this item.
Enable multi-user support - this item is necessary if you have several users. That is, if you made multiple users (multiple-users) on your device (not to be confused with a working profile). Unfortunately, AFWall + only works with multiple users in the “Block selected” mode (see below). And also I was not able to properly configure the 2nd user with the ability to start traffic from the 2nd user via VPN, so I could not test this function (additional users) normally.
Dual apps Support - Support for differentiation of rights for dual applications of the type "Work Profile", dual applications in firmware MIUI, Island and other similar tools. I have this item enabled, since I use the "Work Profile" to create a separate space for some applications. I want to note one detail right away - AFWall + does not see the application in the work profile until the same application is installed in the main profile (I hope the developer corrects this). What I have to do: I install applications in both the main profile and the working, mainly (personal) profile, I block Internet access (through the system firewall) by all means, the rights to autostart and work in the background, and all other rights, but I give necessary rights to the application in the work profile for those types of network access,which I want to give. Then everything works. By the way, you can thus install 2 identical applications on the same device with different accounts. But if in this way you want to bypass the rules of some service, then do not flatter yourself, these services will be able to understand that both applications belong to you through proc / net and through IMEI devices.
There is also a moment about applications from the work profile - unfortunately, in the System / System and User / User filters, applications begin to mix and fall into different categories. Something from the work profile falls into the “System” filter. But this only affects the display in AFWall + and does not affect the functionality in any way. You can distinguish applications from the work profile by the letter “M” after the application name or by a long UID, for example, [101001] Phone Services (M).
- Profiles / Profiles - everything is simple, in this section you can configure several profiles (up to 4). If you have several scenarios of using the device in terms of access to the Internet or the internal network, then you can configure several profiles and switch them by first pressing. Even there are widgets on the desktop from AFWall +.
The logic of restrictions in this program is divided into 2 ways:
1) Allow selected - Allow only what is selected. This is a more "hard method", but I use it. He is tough in that when you install some kind of application, you must separately give him access. But this is what I like about this method. Immediately I want to make a reservation that on LOS 15.1 personally for some reason this method did not always work for me and I had to give access to some applications related to “Core / Core” and “System / System”.
2) Block selected - as the name implies, blocks only the selected. Try to avoid this method, as it is better to act on the principle of "Forbidden is all that is not allowed."
Let's look at a possible configuration option for this application. I want to make a reservation right away that for different scenarios of using the device and for different versions of Android, it is necessary to configure this application in different ways.
Let's analyze the simplest option when you have neither a VPN, nor Orbot, built-in Google applications, no other special proxy servers.
In the simplest case, everything will work very simply. You set it to the “Allow selected” mode and simply give access ONLY to applications that you need only to Wi-Fi or mobile Internet.
Sometimes this does not work and you still need to give access to "[-10] (Any app) Same as selecting all apps / is the same as selecting all applications." Although it is called “the same as the choice of all applications”, it should not automatically give access to all applications at once.
That is, if you are in the “Block selected” mode, then the checkmark on this item should block access to all applications, and in “Allow selected” I have no effect on anything (on LOS 16) . But, unfortunately, this can vary from version to version of Android and other settings. Check in advance. And check when upgrading to a new version of LOS (or Android).
In some cases, it is necessary to enable “[0] (root) Apps running as root / applications with root access”, although this item does not mean access specifically for those applications that you install with root privileges.
In some cases, you need to enable "[-11] (kernel) - Linux kernel / (kernel) - Linux kernel". But this item must be included carefully. With this item blocked, everything works for me, and it can be seen in the logs that this process is constantly trying to get through somewhere.
There are some applications that are grouped under one UID, and you can only disable / enable the Internet as a group. This is mainly a group [1000] This group refers to most Android system applications. This group is disabled for me.
There are some more points that you need to include if you need them.
Complications will begin if you want to configure the device in a bunch of AFWall + plus Orbot plus an additional VPN plus a work profile.
I want to offer you my option of setting AFWall + in conjunction with Orbot and Work Profile without Google applications on LOS 16 (although it worked on LOS 13 and 15.1)
And everything, everything works. 99% of traffic in 99% of cases goes through VPN / Orbot, and without VPN / Orbot only what I explicitly indicated goes. This is my way, in terms of privacy, I recommend that you do the same, but I can not insist. If there are any weaknesses in my method - please inform in the comments.
About the switch setting - “Tor control / Tor management”. This setting does not restrict access to Tor, but forces applications to use the Tor network, even if Pseudo-VPN is not included in Orbot and even if the application itself does not have the “Use Tor” setting or the ability to set a proxy. In order for this to work, you need to specify which network the application can access (Wi-Fi or mobile) and put a “tick” in “Tor control / Tor control”. Then the application will forcefully use Tor.
The downside of this method is that there is a “DNS / DNS leak”. Applications themselves use the Tor network, but by the DNS server (which helps to understand the program / device on which IP the server of the site you are accessing is located), they can roughly understand where you are and even combine all the requests into one profile and understand who you are. [ 145 ]. Therefore, I do not use this option.
In fact, in AFWall + you can write the rules yourself in “Set customs Scripts / User scripts” and if you know how to write these scripts, then you can force traffic to pass through Tor without enabling a pseudo-VPN and without DNS leakage. The functionality of custom scripts is very wide. You can even use Orbot without including its pseudo VPN, configure a separate “real VPN” and run some applications through Tor, some through a real VPN, and some directly. As mentioned above, AFWall + is a wrapper over the iptables tool.
During customization, be sure to test for DNS leaks, whether it really launches the application through Tor, VPN, and so on.
Useful links:
a) Distribution of the Internet from the device immediately through Tor [ 146]. By default, the Internet is distributed from the device directly from the mobile network without activating Tor / Orbot.
Regarding the interaction of the built-in firewall and AFWall + - the mechanisms do not overlap and impose restrictions on the applications separately for different mechanisms. Internet restriction in any of the mechanisms limits the application.
Regarding VPN - if you specify some applications as allowed to VPN in VPN settings and enable VPN, then these applications can only work through this VPN (at least for me on my version of LOS and Orbot).
Ad blocker and tracker by changing the hosts file on the device. In fact, this is just a wrapper for convenient editing of the hosts file. Requires root, and full, with write access to the system, that is, with the rights r / w (read and write).
Pros -
Minuses -
In general, you yourself can modify the hosts file, but just the AdAway application makes this process more convenient.
Let's look at the application settings in Preferences
- Hide welcome card - Yes.
- Check for updates - if you use the rules downloaded from the Internet, it is better to enable it.
- Allow whitelisting (meaning whitelists) - this means whitelists that are not set by you, but which come from files that are loaded from the Internet with lists. My feature is turned off, because it is unclear why it is necessary to include some sites in the “white list”. Only one thought comes to mind - in some of the lists some site / domain is in the black list, but it “breaks” some “normal” sites and in the other list there is a “white list”, which still allows you to work site. But I have not seen this. And if I meet someday, and I really need this site, then I myself will manually add it to the white list (yes, I have to restart the device).
Examples of such possible cases [ 155 ] (all examples are bourgeois).
- “Target hosts file” and “Custom target” - setting for rare cases by choosing the path to the hosts file. For example, if you do not have a complete root, but you can get it temporarily, then you can create a symlink for the hosts file (something like a redirection for the file - a synonym for the path) and select where the new path to the hosts file is located.
- Enable webserver - you need a function only so that some rare applications do not "fool around" and do not close when ads and trackers in their applications are blocked. Instead of simply blocking requests, such applications will additionally be given an empty “response”. I do not use this feature.
- Enable crash reports / Send bug reports - I try not to trust anyone lately, I do not send anything to anyone. Until the developers work out some very transparent mechanism for sending bug reports, I will not send anything to anyone.
Menu:
Host sources (
Initially 3 subscriptions (lists))
These lists initially only contain lists for trackers and for mobile advertising (for the most part the one that pops up in applications).
These lists suit me, because in the browser I use my own powerful ad blockers and trackers (Fennec browser or Tor browser + uBlockOrigin + uMatrix). In rare cases, I use the Bromite browser (with a weak blocker) and I still have enough of these lists (since I do not use common sites). And I use the AdAway functionality itself to catch requests from the LOS itself and rare applications (by the way, I didn’t catch anything serious in LOS).
Here are the lists that can be connected optionally [ 157 ], [ 159 ], [ 161]. Here is a separate list for Google and Qualcomm (including A-GPS servers and LOS statistics) [ 163 ].
Do not add many subscriptions, the Internet will work more slowly (or the device itself will work slowly) if there are many rules in hosts. But if it’s not possible to use blockers in the browser, then it’s better to try to look for good subscriptions. For example, if you do not like Fennec + uBlock Origin, then you can use Bromite + additional subscriptions in AdAway.
You can also import your static lists. Note that it is necessary to palm off in the format of hosts of the type:
127.0.0.1 yandex.ru
other formats are not understood by the program.
- Your lists
Here are the rules that you set manually. These rules take precedence over those in subscriptions.
a) Blacklist (Black List) - you can add it right there manually or from the log.
b) Whitelist (White List) - you can add it right there manually or from the log.
d) Redirects (Redirects) - I do not use. For advanced users. Can not say anything.
- Log DNS requests - Displays the log of blocked / missed requests. Unfortunately, this log must be enabled every time the device is turned on. But I often use this tool.
Firstly, during the initial setup of LOS itself, I constantly looked at which sites LOS itself “knocks” on. Also, when installing any programs, I do the same. If I don’t like something, I immediately blacklisted in the log. Or vice versa, if some application does not work, I look at which sites were blocked and why the application does not work. But since I have all the applications from F-Droid, I did not find any "extra" requests.
To check, you need to enable logging, clear the log (button at the top right), run the application and figure out which sites were involved.
I want to share my findings with you:
-Scan for adware ( Adware) — «» . , , - , .
Orbot is a program from the Guardian Project to launch Explorer into the Tor network on an Android device. Also, this organization (Guardian Project) previously developed the version of Tor browser for Android - Orfox. Now they are working closely with the development team of Tor network and Tor browser for computers to create a version for Android.
At the moment, there is a separate Orbot and Tor browser (with built-in Orbot). Orfox is no longer supported.
Orbot lets you run any application through the Tor network. The program is gradually improving, but the latest versions are in the beta stage and work poorly on some devices. The last version that works stably for me is 16.0.5-RC-2.
Orbot is actually very easy to set up. You should only start it, wait a little time (at the first start it can last up to 2 minutes) and wait for the status “Bootstrapped 100%: Done”. Further, there are options:
1) In the settings of a specific application, if there is such an item "Work through Tor" - specify this item and the application will work through Tor.
1.1) In the application settings, there may not be a point “Work through Tor”, but there may be a point work through a proxy. Next, in the settings of this proxy, install host: 127.0.0.1, port 8118.
2) VPN mode (VPN ), , Tor ( ) Tor-Enabled Apps/ Tor. VPN Orbot Android VPN . «Always-on VPN/ VPN» ( VPN ) «Block connections without VPN/ VPN» ( , Orbot. - ). Tor -VPN ( , VPN ).
3) iptables ( AFWall+) , Tor VPN , « Tor». , , DNS Tor.
:
-«Use Bridges/ » . - , 4- ( 3 ) .
On the left on the main screen there is a choice of the country of the Output node. Selecting a country from the list will force Orbot to sort through the chains so that sites show that you are from this country. I highly recommend not doing this, because after a while enough statistics will be gathered and you may be recognized by indirect signs. If you still need to (for example, the site works only in one country), then after you go to the site, it is better to go back to Global (Auto). Also, this functionality is unstable.
In the upper right corner there is a button in the form of a round arrow, when clicked, the chains should be rebuilt. It is useful if it doesn’t let you to a site from a specific output node. Some sites know many Tor output sites and do not allow access to these sites from these sites. But they don’t know all the output nodes and can put you on their site after you have updated the chains. This functionality sometimes does not work, sometimes the chains do not change. You must turn off the Internet, change the chain and turn on the Internet again.
In the menu "Settings"
- Start Orbot on Boot / Run Orbot at boot - for those who are going to use Orbot on an ongoing basis, you should enable this item.
- Open Proxy on All Interfaces - for a specific situation, for example, to distribute the Internet (tethering) immediately with Tor.
- Entrance Nodes / Input nodes - specify a limiting list of Input nodes (servers) through which Orbot should build chains. The functionality is unstable. Yes, and limiting the number of nodes is not recommended to avoid a decrease in privacy.
- Exit Nodes / Output nodes - specify a limiting list of Output Nodes (servers) through which Orbot should build chains. The functionality is unstable. Yes, and limiting the number of nodes is not recommended to avoid a decrease in privacy.
- Exclude Nodes - specify a limiting list of OUTPUT nodes (servers) through which Orbot should NOT build chains. The functionality is unstable. If you know that some servers belong to attackers, you can add them to this list.
- Strict Nodes - Orbot instructs to use ONLY the above nodes. Without this setting, Orbot will try to use the above restrictions, with the same setting Orbot will be obliged to use the restrictions. The functionality is unstable.
- Use Bridges - the same setting as on the main screen, but here you can manually specify the address of the bridge (additional link in the chain). It could be your own junction / bridge.
- Relaying - permission to be an input or intermediate node (NOT output). Do not do this on a mobile device in order to avoid internet consumption and battery drain quickly.
- Isolate destination addresses - ATTENTION, IMPORTANT setting. The inclusion of this item allows for different applications to use different chains and output nodes. If this item is turned off, then when you request to the same site, but from different applications, the same IP will be used (that is, the same output node). For example, you go to yandex.ru in a browser and look for something “piquant”, and if you log in to Yandex in another browser, Yandex will instantly “figure it out” to you, that is, it will connect you by IP and the time you visit the sites. With the IP setting turned on, they will be different (which cannot be achieved with a normal VPN).
The downside is that this setting eats up the battery a little more.
, , - ( , ) - proc/net. IP proc/net. .
— No Network Auto-Sleep/ — Orbot «» . . Captive Portal connectivitycheck.gstatic.com, , «». .
: Orbot will not be able to start if the date or time on the device is set incorrectly.
The proc / net problem - there is a huge privacy problem due to the fact that any application can read the proc / net file and see which IP addresses which application is connecting to and see the statistics of accesses to IP addresses in recent times. This IS NOT BLOCKED ANYTHING. Not a single remedy helps. You can install a Net Monitor (org.secuso.privacyfriendlynetmonitor) [ 131] . IP . « » () . VPN-, Orbot, Privacy Guard, xPrivacyLua . — , IP . : IP IP . 99% , !!! IP , , 99%-, 100% . , .
Google Android 9 P, «» Google Android 10 Q ( LOS 17).[165]
, ? [166], , Facebook . , .
In general, it is unclear whether it will be possible to disable these accesses even in the Android 10 Q version. More precisely, for this information, you will need to request information through the NetworkStatsManager and ConnectivityManager classes methods. But it is unclear what resolution this applies to and whether it will be possible to block this permission (at least in AppOpsX). When introducing a new restriction, Google allows older applications to bypass it for another year after the introduction of the new restriction !!! They regulate this with the so-called Level API (I will further describe this issue). In the same article [ 165 ], it seems like they mean that in the version of Android 10 Q they will not wait a year, but will include this restriction immediately for all applications:
“The following changes affect all apps running on Android Q, even if they target Android 9 (API level 28) or lower.”
A small victory for privacy advocates, but I would not really hope for Google’s integrity. Let's see, the time before the release of Android 10 is a matter of days.
What to do?
Android Guardian Project 1) Orbot 2) Orfox. Orfox — - Firefox, Orbot. Orfox . Tor (Guardian Project Tor project) Tor Android . Tor Browser Android Firefox, Orbot ( Orbot), .
F-Droid Tor Browser:
1) Tor Browser
2) Tor Browser (Alpha)
Both applications are based on the same stable version of Firefox, but differ in versions of the Tor network and some additional settings. The regular (non-Alpha version) works more stable.
It differs from Orfox in that when you start the application you need to wait for the connection to Tor, and also in that you can set bridges (third-party and your own). As well as in a regular Tor browser for a computer, Mozilla’s tracking (telemetry) was removed from this browser, NoScript add-on was installed, all data (except bookmarks) was deleted upon closing, DuckDuckGo and other settings were set by default as a search engine (for example, WebRTC was turned off). There is also a separate setting for Security Settings.
() . , . , . , . «» , (browser fingerprint) ( ). JavaScript [167].
, Tor Browser proc/net, AdAway ( hosts).
As a result, I use 4 browsers:
1) Tor Browser (Alpha) with optionally installed uBlockOrigin, uMatrix (everything that is blocked) for daily use.
2) Tor Browser without additional extensions for sensitive issues. I rarely use it.
3) Fennec with optionally installed uBlockOrigin, uMatrix (where everything that is forbidden is forbidden) and working not through Orbot to visit sites that do not open through Tor. I use it very rarely, try not to go to such sites (which do not open through Tor).
4) Bromite - for those cases when the site does not open in Firefox-like browsers (Tor Browser and Fennec are based on Firefox). There are few such sites.
If you will use several browsers, I advise you to put different themes, so as not to accidentally go to any site in the wrong browser.
General information about Tor:
ATTENTION: Tor Browser will not be able to start if the date or time on the device is set incorrectly.
There are two more browsers that I would like to cover.
Fennec (aka Fennec F-Droid) is a slightly redesigned version of Firefox with telemetry (trackers) partially disabled.
Let's go through the Settings
- Sign in - the ability to register and enter Firefox Sync to synchronize bookmarks, passwords, open tabs and history. It seems like everything is encrypted “by default” even from Mozilla itself [ 171 ]. You can even try making your Firefox Sync server [ 173 ].
I don’t really need cloud services, but the bookmark synchronization service would be useful to me. I’m in thought between
1) Own Firefox Sync server
2) Own server with Nextcloud - an almost complete set of cloud services on your personal server.
3) Own server with Turtl - note service, including bookmarks.
4) Wallabag - an analogue of Pocket. Not only saves bookmarks, but also deflates sites. You can make your own server.
I cannot recommend Firefox Sync because I could not find an audit of this solution with the audit results in a relatively broad discussion. And bookmarks, passwords and browsing history are very sensitive data. Mozilla (Firefox developer) has not yet been caught in a blatant lie. There was and remains a case with analyzer tracker from Google when you go to addons.mozilla.org/en-US/firefox to search for new add-ons . But they especially did not hide it. Also, Firefox Sync does not work in the Tor browser.
Unfortunately, there is no bookmark export feature in mobile versions of Firefox-like browsers.
I tend to Nextcloud, simply because it’s easier to configure and has more users (and therefore more examples of settings on the Internet). And also a very wide functionality.
- Search - select DuckDuckGo. If you do not have DuckDuckGo in the list, then add later. Google, Yandex, Mail.ru, Yahoo and Bing are best removed even from the list.
How to add a search engine to Fennec, if it is not in the list of proposed
, DuckDuckgo.com. «Page/» — «Add a Search Engine/ … ». -. , , ( utm , ).
— Show search suggestions/ — , - , « 8 999 77 5-55-55» . . , cookies ( ) . .
— Privacy/
- Do not track - useless setting. If it is, then the site is sent a PLEASE do not track you. They themselves are not funny? There was a study where it was shown that those who changed this setting, on the contrary, were more vulnerable, since the request not to track you was part of the technique for collecting browser fingerprints. Therefore, leave this setting as it was originally (whatever it may be) so that it is as similar as possible for more people.
- Tracking protection - Minimum blocking of trackers based on the Disconnect list. It doesn’t even block Google and a bunch of other trackers. You can disable it (of course, by pre-installing and configuring uBlockOrigin).
- Cookies - set Enabled, excluding 3rd party / Enabled, except for third-party sites
— Clear private data on exit/ . . , . , ( , Android , «»), . «Quit/» , . - - , . , «Quit/».
— «Mozilla Location Service/ Mozilla» — Wi-Fi GPS Wi-Fi. . - ( Google , ), - , .
— «Fennec Health Report/ » — . .
— Advanced/
— Restore tabs/ — .
IceCat, Firefox. [113] — , Fennec - , Firefox ( Fennec).
HTTPS Everywhere, uBlockOrigin ( ), uMatrix ( -). WebRTC (about:config → media.peerconnection.enabled → false). NoScript ( uMatrix) XSS, uMatrix, XSS.
.
This is a redone Google Chrome. It’s faster than Fennec, but it doesn’t have a very strong ad blocker and tracker (and thanks for that, it doesn’t exist at all in regular Chrome for Android). Therefore, I use it in rare cases when some pages are seriously buggy in Fennec (hello to the developers of the mobile version of habrahabr).
In the settings:
- Search engine / search engine - DuckDuckGo.
- Privacy / Personal data
- Close all open tabs on exit - turn it on. Deletes open tabs when clicking on "Exit / Exit"
- Search and URL suggestions / Turn off search and URL suggestions.
- Use page prediction / Turn off the pages previously - turn off.
- Access payment method - I turn it off.
- Usage and crash reports / Usage and crash reports - TELEMETRY. I disconnect.
- Open links in incognito tabs always - always open tabs in incognito mode. In essence, this is the same as "Delete data (cookies, site data, visit history) upon exit." I'm turning on.
- Do Not Track / prohibition of tracking - do not change. As it was originally, let it remain so.
- Tap to Search / Click to search - turn off definitely.
You can also turn off JavaScript from the main window, which I advise you to do if you go to sites through Bromite just to read articles. But some sites with JavaScript disabled may not work.
Initially, LOS does not contain proprietary Google applications (except for some devices with preinstalled programs for Google’s mobile operator, Google Fi). If you need them, then you can install them yourself. Usually this should be done immediately after installing the LOS without rebooting the device.
Actually, not separate applications are installed, but a whole set of system applications (package), which is deeply installed in the form of system applications and services.
Why you might need a set from Google
1) Normal (mail, maps, Chrome browser) Google applications will not work without preinstalling this package, even if you download these applications separately.
(Youtube can be used in other applications).
2) Some other applications will work only if you install this set of applications. Some applications will be trimmed in functionality. For example, applications that rely on Google maps (use the Google backing) may or may not start at all, or part of the functionality tied to maps may not work.
There is good news: applications for Russian consumers in most cases will start and will work without Gapps. Recently, generally in Russia, they are gradually moving away from being tied to Google (they are making their own substrate based on Yandex cards, Bing, Openstreetmap cards and its derivatives). This slightly increases the size of the applications, but it works. Russian banking applications also work without Google Apps (including root).
3) Push notifications. In order to receive data updates from the Internet (for example, in instant messengers, email clients), you need an Internet connection. If many applications will constantly have an Internet connection, the device’s battery will drain faster. Therefore, Google proposed its GMC function [ 175 ]. The device maintains a constant connection with the Google server, and when a new message is received, the messenger / mailer server sends a message about it to the Google server, and Google sends it to your device. The plus is that the device does not need to support many connections with the servers of all applications and does not need to keep all applications turned on in the background.
It is also a plus for developers that they need to write less code and come up with their own implementation of sending notifications.
F-Droid . , , Google . Gapps Google ( ), «» , Gapps 1-2 , , , Gapps.
4) To quickly determine the geolocation by Wi-Fi or cell towers. Without this, navigation will be determined only by GPS. Some believe that even by GPS, geolocation will not be determined - this is a mistake !!! It’s just that for GPS determination it is necessary at the first start to wait in an open area without moving for about 10 minutes, when the satellite data is updated. Then if you rarely turn on navigation - 2 minutes. If often - 10-15 seconds. Everyone just forgot what a first start is, a cold start, a warm start, a hot start to old navigators.
In LOS, 3 types of packages work (and are fairly tested)
For the Russian consumer, developers make applications without a tight binding to Gapps. In principle, I try to use only applications from the F-Droid, so this does not bother me much. A couple of applications (banking + one at work) work fine without Gapps and with root. Friends say that public services, taxi services and so on - everything works fine without Gapps.
The only thing that would be useful to me is determining the location via Wi-Fi and cell towers. It seems like you can separately install UnifiedNlp (from microG) + download the base of towers and Wi-Fi (through one of the backends). I have not figured it out yet, but it seems like this can be done without signature spoofing on the official LOS.
If you do not use Gapps, then you do not have Google Play Market. But you may need some applications that are only available on Google Play. Downloading them from other sources can be dangerous. For such cases, there are applications that can download applications from Google Play:
1) Yalp store (com.github.yeriomin.yalpstore)
2) Yalp Store (fork) (com.github.kiliakin.yalpstore) - since the original Yalp store is not updated, then made a fork (branch) of the application.
3) Aurora Store (com.aurora.store)
All three applications have similar functionality. Please note that Google periodically tightens the screws and these applications may sometimes not work, or lose some of the functionality, for example, application search does not work well, it is better to search by exact name.
. - , Google . , ( ) . , MicroG, Gapps ( Google Play Market).
( ) Google Play split apk — apk . Yalp , Yalp , .
Almost (in 99% of cases), all applications from Google Play have trackers. What are the most popular trackers in the application, you can see on the site [ 61 ]. Or by downloading the Exodus Privacy [ 63 ], ClassyShark3xodus [ 65 ] applications . VERY INTERESTING INFORMATION !!! REQUIRED TO VIEW. We open, for example, data on the Yandex browser [ 183 ]. And what do we see?
-AppMetrica
-Facebook Ads
-Facebook Analytics
-Facebook Login
-Facebook Share
-Flurry
-Inmobi
-Yandex Ad
, ? Facebook Ads, Facebook Analytics, Facebook Login, Facebook Share — . Flurry — Yahoo. Inmobi — Mumbai, India. , , Facebook Yahoo?
MAPS.ME Mail.ru [185]. ))
, - , - «Crash», «Bug» — .
Facebook [187]. . Facebook ? [189]. Facebook does not need to embed individual trackers in their application, since they collect all the data without separate tracker modules anyway.
As a result, Exodus is a very interesting tool, when using which you can finally realize that in the modern world your data is not yours. But you can not rely solely on Exodus, applications can collect data without embedding individual trackers. And the data can then be sold separately, through other channels.
We approach the most important thing - permission control or access control. I have already described most of the permissions for Internet access. She also described what is included in the concept of “Special app access.”
Let's denote the types of permissions:
Let's go through the restriction tools:
I have already partially described the restriction tool in Apps & notifications -> Special app access. Various restrictions are presented here, which may not directly apply to any type of restrictions, may apply to normal (CHANGE_WIFI_STATE).
The standard permission mechanism for Android: Apps & notifications -> Advanced -> App permissions
Only permissions with the Danger type are listed here. Everything is clear here, you can only enable or disable permission groups. But there is also another type:
“Additional permission” item, where some applications create their permissions, access to which can be given to other applications [ 193 ].
LOS: Security & Location ( )->Trust (Trust)->Privacy Guard ( ) ( — PG)
, LOS. , LOS, /.
LOS - — .
«Enabled by default ( )».
You can also enable “Show notifications” at first. This setting will display in notifications that some application is controlled by PrivacyGuard. In fact, even if you set PrivacyGuard to not block anything, the tool itself records the number of calls to this or that resolution. Notifications show that some application is running, and the number of calls can understand how much this or that application is "impudent".
Immediately, you can enable the display of system applications "Show built-in apps (System applications)." At first, I also turned on this setting, so that later I could see the number of calls to a particular resolution by system applications. I did not find any explicit attempts by any system applications to get extra accesses. If there were any calls, then this is because Android is so arranged and I found an explanation for this on the forums. For example, when you select a Wi-Fi network, it appears that the system application is gaining access to the location (like any other application). In any case, for self-education, you can enable tracking for system applications at first.
. , .
. /, 3- :
) Allowed () —
) Ingored ( Disallow) () —
) Always ask () — , .
The Always ask function is useful if there is any application that would not want to give constant access to something, but would like to use it. For example, give instant messengers with the function of calls access to the microphone. But you need to understand that if you gave some application temporary access to the repository (for example), then it can deflate / analyze all the files created earlier. Temporary access to the repository does not create a temporary separate folder (but I would like to), but gives temporary full access to your shared repository. So be careful with the Ask feature too.
In the menu, you can go to "Advanced (Advanced)", where you can see the access to access in the context of the access itself, and not the applications.
Privacy Guard «» , , , .
Privacy Guard «» . , «Start at power up ( )» — «RECEIVE_BOOT_COMPLETED» «Run at startup» Android. , . , , .
:
, «» , Android Privacy Guard . [195] [197] , :
) — , PG — :
) — , PG — :
) — , PG — : , PG, .
) — Forbidden , PG - Forbidden : access is not granted
e) Standard permission - Forbidden , PG - Ask for : access is NOT granted
e ) Standard permission - Forbidden , PG - Forbid : access is requested each time
But since LOS 16 has come out and apparently something has changed. My point b) now looks like this: Standard permission - Forbidden , PG - Allowed: access is NOT granted.
