* [https://trac.torproject.org/projects/tor/wiki/doc/TorPlusVPN torproject.org wiki] <- original / "master". Please add changes to the original so they can spread to the mirrors.
*[torproject.org wiki](https://trac.torproject.org/projects/tor/wiki/doc/TorPlusVPN) <- original / "master". Please add changes to the original so they can spread to the mirrors.
@@ -14,18 +14,18 @@ Mobile devices (mobile phones, tablets, pads, etc.) are cheap and widespread. Pe
...
@@ -14,18 +14,18 @@ Mobile devices (mobile phones, tablets, pads, etc.) are cheap and widespread. Pe
Similar articles about "mobile privacy" (or "Android without Google") exist. Only this article has a strong orientation on Tor, security, privacy, anonymity, encryption and Open Source software at once.
Similar articles about "mobile privacy" (or "Android without Google") exist. Only this article has a strong orientation on Tor, security, privacy, anonymity, encryption and Open Source software at once.
= Privacy Problems =
# Privacy Problems
Unfortunately there are very few embedded/mobile devices, which are really free as in speech. Many vendors bundle their devices with a lot bloatware, which can not be easily uninstalled (needs root or custom firmware). Also sometimes spyware (really spyware by definition, Carrier IQ, which logged keystrokes, short messages, phone calls, etc.) and other privacy problematic software (ex: upload, sync by default your contacts). Often, when you want to take control over your device (rooting, cleaned firmware, etc.), you'll loose warranty. Many devices have even looked bootloaders, to make it even harder to get control over the hardware. All currently available phones contain proprietary firmware/basebands and ARM devices generally do not have free 3d graphic drivers available yet (ARM Mali / Lima might change that).
Unfortunately there are very few embedded/mobile devices, which are really free as in speech. Many vendors bundle their devices with a lot bloatware, which can not be easily uninstalled (needs root or custom firmware). Also sometimes spyware (really spyware by definition, Carrier IQ, which logged keystrokes, short messages, phone calls, etc.) and other privacy problematic software (ex: upload, sync by default your contacts). Often, when you want to take control over your device (rooting, cleaned firmware, etc.), you'll loose warranty. Many devices have even looked bootloaders, to make it even harder to get control over the hardware. All currently available phones contain proprietary firmware/basebands and ARM devices generally do not have free 3d graphic drivers available yet (ARM Mali / Lima might change that).
Using a [https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxyTransparentProxy] can lead to [https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxyLeaks Transparent Proxy Leaks]. Learn what [https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO Protocol Leaks] are. (For example Orbot for Android supports transparent proxying (local redirection).) Also understand first, [https://trac.torproject.org/projects/tor/wiki/doc/Modes_Of_Anonymity Modes Of Anonymity].
Using a [TransparentProxy](https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy) can lead to [TransparentProxy Leaks](https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxyLeaks). Learn what [Protocol Leaks](https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO) are. (For example Orbot for Android supports transparent proxying (local redirection).) Also understand first, [Modes Of Anonymity](https://trac.torproject.org/projects/tor/wiki/doc/Modes_Of_Anonymity).
= Providers =
# Providers
Most providers log for billing reasons and/or are obligated to log due to data rentation laws. They log who you called, with whom you've spoken, when and how long, whom you've send messages with, (in some countries, the content of your messages), when you went online, for how long, how much data transmitted, (in some countries they store which websites you visited and censor certain websites), your location information (cell), when you done anything of that. (In some countries or after court order, they even trace you permanently.)
Most providers log for billing reasons and/or are obligated to log due to data rentation laws. They log who you called, with whom you've spoken, when and how long, whom you've send messages with, (in some countries, the content of your messages), when you went online, for how long, how much data transmitted, (in some countries they store which websites you visited and censor certain websites), your location information (cell), when you done anything of that. (In some countries or after court order, they even trace you permanently.)
= GPS =
# GPS
There are different "sorts" of GPS. [https://en.wikipedia.org/wiki/Assisted_GPS AGPS] uses internet, speeds up the initial GPS fix, but not so privacy friendly. [https://en.wikipedia.org/wiki/Mobile_phone_tracking#Network-based Network-based mobile phone tracking] is also used to speed up the initial fix, it shouldn't leak more information to the provider, as it's only listening. The "normal" GPS alone is a listening only service and therefore does not leak anything.