That is, in LOS 16 settings are more tightened towards privacy. If at least something is forbidden, then there will be no access.
There are still moments:
- In versions LOS 14, 15.1 there were failures in the work of Privacy Guard. It seems to be fixed in 15.1, in the 14th version I don’t know (but it is no longer supported).
- If you installed Gapps, either you won’t be able to limit them, or the settings themselves will switch to the “Allowed” state as soon as you exit PG, or the device can enter Bootloop and have to reinstall LOS (or get a little tricky [ 199 ]) . This does not surprise me. Another confirmation that Android with Gapps installed is becoming the property of Google, not yours.
— , . Google Android , , . API level ( ). , - , , , .
— PG [201] ( ) Android- LOS .
, , F-Droid, , Android PG.
This application essentially performs the same function as PG, only there are additional settings that are not in PG. For example, instead of a separate change your audio settings, many small settings are presented, such as Control the volume of signals, Control the volume of notifications, and so on.
From what I would also like to mention: the ability to configure permissions for accessing different sources of location in more detail, such as Mock location (from a separate application that can make a fake location - hello to Pokemon guides), Approximate location (NEIGHBORING_CELLS) - for determining by cellular towers.
To be honest, I did not test the possibility of a detailed restriction of location sources in AppOpsX, since there:
Also in AppOpsX there are other settings that are not in PG and in the standard Android settings, and which I found useful. For example:
Read clipboard (Modify clipboard) and Modify clipboard (Change clipboard). Such restriction functions should appear in Android 10 Q, but it already exists in AppOpsX in Android 9 Pie.
If some settings that are in AppOpsX, but which are not in PG, are disabled in AppOpsX, then they will also appear in PG. It is sometimes inconvenient for perception.
There is also an inconvenience in the fact that if you prohibit something to the application in AppOpsX, and then return access, in some cases access will return only if you restart the smartphone. I don’t know what it is connected with.
Let's go through the settings.
- Automatically turn off permissions - a feature in which AppOpsX disables permissions immediately when installing the application. Unfortunately, on some devices with Android 9, Pie AppOpsX does not work in standard mode (just with root) and this function does not work in this case.
- Close permission template automaticaly (Template for automatically disabling permissions) - select which permissions will be disabled when Automatically turn off permissions is enabled
-Use ADB mode ( ADB) — AppOpsX , ADB. ADB over network (ADB ) AppOpsX Use scipt start server ( ). AFWall+ AppOpsX localhost LAN control/ .
— Allow running in the background ( ) — , «Automatically turn off permissions ( )»
-Root compatibility mode ( ) — AppsOpsX, . LOS 16 (Android 9) . Automatically turn off permissions ( ).
— Show system apps ( ) — LOS, . , , System . LOS (, ), .
In the menu itself, you can enable the mode of viewing permissions not by applications, but by permissions, which is very convenient.
[203], [205] ,[207], [209] .
, :
ACCESS_WIFI_STATE — View Wi-Fi connections
CHANGE_WIFI_STATE — Connect and disconnect Wi-Fi
INTERNET — Full network access — Android ( LOS) AFWall+
RECEIVE_BOOT_COMPLETED-Run at startup — , , 100% (, , Orbot, AFWall+,AdAway )
READ_PHONE_STATE - Read phone status and identity - restrict access to many non-resettable data. But do not rely heavily on this limitation, many data can be obtained in an indirect way.
WAKE_LOCK-Prevent device from sleeping - I limit to those applications to which I also limit work in the background.
READ_CLIPBOARD-Read clipboard - I don’t know if applications can access the clipboard even if they don’t “clamp” the tap for a few seconds to call the clipboard menu. Just in case untrusted applications, I turn off the reading of the clipboard.
RECEIVE_MMS - I advise you to disable even the default application. Especially if you do not have the latest version of Android (or LOS). Previously, too many bad things came through MMS.
And of course I restrict all permissions with the Dangerous type (dangerous) to those applications that do not need it.
The above recommendations do not mean that you should rely only on my experience. I advise you to study everything yourself.
Now let's move on to the "fun" - permissions that are practically or even impossible to limit:
, Android 10 Q ( Android 5,6,7,8,9).[215]
I did not find how to limit the application to launch other applications. This was a frequent occurrence in versions of Android 6 and 7, but recently I have not seen this. Either Android limited this opportunity, or due to the fact that I carefully select applications, this now does not happen to me.
Google Android - , - , - , - . Android Level API.[225]
Android - , . — Scoped storage. Android 10 Q Level API=29. , , Android 10 Q Android 10 Q . - Level API=28, Android 10 Q . SD-, (, , ). , , , ! Level API ?: Google Play Android Level API , API. Google - .
, Android, Level API .
Level API «apps_Packages Info
(com.oF2pks.applicationsinfo)»[227]. , Level API ( SDK) .
Level API/SDK Google Play .
Let's look at the example of such a “wonderful” Telegram messenger permission to read and write to the repository. Aside from the fact that in telegram registration is only by phone number and the code of their servers is closed, let's talk about how their chats work. There is a problem that user alex0ff [ 229 ] described back in 2014.
I will describe the version from F-Droid in which the folder structure has not changed [ 231 ].
Watch your hands (sim salabim) - applications have several options for storing their data:
:
) sdcard/Telegram. . . . [211], [213]. , — . Facebook proc/net IP ( ). , Facebook ( WhatsApp Instagram) ? .
b) in principle, all files from secret chats should not be stored in the general storage. In fact, the files (but not all seem to be) are stored in the sdcard / Android / data / org.telegram.messenger folder !!! They are seen by all applications with access to the repository. Why are they not saved in data / data / org.telegram.messenger so that no one can see them? Too many questions from me and so few answers from Paul.
So, if you do not understand anything from what I wrote, then I will describe it more simply :
, Telegram WhatsApp. , ( , WhatsApp ). WhatsApp 99%-, . .
, Telegram WhatsApp. ( ).
. , . Conversations AdAway.
. ( ) WhatsApp-[233]. — WhatsApp. , WhatsApp, WhatsApp- ( ), WhatsApp-, .
, , , .
, WhatsApp iPhone.
Historically, the internal memory of the device was called an SD card, as in the first devices there really wasn’t a normal memory chip and it was replaced by an SD card (soldered). Now, chips with a normal amount of memory are installed in the device and the name has changed to " usb-storage». SD SD (, ). Android sdcard . SD , - , SD ( — ), SD . , SD .
[69].
Standard Android has a separate feature called the Work Profile. It is needed in order to have two spaces on one phone - your personal and for work applications. In order for the work profile to be activated, you need to install a special application from your employer. But you can use this mechanism without "foreign" programs by activating it using the Shelter application (net.typeblog.shelter) from F-Droid.
The first time you run this application, you will need to give access to “Install unknown apps” and Device admin apps. Serious enough rights, but they are necessary for the application to work. At the same time, this application does not ask for Internet access and does not ask for root access, it is open source (unlike the analogue of Island).
, , 5 . ( Android) . .
LOS 14, 15.1 16 .
?
—
—
—
() :
— proc/net — IP .
— IMEI
— .
, , , . , EMEI. , , (Wi-Fi ) .
. Accounts () . «Work profile settings ( )» «Contact search ( )»
Shelter , .
Shelter:
:
1) AdAway — AdAway , .
2) AFWall+ — AFWall+ , . — AFWall , . , .
AFWall+ «Dual apps Support/ »
3) PrivacyGuard — , PG. PG - . Advanced () .
4) AppOpsX — «Users ()», «Work profile».
, AppOpsX.
5) Orbot VPN — , Orbot — Tor Orbot- Tor.
, — «RECEIVE_BOOT_COMPLETED Run at startup»
, VPN/Tor.
, , IP proc/net.
XprivacyLua — Xposed.
, «» . Android, ( [235]).
XprivacyLua signature spoofing, , , , - .
XprivacyLua proc/net.
XprivacyLua Android, .
ADB [237], [239]
, adb LOS, .
, - «» , adb [241] ( , ). , , . Facebook — :). Google Play «/» , - ADB, . 4pda .
PG AppOpsX, adb. . [243]. revoke — .
ADB, ADB, , .
, LOS Google (Gapps), , Google. , LOS / Google /[245]. , LOS 14, 15.1 16. ( ).
DNS — Google DNS. , DNS 8.8.8.8
Google , IP. , .
Android Wi-Fi DNS . DNS Google-. Orbot ( AFWall+) — , DNS Google. , dnsleaktest.com[59].
LOS 16 DNS , DNS, DoT — DNS over TLS. .[247]. DoT DoH ( IP). «» Google-.
LOS Android DoT Google, Cloudflare (1.1.1.1). — Cloudflare , , . Cloudflare. ( ).
Settings > Network & internet > Advanced > Private DNS «Off», DNS .
DNS — . Orbot DNS IP , IP Tor.
Captive Portal — . Captive Portal, . «https://captiveportal.kuketz.de».
A-GPS — A-GPS . — IMEI!!! , Google . A-GPS . GPS ( AFWall+) . . , Android ( ), A-GPS.
AOSP Webview — LOS AOSP Webview. Chromium. . . , 4-5 Webview. Webview . — K-9 Mail.
AOSP Webview Google . AdAway — AOSP Webview K-9 Mail Google.
AOSP Webview Bromite Webview[97], .
AOSP Webview , 1- : WebView , WebView. DuckDuckGo [249] Google[251].
Project Fi — Google LOS . , [245]. . , , , , LOS.
- , . TWRP — [253],[255].
:
— ( LOS 15.1 LOS 16)
— firmware
— ,
— ,
— ( Nextcloud), , .
— , ( ). , , , «» .
, . , LOS 15.1 LOS 16, LOS . , .
, — .
, TWRP , . ( ADB), .
, (, ) , EDS Lite (com.sovworks.edslite) . , Android. , , .
, - ? !
, Wi-Fi GSM ( ) USB . . , ( , ).
Android 6, LOS 13[265],[267]. , . , Android 6 ( Replicant Android 4.2)
( ) Android. (, proc/net). Pixel 3a, Pixel 3a XL, Pixel 3 and Pixel 3 XL[269]. (AdAway ). Gapps, . GrapheneOS Android 10 Q. - Pixel 3a, .
Librem 5 — Linux[271], [273]. . — , Wi-Fi (). , (700$). , .
Ubuntu touch — , ( Ubuntu Phone[275]). ( ) . [277]. , , .
, Apple , Google, Siri, :
. — Apple , ( ) .
— . Google Apple ( ) . — Android 10 Q . , .
Linux (PureOS, Ubuntu Touch).
( ). 150$ , 5 400$.
- - «» . Librem 5 Linux, ARM, Arm Holdings. Arm Holdings , [295]. , . - ( RISC-V), - .
. , ( ) .
— Google , , . Android Android-AOSP[297]. Android Miracast ( Chromecast), QUIC, DoT, DoH, DNS . , Android 11. , Google Fuchsia[299] Google (, Chromium ). Android . Google: Chrome, Google [301].
— . Huawei . Xiaomi , 3 . Xiaomi , . Nokia . Samsung .
, LOS.
- [303] — , , « ». , , , .
— .
— , [305].
— F-Droid. F-Droid.
— . , , , ( , ).
— - , ( Uber).
— Gapps .
— Magisk . — , .
— .
— , . , LOS. Huawei , Huawei - ( 3 ). , . , 2 . !!! , — 1000 , LOS — , , , LOS Android . , , . , — «» — . — - ?
— ( ) LOS. Android One. , LOS , LOS Android. Android 10 Q , , LOS 17 ( Android 10 Q). , LOS 15.1, LOS 16, - LOS 17 ( Android 10 Q).
, Ivi, Gapps. 10 — ( ). 70% , , «». Orbot , - .
F-Droid, :
1) . , . . — Gapps . - — , . /.
2) . F-Droid OSM (Openstreetmaps), , . , . — OSM . , — . : Google - (, ). Mapbox ( OSM), Google , , , Mapbox. OSM Mapbox — , Google . , , . №2 — [307]. Google . — ( «» ). — , , . . , OSM. , OSM , . . OSM — , . . .
, OSM. , , , .
, , , , , , . ?
, . — . — .
: , … ( ).
: , , . -, 70% LOS, Android iPhone ( WhatsApp). , LOS , Android . . , . .
: (), , … ( )
: . LOS ( , ).
: , .
: -, . -: ? , «» — , , , , . , , . « — .» , .
: , , « »? , .
: . , . , . , - ( , F-Droid). , , . 100% — . 95%, 15%.
: () . . . , , .
: . , . . « ?», « WhatsApp-e» , . , . . .
, , . . — , « ».
: Tor , , 6 . .
: — , . . , . , . , — / i2p, zeronet, yggdrasil /. , .
: Tor ? ?
: . , 2 2,2 . , Tor . Tor . Tor , DDOS . . — - ( Tor ). -, , «» . - — . 2 — .
: .
: - , . - , . — . . . , - LOS, — . . . , — , . - — . F-Droid. Fennec uBlockOrigin . LOS. - 4-5 . — , «» . , . Google . , ( , , ). . - ( «» ), ( ) .
: Google «» Android. LOS.
: «» . , Facebook (, , IP ) «» SwiftKey ( ), «». . . , xakep.ru .
: ?
: . , . . , , . ( ). , — .
. . , ( [309]).
, :
1) (, Orbot ). ? Android 9 - ? SuperFreezZ (superfreeze.tool.android)?
2) , SIM ( Defcon 21). SIM ?
3) - ? - ?
I think this article will be of interest to you even if you can’t install LOS for yourself, since this article also discusses the standard Android settings, settings and methods for using useful applications, the F-Droid app store, Android permissions that cannot be limited and other nuances that may be useful to you.
Table of contents:
general information
Reasons to upgrade to free firmware
Device selection
- The main factors to consider when choosing a device
- Device selection
Install LOS firmware
- Firmware update
- Unlock bootloader (unlock bootloader)
- LOS installation example
- What could go wrong
- Pre-launch preparation
- About device encryption
LineageOS
- Standard LOS settings
- Root / root / superuser rights / superuser
- Bootloader (bootloader)
F-droid
VPN slot
AFWall + (Android Firewall +) and built-in Firewall
- Built - in Firewall
- AFWall +
Adway
Orbot, Tor Browser and proc / net problem
- Orbot
- proc / net problem
- tor browser
Fennec and bromite
- fennec
- bromite
Google Apps (Google Apps / Gapps)
Yalp store / Aurora Store
Trackers in applications
Permission Control, PrivacyGuard, AppOpsX
- Types of permissions
- Tools to restrict permissions
—— Android standard permission mechanism
—— Privacy Guard
—— AppOpsX (com.zzzmode.appopsx)
- List of permissions
- What can not be limited
- Level API / sdk
- Regarding the need to track permissions
SD-card / usb-storage
Work profile and Shelter (net.typeblog.shelter)
XprivacyLua
ADB (Android Debug Bridge)
Complete abandonment of Google in LOS
- DNS
- Captive Portal
- A-GPS
- AOSP Webview
- Project Fi
Backup (backup) or backup
Separate encryption of personal files
Radio module firmware and low-level bookmarks
Other firmware
- replicant
- GrapheneOS
- Not Android devices and firmware
- What about the iPhone?
Prospects
General recommendations
Why is it better to use the latest version of LOS and current devices
My experience
Potential question is my answer
Transition techniques and partial (temporary) solutions
Questions for IT people
List of links
I advise you to pre-read these articles here (or after reading my article):
→ About LineageOS, MicroG
→ List of interesting programs in F-Droid (and not only in F-Droid)
→ About Android architecture in a less clear language, I advise you to read all 4 parts from the cycle. Everything is described there a bit in technical terms, but still I advise you to delve into it if you want to roughly understand the device and architecture of Android.
I will try to supplement these articles with such things as device selection, firmware, security and privacy settings, some software settings, and I will also provide methods for risk identification, which arise even in free firmware without proprietary components.
In the instructions, I will refer to the English and Russian names of the settings items for the operating system and programs, since at the moment the most complete help on issues can be obtained in English-speaking forums, and it will be more familiar to look for a solution to your questions.
The version of LineageOS 16 will be considered (in part, some points from version 15.1 will also be considered) and based on Android 9 Pie, respectively. Some of the described methods (more precisely, almost everything except Privacy Guard) are applicable not only to LineageOS, but also to other firmware on Android 9 Pie.
I tried to write the article “linearly” so that I could perceive the information without having to “jump” from point to point. But since many things are interconnected, the sendings were completely avoided. If at some point you find something incomprehensible, try reading the article to the end. If there is any obvious gap even after reading the entire article, please indicate where I did not look.
general information
LineageOS [ 1 ], [ 3 ] - firmware based on AOSP (Android Open Source Project), which is done by enthusiasts. LineageOS is a continuation of the CyanogenMod project. This firmware is not for all devices, since the creation of such firmware for each device is the work of enthusiasts.
Reasons to upgrade to LineageOS free firmware
- Privacy. LineageOS is based on the "clean" version of Android - AOSP without applications from Google and other applications from commercial companies. The absence of proprietary components increases privacy (coupled with other techniques).
The Android system (AOSP) is based on Linux and is distributed under a free license [ 4 ] and with open source codes (open-source). LineageOS is based on AOSP (with some additions from CAF - Code Aurora Forum for those devices based on Qualcomm hardware). That is, LineageOS is a firmware, just in which the proprietary services from Goolge are not added (and not cut out, as some people think). The fact that it is open-source allows you to look at the entire source code of AOSP and LineageOS for the presence of "tricks" (bookmarks). You can compile (compile from source) the firmware for your device based on the source code, if you do not trust the one who compiles the firmware. By the way, many do so, but mainly to add / remove something from the firmware. - Security. In some cases, LineageOS releases firmware updates for devices that are no longer supported by the manufacturer. If you already have a device that has not had security updates for a long time, then you can check to see if LineageOS firmware has been updated on your device with the latest security updates.
Also, if you are going to buy a new smartphone, you can choose a device that is supported by LineageOS, and which, with a high degree of probability, will be supported for a long time by the LineageOS community. - Additional functions. The firmware contains additional components, such as Trust, Call Recorder (Recording calls, voice recorder) and other minor improvements. Trust (+ Privacy Guard) allows you to centrally view and manage security and privacy settings. Call Recorder - record calls. Protected Apps - you can put access to individual applications only by a separate code or by fingerprint. Customization of the interface, Dark mode (Dark theme) and other useful functions.
- Protect yourself in advance from isolation, or from self-isolation.
Insulation. There are precedents for restricting the use of services by Western companies. Examples - a ban on the use of Western services in the Crimea. Ban on the use of Western services in Huawei products. No one guarantees that tomorrow the same restriction may be imposed on a wider circle of users or companies.
Self isolation. In the light of recent trends on the prohibition and blocking by various countries of services from "hostile" countries, no one will guarantee that tomorrow access to Western services and programs will remain in certain territories.
This is another reason to switch to free software in order to be less dependent on the whims of politicians of a country.
Device selection
I offer you a methodology for selecting a new device for installing LineageOS based on my experience. These tips are purely advisory in nature and I do not pretend to be absolutely objective.
Key factors to consider when choosing a device
- The presence of firmware on the device.
There are both “official” [ 3 ] versions of LineageOS, and “unofficial” ones. Officiality is that:
- the team compiles and “signs” the firmware with its key and puts it on its website [ 5 ]
- for "officially" supported devices there is relatively good support on the forums [ 7 ]. You can also look for support from developers directly on a separate device on the forums xda [ 9 ], w3bsit3-dns.com [ 11 ] and telegram channels. Such support does not mean that they will answer your question. But with a correctly posed question with a detailed description of the problem, the chances of an answer tend to 100%. Unfortunately, the vast majority of developers are English speakers. In these forums, not only developers themselves, but also other experienced users can help you.
- “officially” supported devices have the function of auto-updating “over the air” (OTA updates), that is, as in normal Android from Google, it will be possible to put security updates simply through a separate menu item on the phone itself.
Unofficial - compiled by enthusiasts. There are no updates over the air and sometimes contain viruses. Check whether such firmware contains viruses or not is almost impossible. Unless you yourself have assembled the firmware for a device that is not officially supported officially (which can be done only by good IT-specialists).
I highly recommend choosing a device that is available on the official website [ 5 ]. This is one of the factors of the stability of the firmware and the duration of the device support, as well as the fact that the firmware is not superfluous. In some cases, if the device is popular, and someone makes an unofficial version for it, then after a while the developer of the unofficial version joins the LineageOS development team (more precisely, the device’s maintainers), the firmware is executed properly and becomes “official”. This means that if, when choosing a device, your eyes fell on a certain model that has only an unofficial version of LineageOS, then you can search for information on this device in the English-language forum xda-developers for a potential release of an “official” version in the future. Such cases are not so rare.
Additional information on devices will help you: links [ 13 ], [ 15 ], [ 17 ].
There are also different sites where devices with unofficial versions of LineageOS are presented, but I don’t know what data were used to compile these lists and I can’t recommend them to you, just like I can’t recommend using unofficial firmware in general. - LineageOS version for the device. LineageOS 15.1 and 16 firmware versions are currently available for devices. Both versions support security updates, but LineageOS 15.1 is based on Android 8.1 Oreo, and LineageOS 16 is based on Android 9 Pie. It is better to select a device on LineageOS 16 version, since the higher the version of Android, the more privacy threats and more interesting functions are eliminated. I will write about this later.
- The version of the internals of the device. Some manufacturers under the same name produce several different versions with different "fillings". For example, there are a large number of versions of the Samsung Galaxy S5 LTE. There are several versions: A) klte, which includes revisions (G900AZ / F / M / R4 / R7 / T / V / W8, S902L), B) kltechn, which includes revisions (G9006V / 8V), and so on. Code names are used for quick identification. There are several versions of klte, kltekor, kltedv, kltechn, kltekdi for the above Galaxy S5 LTE. Perhaps there are other versions of the Galaxy S5 LTE for which there is no LineageOS firmware. Therefore, when buying a device, check the version with a specific seller.
- Ability to unlock the bootloader. Before buying, you need to clarify whether it is possible to unlock the bootloader. Even if the device has LineageOS firmware, this does not mean that you will have the opportunity to install it! In order to install LineageOS you need to have an unlocked bootloader. For some phones, this is done easily with just one step. But there are manufacturers who for some (or for most) of their devices have made a whole procedure for unlocking the bootloader. To do this, you need to register on the manufacturer’s website, enter information about the phone (or install a special program on the computer), send a request to unlock the bootloader and wait from 0 seconds to the 1st month. Huawei previously allowed you to unlock the bootloader, but then completely closed this possibility. There were workarounds, sites on which you could buy a code to unlock. These workarounds are constantly changing; for different devices, workarounds are different. For such cases, weigh the pros and cons, find out if it is possible to unlock the bootloader, how long it will take (if you go through the official unlocking procedure), how much does the code to unlock on a third-party site cost to bypass, and so on.
- The popularity of the device. The more popular the device, the higher the chances that support for this device will last longer. Even more important is the popularity of using LineageOS for this device. Use statistics can be viewed on the official website [ 19 ]. There is also an unofficial, but more representative site [ 21 ]. Note that A) some names are indicated by code words (codename). B) those devices are also presented that are not officially supported, but are used.
- Filling. All other things being equal, I recommend choosing a device with a Qualcomm chip. Devices on these chips are supported on average longer and wider than devices on other chips.
- Other firmware and initial firmware. If there are alternative firmware for the device (besides LOS), then this means that there are many who “dig around” in the firmware internals for this device, which increases the chances of being able to find a solution to your problem if it arises. It is also important to pay attention to which firmware was originally installed on the new device. Best if the smartphone is part of the Android One program. This means that Google for such a device will force manufacturers to release security updates, updating to new versions of Android for 2 years. These updates will help LineageOS developers support the device longer. Please note that the fact of entering the Android One program does not guarantee that the bootloader can be unlocked and there are firmware for the device other than the original one. For example, smartphones from Nokia, which are part of the Android One program, do not have the ability to install alternative firmware.
- The novelty of the device. Remember that LineageOS enthusiasts are developing and at some point these enthusiasts may have their own device changed (broken, lost, bought a new one). In this case, they may not be interested in further support of this device. For example, Xiaomi Redmi Note 5 (Pro) was officially supported for no more than a year (although there are also unofficial LineageOS firmware for it). But such a device as LG G2 (d802) has been supported since 2013 and has even the latest version of LineageOS - 16. For the longest support, it is advisable to buy a relatively new device, which is still sold internationally.
- The remaining parameters that relate to the consumer characteristics of the device. For example, RAM size, processor speed, supported LTE frequencies, and so on. I recommend buying a phone with at least 32 GB of internal memory so that you have to use “clouds” less, thereby reducing the risk of leakage of your data. Please note that some specific things on the smartphone may not be supported, for example, such as infrared, unlocking the face based on the shape of the skull (in addition to photos), special effects of the camera with several lenses. But in the latest versions of Android, some of these functions (for example, full support for several rear camera lenses) are embedded in the system itself and most likely there will be no problems with this.
Device selection
Next, I offer you one of the possible methods of selecting a smartphone for the purchase and installation of LineageOS. Suppose you need a smartphone in the middle price category up to 15,000 rubles without any frills.
- We open a site with statistics on the use of LineageOS [ 21 ] and begin to browse smartphones from more popular to less popular. Smartphones that have a separate link in the name are officially supported at the moment.
- The most used currently officially supported is OnePlus One. We look at the year of release - 2014. But they are not sold in Russia, and as far as I understand, they are not sold abroad either. Move on.
- Next on the list of popular and sold in Russia is Xiaomi Redmi Note 4. 2017 release. But for this model there is only a version of LineageOS 15.1 (although security patches are also released on time). Suppose this suits us (but I will describe the advantages of the newer version of LineageOS below). We go to the w3bsit3-dns.com forum (and other forums), look for this particular model and see that there are two versions of the device - on the MTK chip and on the Qualcomm Snapdragon chip. Once again we check whether the version on the Snapdragon chip is sold in Russia (only for this version there is LineageOS). We call the seller and ask if the version on Snapdragon is accurate and for which market the device is (it is necessary to buy a global version, since this version has more supported 4G frequencies). Take note of this version.
- We are looking further. Xiaomi Poco F1 is too expensive. Xiaomi Redmi 4 (X) - a situation similar to Xiaomi Redmi Note 4. ZUK Z2 Plus - is not for sale in Russia. OnePlus 3 / 3T is too expensive. And so, in turn, we reach the Xiaomi Mi A1. Sold on pure Android, included in the Android One program, no need to wait for the bootloader to unlock, there are no critical messages on the forums.
As a result, if I chose devices up to 15,000 rubles, I would choose something between Xiaomi Redmi 4 (X), Xiaomi Redmi Note 4 and Xiaomi Mi A1.
ATTENTION: this is only one of the possible methods for selecting the device, I am not responsible for the fact that at some point the LOS team will stop releasing updates on your phone or that you cannot unlock the bootloader. Read everything carefully and make an informed decision.
Install LOS firmware
I advise you to first read all the installation instructions for a specific LOS device on the LOS website, additionally read the topics on w3bsit3-dns.com, xda-developers, reddit.com/r/LineageOS and from this article (some warnings).
Firmware update
After purchasing the device, you need to update the stock (original) firmware of the smartphone to the latest version. The fact is that Google is gradually dividing Android into different layers so that the top layer can be updated separately, which will increase the ease of developing new firmware for older devices (for any version of Android). The LOS team also took advantage of this opportunity, updating only the top layer. But for correct operation, it is better to install updates of the original firmware in order to update not only the upper layer, but also the lower layers (firmware). To do this, you will have to connect to Wi-Fi and find the “firmware update” item in the settings. You may have to do this several times in a row.
Manufacturers often hide the menu item “firmware upgrade” if you unlocked the bootloader. Therefore, it is recommended that you update the original firmware before unlocking the bootloader.
Attention: Huawei (including the Honor brand), at the moment, have closed the ability to unlock the bootloader. But for different devices of this company, there are different workarounds for unlocking the bootloader, which only work on older firmware. If you still decided to purchase a device from Huawei for firmware with alternative firmware (for example, LOS), then read the w3bsit3-dns.com, xda-developer and others forums on a specific device in advance on unlocking the bootloader. For these devices, it may be better to first unlock the bootloader, and then update the firmware.
Unlock bootloader
For some devices, you need to unlock the bootloader through a special program.
On the example of Xiaomi devices (example instruction [ 23 ]):
- We create a Xiaomi account on the phone, indicate your phone number, email.
- We receive SMS with a code for registration.
- Verify account
- We go to en.miui.com/unlock and go under your account. There may be problems with the fact that sometimes sites are displayed in Chinese. We are looking for menu items to switch to the English version.
- Download the program from en.miui.com/unlock/download_en.html . Please note that this program only works on a Windows computer and it requires internet access.
- In the Mi Unlock program in the settings, we find the Install Drivers item, click it and wait for the drivers to be installed.
- On a smartphone, in the system settings, click on the line with the MIUI version several times in a row and the developer settings hidden menu opens (developer / developer settings)
- Further in Settings -> Advanced settings-> For developers we find the item "Debugging via USB", and there may also be additional settings such as "Enable OEM unlock", which also need to be enabled.
- We connect the smartphone to the computer. We reboot the smartphone into fastboot mode (we simultaneously hold down the volume down button + the smartphone’s power button until fastboot appears).
- In the Mi Unlock program, you need to log in under your account. Next, the program should determine the smartphone. You press the “Unlock” button, confirm several times and wait for the result. If the smartphone is relatively new, then you will be shown a warning that the Nth amount of time is left until the smartphone is unlocked. It can be from 72 hours to 1440. Relatively old models should be unlocked either immediately or in 72 hours.
There are a lot of such instructions on the Internet. I brought this procedure in order to warn about some of the nuances.
- As you can see, in order to unlock the bootloader, in some cases, mandatory verification by phone number and email is required. In the light of privacy issues, for me personally this is an extremely negative fact. I am sure that during authorization information will be read as much as possible on the phone (surrounding Wi-Fi points, GPS location, current settings, and so on) and transmitted to Chinese servers. Also, when installing and starting Mi Unlock, information from the computer will also go to Chinese servers. Paranoids (in the good sense of the word) will have to install a clean version of Windows (or in a virtual machine with port forwarding), do not use a smartphone before installing LineageOS firmware, change the Wi-Fi MAC address (there were no other Wi-Fi points nearby), do temporary SIM card and temporary email address.
- In the process, you may encounter some problems:
- The smartphone is not detected by the Mi Unlock program. Try inserting a cable from your smartphone into another USB port on your computer. Also, through the settings, try updating the version of Mi Unlock (the Chinese believe that you can upload the latest version on the site). Run Mi Unlock as administrator (hold SHIFT, right-click on the program's shortcut -> Run as administrator).
- The smartphone does not enter fastboot mode. Try holding down the volume and power buttons for up to 25 seconds.
- Mi Unlock does not connect to a server in China - try temporarily installing a Chinese proxy on your computer.
- On one Xiaomi account, you can unlock only one device in 30 days.
Attention: when unlocking the bootloader, all data on the device will be deleted, so if you used the device and you have some data left, then you need to worry about saving it separately (we make a backup).
Next, we are looking for installation instructions for a specific device.
For example, Xiaomi Redmi 4 (X) [ 25 ]. Or, if you have a device with an unofficial version of LOS, then on xda-developer and w3bsit3-dns.com. In any case, even if you have the official version of LOS, it is better to check for nuances in all forums. Separately, I want to note that if some other alternative firmware is already installed, then you may have to perform other actions, especially if you want to save some settings and application data. The same applies to major (major) updates from LOS (for example, from version 15.1 to version 16).
TIP: if you can’t find information on your device in forums (especially foreign ones), try searching by device code. For example, for Galaxy A7 (2017), the code name is a7y17lte. Often the information you are interested in is on the forums, but you need to look better.
LOS installation example
Let's go through paragraphs [ 25 ] with some comments from me.
BASIC REQUIREMENTS
- , adb fastboot .
adb fastboot [ 27 ], [ 29 ]. ( . ), . Windows [ 31 ]. - «»- « »- « Android ( Android Debug Bridge (ADB))» («System»- «Developer options» — «Android debugging (Enable the Android Debug Bridge (ADB) interface)»)
UNLOADING THE LOADER
This item I have already described above, I will not repeat it.
INSTALLING A MODIFIED RECOVERY
1. Download TWRP for a specific device. Sometimes the manufacturer produces devices with slightly different versions of the parts of the device, whether it be a touch screen or something else, and then TWRP from the official website may not work (or work crookedly). This is solved by searching for an alternative (or newer) TWRP for this device on w3bsit3-dns.com or xda-developer forums.
2. Connect the device to your computer via USB.
3.1. In the computer at the command line, or in the terminal in Linux / macOS, type:
adb devices
A window should pop up on the smartphone screen asking you to connect a specific computer to the smartphone for debugging. If an error occurs on the command line (or Linux terminal), then on Windows, try to run the command line as administrator, or sudo adb devices in the Linux / macOS terminal.
Next, make sure that 1 device is shown.
3.2. We type:
adb reboot bootloader
The smartphone should restart to fastboot mode. Also restart in fastboot mode by simultaneously holding down the power button + volume down button.
A splash screen should appear on the smartphone screen.
4. We collect:
fastboot devices
Get the list of devices. Make sure 1 device is shown.
5. Flash the recovery (previously downloaded TWRP) to the device. Better yet, temporarily download (described below what is the difference).
fastboot flash recovery twrp-x.x.x-x-santoni.img
Where "twrp-xxx-x-santoni.img" is the TWRP file that you downloaded.
Note: for convenience, you can specify the full path to a file of the type "C: \ Users \ Vasya Pupkin \ Desktop \ twrp-xxx-x-santoni.img" with quotes in the file path.
Sometimes TWRP is not installed on some devices (especially for devices with A / B function) and some tricks need to be done. In any case, I do not advise you to flash TWRP into the device, since installing TWRP still installs the application on a smartphone with trackers trackers. There is a way out - you can simply run TWRP once through a command like:
fastboot boot "C:\Users\ \Desktop\twrp-x.x.x-x-santoni.img"
6. If you requested TWRP, but did not start it one-time, then you will have to re-enter recovery by simultaneously holding down the power button + volume down button.
INSTALLING LOS THROUGH THE RECOVER
1. Download the LOS firmware from the official page or build from the source yourself. Optional: download Google Apps (for arm64 architecture). [ 33 ]
This is a Google app installation. I don’t see much point in this action, since one of the goals of installing LOS is to get rid of Google's endless surveillance. Previously, LOS, when it was also called CyanogenMod, was popular because this firmware made it possible to support old devices and introduced some functions. Now according to official polls [ 35 - item Features] The majority of users who choose LOS have done so for the Privacy Guard function. And the number of users who do not install Google Apps (Gapps) at all is slowly but surely growing.
The MicroG project [ 37 ] and its implementation for LOS [ 39 ] stand apart . This is a rather successful attempt to rewrite Google applications, leaving the main functionality, but at the same time limit the transfer of data to Google servers as much as possible. I will not stop much even on this project, because I decided for myself to 100% refuse the services of Google (and not only Google). I will write about the pros (and cons) of such a decision separately in one of the points.
2.If you are not in recovery mode, reboot into recovery by simultaneously holding down the power button + volume down button. If you did not install TWRP, then you will need to temporarily restart TWRP again through:
fastboot boot "C:\Users\ \Desktop\twrp-x.x.x-x-santoni.img"
3. In the main menu, select Wipe
4. Select Format Data, enter “yes”. This will remove the encryption and all your personal data on the device.
5. In the same Wipe menu, go to Advanced Wipe.
6. Check the box ONLY opposite Cache and System, and by dragging the slider to end this action.
7. Next, you need to load the LOS firmware into the device through the ADB Sideload mechanism. To do this, select “Advanced” in the smartphone, then “ADB Sideload”. After that, run on the computer:
adb sideload "C:\Users\ \Desktop\filename.zip"
where “C: \ Users \ Vasya Pupkin \ Desktop \ filename.zip” is the path to the LOS firmware in the “zip” format. The firmware
log will be displayed on the smartphone screen. On some devices, in some versions of the firmware, something like “firmware not installed” is displayed in the log at the end. Often this is a false inscription and the firmware will still be installed. But just in case, check on the forums (w3bsit3-dns.com, reddit, xda-developer) if others have the same problems with your device.
8. Optional. ATTENTION: If you still want to install Google Apps, then this must be done immediately without restarting the smartphone! It will be necessary to go back to the menu, then again select “Advanced” on the smartphone, then “ADB Sideload” and launch it on the computer
adb sideload "C:\Users\ \Desktop\gapp.zip"
where "C: \ Users \ Vasya Pupkin \ Desktop \ gapp.zip" is the path to Google applications on your computer. If you accidentally restart the smartphone after LOS firmware, then you will have to do Factory reset, otherwise Google applications will practically not work.
9. Optional: root the device by installing a specially prepared LOS AddonSU (package for version arm64) [ 41 ] or another root addon that you like.
adb sideload "C:\Users\ \Desktop\addonsu-16.0-arm64-signed.zip"
Note: getting root (root) to achieve the goal of real device control is simply necessary. Without root, unfortunately, it is impossible to install the main programs firewalls and powerful restrictions on accessing data and sensors on the device to other programs (permission manager). Therefore, I highly recommend rooting your device. The standard add-on is the aforementioned LOS AddonSU, but many users use an add-on like Magisk. I personally use the standard LOS AddonSU. The reasons, cons and pros I will describe in a separate paragraph.
What could go wrong
- 4) « (RECOVERY)» 4.5) :
fastboot oem unlock.
, . - (Gapps ), . , . 3 — arm, arm64 x86.
- , Wipe, Advanced Wipe Format Data. . , ( soft brick). , .
- - , , , bootloop ( ), soft brick ( ), hard brick ( ). Bootloop soft brick - , .
hard brick. . . . — ( hard brick) . - , . «bootloop» . . , LOS. Soft brick . -, 99% . hard brick . soft brick - zip-, Android 7 LOS 16. , . - LOS AddonSU , , . LOS ( ). ADB, . TWRP, Wipe, adb sideload
adb sideload "C:\Users\ \Desktop\addonsu-16.0-arm64-signed.zip"
- , TWRP . . , TWRP , , LOS. - , TWRP . , TWRP, :
1) Android 8 LOS 15 ( Android 8)
2) Android 9 LOS 16 ( Android 9)
3) LOS 15.1 (Android 8.1) LOS 16 (Android 9)
4) TWRP .
- , LOS ( 15.1 16) . (, LOS 16). () ( ) . «» () firmware (Bootloader + Modem + DSP), ( 50-70 ) . adb sideload . . — «» .
: , , (LOS) LOS . LOS (CyanogenMOD) , Android . - If you have not yet made a specific TWRP for your device that can download LOS firmware, then you can do this step through the standard recovery (not TWRP, but which is sewn into the device initially), or through some other recovery. That is, if the device has LOS firmware and you can unlock the bootloader on this device, then you will have the opportunity to install the firmware. Search the forums. Enthusiasts with xda-developer and w3bsit3-dns.com usually release TWRP versions very quickly for non-standard cases. The maximum how long I had to wait for such a TWRP was 2 days.
For some devices, the LOS command releases its recovery instead of TWRP.
Congratulations, at this point you installed the LOS firmware on your device.
Pre-launch preparation
But that's not all. Not including a smartphone:
On the computer from the official F-Droid website [ 43 ], download the F-droid application itself. This is an app store. The store is called, but there all applications are free and are in open-source status.
Download from the same site:
- AFWall + (dev.ukanth.ufirewall) [ 45 ]
- AdAway (org.adaway) [ 47 ]
- AppOpsX (com.zzzmode.appopsx) [ 49 ]
- From the guardianproject organization’s website in the [ 51 ] folder, download the last working Orbot. At the moment (September August 2019), only version 16.0.5-RC-2 of the last works on my device from the last [ 53 ]
You can do all this in advance.
If you want to transfer SMS - install QKSMS [ 55 ] on your old phone and backup SMS.
If you want to transfer the call list - install Slight backup [ 57 ] on your old phone and backup the call list. Make better backup of only calls and contacts, otherwise then there may be problems with the transfer. Do not select items such as “Settings” or “Bookmarks”.
If the contacts cannot be transferred this way, you can usually transfer them simply via a vcf file, or transfer via bluetooth. Well, or if you set up Nextcloud storage for yourself, then everything will be simple and easy.
Next, turn on the smartphone and you will be prompted to configure it.
- . . , -, . .
- Wi-Fi, . Wi-Fi .
- . ( LOS)
- LineageOS ( ).
- ( , ).
- Privacy Guard .
- ( ). , .
- ( ). , LOS 16 ( ). .
- . . ( , — ) SIM Toolkit SIM App Dialog . ( ). Apps & Notifications →See all # apps → «Show system».
, . (AFWall+, AdAway, Orbot, AppOpsX) Files/. - AFWall+. , (Lan/localhost, Wi-Fi ) Orbot VPN AdAway F-Droid. . AFWall+ .
- Android, PrivacyGuard AppOpsX , .
- Orbot, VPN, VPN AdAway F-Droid. VPN Orbot , VPN.
- AdAway. DNS .
- LOS .
- AdAway . :
connectivitycheck.gstatic.com — Captive portal
time.android.com —
izatcloud.net — Qualcom A-GPS. A-GPS.
play.googleapis.com, www.google.com — google. .
— Wi-Fi . - Wi-Fi ( )
- ( , ) AdAway. , AdAway
- LOS ( Android) ( LineageOS).
- ( ) F-Droid . ( Privacy Guard «»), , , . .
- — Shelter ( , — Shelter).
- . . - ( example.com) AdAway AdAway. .
AFWall+ DNS Orbot, [59]. Tor , , www.deviceinfo.me [60]
F-Droid ( ) — [61] Exodus Privacy[63], ClassyShark3xodus[65]. , . , AdAway, AdAway . - ( , , ).
. Setting the password or pattern at first power-up does not automatically mean that the device will be encrypted. Especially on older versions of Android or on cheap devices. Also, the device may not be encrypted when you turn on the device for the first time, if you previously had some other non-native (non-stock) firmware. You can check for encryption in the settings (look for Encryption). Not the whole device is encrypted, but only applications, their data and your data. Android system data is not encrypted, since by default it should not be accessible (if the bootloader is blocked). In fact, this encryption is not very reliable in the sense that there are often flaws in such encryption and workarounds. But the newer the phone and the newer the Android version, the less likely it is to hack. More precisely,the harder it will be and more time will be required by highly qualified specialists to circumvent encryption. On modern phones (not the lowest price category) on the latest versions of Android, encryption will definitely protect you from the average cracker.
In order not to get into a situation that you will find out that there is no encryption after you have configured the device, it is better to immediately check the encryption for the first time you turn it on. Because in rare cases, to enable encryption, it will be necessary to do manipulations, in which you have to erase all the data (for example, install the stock / original firmware) and you will lose time on reconfiguring the device.
Regarding the encryption of the SD card in LOS - this is only possible if you make it in Adoptable Storage format. The first time you use an external SD card, you will be asked if you want to use its internal storage, or as portable. It will be necessary to choose the “internal”. In this case, the deterioration of the SD card will increase and it is undesirable to store important data there due to the increased risk of a card failure in operation.
I do not use SD cards, so I can not advise you how to verify that it is securely encrypted.
Encryption is imperative if you have ill-wishers specifically targeted at you. Having stolen your phone without encryption, they will be able to extract ALL data from your device - correspondence, passwords, photos, and so on.
But even if you do not have such ill-wishers, then you can simply lose your device, and those who find it will be able to do much harm to you. Or if the device breaks down (for example, the screen breaks), then in the repair shop the receiver can also easily pull out all your data. And these guys are not always clean at hand.
So again: ENCRYPTION MUST BE INCLUDED !!!
LineageOS
Standard LOS Settings
Let's go through the LOS settings, which concern mostly security and privacy. Many of them apply to the clean version of Google AOSP. I will consider the version of LOS 16.
In Settings, there is a search for the settings.
Network & Internet (Network and Internet)
- Wi-Fi
- Wi-Fi preferences (
Turn Wi-Fi settings) - Turn on Wi-Fi automaticaly (Turn Wi-Fi on automatically) - no.
- - Open network notification - no.
Also in the Wi-Fi settings you can add a hidden network (I hope you have hidden your Wi-Fi network at home).
- Mobile network
- Wi-Fi calling - Disable.
- Carrier video calling - disable.
- Access Points Names (APN)
Here in the settings of the access point (in fact, the settings for the Internet via the cellular network) can be a proxy. If it is, then AdAway may not work when using mobile Internet. Check if you can disable this proxy at your OPSOS and whether your tariffing will change. If possible, disable this proxy.
Connected devices
- NFC - Disable NFC and try not to use it. I can’t say anything on this topic, since there is no NFC on my device, and also because there is little information on this topic regarding privacy and security.
- Use Bluetooth only when necessary, turning it off when not in use. Pair (first connect) devices only in a place where there are no strangers.
Apps & notifications
- Notifications
- On lock screen
I have Hide sensetive content. This setting allows you to remove the notification text on the locked screen, and leaves only the name of the application from which the notification arrived. No one accidentally sees the text of a message intended only for you.
- Default apps.
Carefully review what is installed on different types of applications. Select trusted applications.
Most importantly, in the “Browser app” section, select either “None” or “Tor browser”. This is necessary so that if you were sent some kind of link, then you would choose in which browser to open (in the case of “None”) or so that it opens in the “Tor browser”. I’ll explain why - you can click on the link in some messenger that will look adequate, such as “example.com”, but in fact there will be a link like “vk.com/away.php?to=example.com” and if you open this link in your standard browser, Vkontakte will be able to understand that someone on this IP opens a specific page. If you were logged in to VKontakte in this browser, then you will immediately immediately understand which sites you go to (not just the general name of the site, but a specific page). But even if the link doesn’t contain such “meannesses,” you may still not like it,so that your Internet provider knows what sites you open and if you accidentally open a link in a specific browser, this information will be sent immediately to the provider.
- Advanced (
App ) - App permissions. I will describe this item separately in conjunction with PrivacyGuard and AppOpsX.
- Special app access (
Battery access)
In Android, the control for automatically closing applications changes from version to version. All sorts of Doze features, machine learning, application usage statistics, and so on. The rules change, something is added, something is removed. I'm just tired of guessing Google’s next steps. At the moment I do not use these functions, more precisely: I do not rely heavily on them. In this paragraph, I just add mail services and other applications that need to work in the background.
- - Device admin apps This application
should not have any applications other than those in which you are 100% sure. This is a very dangerous permission. In fact, this permission makes it possible to change any setting in the device. For example, I have only Shelter allowed in this paragraph. Yes, in general, the request for this permission is already very suspicious, even if you did not issue this permission.
- - Display over other apps
I don’t have applications that would need this feature. This function is used in some cases by virus applications, for example, to intercept entered passwords.
- - Do Not Disturb access - DND (Do Not Disturb)
This is necessary for fine tuning the silence modes. I do not use this feature. But this function is sometimes needed by viruses to turn off alerts and sound from bank SMS when they steal money from the account.
- - Modify system settings.
This is the permission to change the screen brightness, volume. This feature is needed mainly by media players.
- - Notification access (Access to the notification)
Access is required only to the launcher. You can not give other applications to read notifications, which may contain texts of codes from SMS and so on.
- - Picture-in-picture (Picture in Picture)
Similar to Display over other apps. This function is only needed for video players, and browsers through which you also want to output video separately. Cool feature, by the way. Now not even all TVs support it.
- - Premium SMS access (access to paid SMS) - ANYONE
- Unrestricted data (Unlimited mobile Internet)
For each individual application, you can remove the ability to download / upload something to / from the network. (I will write about this separately) But when you turn on the settings for saving traffic ("Settings" - "Network and Internet" - "Data Transfer" - "Saving traffic") all applications in the background (except for some system ones) cannot "knock" on the Internet . This setting acts as an exception specifically for the mode of saving traffic.
- Install unknown apps (
Ability to certain programs to offer the installation of other programs. Previously, this setting was only for all third-party applications at once, but now in the latest versions of Android there is a separation of access to each individual application. In any case, no application (except Google Play, which I do not recommend installing) can install applications in the background. A window with a request for installation will certainly pop up. At this point, I have the opportunity only for Shelter and for F-Droid. (more will be below). To send a request for installation, the system file manager is by default.
- - Usage access
Access to general device usage history data. Do not give to anyone. Well, or special programs that make up an analysis of the use of the device for you. Carefully give access to this feature.
- - VR helper service (VR helper services)
I don't know anything about this. I do not use VR, respectively, I do not give access to anyone.
- - Directory access
A very interesting new restriction on access to folders such as “Pictures”, “Movies”. This is a new limitation that only appeared in Android 9 Pie. The fact is that now, in order to get the application the ability to save pictures in “Pictures”, the application requests full access to all files !!! Google decided to make a separate restriction on the above folders. BUT practically no application developer is in a hurry to limit himself and asks for full access to all folders. Currently, Android users 2.5 billion [ 67 ]. Of these, 10% use the latest version of Android Pie [ 69]. That is, for 250 million potential users (the number of which will only grow), you could remake your application and show at least some commitment to privacy. But no, they spat on us.
It is clear why applications need access to these folders. The same messengers save the pictures there, in case the pictures remain when you delete the application (random or special). People do not want to lose memorable photos. But why practically no application makes it possible to save their data in the internal memory of the application itself? Take the notorious Telegram. There is no such setting. He himself chooses what and where to save (even files from secret chats are visible to other applications, I will write about this). I began to think about how best to ensure the possibility of using such applications (which need access to memory), but do not give them this same access. Found an article [ 71] in which the file structure and the policy of restricting access to the file structure are described in detail. It turned out that you can share files with the application without giving access to the data itself. For example, you want to send a file to a friend through a messenger, but you do not want to give access to files to this messenger. In theory, in the messenger it would be possible to implement file selection through a standard file manager (and this is an old function). Unfortunately, application developers do not. And when Telegram restricts access to the store, even the Share button from Telegram itself does not work. Here you have a private messenger!
In Android 10, Q will still change in this part. I don’t understand how exactly this restriction will work. If you give access to the repository, but do not give access in this setting, will access to other folders be given? Or vice versa.
In any case, I believe that this approach is still insufficient in terms of maintaining confidentiality. I restrict access to ALL storage applications that have access to the Internet. This is one of the lines of protection for my data.
As far as I understand this function is preparation for the scoped storage function, which will appear in Android 10 Q, but will become mandatory only in Android 11. In the meantime, I restrict access to the store to all applications with the Internet (or launch it in the work profile).
- - Wi-Fi control
New setting from Google. The fact is that in Android 9 (and in LOS 16), for the application to be able to scan / switch / connect to Wi-Fi, ALL conditions must be met
1) For the application to have access to Wi-Fi control (Manage Wi-Fi networks Fi). (CHANGE_WIFI_STATE)
2) For the application to have access to geolocation (ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION)
3) Geolocation is turned on (not for a separate application, in general) And only then the application will be able to scan networks and connect to them.
Earlier in Android 8.1 (LOS 15.1), either the 1st point or the 2nd + 3rd was enough. Now all items are required. On the one hand, Google is hinting to users that if the application has access to Wi-Fi scanning, then it automatically has the ability to calculate the location.
On the other hand, everything is too much. I don’t want to enable geolocation (access to which other applications can use), but I want to be able to scan Wi-Fi with a third-party application.
This setting must be disabled for all applications except those for which this permission is necessary for operation.
Battery
- Battery manager (Battery manager)
- Manage apps automaticaly (
I have this function enabled. But I do not hope for this feature in terms of privacy. Android decides what to limit and what not. Therefore, I use this function only to reduce energy consumption, but not as not for security or privacy.
- Battery saver and perfomance (Energy Saving and Performance)
- Extreme power saver (Aggressive Energy Saving).
In principle, this function, if you enable it, should completely kill / freeze all applications running in the background. I do not hope for it, since I am not sure that applications will not be able to circumvent these restrictions. Earlier on another device with Android 7 Nougat I had a similar function enabled, but especially cunning applications from giants (not only from Google) managed to show something in notifications. Apparently they started some kind of combination of background services that supported the operability.
This function is not turned on for me, since the necessary applications will be immediately closed, and especially tricky ones can slip through.
If someone used this function (in Android 8.1.9 or LOS 15.1, 16) and knows exactly the result of this function, please inform in the comments.
- Automatic power saver
This feature enables aggressive power saving when a certain charge level is reached. Due to the use of Orbot, VPN and due to the lack of Google Play (which can hold one Internet connection for all applications), applications such as mailers / instant messengers each have to individually "go" to the Internet at certain intervals. Sometimes with hard use of the device you don’t notice how the battery sits down. This is what this setting is for. But in the section “Apps & notifications (Applications and notifications) -> Battery optimization” I set the main applications (Orbot and mailer) to exceptions. To be honest - I do not know why these settings are divorced in different points. If someone knows exactly how they are connected - please describe in the comments.
- Performance profile
In addition to unloading applications from the background, it is also possible to limit the processor speed to increase battery life. I set the “Balanced” profile, as I 1) do not play games, I have enough speed and so on.
2) I try to ensure that the device does not overheat, since in this case the battery becomes unusable much faster. Given that now no one is just releasing devices with a removable battery in the middle price segment (and even LOS 16 on it), you have to monitor the health of the battery. By the way, because of the same reasons, I do not bring the battery charge below 20% and do not charge above 85% s.
Security & Location
- Screen lock
Here you can choose how to protect the device —None, Swipe, Pattern, PIN (PIN), Password. If you selected something from Pattern, PIN or Password when installing LOS 16, then encryption of the device should have started. Here you can change the type of lock. I strongly recommend leaving any of the Pattern (Pattern), PIN (PIN), Password.
- Lock Screen Preferences (
On the locked screen) - about this item was already in the "Apps & notifications (Applications and notifications)." Some settings may be available from different points, do not be surprised.
- Add users from lock screen
The ability to add new users directly from the lock screen. Do not enable this feature.
- Work notifications The
same as in “On lock screen”. Only for applications in the so-called Work profile. I will separately describe about the “Work Profile”, how to activate it, how it can be useful and other interesting things.
- Fingerprint
I can not say anything about fingerprints, since my device does not have such a function. I don’t know how it works in terms of encryption, bundles with other security features (Password, PIN, pattern). If anyone has information - please share.
On the Internet they write that even if you add a fingerprint unlock, then when you reboot the device you will still be asked to enter a Password (or graph. Key or PIN). In my opinion this is correct. I would like these settings to be even tougher (but customizable), for example, asking for a password after 1 hour of not using the device, and after rebooting, so that it asks for the fingerprint and password.
Actually, I don’t really trust this functionality. In theory, the fingerprint scanner is not transmitted further than its separate chip. But this is all closed functionality, no one can check. It is also assumed that fingerprint scanners can be used on cheap phones to verify fingerprints programmatically, which means that the impression goes to the device, and then the grass does not grow further.
In any case, if you install fingerprint unlock, turn on the Lockdown function (see the description below).
- Trust (Trust)
- SELinux
An additional mechanism to ensure the correct operation of access control on the device. The status must be Enforcing and the icon on the left is green. If this is not the case, then look for solutions on the forums. Make sure you download the normal firmware (highly recommended official LOS). Sometimes you just need to update the firmware.
- Root access (superuser mode)
In this menu item you can’t change anything, it only shows who is given root. You can change these settings in System → Developer options → Root access. I’ll write about root later. Running ahead of time, I’ll say that it’s better to have Apps only in this section.
- Android security patch (Anrdroid security packages)
This menu shows whether you have eliminated the latest known vulnerabilities. Shows two items:
-Platform (Platform)
-Vendor (Manufacturer)
If at this point it is displayed that everything is not in order, then look for a solution on the forums. Usually it’s enough to just put the updates “over the air” (OTA updates) if you have the official version of LOS. Sometimes you need to separately download firmware (update from the manufacturer) and install it. The monthly security updates that Google is preparing are included in the LOS firmware very quickly. Much faster than on most other firmware, even stock (original).
- Encryption. Must be included.
- Privacy Guard. I will describe this setting separately in sufficient detail, where I will also consider other mechanisms for restricting access rights.
- LineageOS statistics (sending statistics)
Ability to send statistics to the LOS server. You are free to decide whether to send them this data or not. (when you first turned on the firmware, you should also be asked about this) There you can also see what data is sent. I do not like the unique fingerprint of the device and the mobile operator in this list. On the other hand, more accurate statistics on the use of devices will help to understand the preferences of users, and may help others when choosing a device. You decide.
- SMS message limit.
Restriction on sending SMS messages per minute. Apparently all sorts of viruses use this feature so often that they introduced a separate limitation. Or users accidentally sent huge SMS (every 70 characters in SMS is counted as a separate SMS).
-Location
The default setting for enabling location.