There are different "sorts" of GPS. [AGPS](https://en.wikipedia.org/wiki/Assisted_GPS) uses internet, speeds up the initial GPS fix, but not so privacy friendly. [Network-based mobile phone tracking](https://en.wikipedia.org/wiki/Mobile_phone_tracking#Network-based) is also used to speed up the initial fix, it shouldn't leak more information to the provider, as it's only listening. The "normal" GPS alone is a listening only service and therefore does not leak anything.
= Mobile Malware =
# Mobile Malware
Malware on your mobile device can be even more serious than malware on your computer because phones have access to a greater deal of privacy relevant information. Once malware is on your device:
Malware on your mobile device can be even more serious than malware on your computer because phones have access to a greater deal of privacy relevant information. Once malware is on your device:
* All phone calls, messages, mails, notices, calendar entries and anything else on that device are compromised.
* All phone calls, messages, mails, notices, calendar entries and anything else on that device are compromised.
* The microphone can be used wiretap even while you are not having phone calls. (Most people have their devices very close to them at all times.)
* The microphone can be used wiretap even while you are not having phone calls. (Most people have their devices very close to them at all times.)
...
@@ -37,114 +37,115 @@ Malware on your mobile device can be even more serious than malware on your comp
...
@@ -37,114 +37,115 @@ Malware on your mobile device can be even more serious than malware on your comp
Your best bet is to completely abstain from using Google or any other synchronization service, where you have no control over the servers. It is less comfortable to use your phone without Google, but it is possible. We will discuss alternatives to the Google apps, which you can not use anymore.
Your best bet is to completely abstain from using Google or any other synchronization service, where you have no control over the servers. It is less comfortable to use your phone without Google, but it is possible. We will discuss alternatives to the Google apps, which you can not use anymore.
Use a after market firmware, such as [http://www.cyanogenmod.com CyanogenMod] (Open Source), a custom ROM from [http://www.xda-developers.com/ xda-developers], etc. Those modded firmwares to sometimes not contain any bloat- or spyware. And of course, do not install any Google addon packs.
Use a after market firmware, such as [CyanogenMod](http://www.cyanogenmod.com)(Open Source), a custom ROM from [xda-developers](http://www.xda-developers.com/), etc. Those modded firmwares to sometimes not contain any bloat- or spyware. And of course, do not install any Google addon packs.
Best is also to abstain from any closed source software or adware. Carefully read their permissions, privacy policy and recherche about any privacy implications.
Best is also to abstain from any closed source software or adware. Carefully read their permissions, privacy policy and recherche about any privacy implications.
= Android =
# Android
Although Android itself is Open Source, it does not mean much. Practically all devices require non-free binary drivers ("blobs") you can not simply download the source code, compile yourself, flash and done. If you flash a custom software you'll in most cases void the warranty.
Although Android itself is Open Source, it does not mean much. Practically all devices require non-free binary drivers ("blobs") you can not simply download the source code, compile yourself, flash and done. If you flash a custom software you'll in most cases void the warranty.
The privacy problems described above are valid for Android as well. See http://replicant.us/ for an effort to change that.
The privacy problems described above are valid for Android as well. See http://replicant.us/ for an effort to change that.
By default on most Android devices, Google apps are preinstalled. With default settings, contacts, mail and calendar will be synced with your Google account. So everything you stored in those three applications, Google also knows. That will be done as soon as you have a working mobile internet or WiFi connection.
By default on most Android devices, Google apps are preinstalled. With default settings, contacts, mail and calendar will be synced with your Google account. So everything you stored in those three applications, Google also knows. That will be done as soon as you have a working mobile internet or WiFi connection.
Even worse, a market service runs by default in background. When you are logged into the Google Market (now called Google Play), you can install apps with just one click and they will be pushed to your device. What sounds great from view of user experience is very bad for security. Google could also simply push any other app they want. They could silently push malware. This could happen, in case Google gets hacked ([http://www.wired.com/threatlevel/2010/01/operation-aurora/ already happened], if a employee turn malicious, or due to law enforcement. For more information on this see [http://donttrack.us/ donttrack.us] (ignore the DuckDuckGo related stuff and follow their sources). They can also remotely delete apps from your device. Who does need to have control over your device if you want privacy and anonymity?