- “Battery saving mode” - disables GPS positioning and uses location via Wi-FI, bluetooth and cellular networks. I did not check how exactly this restriction works. I generally do not have a module for determining location via Wi-FI, bluetooth and cellular networks (since Gapps or microg are not installed). Apparently the restriction works as it is written. Although in the curtain you can select 3 points - 1) by GPS, 2) Wi-FI, bluetooth and cellular networks 3) by all sources. Throughout Android, the settings for location and access to Wi-Fi scanning (which in fact also gives access to location) are scattered in different angles. It’s easier for me to turn off geolocation for everything except Osmand instead of understanding these settings. There can be many tricks in these settings. For example,in normal Android (with Gapps) there are some hidden functions that make it hard to completely turn off Wi-Fi.
- “Scanning” - allows applications to scan Wi-Fi or Bluetooth networks even when Wi-Fi or Bluetooth is turned off. Again, some crazy settings. To be honest, it seems to me that either Google is full of scumbags, or it was specially made so that the user could not figure it out. I can collect and write down all these settings related to geolocation separately, compare them, try to understand how exactly they intersect - but these will be just my guesses. In the end, I turned off this feature for both Wi-Fi and Bluetooth.
- App-level permissions (
Convenient permissions for applications) Convenient list in the native way (from Android) to control application access to the location in a list.
- Show passwords
Setting to show each character entered for a very short time when entering passwords. I advise you not to include this item. Now CCTV cameras have begun to shoot in high quality and resolution, and also someone can stand behind. It is hard to understand which letters you press when entering the password due to overlapping fingers, but if the letter itself is displayed on the screen (even a split second), then this is bad. If you have thumbs and you often miss, then you can enable this setting, but then when entering the password, make sure that no one is shooting you and no one is peeping.
- Device admin apps - the same setting as in “Apps & notifications” - “Special app access”
-SIM card lock
Normal SIM card lock / unlock by PIN code. This method of protection is more than 20 years old, I think you should know all about it. (If you do not know, then read this article [ 73 ]). If you have any services tied to verification by mobile phone (for example, banking applications), then I recommend using this function and setting a lock. Yes, this is inconvenient, yes, there are ways to bypass the PIN, but it will take a significant amount of time, and if you have stolen a SIM card (with or without a phone), you will have time to find another phone and call SIM card.
- Trust agents
This is an application to unlock the device bypassing a password or fingerprint scanner. The standard firmware usually gives access to the Google Smart Lock application. This allows the phone to be unlocked in a specific place or next to a specific Wi-Fi router. I recommend that you do not use this feature and disable all programs in this setting. They can steal the device and unlock it near your house (or next to the place that you registered as a trusted one).
- Screen pinning (Lock in the application)
This function does not work in LOS 16 (although on some devices this function may still work). This function is intended so that only 1 application can be fixed, without the ability to switch to another application. Useful if you need to give the device to children by including only one program.
Accounts
List of accounts from different programs. Functionality dangerous in terms of privacy. Any program that has access to the list of accounts can instantly link your accounts from different services. Starting with Android 6 Marshmallow, an application does not need to request a list of accounts in order to have access to its account. As far as I understood from “if an app shares the signature of the authenticator” [ 75 ]
It is not clear if the company is developing two applications with one “signature of the authenticator”, then when installing the second application from the same company the second application will be automatically will get information that the first application is installed from the same company and even get access to information about this account? Please comment on those who are knowledgeable in this area.
As a matter of fact, access to the list of accounts (in addition to the account from the application itself) cannot be limited by standard means of Android. Google believes that we - scum (with which Google apparently represents us) should not think about this. I will describe further on the topic of access rights restrictions (you can and will need to limit it in Privacy Guard or AppOpsX). In advance, I’ll just say that carefully monitor which applications create accounts and which have access to view a list of accounts.
System
- Languages & Input
- Virtual keyboard (- Virtual keyboard)
- - Android keyboard (AOSP) (Android keyboard (AOSP))
- Advanced (Advanced settings) - turn on the Show app icon. This is necessary so that later it is convenient to quickly restrict keyboard access to the Internet and contacts from the list of applications using standard Android tools.
Also in the keyboard settings you can remove sentences of frequently used words
- “Text correction” - “Personal suggestions”
This is in case you give someone a phone for a while, or if bandits force them to unlock the device - then by the frequency of the words you can very easily understand your preferences. ATTENTION: do not underestimate this setting. I personally know the case in an unfavorable family when the aggressive head of the family, finding nothing on the wife’s phone, nevertheless realized that she was going to report to the police, according to the suggested words like “state”, “police” and so on. Even if you delete all correspondence, all unnecessary evidence of contacts with someone, traces will settle on the keyboard. In general, you can periodically clear the cache and keyboard data.
- Buttons
- Power button
- Lockdown
If you have fingerprint unlock, then enable this feature. It works like this - if you hold down the power button, in addition to “Turn off / restart / take a screenshot”, there will also appear “Lockdown”, which will lock the device so that the next time the device can be unlocked, it will only be possible with a password or a graphic key. This is in case the villains on the street break you and try to put your finger on the fingerprint scanner. Yes, of course this is for rare cases, but a function may come in handy at some point. Turn on - there is no asking.
- Status bar
- Network traffic monitor
Turn on the Display mode the ability to view the speed of the current Internet for downloading and uploading. This will help you understand if at some point some application in the background starts to download something intensively to the device, or upload your data to the server. It will also help prevent the consumption of mobile traffic.
Also in the Status bar (Status Bar) there are other interesting settings. For example, the percentage of battery power, so as not to remain with a discharged device at the wrong time, and so that you do not have to use other people's devices of neglected people (in which all devices are crammed with viruses and "snoopers").
- Date & time
We remove "Automatic date & time (Network date and time)", we remove "Automatic time zone (Network time zone)". In theory, these settings should disable automatic time setting from Google servers. But it was not there. Anyway, even with disabled settings, the system tries to periodically reach Google servers with ntp. This can be seen from the logs AFWall + and Adaway.
ATTENTION: You will have to manually set the date and time. When you download TWRP, the date and time may go astray. When you remove the battery, the date and time may also go astray. The fact is that Orbot and Tor browser cannot start if you have the wrong date and time. You can take the effort to find out what the problem is, but most often the problem is the wrong time in the system.
- Developer options (For developers)
Use these settings carefully, especially pay attention to those that relate to interference with the hardware of the device. That is, do not change what you do not know. For example, all sorts of "acceleration", "experimental" and so on.
- Advanced restart (Restart options)
Allows you to reboot into recovery mode without holding the volume button down. Useful if physically this button is broken.
- Running services A
native Android tool for viewing the list of running applications and the list of applications in the cache. You can immediately stop the application. If for some reason an application is running, although it should not be, then this should be dealt with. Either restrict autorun, or restrict the launch of some applications to others.
- WebView Implementation (WebView Service)
In order not to embed a browser or JavaScript handler in every application, there is an implementation from Google. This is more convenient for application developers, and should also save space on your smartphone. For example, a developer can make a version for mobile browsers and palm off the same version in his application. Or in order to quickly view the link in some messenger without going to any browser. LOS has a Chromium-based WebView AOSP implementation. I described below what “merges” WebView and how to avoid it (install WebView from Bromite). I had to leave it on, as some applications (for example, K-9 Mail) use WebView. But my hands will reach and I will switch to Bromite WebView.
- Root access (Superuser mode)
Who should be granted superuser rights:
Disabled
Apps only
ADB only (ADB only)
Apps and ADB (Apps and ADB)
It is desirable that the item only in the normal state is only Applications only). About root I will describe later.
- Manage root access (
List of superuser rights) A list of applications that have root (root) rights in the Privacy Guard interface with the ability to revoke rights. Route should be provided only to those applications in which you are sure.
- Android debugging (Android debugging)
Enabling the ADB interface for connecting from a computer or from some programs of the device itself (for example, for some cases in AppOpsX). It is advisable to turn it on only when necessary and turn it off when not needed.
- Debugging notify
It’s better to turn it on to see that some application is trying to connect via the ADB interface when connected to the computer
- Revoke USB debugging authorization.
It is advisable, after manipulating ADB, to revoke access to all devices so that attackers cannot steal your smartphone + computer and connect to your smartphone via ADB with the screen locked.
Next, the most recent settings related to managing the operation of applications in the background. You can immediately find restrictions and change the status of applications. I prefer to limit the work in the background of the application for sure. And especially unpleasant applications, generally close.
- Kill app back button (
Setting the back button) The setting allows you to close (or rather forcefully close) the application by long pressing the back button. I use this functionality when it is necessary to temporarily launch an application that I do not trust, and then close this application after use.
In addition to the settings presented, there are also other interesting settings in different sections, such as redefining buttons, forcing the application to work in full screen mode (without a system line at the top and without buttons at the bottom) and other cool things.
Root / root / superuser rights / superuser
As the name implies, this is access to all the software internals of the device. Initially, on most Android devices (except for very rare devices), the root is not provided. Firstly, with inept handling, you can break the firmware (soft brick), and secondly, you can even overclock the processor and physically damage the device.
Thirdly, if you are an insecure user and do not follow what programs you install, which rights and whom you give to, then the risk of installing a virus that very deeply puts its tentacles in the system will be quite large.
But do not be scared if you are an accurate user. Unfortunately, Google does not provide convenient options for fine-tuning the device, especially regarding privacy. Gradually, let's say “rather slowly”, Google adds opportunities to limit access to programs, but this is not enough. Sometimes it even removes useful settings (it made it difficult to deactivate the Captive Portal, removed support for Miracast in order to promote its Chromecast device working only through Google and so on). Therefore, you have to root the device in order to install useful programs that increase privacy. For example, such as Afwall +, Adaway, AppOpsX.
I want to immediately notice that basically there are 3 types of
root : Temporary root - temporary root . It disappears upon reboot.
Full root- Full permanent rights that allow you to change all sections and folders, including the system folder.
Shell root - partial permanent permissions that allow you to read all files, but cannot change files in the system folder. That is, there are no rights r / w (read and write), but only read. This happens if the manufacturer specifically set a restriction on writing to this section, as well as on devices with an A / B system of slots [ 77 ]. In different cases, the issue is resolved in different ways.
Actually, for only one application that I use, it is necessary to write to this section: Adaway. This program changes the hosts file.
Some devices on A / B with Android 9 (LOS 16) now allow you to modify files in the system (at least the system / etc / hosts file can be changed) with a native root (with addonSU from the LOS command), although this is possible in LOS 15.1 was not. For most other cases, usually there is a special version of Magisk that changes the structure so that there is write access to the system.
There are many modules for root. For LOS firmware, 2 modules are usually used:
1) addonSU- native to LOS module. I use this particular module, since it is developed for all devices by the LOS team, and the remaining modules, although open-source, are often made enthusiastic for each individual device (and I don’t have confidence in the cleanliness of these enthusiasts). Also Magisk is too powerful a module. Please note that payment via phone will not work with root through addonSU, Netflix will work only with low resolution, most applications of foreign banks will not work. Most applications of large Russian banks work with any root, but payment with a device via NFC will not work. True, there is a workaround for passing SafetyNet and device payment: iSU [ 79 ], [ 81], but I don’t use it and can’t say anything about the performance of iSU.
2) Magisk. A very powerful module, can wedge so deep that it can somehow replace the system folder, making it changeable even for cases where it is not provided by the manufacturer. It has different compatible modules. It can hide the fact that it is installed from programs, and after hiding, you can even configure payment by the device via NFC. But most of the modules at the moment do not make sense, since many functions are in Android 9 (Energy Saving, DoH), or can be configured using regular root. This module is too powerful and therefore dangerous. If you are a very confident user and 100% understand what and where you are installing, then you can use this module, especially if there is no choice (for example, if you have a closed system for recording and you want to use AdAway). In any case, it’s better to install Magisk in core-only mode,to replace only system and not wedge into processes.
If you need a full root just to change hosts, and your device does not support full root with AddonSU, then in some rare cases (devices from A / B to LOS 15.1) you can still change the hosts file through TWRP without Magisk installation. You need to read about each individual device.
Here's an explanation of why some of the LOS team do not recommend using Magisk and explain why this can be dangerous: [ 83 ].
Separately, it should be mentioned:
a) You can not install 2 addons from the root at the same time. Or "native" addonSU, or Magisk, or some other.
b) Do not useSuperSU (it was previously popular), because at the moment it is being developed by a Chinese commercial company (I am extremely alarmed by the word Chinese and the word commercial).
c) To install another root, you must first delete the previous one. It is also done as it is installed - by means of adb sideload through a special zip archive.
In the end, I settled on addonSU, since I don’t use contactless payment, I don’t have subscriptions to Netflix or Ivi, on my device I have access to the system for change and I can use Adaway without Magisk.
In LOS in the settings, it would be better if you had root only for applications (Apps only) without root for ADB. The fact is that if you connect your device to a computer, then an authorization window will pop up on your device to access a specific computer to ADB. And if you give access to this computer and if you check the box “Trust always” even worse, then through the computer you can fetch a lot of information or even install some programs. But if there is also a root for ADB, then in this case, you can generally introduce viruses deeply and make them hidden. Yes, you yourself in some cases may need a root for ADB, but you can temporarily turn it on for such cases, and then turn it off if not needed.
PRODUCTION CASE
, . LOS, xda-developers , LOS. , . AddonSU . Magisk. . , — 11 Linux kernel - IP, AFWall+. , — 11 Linux kernel , DNS NTP ( ). , «0». IP, , IP , - . IP — . : - !!! , LOS Magisk. . .
I strongly advise against using closed (proprietary) programs that require root. I install programs using root ONLY from F-Droid and only popular ones. Even if this is some kind of official application (for example, a banking application) that requires a root, if it detects that your device is rutted, it’s still better to get a separate device or use the web version.
If you still decided on Magisk (or because of circumstances), then be very careful with Magisk modules. Again, it’s better to install the official Magisk and only the popular open source modules.
Bootloader (bootloader)
Unlocking the bootloader (unlock bootloader) allows you to install custom firmware (Custom ROM), such as LOS. When you unlock the bootloader on some devices, you lose the guarantee, as some phones have special chips (for example, Samsung Knox) that, when unlocking the bootloader, forever remember that the bootloader was unlocked. Even if you then install the stock firmware and lock the bootloader, in any case it will still be impossible to hide that the bootloader was once unlocked.
Unfortunately, when installing LOS, in most cases it is impossible (technically possible, but the device will not work) to lock the boot boot (lock bootloader) back, except for a few devices from Google of the Pixel lineup.
What is bad unlocked bootloader? The fact that if cybercriminals steal your device, then they will have the opportunity to install some add-ons on your device. But they will not be able to access the current data if you have encryption enabled. And if then the device is returned / thrown to you with installed viruses, and you turn it on and unlock it, then your data is decrypted and the installed virus can immediately start sending data to attackers. There is a way out of this situation - if your device was in the hands of attackers aimed at you (for example, at the borders of some countries) for more than 20 minutes, then you have to demolish the firmware and reinstall it cleanly, without turning on the phone (well, or get a SIM card, turn off Wi-Fi Fi, download your latest data and only then reinstall the firmware). At all,It’s not known how savvy these very cybercriminals are, maybe they have knowledge of how to inject viruses even with a locked bootloader. In any case, if there is a suspicion that the device fell into the hands of attackers even with a locked bootloader, I would advise installing the firmware again. Especially at the border (for example, Chinese), as they install tracking applications and are not even shy about it.
But it is not all that bad. As you already understood from the description, they should be aimed at you and after they give the device to you, you will need to unlock it and enter the Internet and only then the data can "go to the side".
Warning: do not try to lock the bootloader on the LOS firmware if you are not 100% sure that this is supported on your device. (only supported by some Nexus and Pixel models)
F-droid
F-droid is a program of the catalog (market) of applications for Android with its server (repository). That is, the F-droid project consists of two parts:
1) Application
2) Server (repository), from which this application can download other applications.
Both the application and the server are open source, i.e. open source. This means that you can look at all the program code, with the proper skills from these sources, make your own application or server. Or even add / remove something from the functionality of the application / server.
The first release of the project took place on September 29, 2010, that is, it is a rather elderly, proven project, only two years younger than Android itself.
Through their repository (server), only free open source applications are distributed without tracker trackers, without advertising (except for rare exceptions, they will warn you about this). The code of these applications you can see for yourself and make sure that there is no built-in muck.
Nobody knows the number of users of f-droid, since f-droid does not intentionally collect statistics, they even refused to harmlessly count the total number of application downloads. But recently, in connection with the global trend for privacy, this application catalog is rapidly gaining momentum, if you can judge by the number of applications in the repository itself, by the number of posts in specialized forums.
The official f-droid repository contains only free software, which is checked by the F-Droid team with special tools and manually for the presence of closed "pieces" of code, for the presence of tracker-trackers and "controversial" functions. If there are tracking elements in the application that the program doesn’t need, then such a program is simply not skipped. If some controversial functions are justified, but still dangerous in terms of privacy, then this is separately described and placed in the so-called “Antifeatures” (dubious functionality / anti-functions) [ 85 ]. Let's look at each warning:
Ads (This app contains advertising)- the presence of advertising. This means that there is advertising in this application. To display targeted advertising, the application needs to collect your data through the built-in tracker trackers, therefore applications with advertising and tracker trackers are NOT MISSED in f-droid. Non-targeted ads may be skipped in f-droid . That is, only with ads that are shown not based on your preferences and data, but simply the same for everyone.
Tracking (This app tracks and reports your activity / This app tracks and reports your activity)- the presence of tracker-trackers. If the application "silently" sends some data to its servers, then such an application will be labeled "Tracking", if by default tracking is disabled, or the application explicitly asks if it is possible to send data to its servers, then this there will be no shortcut. But even if the application asks for your permission, but at the same time collects completely redundant data, or contains “closed” trackers such as Google analytics, then such applications, in principle, are NOT MISSED in f-droid. For us, this means that the presence of the “Tracking” label is not something very dangerous, since tracking is either disabled by default, or we can disable it (but do not forget to do this).
In general, tracking here refers to the general collection of statistics and reports about the crash of the application. As already mentioned, if the application has clearly excessive data collection, then such an application will not be allowed into the f-droid repository at all.
NonFreeNet (This app promotes non-free network services / This application promotes non-free network services) - this means that the application depends on "closed" servers. For example, there is an applicationTelegram in f-droid, it is open source. But it works only through their server, and their server cannot be replaced, since the telegram command did not upload the server source codes. That is, using Telegram you are required to use only their servers. This label warns you that you are at risk. For example: there is another Conversations messenger in f-droid. Although he offers to create an account on their server, but right away at startup you can not create an account, but enter the data of an existing account on another server. And another server may be your own XMPP server. Therefore, Conversations does not have a “NonFreeNet” label, which Telegram cannot boast of (and Matrix Riot, too, by the way). In general, the presence of the “NonFreeNet” label does not automatically mean that the server will share your data with someone,but in the age of rampant information trading, the server owner has great temptations to sell information about you. Also, the absence of the “NonFreeNet” label does not mean that the f-droid project thoroughly tested the server implementation. For example, regarding the implementation of its XMPP server for Conversation, a check was made that it was possible to make your server from source (that is, there is an open source implementation of the server), but it was not tested for security (for example, regarding the possibility of hacking the server by villains). Choosing a secure third-party server (or creating your own) rests on your shoulders.as part of the implementation of its XMPP server for Conversation, a check was made that it was possible to make your server from source (that is, there is an open source implementation of the server), but was not tested for security (for example, regarding the possibility of hacking the server by villains). Choosing a secure third-party server (or creating your own) rests on your shoulders.as part of the implementation of its XMPP server for Conversation, a check was made that it was possible to make your server from source (that is, there is an open source implementation of the server), but was not tested for security (for example, regarding the possibility of hacking the server by villains). Choosing a secure third-party server (or creating your own) rests on your shoulders.
Pay attention to applications with this label (NonFreeNet). If possible, then avoid applications with such a shortcut. It is clear that you will never find a Facebook application without this shortcut. In such cases, it is best to opt out of using Facebook if you are ready for it.
NonFreeAdd (This app promotes non-free addons / This application encourages closed-source add-ons) - a warning that non-free add-ons (add-ons, extensions, and so on) can be downloaded from the application. For example, applications such as OSMand, Fennec f-droid. For us, this means that we must carefully watch what extensions we put in the application. This does not mean that all add-ons / extensions in Fennec violate your privacy (some protect on the contrary), but you need to be careful.
NonFreeDep (This app depends on other non-free apps / This application depends on other non-free applications) - this label means that the application relies on some other components / applications that are not free. For example, there is an “Open In WhatsApp” application that allows you to write to someone on WhatsApp without giving access to the address book to WhatsApp itself. It’s clear that this application is designed to work in conjunction with the proprietary (closed) WhatsApp application. With this label you are just once again warned about it. Although the Open In WhatsApp application itself allows you to at least somehow limit the WhatsApp appetites, if you cannot refuse it.
UpstreamNonFree (The upstream source code is not entirely Free / The original source code is not completely free)- this means that the application in f-droid was made by processing a regular application and removing proprietary (closed) components from it. This warning is necessary because you understand that the developer of the original application is not completely committed to the open source ideology and may add some more proprietary components / dependencies to the original application. As a result, “cleaning out” applications for uploading to f-droid will become more and more difficult over time, and enthusiasts will refuse to do this. But this is an indirect indicator that does not guarantee that this will happen. Attention: this does not mean that the application in f-droid has closed components, but means that the application in f-droid was created from an application with closed components that were deleted / replaced.
NonFreeAssets (This app contains non-free assets / This application contains non-free components) - the presence of some resources in the application, under a private license. In most cases, these resources are understood as such things as pictures, sounds, music and so on. Just if you download the application and “pick it up” and get, for example, an application shortcut, you cannot use it in your projects according to the law. That's all. Nothing wrong.
KnownVuln is a shortcut meaning that the application definitely has security vulnerabilities. Typically, such applications are removed from f-droid after a vulnerability has been identified, so you are unlikely to encounter such applications. But the absence of such a label does not mean that there are definitely no vulnerabilities, it means that there are no known vulnerabilities.
DisabledAlgorithm - a shortcut meaning that the application definitely has a weak encryption algorithm. This is practically the same as with KnownVuln .
NoSourceSince (The source code is no longer available, no updates possible / - Source codes are no longer available. The application will no longer be updated until the source codes become available again.
It seems to me that this is a very balanced policy. What contains obvious nasty things will not be missed in f-droid. What relies in part on closed components will have warning labels.
Since both the f-droid application and the f-droid server are open-source, you can use others both the application and the server. For example, there are other clients (applications) for the f-droid repository - M-Droid [ 87 ], G-Droid [ 89 ]. Also in f-droid itself you can connect your repository, or other people's repositories. Initially, the default is 1 repository: F-Droid. Let's walk through the most famous repositories.
- F-Droid. . . , , . F-droid , F-Droid « » (Reproducible builds) [91]. - F-Droid , . .
- F-Droid Archive. f-droid . f-droid, . . , , - . , , , , . , .
- Guardian project Official Releases. f-droid, . Guardian, Orbot Tor browser Android. , Guardian project , . .
- Guardian project Archive — f-droid, . Guardian . F-droid Archive , . , ( ), .
- Bromite [93] — Bromite [95]. Chrome Google . , . WebView AOSP Chromium WebView Bromite .[97]
- MicroG — [99], [101]. MicroG Google push-, Wi-Fi, . .
- IzzyOnDroid — [103], [105] — open source ( ). , ( Github), ( .apk) . : , ( Google Play). , , apk ( f-droid), , «». , , , . 100- . , . , - , , , . .
.
There are other repositories that you can find on the Internet, for example [ 107 ], [ 109 ], [ 111 ], but you need to use these repositories carefully.
The official F-Droid repository is de facto becoming the main source of open-source applications on the Android platform for most interested users, including due to the support of deterministic compilation (Reproducible builds). Users very much ask open-source application developers to prepare their source code so that they can be used by f-droid (yes, some applications are hard to translate into a specific format suitable for f-droid). This can be seen in the issues of some applications on Github-e, Gitlab-e and other Git source servers.
A big plus of F-Droid is that their infrastructure is all open-source and at any time, any organization will be able to pick up this matter.
Additional settings
In Settings:
- Manage installes apps
(Repositories) - enable / disable known repositories, add new ones.
- Automaticaly fetch updates (allows you to download the update automatically. When to install the update - it's up to you
- Include incompatible versions - versions for old devices and for other architectures (you may have an x86 processor on which not all applications work).
- Include anti-feature apps (I do not know what this setting affects, I already show applications with antifeatures. Perhaps such a setting enables the display of an application with too dubious functionality. But I don’t know for sure. Who knows what exactly this setting does - please write in the comments.
- Use Tor - allows you to work through Tor as through a proxy (proxy) to the localhost address (127.0.0.1) with port 9050, and also redirects to the onion server. For work it is necessary that Orbot is launched. This is a useful feature that allows you to work through the Tor network, not including the pseudo-VPN mode (and allows you to use a real VPN) in Orbot, but I will write about this separately.
- Enable HTTP Proxy (Work through HTTP proxy), indicating the Proxy Host (Proxy Host) and Proxy Port (Proxy Port).
- Prompt to send crash reports - is it possible to ask you to send crash reports to the application. If this option is enabled, before sending data about the application failure, you should be asked whether such information can be sent. Choose at your discretion.
- Prevent Screenshots - prohibits another application (and even for the standard screenshot function built into LOS) to take screenshots when you are in the F-Droid application. In general, applications have a ton of other ways to find out the list of installed applications, so this can only be an additional way in a compartment with other means. But I don’t see much sense in this yet, since Android in the latest versions prohibits taking screenshots for ordinary applications that are not currently running.
- Hide with search button and Panic button settings - settings that allow you to hide the F-Droid application or delete repositories by clicking a specific button, as well as delete certain applications. The meaning of these points is not entirely clear to me. If someone gets access to an unlocked smartphone, then this villain will already have the opportunity to fish out a lot of information, which makes this point useless. It can only be, unless you have your own repository and there is no encryption on the device.
- Keep cached apps (the ability to store cached applications) - the ability to store downloaded versions of applications in memory for a specified period. I kept 1 month. This is in case you update any application and the new version will work unstably. This will be especially useful if this is some kind of Internet application (for example, VPN) and the new version will stop working. You can install the previous version. Unfortunately, in recent versions of Android there is a ban on downgrade (downgrade) applications. This means that you have to uninstall the application, and install an older version with a loss of settings. So you have to either export the settings from the application (if there is such a function), delete the application, install the previous version and import the settings.Or refine using other methods (copying the settings folder through a special file manager with root or through a special oandbackup application
(dk.jens.backup) with root).
Files of downloaded .apk applications are saved in the folder data / data / org.fdroid.fdroid / files or in mnt / sdcard / Android / data / org.fdroid.fdroid / cache / apks
Next, turn on Expert mode .
- Unstable updates (Unstable updates) - show and offer to install unstable application updates. I do not have this item turned on, since even when the setting is turned off, sometimes versions come across a little unstable. Although there were some applications that were already updated on Google Play, but in the F-Droid were listed as unstable. So, if there is some application that should have been updated, and the functions you need should appear there, then you can try to enable this item.
- Allow repos to install / uninstall apps (Allows repositories to install and uninstall applications) - allows repository owners to send a request to uninstall / install programs. It is useful if you made your repository for your friends and after a while it turned out that some application is too dangerous, and you can send a request to delete this application to everyone. Or vice versa, a new interesting application has appeared, you send to all your friends (who have your repository configured) a request to install a new application. It is also useful if you made a repository for your elderly parents.
But so far there is no distinction on which repository has the right to send such requests and which does not. Either you can enable this feature for all repositories, or not at all.
Also in the F-Droid application, it is possible to transfer applications (only apk, without settings and internal data) to other devices via Wi-Fi, bluetooth or a USB flash drive via a USB-OTG adapter. Useful if there is no internet nearby. This is done not in the settings, but in the main menu through the “Nearby (Near)” item.
Additional Information:
F-Droid Cons :
- Sometimes the speed of downloading applications and updating the list of applications can be low. This is normal, as the F-Droid lives on donations and does not have the ability to make high-speed servers and CDNs. In the settings of the main repositories there is a list of “mirrors” - auxiliary servers.
- Sometimes the application is buggy, but nothing critical. For example, an application tries to install an application update several times in a row. But still, the F-Droid itself has never broken anything for me.
- No application rating, slightly outdated interface, inconvenient search.
- It is not visible from which repository this or that application is presented. If you enable several repositories, it is not clear what is the archive / beta version, and what is stable and from which repository the application is.
-Sometimes, when an update for an application comes out, this update is visible when searching for this application in the F-Droid, but for some reason the F-Droid does not offer to update (it seems to be fixed, I have not seen such cases recently).
Pros :
-In the latest versions of Android, permission to install from third-party sources (not only from Google Play) is issued for each individual application. You can give permission to install only for F-Droid, which reduces the likelihood of installing from other sources. But this is a plus of new versions of Android, not F-Droid.
- F-Droid shows all the permissions that the application requires, including most of the "normal" ones. Google believes that some permissions (such as Internet access) are so insignificant that you can not talk about them. Google Play does not show these permissions, considering that you do not need to know that the application wants to have Internet access !!!
-In the F-Droid, the application page provides links to the source code and the application website. It's easier to look for discussions of issues, recommendations, and so on.
About the completeness and quality of applications in F-Droid.
The number and quality of applications is gradually, but inexorably growing. Read the article (if you have not already read it) [ 113 ]. But in addition to this article, I would like to draw attention to such applications as:
- Anysoftkeyboard (for some reason it is impossible to download from the site, but there is an F-Droid application) + Russian to this keyboard [ 115 ]. If you do not have LOS, then this is definitely the application for you. The main thing is that the keyboard does not require access to the Internet (unlike the Google keyboard or SwiftKey).
- Amaze[117], File Manager [119]. , . - . , .
- PDF MuPDF viewer [121], MuPDF mini, [123]
- QR , — Barcodegen [125]. .
- QR Barcode Scanner [127]. .
- QR — SecScanQR [129]
- Net Monitor [131] — , IP . , , HTTP ( HTTPS) . , ! proc/net.!
- VLC [133] — , F-Droid. , . - .
- J2ME — J2ME Loader [135] — /, Nokia Siemens. , — , .
- — Simple Calendar — [137]. Android , - , . ( ), .
In general, the F-Droid has a whole set of applications from simplemobiletools. And a calendar and notes and contacts and a flashlight and so on. These applications differ in that they ask for minimum permissions. Each application performs only its function.
There are also a bunch of other interesting applications - game console emulators, VPN clients (OpenVPN, Wireguard, and so on), a bunch of small games (there are Tetris), notes, calendars, directories, a Wikipedia download tool for viewing offline (Kiwix), a periodic table scanning base stations of cellular networks for further assistance to geo-projects or to check attempts to listen to you (Tower collector [ 139]), applications for smart watches, meme collections, password managers, torrent clients, i2p clients, SIP clients, encryption of ordinary SMS during transmission - Silence (but only works if both interlocutors have an application installed), various shells (launcher), to-do lists and more. The quality of such applications is growing. In most cases, application functionality is no worse than its counterparts on Google Play (and sometimes even better). Fundamentally new applications almost do not appear on Google Play, mainly analogues of existing ones appear. Therefore, do not pay attention to the fact that the F-Droid repository has only 2000 applications - they are more than enough.
If you can read in English, then there is also a separate forum [ 141 ] with questions / answers, collections and news on applications in F-Droid.
VPN slot
In Android, it is possible to use a VPN. To do this, use a dedicated VPN slot, which can be used by various programs. Many good programs use their VPN slot to implement their functions and create pseudo-VPNs, for example, NetGuard (firewall + conditional ad blocker and tracker), Blokada, DNS66 (ad blocker and tracker). Realizing their function, unfortunately, these programs “clog” the VPN slot, but do not really create a secure connection to any server with a VPN. Using these good programs you lose the ability to use a real VPN. These programs are not bad if you do not have root (superuser rights) and you do not want to use a VPN, but want to additionally limit some programs + “cut” ads and trackers.
Programs in the work profile and devices connected to your smartphone through the distribution of the Internet (tethering) - DO NOT pass through the VPN, but pass directly. (although with the help of certain settings Orbot and iptables (through scripts in AFWall +) you can make sure that everything passes through the VPN).
Personally, I use programs that require root, but at the same time leaving the ability to use the VPN slot to create a real VPN.
AFWall + (Android Firewall +) and built-in Firewall
Google believes that there are so-called “normal” permissions. These are permissions that cannot be limited by standard methods, and which you won’t be warned about in the Google Play description or when installing the application. One of these permissions is Internet access !!! .. You may not even know that the application has Internet access. Personally, I am trying to severely restrict Internet access to all applications that do not need it. I try, in principle, not to give access to Internet applications that have access to my files. For example, photography applications, PDF viewers, and so on. And vice versa, those applications that have access to the Internet (browsers) should not have access to the Storage, contacts and so on. To limit Internet applications, I use two tools:
Integrated firewall
Built-in Android - This is originally built-in in all recent versions of Android Firewall. But Android limits the ability to use these settings! In LOS, this feature is present (not removed). In the “Settings” - “Apps & notifications”, select the application, there is the setting “Data usage” and here in LOS 5 settings:
- Wi-Fi data / Wi-Fi data - turn off the Wi-Fi internet application
- Cellular data / Mobile data - turn off the Internet application over the cellular network
- Background data - turn off the application Internet access when the application is minimized (in the background).
- VPN data - limits the ability to use the network via VPN.
- Unrestricted data usage - I wrote about this earlier. Limits the ability to access the Internet in the "traffic saving" mode
I try to limit the Internet to the fullest, starting with the built-in firewall. First of all, when I first start the device, I restrict access to the keyboard, the built-in browser. But I don’t really trust these settings, since they cannot restrict processes / applications from the “Core / Core” category, and I also read that some applications can bypass the restrictions on the “Background data” ban. I don’t know what kind of “holes” Google left unconsciously or intentionally in their system.
For those who do not have LOSthese settings may or may not be at all. Sometimes you need to install an additional application that will give access to hidden settings. There are applications that organize the interface for these settings (internal). But I do not use such applications - just know that if you do not have LOS, then you can still try to restrict Internet access by system methods without root and without applications using the VPN slot (using the VPN slot - NetGuard).
AFWall +
AFWall + - Firewall / Firewall based on the iptables tool [ 143 ]. This application requires root (root), but not necessarily with full access to change the system, so it will work on any device with superuser rights. The advantage of this application is that it does not use a VPN slot.
This is a very useful application that allows you to prohibit access to certain types of network access for each application separately.
- “Wi-Fi control” - access to the Internet and network via Wi-Fi.
- "LAN control" - access to LAN and localhost. This restriction is included in the “Wi-Fi control / Wi-Fi control”, if you do not enable it separately in the settings.
- “Mobile date” - access to the Internet through mobile communications (2G, 3G, EDGE, LTE, 4G).
- «Roaming control/ » — . «Mobile date/ », .
- «VPN control/ VPN» — VPN, VPN . , . , VPN.
- «Tor control/ Tor» — Tor, Tor. ( — Tor, Tor)
On the main screen there is a division into
“All” - a list of all applications.
"Core" - a separate list of applications related to the Linux kernel.
“System” - a separate list of system applications.
"User" - a separate list of applications you installed.
Let's go through the
Preferences / Settings
-UI Preferences / User Interface
- Enable notifictations / Enable notifications - show a warning that a new application is installed and it needs to be given / taken away the rights to the Internet. It is useful if you have the “Block selected” strategy (more on that later) so that the new application does not have time to send something to the Internet until you have disabled access to it.
- Rules progress - I enable this setting to see what rules apply. In rare cases (in the latest versions less and less) the application of the rules can get stuck. In this case, I exit the application and re-run the Apply Rules.
- Show filters / Show filters for convenience in the interface filters for viewing the type "all / kernel / system / user".
- Show UID for apps / Show UID for applications - display the code of the installed UID application. I use this function for clarity. I advise you to enable it.
- Confirm AFWall + disable / Confirm disable AFWall + - I enable this function so as not to accidentally disable the firewall and for a split second not to allow any of the applications to “skip” to the Internet.
- Rules / Conectivity
Here I include in addition
“LAN control”, “VPN control”, “Tor control”. I don’t turn on the Roaming control, since as far as I know the Russian PPSOs are tricky, they sometimes somehow configure the interaction of the networks so that the phone does not understand that you are roaming. Therefore, I would not rely heavily on this feature.
The following are the settings for advanced users, but we will need to use them!
-Log / Magazine
- Turn on loh service / Turn on the log service - I turn on this service so that later I can see which application is breaking. Very useful feature. Using this function, I realized that even in LOS, even with time synchronization turned off and statistics sending turned off, the system still tries to get to some NTP servers, but not only to them (for example, to 1.1.1.1, to some other ip, which do not even “google.” Unfortunately, in the free application functionality (and there is also a paid version of AFWall +), the log is not very convenient and not very informative.
- Enable show toast - show notifications when an application tries to gain access, when access is blocked by AFWall. But this is not a notification in the upper curtain, but notifications with small pop-up inscriptions (toasts). Useful when setting up accesses. Sometimes some non-standard functionality (such as Tethering / distribution of the Internet via Wi-Fi) does not work and you cannot understand why. In this case, a message may appear which process is blocked and you can understand what needs to be turned on in order for the functionality to work. But this inscription is not always displayed, although it may be just that in AFWall + something is limited. Conversely, it may be that a ban on one process is displayed, but you need to give access to another (this rarely happens). But all this is not about ordinary applications,but some more systemic functions.
- Security
This menu is designed to set a password and a graphic key for access to open the application. I don’t use this functionality because I don’t give anyone the device in my hands and my device is encrypted. But if you give someone a device in your hands, you can put protection on this application. I believe that for such purposes it is more efficient to put separate protection against LOS itself on all applications that have root (and on other applications with sensitive data) than on just one application. (I do not use this built-in function in LOS and unfortunately I can not tell you exactly how).
- Experimental
- Fix startup data leak / IMPORTANT! The fact is that AFWall has a drawback: this program does not start very first when the device boots, and the restrictions set in the program disappear when the device is rebooted. In those few seconds when the device is already loaded, but AFWall has not yet started, + the device manages to connect to the Internet, and some programs manage to access the Internet for 1-2 seconds. To address this shortcoming, there is this proposed feature. You must first select the experimentally appropriate option in the "Startup directory path for script", and then enable "Fix startup data leak / Fix data leak at startup." But most likely this function will require full superuser rights with system r / w (read / write).
Also, this problem can be partially solved using the following actions:
1) Restrict access to applications that should never have access to the Internet through a system firewall (described above as). But this does not solve the problem of accessing applications / processes with the status of "Core / Kernel".
2.1) Turn off Wi-Fi and cellular network before rebooting / turning off the phone
2.2) Particularly skilled ones can write a script for “not turning on” Wi-FI and cellular communications when the device is turned on.
3) Block requests to sites that your phone is trying to "reach" through the hosts file (for example, through the AdAway program). The disadvantage of this method is that only attempts to access sites through the site name, not not through IP, are blocked through the hosts file. For example, in the first seconds, requests for IP type 1.1.1.1 crawl through. (DNS Cloudflare).
4) Disable “Run at startup / run at startup” for some applications in the Privacy Guard (called “Start at power up” in the Privacy Guard) or AppOpsX.
- Enable inbound connections - if you want to have access from the local network to the device (Samba, sshd, AirDroid and so on), you will need to enable this item.
Enable multi-user support - this item is necessary if you have several users. That is, if you made multiple users (multiple-users) on your device (not to be confused with a working profile). Unfortunately, AFWall + only works with multiple users in the “Block selected” mode (see below). And also I was not able to properly configure the 2nd user with the ability to start traffic from the 2nd user via VPN, so I could not test this function (additional users) normally.
Dual apps Support - Support for differentiation of rights for dual applications of the type "Work Profile", dual applications in firmware MIUI, Island and other similar tools. I have this item enabled, since I use the "Work Profile" to create a separate space for some applications. I want to note one detail right away - AFWall + does not see the application in the work profile until the same application is installed in the main profile (I hope the developer corrects this). What I have to do: I install applications in both the main profile and the working, mainly (personal) profile, I block Internet access (through the system firewall) by all means, the rights to autostart and work in the background, and all other rights, but I give necessary rights to the application in the work profile for those types of network access,which I want to give. Then everything works. By the way, you can thus install 2 identical applications on the same device with different accounts. But if in this way you want to bypass the rules of some service, then do not flatter yourself, these services will be able to understand that both applications belong to you through proc / net and through IMEI devices.
There is also a moment about applications from the work profile - unfortunately, in the System / System and User / User filters, applications begin to mix and fall into different categories. Something from the work profile falls into the “System” filter. But this only affects the display in AFWall + and does not affect the functionality in any way. You can distinguish applications from the work profile by the letter “M” after the application name or by a long UID, for example, [101001] Phone Services (M).
- Profiles / Profiles - everything is simple, in this section you can configure several profiles (up to 4). If you have several scenarios of using the device in terms of access to the Internet or the internal network, then you can configure several profiles and switch them by first pressing. Even there are widgets on the desktop from AFWall +.
The logic of restrictions in this program is divided into 2 ways:
1) Allow selected - Allow only what is selected. This is a more "hard method", but I use it. He is tough in that when you install some kind of application, you must separately give him access. But this is what I like about this method. Immediately I want to make a reservation that on LOS 15.1 personally for some reason this method did not always work for me and I had to give access to some applications related to “Core / Core” and “System / System”.
2) Block selected - as the name implies, blocks only the selected. Try to avoid this method, as it is better to act on the principle of "Forbidden is all that is not allowed."
Let's look at a possible configuration option for this application. I want to make a reservation right away that for different scenarios of using the device and for different versions of Android, it is necessary to configure this application in different ways.
Let's analyze the simplest option when you have neither a VPN, nor Orbot, built-in Google applications, no other special proxy servers.
In the simplest case, everything will work very simply. You set it to the “Allow selected” mode and simply give access ONLY to applications that you need only to Wi-Fi or mobile Internet.
Sometimes this does not work and you still need to give access to "[-10] (Any app) Same as selecting all apps / is the same as selecting all applications." Although it is called “the same as the choice of all applications”, it should not automatically give access to all applications at once.
That is, if you are in the “Block selected” mode, then the checkmark on this item should block access to all applications, and in “Allow selected” I have no effect on anything (on LOS 16) . But, unfortunately, this can vary from version to version of Android and other settings. Check in advance. And check when upgrading to a new version of LOS (or Android).
In some cases, it is necessary to enable “[0] (root) Apps running as root / applications with root access”, although this item does not mean access specifically for those applications that you install with root privileges.
In some cases, you need to enable "[-11] (kernel) - Linux kernel / (kernel) - Linux kernel". But this item must be included carefully. With this item blocked, everything works for me, and it can be seen in the logs that this process is constantly trying to get through somewhere.
There are some applications that are grouped under one UID, and you can only disable / enable the Internet as a group. This is mainly a group [1000] This group refers to most Android system applications. This group is disabled for me.
There are some more points that you need to include if you need them.
- [12] « (tethering) DHCP+DNS services/ () — DHCP+DNS» «[0] (root) Apps running as root/ root » «Wi-Fi» — , Wi-Fi.
- [10010] «Download manager». « » . . , VPN Tor, [10010] Download manager ( Wi-Fi ), Download manager IP!!! , — .
- [1021] « (gps) — GPS/GPS» ( ) — , A-GPS. , .
- [10070] Captive portal login — , Wi-Fi. , - Wi-Fi , - // . Captive portal. , , «» Google ( ). , -, ( ).
- some applications, due to the implementation of certain APIs in Android, will need to be given access to the LAN (for example, for AppOpsX in compatibility mode and for some Termux functionality).
- Do not try to forcefully switch applications in the "Core / Kernel" status to Tor via AFWall +.
Complications will begin if you want to configure the device in a bunch of AFWall + plus Orbot plus an additional VPN plus a work profile.
I want to offer you my option of setting AFWall + in conjunction with Orbot and Work Profile without Google applications on LOS 16 (although it worked on LOS 13 and 15.1)
- I choose the strategy “Allow selected”
- Orbot enabled, pseudo-VPN enabled in Orbot. AFWall + gives access for the Orbot app to LAN, Wi-Fi, mobile network, VPN.
- VPN , , F-Droid, [10008] Updater .
- , VPN Tor ( ) Wi-Fi / .
- ( (M) ) Wi-Fi / , VPN. ( ).
- [12] « (tethering) DHCP+DNS services/ () — DHCP+DNS» «Wi-Fi» [10010] «Download manager» - .
And everything, everything works. 99% of traffic in 99% of cases goes through VPN / Orbot, and without VPN / Orbot only what I explicitly indicated goes. This is my way, in terms of privacy, I recommend that you do the same, but I can not insist. If there are any weaknesses in my method - please inform in the comments.
About the switch setting - “Tor control / Tor management”. This setting does not restrict access to Tor, but forces applications to use the Tor network, even if Pseudo-VPN is not included in Orbot and even if the application itself does not have the “Use Tor” setting or the ability to set a proxy. In order for this to work, you need to specify which network the application can access (Wi-Fi or mobile) and put a “tick” in “Tor control / Tor control”. Then the application will forcefully use Tor.
The downside of this method is that there is a “DNS / DNS leak”. Applications themselves use the Tor network, but by the DNS server (which helps to understand the program / device on which IP the server of the site you are accessing is located), they can roughly understand where you are and even combine all the requests into one profile and understand who you are. [ 145 ]. Therefore, I do not use this option.
In fact, in AFWall + you can write the rules yourself in “Set customs Scripts / User scripts” and if you know how to write these scripts, then you can force traffic to pass through Tor without enabling a pseudo-VPN and without DNS leakage. The functionality of custom scripts is very wide. You can even use Orbot without including its pseudo VPN, configure a separate “real VPN” and run some applications through Tor, some through a real VPN, and some directly. As mentioned above, AFWall + is a wrapper over the iptables tool.
During customization, be sure to test for DNS leaks, whether it really launches the application through Tor, VPN, and so on.
Useful links:
a) Distribution of the Internet from the device immediately through Tor [ 146]. By default, the Internet is distributed from the device directly from the mobile network without activating Tor / Orbot.
Regarding the interaction of the built-in firewall and AFWall + - the mechanisms do not overlap and impose restrictions on the applications separately for different mechanisms. Internet restriction in any of the mechanisms limits the application.
Regarding VPN - if you specify some applications as allowed to VPN in VPN settings and enable VPN, then these applications can only work through this VPN (at least for me on my version of LOS and Orbot).
Adway
Ad blocker and tracker by changing the hosts file on the device. In fact, this is just a wrapper for convenient editing of the hosts file. Requires root, and full, with write access to the system, that is, with the rights r / w (read and write).
Pros -
- does not use a VPN slot
- does not load the processor and, accordingly, does not “eat” much battery and RAM
- quite simple and easy to use (besides the fact that in some cases you need to torment yourself one-time with a full root or creating a symlink to the hosts file)
Minuses -
- Requires a full root. But there is a workaround that sometimes works when there is no complete root [ 149 ], [ 151 ], [ 153 ].
- After changing the rules, it requires a reboot of the device so that they begin to be taken into account.
- « » ( ). . , + 1-2 .
- .
- wildcard . . , «example.com», «example.com/cartinka_reklama01.jpg». «example.com» «example.com/cartinka_reklama01.jpg». ( ), wildcard .
AdAway 2-, 3-, 4- ( ) . , «google.com», «account.google.com» «www.google.com» «www.account.google.com» . «*.google.com» - , «», IP. AdAway google.com, , IP 8.8.8.8
- — Google Android DoH (DNS over HTTPS), QUIC ( Youtube). hosts. , Google Android , .
In general, you yourself can modify the hosts file, but just the AdAway application makes this process more convenient.
Let's look at the application settings in Preferences
- Hide welcome card - Yes.
- Check for updates - if you use the rules downloaded from the Internet, it is better to enable it.
- Allow whitelisting (meaning whitelists) - this means whitelists that are not set by you, but which come from files that are loaded from the Internet with lists. My feature is turned off, because it is unclear why it is necessary to include some sites in the “white list”. Only one thought comes to mind - in some of the lists some site / domain is in the black list, but it “breaks” some “normal” sites and in the other list there is a “white list”, which still allows you to work site. But I have not seen this. And if I meet someday, and I really need this site, then I myself will manually add it to the white list (yes, I have to restart the device).
Examples of such possible cases [ 155 ] (all examples are bourgeois).
- “Target hosts file” and “Custom target” - setting for rare cases by choosing the path to the hosts file. For example, if you do not have a complete root, but you can get it temporarily, then you can create a symlink for the hosts file (something like a redirection for the file - a synonym for the path) and select where the new path to the hosts file is located.
- Enable webserver - you need a function only so that some rare applications do not "fool around" and do not close when ads and trackers in their applications are blocked. Instead of simply blocking requests, such applications will additionally be given an empty “response”. I do not use this feature.
- Enable crash reports / Send bug reports - I try not to trust anyone lately, I do not send anything to anyone. Until the developers work out some very transparent mechanism for sending bug reports, I will not send anything to anyone.
Menu:
Host sources (
Initially 3 subscriptions (lists))
| URL
|
SSL
|
Description
|
License
|
|---|---|---|---|
| adaway.org/hosts.txt
|
Y
|
Special hosts file for AdAway containing mobile ad provider
|
CC Attribution 3.0
|
| hosts-file.net/ad_servers.txt
|
Y
|
hpHosts
|
Allowed AdAway project to use it as default
|
| pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext
|
Y
|
Yoyos Hosts file
|
MCRAE GENERAL PUBLIC
LICENSE (version 4.r53) |
These lists initially only contain lists for trackers and for mobile advertising (for the most part the one that pops up in applications).
These lists suit me, because in the browser I use my own powerful ad blockers and trackers (Fennec browser or Tor browser + uBlockOrigin + uMatrix). In rare cases, I use the Bromite browser (with a weak blocker) and I still have enough of these lists (since I do not use common sites). And I use the AdAway functionality itself to catch requests from the LOS itself and rare applications (by the way, I didn’t catch anything serious in LOS).
Here are the lists that can be connected optionally [ 157 ], [ 159 ], [ 161]. Here is a separate list for Google and Qualcomm (including A-GPS servers and LOS statistics) [ 163 ].
Do not add many subscriptions, the Internet will work more slowly (or the device itself will work slowly) if there are many rules in hosts. But if it’s not possible to use blockers in the browser, then it’s better to try to look for good subscriptions. For example, if you do not like Fennec + uBlock Origin, then you can use Bromite + additional subscriptions in AdAway.
You can also import your static lists. Note that it is necessary to palm off in the format of hosts of the type:
127.0.0.1 yandex.ru
other formats are not understood by the program.
- Your lists
Here are the rules that you set manually. These rules take precedence over those in subscriptions.
a) Blacklist (Black List) - you can add it right there manually or from the log.
b) Whitelist (White List) - you can add it right there manually or from the log.
d) Redirects (Redirects) - I do not use. For advanced users. Can not say anything.
- Log DNS requests - Displays the log of blocked / missed requests. Unfortunately, this log must be enabled every time the device is turned on. But I often use this tool.
Firstly, during the initial setup of LOS itself, I constantly looked at which sites LOS itself “knocks” on. Also, when installing any programs, I do the same. If I don’t like something, I immediately blacklisted in the log. Or vice versa, if some application does not work, I look at which sites were blocked and why the application does not work. But since I have all the applications from F-Droid, I did not find any "extra" requests.
To check, you need to enable logging, clear the log (button at the top right), run the application and figure out which sites were involved.
I want to share my findings with you:
- connectivitycheck.gstatic.com — Captive portal. (Captive portal) Wi-Fi -. — , Wi-Fi . Wi-Fi , . , « ».
- time.android.com — (NTP) — , .
- time.izatcloud.net, xtrapath1.izatcloud, xtrapath2.izatcloud, xtrapath3.izatcloud, gpsonextra.net, path1.xtracloud.net . A-GPS, GPS ( « »). GPS , . , ( A-GPS).
- firefox.settings.services.mozilla.com, shavar.services.mozilla.com, addons.cdn.mozilla.net — Fennec ( IceCat) (), ( !!!, issues F-Droid). . F-Droid. . ( — )
- F-Droid ( ), hosts AdAway, ( , ) (uBlock Origin, Bromite ).
-Scan for adware ( Adware) — «» . , , - , .
Orbot, Tor Browser proc/net
Orbot
Orbot is a program from the Guardian Project to launch Explorer into the Tor network on an Android device. Also, this organization (Guardian Project) previously developed the version of Tor browser for Android - Orfox. Now they are working closely with the development team of Tor network and Tor browser for computers to create a version for Android.
At the moment, there is a separate Orbot and Tor browser (with built-in Orbot). Orfox is no longer supported.
Orbot lets you run any application through the Tor network. The program is gradually improving, but the latest versions are in the beta stage and work poorly on some devices. The last version that works stably for me is 16.0.5-RC-2.
Orbot is actually very easy to set up. You should only start it, wait a little time (at the first start it can last up to 2 minutes) and wait for the status “Bootstrapped 100%: Done”. Further, there are options:
1) In the settings of a specific application, if there is such an item "Work through Tor" - specify this item and the application will work through Tor.
1.1) In the application settings, there may not be a point “Work through Tor”, but there may be a point work through a proxy. Next, in the settings of this proxy, install host: 127.0.0.1, port 8118.
2) VPN mode (VPN ), , Tor ( ) Tor-Enabled Apps/ Tor. VPN Orbot Android VPN . «Always-on VPN/ VPN» ( VPN ) «Block connections without VPN/ VPN» ( , Orbot. - ). Tor -VPN ( , VPN ).
3) iptables ( AFWall+) , Tor VPN , « Tor». , , DNS Tor.
:
-«Use Bridges/ » . - , 4- ( 3 ) .
On the left on the main screen there is a choice of the country of the Output node. Selecting a country from the list will force Orbot to sort through the chains so that sites show that you are from this country. I highly recommend not doing this, because after a while enough statistics will be gathered and you may be recognized by indirect signs. If you still need to (for example, the site works only in one country), then after you go to the site, it is better to go back to Global (Auto). Also, this functionality is unstable.
In the upper right corner there is a button in the form of a round arrow, when clicked, the chains should be rebuilt. It is useful if it doesn’t let you to a site from a specific output node. Some sites know many Tor output sites and do not allow access to these sites from these sites. But they don’t know all the output nodes and can put you on their site after you have updated the chains. This functionality sometimes does not work, sometimes the chains do not change. You must turn off the Internet, change the chain and turn on the Internet again.
In the menu "Settings"
- Start Orbot on Boot / Run Orbot at boot - for those who are going to use Orbot on an ongoing basis, you should enable this item.
- Open Proxy on All Interfaces - for a specific situation, for example, to distribute the Internet (tethering) immediately with Tor.
- Entrance Nodes / Input nodes - specify a limiting list of Input nodes (servers) through which Orbot should build chains. The functionality is unstable. Yes, and limiting the number of nodes is not recommended to avoid a decrease in privacy.
- Exit Nodes / Output nodes - specify a limiting list of Output Nodes (servers) through which Orbot should build chains. The functionality is unstable. Yes, and limiting the number of nodes is not recommended to avoid a decrease in privacy.
- Exclude Nodes - specify a limiting list of OUTPUT nodes (servers) through which Orbot should NOT build chains. The functionality is unstable. If you know that some servers belong to attackers, you can add them to this list.
- Strict Nodes - Orbot instructs to use ONLY the above nodes. Without this setting, Orbot will try to use the above restrictions, with the same setting Orbot will be obliged to use the restrictions. The functionality is unstable.
- Use Bridges - the same setting as on the main screen, but here you can manually specify the address of the bridge (additional link in the chain). It could be your own junction / bridge.
- Relaying - permission to be an input or intermediate node (NOT output). Do not do this on a mobile device in order to avoid internet consumption and battery drain quickly.
- Isolate destination addresses - ATTENTION, IMPORTANT setting. The inclusion of this item allows for different applications to use different chains and output nodes. If this item is turned off, then when you request to the same site, but from different applications, the same IP will be used (that is, the same output node). For example, you go to yandex.ru in a browser and look for something “piquant”, and if you log in to Yandex in another browser, Yandex will instantly “figure it out” to you, that is, it will connect you by IP and the time you visit the sites. With the IP setting turned on, they will be different (which cannot be achieved with a normal VPN).
The downside is that this setting eats up the battery a little more.
, , - ( , ) - proc/net. IP proc/net. .
— No Network Auto-Sleep/ — Orbot «» . . Captive Portal connectivitycheck.gstatic.com, , «». .
: Orbot will not be able to start if the date or time on the device is set incorrectly.
Proc / net problem
The proc / net problem - there is a huge privacy problem due to the fact that any application can read the proc / net file and see which IP addresses which application is connecting to and see the statistics of accesses to IP addresses in recent times. This IS NOT BLOCKED ANYTHING. Not a single remedy helps. You can install a Net Monitor (org.secuso.privacyfriendlynetmonitor) [ 131] . IP . « » () . VPN-, Orbot, Privacy Guard, xPrivacyLua . — , IP . : IP IP . 99% , !!! IP , , 99%-, 100% . , .