Even worse, a market service runs by default in background. When you are logged into the Google Market (now called Google Play), you can install apps with just one click and they will be pushed to your device. What sounds great from view of user experience is very bad for security. Google could also simply push any other app they want. They could silently push malware. This could happen, in case Google gets hacked ([already happened](http://www.wired.com/threatlevel/2010/01/operation-aurora/), if a employee turn malicious, or due to law enforcement. For more information on this see [donttrack.us](http://donttrack.us/)(ignore the DuckDuckGo related stuff and follow their sources). They can also remotely delete apps from your device. Who does need to have control over your device if you want privacy and anonymity?
Not that this can be disabled and equally applies to every OS that supports software updates and is set to automatically apply them.
Not that this can be disabled and equally applies to every OS that supports software updates and is set to automatically apply them.
== Getting Apps / App Market ==
## Getting Apps / App Market
To get apps the Google Market (now called Google Play) can not be used anymore. You need an alternative app market or you need to download the apps from the vendor directly. Sometimes they don't offer a public download link, in this case you can try to mail them.
To get apps the Google Market (now called Google Play) can not be used anymore. You need an alternative app market or you need to download the apps from the vendor directly. Sometimes they don't offer a public download link, in this case you can try to mail them.
[https://f-droid.org F-Droid] (Open Source), The FDroid Repository is an easily-installable catalogue of FOSS applications for the Android platform.
[F-Droid](https://f-droid.org)(Open Source), The FDroid Repository is an easily-installable catalogue of FOSS applications for the Android platform.
Generally, if you don't find a privacy friendly Android app, you can go another way. Install a Linux Distro on top of your Android phone. It is possible for some devices. The kernel will be shared and you will have access to the linux distribution's software repository. The applications will not be the most comfortable ones, as they are made for use on computer, not on mobile devices.
Generally, if you don't find a privacy friendly Android app, you can go another way. Install a Linux Distro on top of your Android phone. It is possible for some devices. The kernel will be shared and you will have access to the linux distribution's software repository. The applications will not be the most comfortable ones, as they are made for use on computer, not on mobile devices.
== Firewall ==
## Firewall
Use [https://code.google.com/p/droidwall/ DroidWall] (Open Source) in White List modus and give only relevant apps access to the internet.
Use [DroidWall](https://code.google.com/p/droidwall/)(Open Source) in White List modus and give only relevant apps access to the internet.
== Permissions ==
## Permissions
For CyanogenMod (Open Source): Settings -> CyanogenMod -> Apps -> enable Permissions. Then go to settings -> Apps -> Manage Apps -> choose an app and remove unnecessary permissions.
For CyanogenMod (Open Source): Settings -> CyanogenMod -> Apps -> enable Permissions. Then go to settings -> Apps -> Manage Apps -> choose an app and remove unnecessary permissions.
== Tor ==
## Tor
[https://www.torproject.org/docs/android.html.enOrbot on torproject.org], [https://guardianproject.info/apps/orbot/ Orbot guardianproject.info] (Open Source) is Tor for Android. Orbot supports [https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy transparent proxing] (local redirection), see Privacy Problems above before using it!
[Orbot on torproject.org](https://www.torproject.org/docs/android.html.en), [Orbot guardianproject.info](https://guardianproject.info/apps/orbot/)(Open Source) is Tor for Android. Orbot supports [transparent proxing](https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy)(local redirection), see Privacy Problems above before using it!
== Browser ==
## Browser
[https://guardianproject.info/apps/orweb/ Orweb] (Open Source) is an alternative for the Tor Browser for Android.
[Orweb](https://guardianproject.info/apps/orweb/)(Open Source) is an alternative for the Tor Browser for Android.
Abstain from browsers, which process your requests on an external server, such as Opera mini (closed source). It is tempting, because it is much faster, but they are a mitm and can also wiretap http'''s''' protected websites.