Google Android 9 P, «» Google Android 10 Q ( LOS 17).[165]
, ? [166], , Facebook . , .
In general, it is unclear whether it will be possible to disable these accesses even in the Android 10 Q version. More precisely, for this information, you will need to request information through the NetworkStatsManager and ConnectivityManager classes methods. But it is unclear what resolution this applies to and whether it will be possible to block this permission (at least in AppOpsX). When introducing a new restriction, Google allows older applications to bypass it for another year after the introduction of the new restriction !!! They regulate this with the so-called Level API (I will further describe this issue). In the same article [ 165 ], it seems like they mean that in the version of Android 10 Q they will not wait a year, but will include this restriction immediately for all applications:
“The following changes affect all apps running on Android Q, even if they target Android 9 (API level 28) or lower.”
A small victory for privacy advocates, but I would not really hope for Google’s integrity. Let's see, the time before the release of Android 10 is a matter of days.
What to do?
- Try not to install applications for those sites that you can view through the browser and watch in the browser.
- Even if you need some kind of application, try to look for an open-source alternative on F-Droid.
- - - open-source , « » ( , IP ). , « » . .
- Tor . Tor Android Tor ( F-Droid, , Orbot , ). Tor, , proc/net! proc/net IP ( ).
Tor Browser
Android Guardian Project 1) Orbot 2) Orfox. Orfox — - Firefox, Orbot. Orfox . Tor (Guardian Project Tor project) Tor Android . Tor Browser Android Firefox, Orbot ( Orbot), .
F-Droid Tor Browser:
1) Tor Browser
2) Tor Browser (Alpha)
Both applications are based on the same stable version of Firefox, but differ in versions of the Tor network and some additional settings. The regular (non-Alpha version) works more stable.
It differs from Orfox in that when you start the application you need to wait for the connection to Tor, and also in that you can set bridges (third-party and your own). As well as in a regular Tor browser for a computer, Mozilla’s tracking (telemetry) was removed from this browser, NoScript add-on was installed, all data (except bookmarks) was deleted upon closing, DuckDuckGo and other settings were set by default as a search engine (for example, WebRTC was turned off). There is also a separate setting for Security Settings.
() . , . , . , . «» , (browser fingerprint) ( ). JavaScript [167].
, Tor Browser proc/net, AdAway ( hosts).
As a result, I use 4 browsers:
1) Tor Browser (Alpha) with optionally installed uBlockOrigin, uMatrix (everything that is blocked) for daily use.
2) Tor Browser without additional extensions for sensitive issues. I rarely use it.
3) Fennec with optionally installed uBlockOrigin, uMatrix (where everything that is forbidden is forbidden) and working not through Orbot to visit sites that do not open through Tor. I use it very rarely, try not to go to such sites (which do not open through Tor).
4) Bromite - for those cases when the site does not open in Firefox-like browsers (Tor Browser and Fennec are based on Firefox). There are few such sites.
If you will use several browsers, I advise you to put different themes, so as not to accidentally go to any site in the wrong browser.
General information about Tor:
- In Russia, the largest number of people using the Tor !!! network [ 169 ]. If you use the Tor network, you will not be considered criminals automatically.
- With great desire, if you aim, then for some time you can figure out a person even sitting through the Tor network. Do not do anything nasty, and not only because they will find, but simply for moral reasons.
- Using only Tor is fraught with a single point of failure. It is necessary to try and develop various means (for example, Tor, I2P, Yggdrasil, Zeronet bridges).
ATTENTION: Tor Browser will not be able to start if the date or time on the device is set incorrectly.
Fennec and bromite
There are two more browsers that I would like to cover.
Fennec
Fennec (aka Fennec F-Droid) is a slightly redesigned version of Firefox with telemetry (trackers) partially disabled.
Let's go through the Settings
- Sign in - the ability to register and enter Firefox Sync to synchronize bookmarks, passwords, open tabs and history. It seems like everything is encrypted “by default” even from Mozilla itself [ 171 ]. You can even try making your Firefox Sync server [ 173 ].
I don’t really need cloud services, but the bookmark synchronization service would be useful to me. I’m in thought between
1) Own Firefox Sync server
2) Own server with Nextcloud - an almost complete set of cloud services on your personal server.
3) Own server with Turtl - note service, including bookmarks.
4) Wallabag - an analogue of Pocket. Not only saves bookmarks, but also deflates sites. You can make your own server.
I cannot recommend Firefox Sync because I could not find an audit of this solution with the audit results in a relatively broad discussion. And bookmarks, passwords and browsing history are very sensitive data. Mozilla (Firefox developer) has not yet been caught in a blatant lie. There was and remains a case with analyzer tracker from Google when you go to addons.mozilla.org/en-US/firefox to search for new add-ons . But they especially did not hide it. Also, Firefox Sync does not work in the Tor browser.
Unfortunately, there is no bookmark export feature in mobile versions of Firefox-like browsers.
I tend to Nextcloud, simply because it’s easier to configure and has more users (and therefore more examples of settings on the Internet). And also a very wide functionality.
- Search - select DuckDuckGo. If you do not have DuckDuckGo in the list, then add later. Google, Yandex, Mail.ru, Yahoo and Bing are best removed even from the list.
How to add a search engine to Fennec, if it is not in the list of proposed
, DuckDuckgo.com. «Page/» — «Add a Search Engine/ … ». -. , , ( utm , ).
— Show search suggestions/ — , - , « 8 999 77 5-55-55» . . , cookies ( ) . .
— Privacy/
- Do not track - useless setting. If it is, then the site is sent a PLEASE do not track you. They themselves are not funny? There was a study where it was shown that those who changed this setting, on the contrary, were more vulnerable, since the request not to track you was part of the technique for collecting browser fingerprints. Therefore, leave this setting as it was originally (whatever it may be) so that it is as similar as possible for more people.
- Tracking protection - Minimum blocking of trackers based on the Disconnect list. It doesn’t even block Google and a bunch of other trackers. You can disable it (of course, by pre-installing and configuring uBlockOrigin).
- Cookies - set Enabled, excluding 3rd party / Enabled, except for third-party sites
— Clear private data on exit/ . . , . , ( , Android , «»), . «Quit/» , . - - , . , «Quit/».
— «Mozilla Location Service/ Mozilla» — Wi-Fi GPS Wi-Fi. . - ( Google , ), - , .
— «Fennec Health Report/ » — . .
— Advanced/
— Restore tabs/ — .
IceCat, Firefox. [113] — , Fennec - , Firefox ( Fennec).
HTTPS Everywhere, uBlockOrigin ( ), uMatrix ( -). WebRTC (about:config → media.peerconnection.enabled → false). NoScript ( uMatrix) XSS, uMatrix, XSS.
.
Bromite
This is a redone Google Chrome. It’s faster than Fennec, but it doesn’t have a very strong ad blocker and tracker (and thanks for that, it doesn’t exist at all in regular Chrome for Android). Therefore, I use it in rare cases when some pages are seriously buggy in Fennec (hello to the developers of the mobile version of habrahabr).
In the settings:
- Search engine / search engine - DuckDuckGo.
- Privacy / Personal data
- Close all open tabs on exit - turn it on. Deletes open tabs when clicking on "Exit / Exit"
- Search and URL suggestions / Turn off search and URL suggestions.
- Use page prediction / Turn off the pages previously - turn off.
- Access payment method - I turn it off.
- Usage and crash reports / Usage and crash reports - TELEMETRY. I disconnect.
- Open links in incognito tabs always - always open tabs in incognito mode. In essence, this is the same as "Delete data (cookies, site data, visit history) upon exit." I'm turning on.
- Do Not Track / prohibition of tracking - do not change. As it was originally, let it remain so.
- Tap to Search / Click to search - turn off definitely.
You can also turn off JavaScript from the main window, which I advise you to do if you go to sites through Bromite just to read articles. But some sites with JavaScript disabled may not work.
Google Apps (Google Apps / Gapps)
Initially, LOS does not contain proprietary Google applications (except for some devices with preinstalled programs for Google’s mobile operator, Google Fi). If you need them, then you can install them yourself. Usually this should be done immediately after installing the LOS without rebooting the device.
Actually, not separate applications are installed, but a whole set of system applications (package), which is deeply installed in the form of system applications and services.
Why you might need a set from Google
1) Normal (mail, maps, Chrome browser) Google applications will not work without preinstalling this package, even if you download these applications separately.
(Youtube can be used in other applications).
2) Some other applications will work only if you install this set of applications. Some applications will be trimmed in functionality. For example, applications that rely on Google maps (use the Google backing) may or may not start at all, or part of the functionality tied to maps may not work.
There is good news: applications for Russian consumers in most cases will start and will work without Gapps. Recently, generally in Russia, they are gradually moving away from being tied to Google (they are making their own substrate based on Yandex cards, Bing, Openstreetmap cards and its derivatives). This slightly increases the size of the applications, but it works. Russian banking applications also work without Google Apps (including root).
3) Push notifications. In order to receive data updates from the Internet (for example, in instant messengers, email clients), you need an Internet connection. If many applications will constantly have an Internet connection, the device’s battery will drain faster. Therefore, Google proposed its GMC function [ 175 ]. The device maintains a constant connection with the Google server, and when a new message is received, the messenger / mailer server sends a message about it to the Google server, and Google sends it to your device. The plus is that the device does not need to support many connections with the servers of all applications and does not need to keep all applications turned on in the background.
It is also a plus for developers that they need to write less code and come up with their own implementation of sending notifications.
F-Droid . , , Google . Gapps Google ( ), «» , Gapps 1-2 , , , Gapps.
4) To quickly determine the geolocation by Wi-Fi or cell towers. Without this, navigation will be determined only by GPS. Some believe that even by GPS, geolocation will not be determined - this is a mistake !!! It’s just that for GPS determination it is necessary at the first start to wait in an open area without moving for about 10 minutes, when the satellite data is updated. Then if you rarely turn on navigation - 2 minutes. If often - 10-15 seconds. Everyone just forgot what a first start is, a cold start, a warm start, a hot start to old navigators.
In LOS, 3 types of packages work (and are fairly tested)
- opengapps — «open» — Google, . Pico[177], . Pico , Google . , Google-. ( ).
- Mind The Gapps — Google. opengapps.
- microg — , - open-source!!! , (). , . opengapps, Google. Google , . , push Google , . , Google . Wi-Fi Google , . opengapps Mind The Gapps — Google . .
: LOS microg. [179]. — microg singature spoofing, «» Google, LOS . «» . - ( ) . singature spoofing . LOS microg, -.
microg LOS, opengapps.
:
— microg () LOS LOS [39] — «LineageOS for microG». , microg — LOS «» LOS. .
— LOS microg ( Nanodroid) .
, microG ( ) [181]. open source push ( GCM).
For the Russian consumer, developers make applications without a tight binding to Gapps. In principle, I try to use only applications from the F-Droid, so this does not bother me much. A couple of applications (banking + one at work) work fine without Gapps and with root. Friends say that public services, taxi services and so on - everything works fine without Gapps.
The only thing that would be useful to me is determining the location via Wi-Fi and cell towers. It seems like you can separately install UnifiedNlp (from microG) + download the base of towers and Wi-Fi (through one of the backends). I have not figured it out yet, but it seems like this can be done without signature spoofing on the official LOS.
Yalp store / Aurora Store
If you do not use Gapps, then you do not have Google Play Market. But you may need some applications that are only available on Google Play. Downloading them from other sources can be dangerous. For such cases, there are applications that can download applications from Google Play:
1) Yalp store (com.github.yeriomin.yalpstore)
2) Yalp Store (fork) (com.github.kiliakin.yalpstore) - since the original Yalp store is not updated, then made a fork (branch) of the application.
3) Aurora Store (com.aurora.store)
All three applications have similar functionality. Please note that Google periodically tightens the screws and these applications may sometimes not work, or lose some of the functionality, for example, application search does not work well, it is better to search by exact name.
. - , Google . , ( ) . , MicroG, Gapps ( Google Play Market).
( ) Google Play split apk — apk . Yalp , Yalp , .
Almost (in 99% of cases), all applications from Google Play have trackers. What are the most popular trackers in the application, you can see on the site [ 61 ]. Or by downloading the Exodus Privacy [ 63 ], ClassyShark3xodus [ 65 ] applications . VERY INTERESTING INFORMATION !!! REQUIRED TO VIEW. We open, for example, data on the Yandex browser [ 183 ]. And what do we see?
-AppMetrica
-Facebook Ads
-Facebook Analytics
-Facebook Login
-Facebook Share
-Flurry
-Inmobi
-Yandex Ad
, ? Facebook Ads, Facebook Analytics, Facebook Login, Facebook Share — . Flurry — Yahoo. Inmobi — Mumbai, India. , , Facebook Yahoo?
MAPS.ME Mail.ru [185]. ))
, - , - «Crash», «Bug» — .
Facebook [187]. . Facebook ? [189]. Facebook does not need to embed individual trackers in their application, since they collect all the data without separate tracker modules anyway.
As a result, Exodus is a very interesting tool, when using which you can finally realize that in the modern world your data is not yours. But you can not rely solely on Exodus, applications can collect data without embedding individual trackers. And the data can then be sold separately, through other channels.
Permission Control, PrivacyGuard, AppOpsX
We approach the most important thing - permission control or access control. I have already described most of the permissions for Internet access. She also described what is included in the concept of “Special app access.”
Types of Permissions
Let's denote the types of permissions:
- Normal — «». , Google ( ) .
, , Bluetooth, Wi-Fi , , [191]. «» .
«» Android- ( «Special app access ( )»). PrivacyGuard AppOpsX ( ADB). - Dangerous — ( «» ). , Android Android. Android . , SMS. SMS , , MMS .
: - , ( ), /. Android !!! . ( ) — ( PrivacyGuard). - Signature — «». , , . (, Android-), . / , , . , ( ) Magisk Xposed Framework. Signature Spoofing. Magisk Xposed Framework MicroG.
, « », - , . . - Special — . Signature, - . . , - Android- « », .
Let's go through the restriction tools:
I have already partially described the restriction tool in Apps & notifications -> Special app access. Various restrictions are presented here, which may not directly apply to any type of restrictions, may apply to normal (CHANGE_WIFI_STATE).
Android standard permission mechanism
The standard permission mechanism for Android: Apps & notifications -> Advanced -> App permissions
Only permissions with the Danger type are listed here. Everything is clear here, you can only enable or disable permission groups. But there is also another type:
“Additional permission” item, where some applications create their permissions, access to which can be given to other applications [ 193 ].
Privacy Guard
LOS: Security & Location ( )->Trust (Trust)->Privacy Guard ( ) ( — PG)
, LOS. , LOS, /.
LOS - — .
«Enabled by default ( )».
You can also enable “Show notifications” at first. This setting will display in notifications that some application is controlled by PrivacyGuard. In fact, even if you set PrivacyGuard to not block anything, the tool itself records the number of calls to this or that resolution. Notifications show that some application is running, and the number of calls can understand how much this or that application is "impudent".
Immediately, you can enable the display of system applications "Show built-in apps (System applications)." At first, I also turned on this setting, so that later I could see the number of calls to a particular resolution by system applications. I did not find any explicit attempts by any system applications to get extra accesses. If there were any calls, then this is because Android is so arranged and I found an explanation for this on the forums. For example, when you select a Wi-Fi network, it appears that the system application is gaining access to the location (like any other application). In any case, for self-education, you can enable tracking for system applications at first.
. , .
. /, 3- :
) Allowed () —
) Ingored ( Disallow) () —
) Always ask () — , .
The Always ask function is useful if there is any application that would not want to give constant access to something, but would like to use it. For example, give instant messengers with the function of calls access to the microphone. But you need to understand that if you gave some application temporary access to the repository (for example), then it can deflate / analyze all the files created earlier. Temporary access to the repository does not create a temporary separate folder (but I would like to), but gives temporary full access to your shared repository. So be careful with the Ask feature too.
In the menu, you can go to "Advanced (Advanced)", where you can see the access to access in the context of the access itself, and not the applications.
Privacy Guard «» , , , .
Privacy Guard «» . , «Start at power up ( )» — «RECEIVE_BOOT_COMPLETED» «Run at startup» Android. , . , , .
:
, «» , Android Privacy Guard . [195] [197] , :
) — , PG — :
) — , PG — :
) — , PG — : , PG, .
) — Forbidden , PG - Forbidden : access is not granted
e) Standard permission - Forbidden , PG - Ask for : access is NOT granted
e ) Standard permission - Forbidden , PG - Forbid : access is requested each time
But since LOS 16 has come out and apparently something has changed. My point b) now looks like this: Standard permission - Forbidden , PG - Allowed: access is NOT granted.
That is, in LOS 16 settings are more tightened towards privacy. If at least something is forbidden, then there will be no access.
There are still moments:
- In versions LOS 14, 15.1 there were failures in the work of Privacy Guard. It seems to be fixed in 15.1, in the 14th version I don’t know (but it is no longer supported).
- If you installed Gapps, either you won’t be able to limit them, or the settings themselves will switch to the “Allowed” state as soon as you exit PG, or the device can enter Bootloop and have to reinstall LOS (or get a little tricky [ 199 ]) . This does not surprise me. Another confirmation that Android with Gapps installed is becoming the property of Google, not yours.
— , . Google Android , , . API level ( ). , - , , , .
— PG [201] ( ) Android- LOS .
, , F-Droid, , Android PG.
AppOpsX (com.zzzmode.appopsx)
This application essentially performs the same function as PG, only there are additional settings that are not in PG. For example, instead of a separate change your audio settings, many small settings are presented, such as Control the volume of signals, Control the volume of notifications, and so on.
From what I would also like to mention: the ability to configure permissions for accessing different sources of location in more detail, such as Mock location (from a separate application that can make a fake location - hello to Pokemon guides), Approximate location (NEIGHBORING_CELLS) - for determining by cellular towers.
To be honest, I did not test the possibility of a detailed restriction of location sources in AppOpsX, since there:
- - . « » PG Wi-Fi, AppOpsX .
- Gapps ( UnifiedNlp location provider) , .
Also in AppOpsX there are other settings that are not in PG and in the standard Android settings, and which I found useful. For example:
Read clipboard (Modify clipboard) and Modify clipboard (Change clipboard). Such restriction functions should appear in Android 10 Q, but it already exists in AppOpsX in Android 9 Pie.
If some settings that are in AppOpsX, but which are not in PG, are disabled in AppOpsX, then they will also appear in PG. It is sometimes inconvenient for perception.
There is also an inconvenience in the fact that if you prohibit something to the application in AppOpsX, and then return access, in some cases access will return only if you restart the smartphone. I don’t know what it is connected with.
Let's go through the settings.
- Automatically turn off permissions - a feature in which AppOpsX disables permissions immediately when installing the application. Unfortunately, on some devices with Android 9, Pie AppOpsX does not work in standard mode (just with root) and this function does not work in this case.
- Close permission template automaticaly (Template for automatically disabling permissions) - select which permissions will be disabled when Automatically turn off permissions is enabled
-Use ADB mode ( ADB) — AppOpsX , ADB. ADB over network (ADB ) AppOpsX Use scipt start server ( ). AFWall+ AppOpsX localhost LAN control/ .
— Allow running in the background ( ) — , «Automatically turn off permissions ( )»
-Root compatibility mode ( ) — AppsOpsX, . LOS 16 (Android 9) . Automatically turn off permissions ( ).
— Show system apps ( ) — LOS, . , , System . LOS (, ), .
In the menu itself, you can enable the mode of viewing permissions not by applications, but by permissions, which is very convenient.
Permission list
I tried to make a list of permissions, with names in Android, PG and AppOpsX
| And_EN | And_RU | PG_EN | PG_RU | AppOpsX_EN | AppOpsX_RU | Description | |||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| normal | - | ACCESS_LOCATION_EXTRA_COMMANDS | Access extra location provider commands | . , () A-GPS. . . | access extra location provider commands | - | - | - | - | A good example for poor documentation, as even books on Android application development state: The Android documentation doesn’t tell us which location commands are “extra,” so we’ll ask for all of them.The documentation of Locus Map gives a hint, though: allows disabling the A-GPS data status and forcing system to load new. | |
| normal | - | ACCESS_NETWORK_STATE | View network connections | (Wi-Fi, 3G, 4G). . . , . | view network connections | - | - | - | - | Allows applications to access information about networks, including if a network is available (or just connecting), what type of network the device is connected to, if any (WiFi, 3G, LTE), if it's in Roaming, and also reasons for a failed connection attempt (if any).Good use: The application may check the state of your connection before trying to access the internet, and e.g. restrict itself to WiFi for some actions.Bad use: Only in combination with other permissions (e.g. data collection for profiling). | |
| normal | - | ACCESS_NOTIFICATION_POLICY | Marker permission for applications that wish to access notification policy. | DND ( ). Do Not Disturb access — DND ( « »). , , DND. | - | - | - | - | - | - | - |
| normal | - | ACCESS_WIFI_STATE | View Wi-Fi connections | Wi-Fi , Wi-Fi . Android . | view Wi-Fi connections (Wi-Fi control) | Wi-Fi ( ( Wi-Fi) | — ( AppOpsX Scan Wi-Fi networks) | — ( AppOpsX Wi-Fi) | WIFI_SCAN | WIFI_SCAN | This could be requested by any application that uses internet access. The application may check the state of your connection before trying to access the internet. It's comparable to ACCESS_NETWORK_STATE, just for WiFi. |
| normal | - | BLUETOOTH | Pair with Bluetooth devices | Bluetooth Bluetooth ( , /). | pair with Bluetooth devices | Bluetooth | - | - | - | - | Allows the app to view the configuration of Bluetooth on the phone, and to make and accept connections with paired devices. |
| normal | - | BLUETOOTH_ADMIN | Access Bluetooth settings | Bluetooth, ( / ). . | access Bluetooth settings | Bluetooth | - | - | - | - | Allows applications to discover and pair bluetooth devices. |
| normal | - | BROADCAST_STICKY | Send Sticky Broadcasts | - . Level API 20. . | send sticky broadcasts | - | - | - | - | ? | |
| normal | - | CHANGE_NETWORK_STATE | Change network connectivity | / Wi-Fi/ . . | hange network connectivity | - | - | - | - | Allows applications to change network connectivity state.Good Cop: Enable network connection only when needed, according to the requirements of the user.Bad Cop: Cause extra costs (especially when in roaming) just for mischievous glee; secretly transfer data (in conjunction with INTERNET). | |
| normal | - | CHANGE_WIFI_MULTICAST_STATE | Allow Wi-Fi Multicast reception | , Wi-Fi. / / . , Wi-Fi (CHANGE_WIFI_STATE), . | allow Wi-Fi Multicast reception | Wi-Fi | - | - | - | - | Allows applications to enter Wi-Fi Multicast mode. This allows to send data packages to multiple recipients simultaneously, without using additional bandwidth. Useful e.g. for streaming servers supporting multiple clients. It also enables to receive network packages not intended for the own device (sniffing).Uses more power than non-multicast-mode. |
| normal | - | CHANGE_WIFI_STATE | Connect and disconnect Wi-Fi | / Wi-Fi, [][https://developer.android.com/guide/topics/connectivity/wifi-scan] , Wi-Fi. | connect and disconnect from Wi-Fi | / Wi-Fi | Change Wi-Fi state | Wi-Fi | connect and disconnect from Wi-Fi | / Wi-Fi | Allows applications to change Wi-Fi connectivity state. Think of it as CHANGE_NETWORK_STATE for WiFi. |
| normal | - | DISABLE_KEYGUARD | Disable your screen lock | . . . | - | - | - | - | - | - | Allows applications to disable the keyguard.This permission is of medium-high importance. It allows an app to disable the «lock screen» that most phones go into after going to sleep and been turned on again. This lockscreen can sometimes be a password screen, or a PIN screen, or just a «slide to unlock» screen. |
| normal | - | EXPAND_STATUS_BAR | Expand/collapse status bar | . . | - | - | - | - | - | - | Allows an application to expand or collapse the status bar.This appears to be a system permission – not for use by regular applications.By collapsing the status bar, an app might have a full-screen mode; an evil app might as well use it to hide the appearance of certain status icons from the user. |
| normal | - | FOREGROUND_SERVICE | Foreground Service | Google Android 9 P . , . Android . | run foreground service | - | - | run foreground service | Required by apps targeting Android P or higher which want to run a foreground service. (A foreground service performs some operation that is noticeable to the user (like playing a sound track). Foreground services continue running even when the user isn't interacting with the app, but must display a Notification.) | ||
| normal | - | GET_PACKAGE_SIZE | Measure app storage space | . . | - | - | - | - | - | - | Allows an application to find out the space used by any package.This permission does not seem to have any risk associated with it. |
| normal | - | INSTALL_SHORTCUT | Install Shortcuts | . . | install shortcuts | - | - | - | - | Allows an application to install a shortcut in Launcher (Homescreen).This is a custom permission for the default Android Laucher (the home screen). It would allow an app to put an icon or shortcut there. While not dangerous, this can sometimes be a sign of a potentially malicious or adware app, which could e.g. create a shortcut that looks like Google Play, but of course launches something completely different. | |
| normal | - | INTERNET | Full
network access |
. ! Android ( ). iptables (AFWall+) . PG AppOpsX . | Have full network access | - | - | - | - | Allows applications to open network sockets. Any application that accesses the internet for any reason will have to request this permission.This is of course required to loads ads (which is why most apps request this), but can also be used to spy on personal data. Special caution is advised when this permission is requested at the same time as others which access personal data. | |
| normal | - | KILL_BACKGROUND_PROCESSES | Close other apps | . . | close other apps | - | - | - | - | Allows an application to call killBackgroundProcesses (String).This permission is a bit of a tricky one. Often this is used by what are called «task killers». Conversely this permission has some potential to maliciously close anti-virus or other security related apps. This should be treat caution. Few users should ever need an app with this permission. Rather, it could be an indicator of malicious intent (especially if not requested by a task killer or system performance tuning app). | |
| normal | - | MANAGE_OWN_CALLS | route calls through the system | – . ( , ), , . | route calls through the system | - | - | - | - | ? | |
| normal | - | MODIFY_AUDIO_SETTINGS | Change your audio settings | . AppOpsX ( Bluetooth, , , ) | change your audio settings | - | - | Allows an application to modify global audio settings. | |||
| normal | - | NFC | Control Near Field Communication | NFC | control Near Field Communication | NFC- | Toggle NFC | NFC | control Near Field Communication | NFC- | Allows applications to perform I/O operations over NFC.The distance which NFC is able to work is only a few centimeters so that devices (or a device and a tag) must effectively be touching each other to communicate. Due to the distance, this technology is not particularly dangerous. However it does present a small risk and it is something that should used with caution. |
| normal | - | READ_SYNC_SETTINGS | Read sync settings | . ( ), . | read sync settings | - | - | - | - | Allows applications to read the sync settings.This permission mostly allows the application to know if you have background data sync (such as for Facebook or Gmail) turned on or off. Might be a indicator that the app wants to adjust its behavior accordingly and respect your wishes concerning when to sync and when not. Note that this only allows access to the sync settings – not to synchronized data. | |
| normal | - | READ_SYNC_STATS | Read sync statistics | ( ). ( ), . | read sync statistics | - | - | - | - | Allows applications to read the sync stats for an account, including the history of sync events and how much data is synced.This permission is related to READ_SYNC_SETTINGS but not particularly dangerous itself. There is a minor risk that some personal information could be gleaned from the sync stats, but the information is unlikely to be valuble. Sync in this case relates to syncing of contacts and other types of media on the phone. | |
| normal | - | RECEIVE_BOOT_COMPLETED | Run at startup | / . | run at startup | Start at power up | run at startup | Allows the app to start itself as soon as the system has finished booting. This can make it take longer to start the phone and allows the app to slow down the device by constantly running. | |||
| normal | - | REORDER_TASKS | Reorder running apps | . . | - | - | - | - | - | - | Allows an application to change the Z-order of tasks. Malware could use this to push some ads o.a. into foreground to be displayed to the user. |
| normal | - | REQUEST_COMPANION_RUN_IN_BACKGROUND | - | - . . . | - | - | - | - | - | - | - |
| normal | - | REQUEST_COMPANION_USE_DATA_IN_BACKGROUND | - | - . . . | - | - | - | - | - | - | - |
| normal | - | REQUEST_DELETE_PACKAGES | Allows an application to request deleting packages. | . , . . | - | - | - | - | - | - | Allows an application to request deleting packages. Apps targeting APIs Build.VERSION_CODES.P or greater must hold this permission in order to use Intent.ACTION_UNINSTALL_PACKAGE or PackageInstaller.uninstall (VersionedPackage, IntentSender)). As this action should launch the application installer, the user should be asked to confirm each install. |
| normal | - | REQUEST_IGNORE_BATTERY_OPTIMIZATIONS | Request exclusion from battery optimizations | . , . . | - | - | - | - | - | - | Grants an app the permission to request being excluded from battery optimizations (aka Doze mode). The user has to approve this. |
| normal | - | SET_ALARM | Set an alarm | . , . . | set an alarm | - | - | - | - | Allows an application to broadcast an Intent to set an alarm for the user.This permission seems to be of low risk because it doesnt allow the setting of the alarm directly. Rather it allows the opening of the alarm app on the phone. | |
| normal | - | SET_WALLPAPER | Set Wallpaper | . . | set wallpaper | - | - | - | - | Allows applications to set the wallpaper. Low risk, if any (except for shocking background images, maybe). | |
| normal | - | SET_WALLPAPER_HINTS | Adjust your wallpaper size | . . | adjust your wallpaper size | - | - | - | - | Allows applications to set the wallpaper hints. Lacking documentation, the best guess is this is about settings for size and position. | |
| normal | - | TRANSMIT_IR | Use IR Transmitter | . . | - | - | - | - | - | - | Allows using the device's IR transmitter, if available. Useful for infrared remote controls. |
| normal | - | USE_FINGERPRINT | Allows an app to use fingerprint hardware. | . USE_BIOMETRIC, . | use fingerprint hardware. | Use fingrprint | use fingerprint hardware | Allows
an app to use fingerprint hardware, but does not give the requesting app access to the enrollment/fingerprint administration flow. |
|||
| normal | - | VIBRATE | Control vibration | . | control vibration | Use haptic feedback | control vibration | Allows the app to control the vibrating function of the device. | |||
| normal | - | WAKE_LOCK | Prevent device from sleeping | . | prevent phone from sleeping | Keep your device awake | prevent phone from sleeping | Allows using PowerManager WakeLocks to keep processor from sleeping or screen from dimming.Useful e.g. for navigation apps, to keep device and screen on without the user needing to tap it every minute.Of course this has strong effects on battery endurance, especially when used frequently. | |||
| normal | - | WRITE_SYNC_SETTINGS | Toggle sync on and off | / , . , , / . . | toggle sync on and off | / | - | - | - | - | Allows applications to write the sync settings.This permission relates to backup and sync of certain types of information like contacts. It allows an app to write settings for how that account and the data are sync and backed up. This is a common permission for social services or contact managers or any other type of app with an account associated with it. Alone, this permission doesn't allow an app access to contacts or other sensitive data. Rather, it just relates to how that data is backed up. Nevertheless, care should be taken as always. |
| dang | CALENDAR | READ_CALENDAR | Read calendar events plus confidential information | . , , / | Read calendar events and details | Read calendar | Read calendar events and details | Allows an application to read the user's calendar data.This permission is of moderate to high importance. While most people would consider their calendar information slightly less important than their list of contacts and friends, this permission should still be treated with care when allowing applications access. Additionally, it's good to keep in mind that calendar events can, and often do contain contact information. | |||
| dang | CALENDAR | WRITE_CALENDAR | Add or modify calendar events and send email to guests without owners | / . , | add and modily calendar events and send email to guests without owner’s knowledge | / . | Modify calendar | add and modily calendar events and send email to guests without owner’s knowledge | / . | Allows an application to write (but not read) the user's calendar data.Apps using this permission can add calendar events, but not read them. So as long as the READ_CALENDAR permission is not requested along, risk should be moderate. However, a malicious app can cause a lot of confusion if you suddenly find a lot of calendar alerts in your notification bar. | |
| dang | CALL_LOG | READ_CALL_LOG | Read Call Logs | . | Read call log | Read call log | read call log | Allows an application to read the user's call log.Implicitly granted with READ_CONTACTS when both minimum and targeted SDK level are 15 (ICS) or lower. | |||
| dang | CALL_LOG | WRITE_CALL_LOG | Write call log | . | write call log | Modify call log | write call log | Allows the app to modify your phone's call log, including data about incoming and outgoing calls. Malicious apps may use this to erase or modify your call log.This permission is not much of a danger by itself, but rather could be used to hide other malicious behavoir. However it has a legitimate purpose for dialer replacements or voice over IP apps (like Google Voice). | |||
| dang | CALL_LOG | PROCESS_OUTGOING_CALLS | Reroute outgoing calls | . , VOIP ( ). | reroute outgoing calls | - | - | reroute outgoing calls | Allows an application to monitor, modify, or abort outgoing calls.This permission is of high importance. This would allow an app to see what numbers are called and other personal info. Generally this permission should only be seen on apps for VOIP (Voice Over Internet Protocol) like Google Voice or dialer replacement type apps.For incoming calls, see MODIFY_PHONE_STATE. | ||
| dang | CAMERA | CAMERA | Take pictures and videos | . | take pictures and videos | - | Access the camera | Take pictures and videos | - | Required to be able to access the camera device.This permission is of moderate importance. As it states, it lets an app control the camera function on your phone. In theory this could be used maliciously to snap unsuspecting photos, but it would be unlikely and difficult to get a worthwhile picture or video. However, it is not impossible to make malicious use of cameras.Legit uses include a.o. camera apps and barcode readers. | |
| dang | CONTACTS | READ_CONTACTS | Read your contacts | . | read your contacts | Read contacts | Read your contacts | Allows an application to read the user's contacts data.This permission is of high importance. Unless an app explicitly states a specific feature that it would use your contact list for, there isn't much of a reason to give an application this permission. Legitimate exceptions include typing or note taking applications, quick-dial type applications and possibly social networking apps. Some might require your contact information to help make suggestions to you as you type. Typical applications that require this permission include: social networking apps, typing/note taking apps, SMS replacement apps, contact management apps.To see what‘s all accessible with this permission, take a look at the app [permission.READ_CONTACTS]http://www.1mobile.co.id/permission-read-contacts-164022.html), which unfortunately is no longer available at Google Play. | |||
| dang | CONTACTS | WRITE_CONTACTS | Modify your contacts | modify your contacts | Modify contacts | Modify your contacts | Allows an application to write (but not read) the user's contacts data.Unless an app explicitly states a specific feature that it would use your contact list for, there isn't much of a reason to give an application this permission. Legitimate exceptions include typing or note taking applications, quick-dial type applications and possibly social networking apps. Some might require your contact information to help make suggestions to you as you type. Typical applications that require this permission include: social networking apps, typing/note taking apps, SMS replacement apps, contact management apps.See also WRITE_CALENDAR. | ||||
| dang | CONTACTS | GET_ACCOUNTS | Find accounts on the device | . Android , . , . , , . | find accounts on the device | Get accounts | Find accounts on the device | Allows access to the list of accounts in the Accounts Service.Applications that require some type of authentication from accounts that are «connected» to the
device. A list of the accounts are ususally displayed so you can choose the account to use with the application. To really use those credentials, the USE_CREDENTIALS permission is required.An evil app could use this permission to spy on you (what are you using?). |
|||
| dang | LOCATION | ACCESS_FINE_LOCATION | Precise location (GPS and network-based) | GPS, Wi-Fi . | access precise location (GPS and network-based) | ( GPS) | Fine location | GPS | GPS | Allows an app to access precise location from location sources such as GPS, cell towers, and Wi-Fi.This permission can be used by applications that display location based ads by publishers like Admob (Google). It is also used by applications that want your exact location. Examples would be Navigation applications, «Check-In» apps like 4square. | |
| dang | LOCATION | ACCESS_COARSE_LOCATION | Approximate location (network-based) | Wi-Fi . | access approximate location (network-based) | ( ) | Coarse location | Access approximate location (network-based) | ( ) | Allows an app to access approximate location derived from network location sources such as cell towers and Wi-Fi.This permission is usually used by applications that display location based ads by publishers like Admob (Google). | |
| dang | MICROPHONE | RECORD_AUDIO | Record audio | record audio | Record audio | record audio | Allows an application to record audio.While this permission is not typically dangerous, it is a potential tool for eavesdropping. However recording audio has legitimate uses such as note taking apps or voice search apps. As a side note recording audio is typically a significant drain on the battery.Bad Cop: In conjunction with the INTERNET permission, this could be used to eavesdrop on the user. | ||||
| dang | PHONE | READ_PHONE_STATE | Read phone status and identity | , : IMEI, SIM ID, , . | read phone status and identity | Read phone state | Read phone status and identity | Allows read only access to phone state.This permission gives access to your device's identifiers (IMEI/IMSI, SIM ID, voice mailbox number, your phone number and, if a call is in progress, the remote number. It‘s not necessarily required for things like call state (whether a call is in progress/pending), network operator, or the network provider used – according to the app permission.READ_PHONE_STATE (no longer listed on Google Play), which shows what this permission is needed for (and what not); also see here.This permission is automatically granted to apps targeted at Android 1.6 or before. | |||
| dang | PHONE | READ_PHONE_NUMBERS | Allows read access to the device's phone number (s). | – READ_PHONE_STATE. (). . | - | - | - | - | read phone numbers | Allows read access to the device's phone number (s). This is a subset of the capabilities granted by READ_PHONE_STATE but is exposed to instant applications.As it's named a subset of READ_PHONE_STATE, the numbers accessed are the ones belonging to you, i.e. assigned to your SIM card (and not your contacts list). | |
| dang | PHONE | CALL_PHONE | Directly call phone numbers | . , , “”. | directly call phone numbers | Make a phone calls | directly call phone numbers | Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed.This permission is of high importance. This could let an application call a 1-900 number and charge you money. However, this is not as common a way to cheat people in today's world as it used to be. Legitimate applications that use this include: Google Voice and Google Maps.Another important point to note here is that any app can launch the phone screen and pre-fill a number for you. However, in order to make the call, you would need to press «Send» or «Call» yourself. The difference with this permission is that an app could make the entire process automatic and hidden. | |||
| dang | PHONE | ANSWER_PHONE_CALLS | Allows the app to answer an incoming phone call. | . . | ? | ? | ? | ? | answer phone calls | Allows the app to automatically answer an incoming phone call, i.e. without user interaction. This is a runtime permission, so no app does get it granted automatically. | |
| dang | PHONE | ADD_VOICEMAIL | Add Voicemail | . | add voicemail | Add voicemail | add voicemail | Allows the app to add messages to your voicemail inbox. | |||
| dang | PHONE | USE_SIP | Make/receive Internet calls | SIP . | - | - | - | - | make/receive SIP calls | SIP | Use SIP for internet telephony. |
| dang | SENSORS | BODY_SENSORS | body sensors (like heart rate monitors) | . , , , . | - | - | - | - | - | - | Allows the app to access data from sensors you use to measure what's happening inside your body, such as heart rate. |
| dang | SMS | SEND_SMS | Send SMS messages | SMS . , “view” (), , | Send and view SMS messages | SMS- | Write SMS/Send SMS | SMS | send and view SMS messages | SMS- | Allows an application to send SMS messages.This could let an application send an SMS on your behalf, and much like the phone call permission, it could cost you money by sending SMS to for-pay numbers. Certain SMS numbers work much like 1-900 numbers and automatically charge your phone company money when you send them an SMS. |
| dang | SMS | RECEIVE_SMS | Receive text messages (SMS) | MMS . MMS , . | receive text messages (SMS) | SMS- | Receive SMS | SMS | receive text messages (SMS) | SMS- | Allows an application to monitor incoming SMS messages, to record or perform processing on them.This permission is mostly a privacy concern. Any app that can read your SMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply «SMS replacment» apps (such as Handcent) and would naturally need this permission to function. Other apps sometimes use this as a way of sending a special code to you device. This can be used by a paid app by sending a code to unlock the full version of an app. Or, this can be used by security apps to listen for a special shutdown codes in case your phone is stolen.More details on this permission can be found a.o. in this post on StackExchange. |
| dang | SMS | READ_SMS | Read your text messages (SMS or MMS) | SMS MMS. | read your text messages (SMS or MMS) | SMS MMS | Read SMS | SMS | Read your text messages (SMS or MMS) | SMS MMS | Allows an application to read SMS messages.This permission is mostly a privacy concern. Any app that can read your SMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply «SMS replacment» apps (such as Handcent) and would naturally need this permission to function. Other apps sometimes use this as a way of sending a special code to you device. This can be used by a paid app by sending a code to unlock the full version of an app. Or, this can be used
by security apps to listen for a special shutdown codes in case your phone is stolen.Check the app permission.READ_SMS to see what information can be obtained with this permission. |
| dang | SMS | RECEIVE_WAP_PUSH | Receive text messages (WAP) | MMS WAP. , MMS | - | - | - | - | - | - | Allows an application to monitor incoming WAP push messages.Sending and receiving MMS is based on WAP. The information that there‘s a MMS message available for download, is sent as WAP Push to the device. |
| dang | SMS | RECEIVE_MMS | Receive text messages (MMS) | MMS . MMS , . | receive text messages (MMS) | MMS- | Receive SMS ( PG, MMS) | SMS ( PG, MMS) | receive text messages (MMS) | MMS- | Allows an application to monitor incoming MMS messages, to record or perform processing on them.This permission is mostly a privacy concern. Any app that can read your MMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply «SMS/MMS replacment» apps (such as Handcent) and would naturally need this permission to function.See also RECEIVE_SMS. |
| dang | STORAGE | READ_EXTERNAL_STORAGE | Read the contents of your usb storage | . USB , SD , SD . | read the contents of your SD card | SD- | Read external storage | read the contents of your SD card | SD- | Allows an application to read from external storage. This permission was granted to all apps by default up to Android 4.3. This changed with Android 4.4 (API level 19), which now requires that applications explicitly request read access using this permission. If an application already requests write access, it will automatically get read access as well.Good/Bad Cop: An MP3 player of course should have access to your music files stored there – but along with that, it could also access all other data stored on the card. Which means, you should never store sensible data (unencrypted) on your SDCard. | |
| dang | STORAGE | WRITE_EXTERNAL_STORAGE | Modify or delete the contents of your USB storage | . USB , SD , SD . | modify or delete the contents of your SD card | SD- | Write to external storage | Modify or delete the contents of your SD card | SD- | Allows an application to write to external storage.This will allow applications to read, write, and delete anything stored on your phone's SD card. This includes pictures, videos, mp3s, documents and even data written to your SD card by other applications. However, there are many legitimate uses for this permission. Many people want their applications to store data on the SD card, and any application that stores information on the SD card will need this permission unless they restrict themselves to their app specific directory provided by the system. Applications that typically need this permission include (but are not limited to) camera applications, audio/video applications, document applications.Warning: Any app targeting Android 1.5 or below (possibly 1.6 as well) will be granted this permission BY DEFAULT and you may not even be warned about it. It is important to pay attention to what version of Android an app is targeting to know if this permission is being granted. You can see this on the Market website in the right hand column. | |
| sign | - | BIND_ACCESSIBILITY_SERVICE | Bind to an Accessibility Service | - | - | - | - | - | - | - | Allows the holder to bind to the top-level interface of an accessibility service. Must be required by an AccessibilityService, to ensure that only the system can bind to it. |
| sign | - | BIND_AUTOFILL_SERVICE | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_CARRIER_SERVICES | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_CHOOSER_TARGET_SERVICE | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_CONDITION_PROVIDER_SERVICE | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_DEVICE_ADMIN | Interact with device admin | - | - | - | - | - | - | - | Allows the holder to send intents to a device administrator. Must be required by device administration receiver, to ensure that only the system can interact with it.For further details, also see: What permissions are granted to an app with device administration privileges? |
| sign | - | BIND_DREAM_SERVICE | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_INCALL_SERVICE | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_INPUT_METHOD | Bind to an Input Method | - | - | - | - | - | - | - | Allows the holder to bind to the top-level interface of an input method. Must be required by an InputMethodService, to ensure that only the system can bind to it. |
| sign | - | BIND_MIDI_DEVICE_SERVICE | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_NFC_SERVICE | Bind NFC Service | - | - | - | - | - | - | - | Must be required by a HostApduService or OffHostApduService to ensure that only the system can bind to it. |
| sign | - | BIND_NOTIFICATION_LISTENER_SERVICE | Bind Notification Listener Service | - | - | - | - | - | - | - | Must be required by an NotificationListenerService, to ensure that only the system can bind to it. |
| sign | - | BIND_PRINT_SERVICE | Bind Print Service | - | - | - | - | - | - | - | Must be required by a PrintService, to ensure that only the system can bind to it. |
| sign | - | BIND_SCREENING_SERVICE | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_TELECOM_CONNECTION_SERVICE | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_TEXT_SERVICE | Bind to a Text Service | - | - | - | - | - | - | - | Allows the holder to bind to the top-level interface of a text service (e.g. SpellCheckerService). Must be required by a TextService to ensure that only the system can bind to it. |
| sign | - | BIND_TV_INPUT | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_VISUAL_VOICEMAIL_SERVICE | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_VOICE_INTERACTION | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_VPN_SERVICE | Bind to a VPN service | - | - | - | - | - | - | - | Allows the holder to bind to the top-level interface of a Vpn service. Must be required by a VpnService, to ensure that only the system can bind to it. |
| sign | - | BIND_VR_LISTENER_SERVICE | - | - | - | - | - | - | - | - | - |
| sign | - | BIND_WALLPAPER | Bind to wallpaper | - | - | - | - | - | - | - | Allows the holder to bind to the top-level interface of wallpaper. Must be required by a WallpaperService, to ensure that only the system can bind to it. |
| sign | - | CLEAR_APP_CACHE | Delete all app cache data | - | - | - | - | - | - | - | Allows an application to clear the caches of all installed applications on the device.This permission is of low importance. It allows an app to clear the cache of apps on the phone or tablet. The cache is a place that an app stores recently used data for faster access. Clearing the cache can sometimes (very rarely) fix bugs related to those files. Clearing these files generally presents no risk other than
to slow the performance of the phone or tablet (as apps will need to re-create the caches when used). |
| sign | - | MANAGE_DOCUMENTS | Manage Documents | - | - | - | - | - | - | - | Allows an application to manage access to documents, usually as part of a document picker. |
| sign | - | READ_VOICEMAIL | - | - | - | - | - | - | - | - | - |
| sign | - | REQUEST_INSTALL_PACKAGES | Allows an application to request installing packages. | . , . | Install unknown apps Apps & notifications→Advanced→App permissions | →→ | - | - | request install package | Allows an application to request installing packages. Apps targeting APIs greater than 25 (Android 7/Nougat) must hold this permission in order to use ACTION_INSTALL_PACKAGE. As this action launches the application installer, the user should be asked to confirm each install. | |
| sign | - | SYSTEM_ALERT_WINDOW | Draw over other apps | . Pictire-in-Picture, Android . | Display over other apps | Draw on top | This app can appear on top of other apps | Allows an application to open windows using the type TYPE_SYSTEM_ALERT, shown on top of all other applications.This permission allows an app to show a «popup» window above all other apps, even if the app is not in the foreground. A malicious developer/advertiser could use it to show very obnoxious advertising. Almost no apps should require this permission unless they are part of the Android operating system. An example of a system alert would be the alert you are shown when your phone or tablet is out of battery and is about to shut down.Also see: Android.SE «Drawing over other apps» | |||
| sign | - | WRITE_SETTINGS | Modify system settings | . | Modify system settings | modify system settings | modify system settings | Allows an application to read or write the system settings.Global settings are pretty much anything you would find under Android's main 'settings' window. However, a lot of these settings may be perfectly reasonable for an application to change. Typical applications that use this include: volume control widgets, notification widgets, settings widgets, Wi-Fi utilities, or GPS utilities. Most apps needing this permission will fall under the «widget» or «utility» categories/types. | |||
| sign | - | WRITE_VOICEMAIL | - | - | - | - | - | - | - | - | - |
| AppsOpsX | - | READ_CLIPBOARD | Read clipboard | . Android 10 Q | - | - | - | - | Read clipboard | ? | |
| AppsOpsX | - | WRITE_CLIPBOARD | Modify clipboard | . Android 10 Q | - | - | - | - | Modify clipboard | ? | |
| ? | PACKAGE_USAGE_STATS | Update component usage statistics | . PG. | Usage access ( ) | ( ) | Get usage stats | PACKAGE_USAGE_STATS | PACKAGE_USAGE_STATS | Allows the modification of collected component usage statistics. Not for use by normal applications.Most likely refers to app statistics, e.g. how often an app was started. |
[203], [205] ,[207], [209] .
, :
ACCESS_WIFI_STATE — View Wi-Fi connections
CHANGE_WIFI_STATE — Connect and disconnect Wi-Fi
INTERNET — Full network access — Android ( LOS) AFWall+
RECEIVE_BOOT_COMPLETED-Run at startup — , , 100% (, , Orbot, AFWall+,AdAway )
READ_PHONE_STATE - Read phone status and identity - restrict access to many non-resettable data. But do not rely heavily on this limitation, many data can be obtained in an indirect way.
WAKE_LOCK-Prevent device from sleeping - I limit to those applications to which I also limit work in the background.
READ_CLIPBOARD-Read clipboard - I don’t know if applications can access the clipboard even if they don’t “clamp” the tap for a few seconds to call the clipboard menu. Just in case untrusted applications, I turn off the reading of the clipboard.
RECEIVE_MMS - I advise you to disable even the default application. Especially if you do not have the latest version of Android (or LOS). Previously, too many bad things came through MMS.
And of course I restrict all permissions with the Dangerous type (dangerous) to those applications that do not need it.
The above recommendations do not mean that you should rely only on my experience. I advise you to study everything yourself.
What can not be limited
Now let's move on to the "fun" - permissions that are practically or even impossible to limit:
- The ability to get a list of applications. You can limit it only to XprivacyLua, but it is not very safe if you do not carefully monitor what you are doing with the device. For advanced users only. It is also possible to partially restrict access if you make a work profile, I will write about this later.
- Access to such sensors as, compass, accelerometer, atmospheric pressure sensor and so on.
- Android, , [211], [213]
,- 2015-2016 Xiaomi . . , , «» . «», - ( «» «», ). - . . , , ! ( MIUI ), . . IT -20, (, , )!!! , . — , . - . , — .
, . , - — .
, Android 10 Q ( Android 5,6,7,8,9).[215]
- proc/net. . GrapheneOS, Pixel 3a, Pixel 3a XL, Pixel 3 Pixel 3 XL.
- Scoped storage [217] — «» . , , , . :
) level API = 28 ( Android 9), .
) - [219] 1- 2020 . - ACCESS_BACKGROUND_LOCATION [221] — , . - 2020 , .
- - - [223]. , . Android 10 Q.
- , EMEI, Wi-Fi MAC, . Android 10 Q, .
- ID , Wi-Fi Bluetooth .
- . . , , / , ( AppOpsX) , / .
- .
I did not find how to limit the application to launch other applications. This was a frequent occurrence in versions of Android 6 and 7, but recently I have not seen this. Either Android limited this opportunity, or due to the fact that I carefully select applications, this now does not happen to me.
Level API / sdk
Google Android - , - , - , - . Android Level API.[225]
Android - , . — Scoped storage. Android 10 Q Level API=29. , , Android 10 Q Android 10 Q . - Level API=28, Android 10 Q . SD-, (, , ). , , , ! Level API ?: Google Play Android Level API , API. Google - .
, Android, Level API .
Level API «apps_Packages Info
(com.oF2pks.applicationsinfo)»[227]. , Level API ( SDK) .
Level API/SDK Google Play .
Let's look at the example of such a “wonderful” Telegram messenger permission to read and write to the repository. Aside from the fact that in telegram registration is only by phone number and the code of their servers is closed, let's talk about how their chats work. There is a problem that user alex0ff [ 229 ] described back in 2014.
I will describe the version from F-Droid in which the folder structure has not changed [ 231 ].
Watch your hands (sim salabim) - applications have several options for storing their data:
- data/data. , Android , «» SD . , , SD . ( Samsung, ). , - . 3 . . (, ).
- sdcard ( , ) Android/data
( sdcard/Android/data/org.telegram.messenger)
) / (Telegram-) , .
) ( , )!!! - sdcard ( Android/data). , sdcard «Telegram». , ( , ).
:
) sdcard/Telegram. . . . [211], [213]. , — . Facebook proc/net IP ( ). , Facebook ( WhatsApp Instagram) ? .
b) in principle, all files from secret chats should not be stored in the general storage. In fact, the files (but not all seem to be) are stored in the sdcard / Android / data / org.telegram.messenger folder !!! They are seen by all applications with access to the repository. Why are they not saved in data / data / org.telegram.messenger so that no one can see them? Too many questions from me and so few answers from Paul.
So, if you do not understand anything from what I wrote, then I will describe it more simply :
, Telegram WhatsApp. , ( , WhatsApp ). WhatsApp 99%-, . .
, Telegram WhatsApp. ( ).
. , . Conversations AdAway.
. ( ) WhatsApp-[233]. — WhatsApp. , WhatsApp, WhatsApp- ( ), WhatsApp-, .
, , , .
, WhatsApp iPhone.
SD-card/usb-storage
Historically, the internal memory of the device was called an SD card, as in the first devices there really wasn’t a normal memory chip and it was replaced by an SD card (soldered). Now, chips with a normal amount of memory are installed in the device and the name has changed to " usb-storage». SD SD (, ). Android sdcard . SD , - , SD ( — ), SD . , SD .
[69].
(Work profile) Shelter (net.typeblog.shelter)
Standard Android has a separate feature called the Work Profile. It is needed in order to have two spaces on one phone - your personal and for work applications. In order for the work profile to be activated, you need to install a special application from your employer. But you can use this mechanism without "foreign" programs by activating it using the Shelter application (net.typeblog.shelter) from F-Droid.
The first time you run this application, you will need to give access to “Install unknown apps” and Device admin apps. Serious enough rights, but they are necessary for the application to work. At the same time, this application does not ask for Internet access and does not ask for root access, it is open source (unlike the analogue of Island).
, , 5 . ( Android) . .
LOS 14, 15.1 16 .
?
—
—
—
() :
— proc/net — IP .
— IMEI
— .
, , , . , EMEI. , , (Wi-Fi ) .
. Accounts () . «Work profile settings ( )» «Contact search ( )»
Shelter , .
Shelter:
- VPN . VPN — , VPN VPN , VPN. VPN .
- ( , ) . , .
- .
:
1) AdAway — AdAway , .
2) AFWall+ — AFWall+ , . — AFWall , . , .
AFWall+ «Dual apps Support/ »
3) PrivacyGuard — , PG. PG - . Advanced () .
4) AppOpsX — «Users ()», «Work profile».
, AppOpsX.
5) Orbot VPN — , Orbot — Tor Orbot- Tor.
, — «RECEIVE_BOOT_COMPLETED Run at startup»
, VPN/Tor.
, , IP proc/net.
XprivacyLua
XprivacyLua — Xposed.
, «» . Android, ( [235]).
XprivacyLua signature spoofing, , , , - .
XprivacyLua proc/net.
XprivacyLua Android, .
ADB (Android Debug Bridge)
ADB [237], [239]
, adb LOS, .
, - «» , adb [241] ( , ). , , . Facebook — :). Google Play «/» , - ADB, . 4pda .
PG AppOpsX, adb. . [243]. revoke — .
ADB, ADB, , .
Google LOS
, LOS Google (Gapps), , Google. , LOS / Google /[245]. , LOS 14, 15.1 16. ( ).
DNS
DNS — Google DNS. , DNS 8.8.8.8
Google , IP. , .
Android Wi-Fi DNS . DNS Google-. Orbot ( AFWall+) — , DNS Google. , dnsleaktest.com[59].
LOS 16 DNS , DNS, DoT — DNS over TLS. .[247]. DoT DoH ( IP). «» Google-.
LOS Android DoT Google, Cloudflare (1.1.1.1). — Cloudflare , , . Cloudflare. ( ).
Settings > Network & internet > Advanced > Private DNS «Off», DNS .
DNS — . Orbot DNS IP , IP Tor.
Captive Portal
Captive Portal — . Captive Portal, . «https://captiveportal.kuketz.de».
A-GPS
A-GPS — A-GPS . — IMEI!!! , Google . A-GPS . GPS ( AFWall+) . . , Android ( ), A-GPS.
AOSP Webview
AOSP Webview — LOS AOSP Webview. Chromium. . . , 4-5 Webview. Webview . — K-9 Mail.
AOSP Webview Google . AdAway — AOSP Webview K-9 Mail Google.
AOSP Webview Bromite Webview[97], .
AOSP Webview , 1- : WebView , WebView. DuckDuckGo [249] Google[251].
Project Fi
Project Fi — Google LOS . , [245]. . , , , , LOS.
Backup ()
- , . TWRP — [253],[255].
:
— ( LOS 15.1 LOS 16)
— firmware
— ,
— ,
— ( Nextcloud), , .
— , ( ). , , , «» .
, . , LOS 15.1 LOS 16, LOS . , .
, — .
, TWRP , . ( ADB), .
, (, ) , EDS Lite (com.sovworks.edslite) . , Android. , , .
, - ? !
- , , Replicant (backdoor/) Samsung .[257],[259].
. Replicant, Android . . ( ), - — . . - «». , (GSM, 3G, LTE) . (, ). , .[261] , . , , , , . . - Mail.ru .
- «» . Wi-Fi[263]. , - -. — Firmware ( LOS) LOS ( ).
, Wi-Fi GSM ( ) USB . . , ( , ).
Replicant
Android 6, LOS 13[265],[267]. , . , Android 6 ( Replicant Android 4.2)
GrapheneOS
( ) Android. (, proc/net). Pixel 3a, Pixel 3a XL, Pixel 3 and Pixel 3 XL[269]. (AdAway ). Gapps, . GrapheneOS Android 10 Q. - Pixel 3a, .
Android
Librem 5 — Linux[271], [273]. . — , Wi-Fi (). , (700$). , .
Ubuntu touch — , ( Ubuntu Phone[275]). ( ) . [277]. , , .
iPhone?
, Apple , Google, Siri, :
- Apple «», . Apple Uber “” , Uber, ( ).[279]
[281]. , Uber , «» Apple .
, Apple, «, ».
, «», . - 2 «» [283] . .
- Siri «» [285]. ( ) - «Apple Siri», . : ) Apple ) , «» . — iPhone , - « », 100 - « ». - « *, , , , . , , Apple »? .
- , iOS 13 ( ):
) [287]. .
) SSID BSSID Wi-Fi, [289]. - Jailbreak (- ), , [291]. , . , . - .
- , jailbreak- ( ).[293]. iOS , . Apple, .
- iPhone . , .
. — Apple , ( ) .
— . Google Apple ( ) . — Android 10 Q . , .
Linux (PureOS, Ubuntu Touch).
( ). 150$ , 5 400$.
- - «» . Librem 5 Linux, ARM, Arm Holdings. Arm Holdings , [295]. , . - ( RISC-V), - .
. , ( ) .
— Google , , . Android Android-AOSP[297]. Android Miracast ( Chromecast), QUIC, DoT, DoH, DNS . , Android 11. , Google Fuchsia[299] Google (, Chromium ). Android . Google: Chrome, Google [301].
— . Huawei . Xiaomi , 3 . Xiaomi , . Nokia . Samsung .
, LOS.
- [303] — , , « ». , , , .
— .
— , [305].
— F-Droid. F-Droid.
— . , , , ( , ).
— - , ( Uber).
— Gapps .
— Magisk . — , .
— .
— , . , LOS. Huawei , Huawei - ( 3 ). , . , 2 . !!! , — 1000 , LOS — , , , LOS Android . , , . , — «» — . — - ?
LOS
— ( ) LOS. Android One. , LOS , LOS Android. Android 10 Q , , LOS 17 ( Android 10 Q). , LOS 15.1, LOS 16, - LOS 17 ( Android 10 Q).
, Ivi, Gapps. 10 — ( ). 70% , , «». Orbot , - .
F-Droid, :
1) . , . . — Gapps . - — , . /.
2) . F-Droid OSM (Openstreetmaps), , . , . — OSM . , — . : Google - (, ). Mapbox ( OSM), Google , , , Mapbox. OSM Mapbox — , Google . , , . №2 — [307]. Google . — ( «» ). — , , . . , OSM. , OSM , . . OSM — , . . .
, OSM. , , , .
, , , , , , . ?
—
, . — . — .
: , … ( ).
: , , . -, 70% LOS, Android iPhone ( WhatsApp). , LOS , Android . . , . .
: (), , … ( )
: . LOS ( , ).
: , .
: -, . -: ? , «» — , , , , . , , . « — .» , .
: , , « »? , .
: . , . , . , - ( , F-Droid). , , . 100% — . 95%, 15%.
: () . . . , , .
: . , . . « ?», « WhatsApp-e» , . , . . .
, , . . — , « ».
: Tor , , 6 . .
: — , . . , . , . , — / i2p, zeronet, yggdrasil /. , .
: Tor ? ?
: . , 2 2,2 . , Tor . Tor . Tor , DDOS . . — - ( Tor ). -, , «» . - — . 2 — .
: .
: - , . - , . — . . . , - LOS, — . . . , — , . - — . F-Droid. Fennec uBlockOrigin . LOS. - 4-5 . — , «» . , . Google . , ( , , ). . - ( «» ), ( ) .
: Google «» Android. LOS.
: «» . , Facebook (, , IP ) «» SwiftKey ( ), «». . . , xakep.ru .
: ?
: . , . . , , . ( ). , — .
()
. . , ( [309]).
- — .
. Privacy Guard. . .
. F-Droid (, — AnySoftKeyboard, — QKSMS, — Open Camera, , — Fennec+Tor browser, K-9 Mail, VLC ). , .
, - LOS — . , 4pda xda-developers ( ). reddit.com, [311].
Shelter ( )
— AdAway, AppOpsX, AFWall+.
root — NetGuard. AFWall+, F-Droid AdAway ( hosts)[313]. , NetGuard VPN, NetGuard VPN. Orbot+ Tor browser . - , Google ( Gapps LOS) — LOS , 1 . , . .
( ) Gapps — 1-2 .
, :
1) (, Orbot ). ? Android 9 - ? SuperFreezZ (superfreeze.tool.android)?
2) , SIM ( Defcon 21). SIM ?
3) - ? - ?
[1] ru.wikipedia.org/wiki/LineageOS
[3] lineageos.org
[4] source.android.com/setup/start/licenses
[5] download.lineageos.org
[7] www.reddit.com/r/LineageOS
[9] forum.xda-developers.com/lineage
[11] 4pda.ru/forum/index.php?act=search
[13] docs.google.com/spreadsheets/d/1swcOWw_KcSaE8otSa-1rthq7bLLmfsNZMWnVF5XCd1o
[15] piotr-yuxuan.github.io/choose-a-new-phone
[17] anton-z-s.github.io/linext/#
[19] stats.lineageos.org
[21] www.lineageoslog.com/statistics
[23] texnoera.com/kak-razblokirovat-zagruzchik-na-xiaomi
[25] wiki.lineageos.org/devices/santoni/install
[27] wiki.lineageos.org/adb_fastboot_guide.html
[29] androidp1.ru/ustanovshhik-adb-na-kompyuter
[31] dl.google.com/android/repository/platform-tools-latest-windows.zip
[33] wiki.lineageos.org/gapps.html
[35] lineageos.org/Summer-Survey-2-Results
[37] microg.org
[39] lineage.microg.org
[41] download.lineageos.org/extras
[43] f-droid.org
[45] f-droid.org/en/packages/dev.ukanth.ufirewall
[47] f-droid.org/en/packages/org.adaway
[49] f-droid.org/en/packages/com.zzzmode.appopsx
[51] guardianproject.info/releases
[53] guardianproject.info/releases/Orbot-16.0.5-RC-2-tor-0.3.4.9-fullperm-universal-release.apk
[55] f-droid.org/en/packages/com.moez.QKSMS
[57] f-droid.org/en/packages/de.shandschuh.slightbackup
[59] dnsleaktest.com
[60] www.privateinternetaccess.com/pages/whats-my-ip
[61] reports.exodus-privacy.eu.org/en
[63] f-droid.org/en/packages/org.eu.exodus_privacy.exodusprivacy
[65] f-droid.org/en/packages/com.oF2pks.classyshark3xodus
[67] expandedramblings.com/index.php/android-statistics
[69] developer.android.com/about/dashboards
[71] habr.com/ru/company/solarsecurity/blog/427431
[73] www.iguides.ru/main/security/khotite_maksimalno_zashchititsya_ot_khakerov_zablokiruyte_sim_kartu_pin_kodom
[75] developer.android.com/reference/android/Manifest.permission.html#GET_ACCOUNTS
[77] source.android.com/devices/tech/ota/ab
[79] github.com/fgl27/isu
[81] forum.xda-developers.com/android/apps-games/isu-simple-app-to-deactivate-activate-t3478348
[83] www.reddit.com/r/LineageOS/comments/a4rlox/requesting_a_good_explanation_on_why_magisk_is_bad
[85] f-droid.org/ru/docs/Anti-Features
[87] f-droid.org/en/packages/com.mdroid
[89] f-droid.org/en/packages/org.gdroid.gdroid
[91] f-droid.org/docs/Reproducible_Builds/?title=Deterministic,_Reproducible_Builds
[93] fdroid.bromite.org/fdroid/repo?fingerprint=E1EE5CD076D7B0DC84CB2B45FB78B86DF2EB39A3B6C56BA3DC292A5E0C3B9504
[95] github.com/bromite/bromite
[97] github.com/bromite/bromite/wiki/Installing-SystemWebView
[99] microg.org/fdroid/repo?fingerprint=9BD06727E62796C0130EB6DAB39B73157451582CBD138E86C468ACC395D14165
[101] microg.org/fdroid.html
[103] apt.izzysoft.de/fdroid/repo?fingerprint=3BF0D6ABFEAE2F401707B6D966BE743BF0EEE49C2561B9BA39073711F628937A
[105] android.izzysoft.de/repo/info
[107] android.izzysoft.de/articles/named/list-of-fdroid-repos
[109] forum.f-droid.org/t/known-repositories/721
[111] f-droid.org/wiki/page/Known_Repositories
[113] habr.com/ru/post/440280
[115] f-droid.org/en/packages/com.anysoftkeyboard.languagepack.russian2
[117] f-droid.org/en/packages/com.amaze.filemanager
[119] f-droid.org/en/packages/com.github.axet.filemanager
[121] f-droid.org/en/packages/com.artifex.mupdf.viewer.app
[123] f-droid.org/en/packages/com.artifex.mupdf.mini.app
[125] f-droid.org/en/packages/de.cryptobitch.muelli.barcodegen
[127] f-droid.org/en/packages/com.google.zxing.client.android
[129] f-droid.org/en/packages/de.t_dankworth.secscanqr
[131] f-droid.org/en/packages/org.secuso.privacyfriendlynetmonitor
[133] f-droid.org/en/packages/org.videolan.vlc
[135] f-droid.org/en/packages/ru.playsoftware.j2meloader
[137] f-droid.org/en/packages/com.simplemobiletools.calendar.pro
[139] f-droid.org/en/packages/info.zamojski.soft.towercollector
[141] www.reddit.com/r/fdroid
[143] ru.wikipedia.org/wiki/Iptables
[145] github.com/ukanth/afwall/issues/957
[147] github.com/ukanth/afwall/issues/940
[149] www.reddit.com/r/LineageOS/comments/c0y6o4/adaway_on_ab_devices
[151] www.reddit.com/r/LineageOS/comments/clhy1y/i_cannot_edit_the_hosts_file_even_with_root_access
[153] www.reddit.com/r/LineageOS/comments/ca810c/edit_hosts_file
[155] github.com/AdAway/AdAway/wiki/ProblematicApps
[157] www.reddit.com/r/androidapps/comments/92yv38/which_lists_do_you_use_on_adaway
[159] github.com/AdAway/AdAway/wiki/HostsSources
[161] 4pda.ru/forum/index.php?showtopic=275091&st=4580#entry62522395
[163] gitlab.com/Jorgu81/hosts/raw/master/HostsGoogle
[165] developer.android.com/preview/privacy/data-identifiers#proc-net-filesystem
[166] www.kuketz-blog.de/android-erlaubt-apps-vollen-zugriff-auf-die-netzwerkaktivitaet
[167] www.deviceinfo.me
[169] roskomsvoboda.org/48296
[171] hacks.mozilla.org/2018/11/firefox-sync-privacy
[173] www.reddit.com/r/privacy/comments/81w6tb/for_the_paranoids_install_your_own_firefox_sync
[175] ru.wikipedia.org/wiki/Google_Cloud_Messaging
[177] github.com/opengapps/opengapps/wiki/Package-Comparison
[179] www.reddit.com/r/LineageOS/comments/8p4169/what_is_lineages_position_on_signature_spoofing/e088xyh
[181] prototypefund.de/project/microg
[183] reports.exodus-privacy.eu.org/en/reports/85066
[185] reports.exodus-privacy.eu.org/en/reports/91964
[187] reports.exodus-privacy.eu.org/en/reports/85068
[189] www.facebook.com/about/privacy/update
[191] developer.android.com/guide/topics/permissions/overview#normal_permissions
[193] developer.android.com/guide/topics/permissions/defining
[195] www.reddit.com/r/LineageOS/comments/9oss72/willshould_privacy_guard_be_removed_from_los_or
[197] www.reddit.com/r/LineageOS/comments/9oss72/willshould_privacy_guard_be_removed_from_los_or/e7x97bo
[199] www.reddit.com/r/LineageOS/comments/6o30uk/locking_google_play_services_in_privacy_guard
[201] www.reddit.com/r/LineageOS/comments/7m9023/difference_between_application_permissions_and
[203] android.izzysoft.de/applists/perms
[205] www.wandera.com/mobile-security/app-and-data-leaks/app-permissions
[207] stackoverflow.com/questions/21227367/when-is-bluetooth-admin-android-permission-required
[209] stackoverflow.com/questions/3490913/what-is-a-sticky-broadcast
[211] www.iguides.ru/main/security/bolee_1000_prilozheniy_dlya_android_sobirayut_lichnye_dannye_polzovateley_bez_ikh_soglasiya
[213] www.ftc.gov/system/files/documents/public_events/1415032/privacycon2019_serge_egelman.pdf
[215] developer.android.com/preview/privacy/checklist
[217] developer.android.com/preview/privacy/scoped-storage
[219] developer.android.com/reference/android/R.attr.html#requestLegacyExternalStorage
[221] developer.android.com/preview/privacy/device-location
[223] developer.android.com/preview/privacy/background-activity-starts
[225] ru.wikipedia.org/wiki/__Android
[227] f-droid.org/en/packages/com.oF2pks.applicationsinfo
[229] habr.com/ru/post/240521
[231] github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/master/README.md
[233] habr.com/ru/news/t/451810
[235] github.com/M66B/XprivacyLua/blob/master/XPRIVACY.md
[237] developer.android.com/studio/command-line/adb
[239] 4pda.ru/forum/index.php?showtopic=383300
[241] androidp1.ru/kak-udalit-vstroennoe-prilozhenie-android-bez-root-prav
[243] github.com/TilesOrganization/support/wiki/How-to-use-ADB-to-grant-permissions
[245] www.reddit.com/r/LineageOS/comments/cl5c90/degoogling_lineageos_instructions_august_2019
[247] en.wikipedia.org/wiki/Public_recursive_name_server
[249] github.com/duckduckgo/Android/issues/315
[251] bugs.chromium.org/p/chromium/issues/detail?id=960720
[253] android-example.ru/useful-articles/kak-sdelat-backup-twrp
[255] androidp1.ru/sozdanie-rezervnoy-kopii-v-twrp-i-vosstanovlenie-android
[257] androidp1.ru/bekdor-v-smartfonah-samsung-galaxy
[259] www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor
[261] www.devever.net/~hl/nosecuresmartphone
[263] rebeltech.ru/uyazvimosti-v-drayverakh-k-wifi-chipam-broadcom-pozv
[265] ru.wikipedia.org/wiki/Replicant
[267] www.replicant.us/supported-devices.php
[269] grapheneos.org
[271] en.wikipedia.org/wiki/Librem#Librem_5_smartphone
[273] en.wikipedia.org/wiki/PureOS
[275] en.wikipedia.org/wiki/Ubuntu_Touch
[277] ubports.com/devices/promoted-devices
[279] vc.ru/27180-apple-razreshila-uber-sledit-za-ekranom-polzovateley-iphone-v-fonovom-rezhime
[281] appleinsider.ru/ios/uber-otslezhivaet-vas-dazhe-posle-zaversheniya-poezdki.html
[283] habr.com/ru/news/t/465629
[285] habr.com/ru/news/t/465447
[287] thenextweb.com/privacy/2019/08/07/apple-will-limit-voip-background-data-collection-from-whatsapp-snapchat-et-al-in-ios-13
[289] developer.apple.com/videos/play/wwdc2019/712
[291] www.ferra.ru/news/mobile/apple-sluchaino-vosstanovila-staryi-sposob-vzloma-iphone-28-08-2019.htm
[293] habr.com/ru/news/t/464473
[295] habr.com/ru/news/t/455704
[297] www.reddit.com/r/fossdroid/comments/c332yr/what_impedes_google_from_moving_other_aosp_apis/erozilc
[299] ru.wikipedia.org/wiki/Google_Fuchsia
[301] habr.com/ru/news/t/454468
[303] habr.com/ru/post/452610
[305] habr.com/ru/news/t/463557
[307] www.kommersant.ru/doc/3280622
[309] habr.com/ru/post/452610/#anchor24
[311] www.reddit.com/r/LineageOS/comments/a1u528/due_to_the_removal_of_30_devices_i_have_decided
[313] github.com/M66B/NetGuard/blob/master/ADBLOCKING.md
[3] lineageos.org
[4] source.android.com/setup/start/licenses
[5] download.lineageos.org
[7] www.reddit.com/r/LineageOS
[9] forum.xda-developers.com/lineage
[11] 4pda.ru/forum/index.php?act=search
[13] docs.google.com/spreadsheets/d/1swcOWw_KcSaE8otSa-1rthq7bLLmfsNZMWnVF5XCd1o
[15] piotr-yuxuan.github.io/choose-a-new-phone
[17] anton-z-s.github.io/linext/#
[19] stats.lineageos.org
[21] www.lineageoslog.com/statistics
[23] texnoera.com/kak-razblokirovat-zagruzchik-na-xiaomi
[25] wiki.lineageos.org/devices/santoni/install
[27] wiki.lineageos.org/adb_fastboot_guide.html
[29] androidp1.ru/ustanovshhik-adb-na-kompyuter
[31] dl.google.com/android/repository/platform-tools-latest-windows.zip
[33] wiki.lineageos.org/gapps.html
[35] lineageos.org/Summer-Survey-2-Results
[37] microg.org
[39] lineage.microg.org
[41] download.lineageos.org/extras
[43] f-droid.org
[45] f-droid.org/en/packages/dev.ukanth.ufirewall
[47] f-droid.org/en/packages/org.adaway
[49] f-droid.org/en/packages/com.zzzmode.appopsx
[51] guardianproject.info/releases
[53] guardianproject.info/releases/Orbot-16.0.5-RC-2-tor-0.3.4.9-fullperm-universal-release.apk
[55] f-droid.org/en/packages/com.moez.QKSMS
[57] f-droid.org/en/packages/de.shandschuh.slightbackup
[59] dnsleaktest.com
[60] www.privateinternetaccess.com/pages/whats-my-ip
[61] reports.exodus-privacy.eu.org/en
[63] f-droid.org/en/packages/org.eu.exodus_privacy.exodusprivacy
[65] f-droid.org/en/packages/com.oF2pks.classyshark3xodus
[67] expandedramblings.com/index.php/android-statistics
[69] developer.android.com/about/dashboards
[71] habr.com/ru/company/solarsecurity/blog/427431
[73] www.iguides.ru/main/security/khotite_maksimalno_zashchititsya_ot_khakerov_zablokiruyte_sim_kartu_pin_kodom
[75] developer.android.com/reference/android/Manifest.permission.html#GET_ACCOUNTS
[77] source.android.com/devices/tech/ota/ab
[79] github.com/fgl27/isu
[81] forum.xda-developers.com/android/apps-games/isu-simple-app-to-deactivate-activate-t3478348
[83] www.reddit.com/r/LineageOS/comments/a4rlox/requesting_a_good_explanation_on_why_magisk_is_bad
[85] f-droid.org/ru/docs/Anti-Features
[87] f-droid.org/en/packages/com.mdroid
[89] f-droid.org/en/packages/org.gdroid.gdroid
[91] f-droid.org/docs/Reproducible_Builds/?title=Deterministic,_Reproducible_Builds
[93] fdroid.bromite.org/fdroid/repo?fingerprint=E1EE5CD076D7B0DC84CB2B45FB78B86DF2EB39A3B6C56BA3DC292A5E0C3B9504
[95] github.com/bromite/bromite
[97] github.com/bromite/bromite/wiki/Installing-SystemWebView
[99] microg.org/fdroid/repo?fingerprint=9BD06727E62796C0130EB6DAB39B73157451582CBD138E86C468ACC395D14165
[101] microg.org/fdroid.html
[103] apt.izzysoft.de/fdroid/repo?fingerprint=3BF0D6ABFEAE2F401707B6D966BE743BF0EEE49C2561B9BA39073711F628937A
[105] android.izzysoft.de/repo/info
[107] android.izzysoft.de/articles/named/list-of-fdroid-repos
[109] forum.f-droid.org/t/known-repositories/721
[111] f-droid.org/wiki/page/Known_Repositories
[113] habr.com/ru/post/440280
[115] f-droid.org/en/packages/com.anysoftkeyboard.languagepack.russian2
[117] f-droid.org/en/packages/com.amaze.filemanager
[119] f-droid.org/en/packages/com.github.axet.filemanager
[121] f-droid.org/en/packages/com.artifex.mupdf.viewer.app
[123] f-droid.org/en/packages/com.artifex.mupdf.mini.app
[125] f-droid.org/en/packages/de.cryptobitch.muelli.barcodegen
[127] f-droid.org/en/packages/com.google.zxing.client.android
[129] f-droid.org/en/packages/de.t_dankworth.secscanqr
[131] f-droid.org/en/packages/org.secuso.privacyfriendlynetmonitor
[133] f-droid.org/en/packages/org.videolan.vlc
[135] f-droid.org/en/packages/ru.playsoftware.j2meloader
[137] f-droid.org/en/packages/com.simplemobiletools.calendar.pro
[139] f-droid.org/en/packages/info.zamojski.soft.towercollector
[141] www.reddit.com/r/fdroid
[143] ru.wikipedia.org/wiki/Iptables
[145] github.com/ukanth/afwall/issues/957
[147] github.com/ukanth/afwall/issues/940
[149] www.reddit.com/r/LineageOS/comments/c0y6o4/adaway_on_ab_devices
[151] www.reddit.com/r/LineageOS/comments/clhy1y/i_cannot_edit_the_hosts_file_even_with_root_access
[153] www.reddit.com/r/LineageOS/comments/ca810c/edit_hosts_file
[155] github.com/AdAway/AdAway/wiki/ProblematicApps
[157] www.reddit.com/r/androidapps/comments/92yv38/which_lists_do_you_use_on_adaway
[159] github.com/AdAway/AdAway/wiki/HostsSources
[161] 4pda.ru/forum/index.php?showtopic=275091&st=4580#entry62522395
[163] gitlab.com/Jorgu81/hosts/raw/master/HostsGoogle
[165] developer.android.com/preview/privacy/data-identifiers#proc-net-filesystem
[166] www.kuketz-blog.de/android-erlaubt-apps-vollen-zugriff-auf-die-netzwerkaktivitaet
[167] www.deviceinfo.me
[169] roskomsvoboda.org/48296
[171] hacks.mozilla.org/2018/11/firefox-sync-privacy
[173] www.reddit.com/r/privacy/comments/81w6tb/for_the_paranoids_install_your_own_firefox_sync
[175] ru.wikipedia.org/wiki/Google_Cloud_Messaging
[177] github.com/opengapps/opengapps/wiki/Package-Comparison
[179] www.reddit.com/r/LineageOS/comments/8p4169/what_is_lineages_position_on_signature_spoofing/e088xyh
[181] prototypefund.de/project/microg
[183] reports.exodus-privacy.eu.org/en/reports/85066
[185] reports.exodus-privacy.eu.org/en/reports/91964
[187] reports.exodus-privacy.eu.org/en/reports/85068
[189] www.facebook.com/about/privacy/update
[191] developer.android.com/guide/topics/permissions/overview#normal_permissions
[193] developer.android.com/guide/topics/permissions/defining
[195] www.reddit.com/r/LineageOS/comments/9oss72/willshould_privacy_guard_be_removed_from_los_or
[197] www.reddit.com/r/LineageOS/comments/9oss72/willshould_privacy_guard_be_removed_from_los_or/e7x97bo
[199] www.reddit.com/r/LineageOS/comments/6o30uk/locking_google_play_services_in_privacy_guard
[201] www.reddit.com/r/LineageOS/comments/7m9023/difference_between_application_permissions_and
[203] android.izzysoft.de/applists/perms
[205] www.wandera.com/mobile-security/app-and-data-leaks/app-permissions
[207] stackoverflow.com/questions/21227367/when-is-bluetooth-admin-android-permission-required
[209] stackoverflow.com/questions/3490913/what-is-a-sticky-broadcast
[211] www.iguides.ru/main/security/bolee_1000_prilozheniy_dlya_android_sobirayut_lichnye_dannye_polzovateley_bez_ikh_soglasiya
[213] www.ftc.gov/system/files/documents/public_events/1415032/privacycon2019_serge_egelman.pdf
[215] developer.android.com/preview/privacy/checklist
[217] developer.android.com/preview/privacy/scoped-storage
[219] developer.android.com/reference/android/R.attr.html#requestLegacyExternalStorage
[221] developer.android.com/preview/privacy/device-location
[223] developer.android.com/preview/privacy/background-activity-starts
[225] ru.wikipedia.org/wiki/__Android
[227] f-droid.org/en/packages/com.oF2pks.applicationsinfo
[229] habr.com/ru/post/240521
[231] github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/master/README.md
[233] habr.com/ru/news/t/451810
[235] github.com/M66B/XprivacyLua/blob/master/XPRIVACY.md
[237] developer.android.com/studio/command-line/adb
[239] 4pda.ru/forum/index.php?showtopic=383300
[241] androidp1.ru/kak-udalit-vstroennoe-prilozhenie-android-bez-root-prav
[243] github.com/TilesOrganization/support/wiki/How-to-use-ADB-to-grant-permissions
[245] www.reddit.com/r/LineageOS/comments/cl5c90/degoogling_lineageos_instructions_august_2019
[247] en.wikipedia.org/wiki/Public_recursive_name_server
[249] github.com/duckduckgo/Android/issues/315
[251] bugs.chromium.org/p/chromium/issues/detail?id=960720
[253] android-example.ru/useful-articles/kak-sdelat-backup-twrp
[255] androidp1.ru/sozdanie-rezervnoy-kopii-v-twrp-i-vosstanovlenie-android
[257] androidp1.ru/bekdor-v-smartfonah-samsung-galaxy
[259] www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor
[261] www.devever.net/~hl/nosecuresmartphone
[263] rebeltech.ru/uyazvimosti-v-drayverakh-k-wifi-chipam-broadcom-pozv
[265] ru.wikipedia.org/wiki/Replicant
[267] www.replicant.us/supported-devices.php
[269] grapheneos.org
[271] en.wikipedia.org/wiki/Librem#Librem_5_smartphone
[273] en.wikipedia.org/wiki/PureOS
[275] en.wikipedia.org/wiki/Ubuntu_Touch
[277] ubports.com/devices/promoted-devices
[279] vc.ru/27180-apple-razreshila-uber-sledit-za-ekranom-polzovateley-iphone-v-fonovom-rezhime
[281] appleinsider.ru/ios/uber-otslezhivaet-vas-dazhe-posle-zaversheniya-poezdki.html
[283] habr.com/ru/news/t/465629
[285] habr.com/ru/news/t/465447
[287] thenextweb.com/privacy/2019/08/07/apple-will-limit-voip-background-data-collection-from-whatsapp-snapchat-et-al-in-ios-13
[289] developer.apple.com/videos/play/wwdc2019/712
[291] www.ferra.ru/news/mobile/apple-sluchaino-vosstanovila-staryi-sposob-vzloma-iphone-28-08-2019.htm
[293] habr.com/ru/news/t/464473
[295] habr.com/ru/news/t/455704
[297] www.reddit.com/r/fossdroid/comments/c332yr/what_impedes_google_from_moving_other_aosp_apis/erozilc
[299] ru.wikipedia.org/wiki/Google_Fuchsia
[301] habr.com/ru/news/t/454468
[303] habr.com/ru/post/452610
[305] habr.com/ru/news/t/463557
[307] www.kommersant.ru/doc/3280622
[309] habr.com/ru/post/452610/#anchor24
[311] www.reddit.com/r/LineageOS/comments/a1u528/due_to_the_removal_of_30_devices_i_have_decided
[313] github.com/M66B/NetGuard/blob/master/ADBLOCKING.md
All Articles