Abstain from browsers, which process your requests on an external server, such as Opera mini (closed source). It is tempting, because it is much faster, but they are a mitm and can also wiretap http**s** protected websites.
== Instant Messenger ==
## Instant Messenger
[https://guardianproject.info/apps/gibber/ Gibberbot] (Open Source) Jabber client, which supports Orbot and Off-the-Record encryption.
[Gibberbot](https://guardianproject.info/apps/gibber/)(Open Source) Jabber client, which supports Orbot and Off-the-Record encryption.
[Beem](http://beem-project.com/)(Open Source) Jabber client, supports Off-the-Record encryption as well.
Abstain from any short messages alternative services, such as [http://www.whatsapp.com/ WhatsApp], as it will upload all your phone numbers to the server.
Abstain from any short messages alternative services, such as [WhatsApp](http://www.whatsapp.com/), as it will upload all your phone numbers to the server.
== Full Disc Encryption ==
## Full Disc Encryption
[https://guardianproject.info/code/luks/ LUKS Disk Encryption by guardianproject.info] (Open Source, ready for FDE?
[LUKS Disk Encryption by guardianproject.info](https://guardianproject.info/code/luks/)(Open Source, ready for FDE?
[http://nemesis2.qx.net/pages/LUKSManager LUKSManager] (Open Source), only folders, no FDE?
[LUKSManager](http://nemesis2.qx.net/pages/LUKSManager)(Open Source), only folders, no FDE?
TODO: encrypt whole internal storage and whole external storage
TODO: encrypt whole internal storage and whole external storage
== Synchronization for Contacts, Calendar, Memo, Photo ==
## Synchronization for Contacts, Calendar, Memo, Photo
[https://en.wikipedia.org/wiki/SyncML SyncML] is probable the way to go.
[SyncML](https://en.wikipedia.org/wiki/SyncML) is probable the way to go.
* Needs own server? - If yes, could be a personal computer.
* Needs own server? - If yes, could be a personal computer.
* Over USB cable also supported?
* Over USB cable also supported?
* Encrypted transmission to the server? - If no, not so important, when done in trusted WiFi. In doubt use Wiki Ad Hoc (direct connection without router).
* Encrypted transmission to the server? - If no, not so important, when done in trusted WiFi. In doubt use Wiki Ad Hoc (direct connection without router).
* Encrypted database on the server? - If no, not so important, when stored on encrypted computer.
* Encrypted database on the server? - If no, not so important, when stored on encrypted computer.
Unfortunately, only closed source apps available. If you are still interested search the market for terms like "[https://en.wikipedia.org/wiki/ZRTP ZRTP]", "phone encrypt" "gsm encrypt", or "call encrypt".
Unfortunately, only closed source apps available. If you are still interested search the market for terms like "[ZRTP](https://en.wikipedia.org/wiki/ZRTP)", "phone encrypt" "gsm encrypt", or "call encrypt".
If you know an Open Source app, please share.
If you know an Open Source app, please share.
== Voip Calls (Voice over IP) ==
## Voip Calls (Voice over IP)
Unfortunately, Voip Calls are not always possible. They work best over WiFi and depending on the network, also over mobile internet. Use [https://en.wikipedia.org/wiki/ZRTP ZRTP].
Unfortunately, Voip Calls are not always possible. They work best over WiFi and depending on the network, also over mobile internet. Use [ZRTP](https://en.wikipedia.org/wiki/ZRTP).
[http://www.csipsimple.com/ CSipSimple] (Open Source), TODO: untested, with proper ZRTP voice verification? [https://guardianproject.info/2012/02/22/free-sip-providers-with-zrtp-support/ article on guardianproject.info]
[CSipSimple](http://www.csipsimple.com/)(Open Source), TODO: untested, with proper ZRTP voice verification? [article on guardianproject.info](https://guardianproject.info/2012/02/22/free-sip-providers-with-zrtp-support/)
[http://www.linphone.org/ Linphone] (Open Source) for [https://play.google.com/store/apps/details?id=org.linphone Android] supports only SRTP (client to server) encryption
[Linphone](http://www.linphone.org/)(Open Source) for [Android](https://play.google.com/store/apps/details?id=org.linphone) supports only SRTP (client to server) encryption
ZRTP (end-to-end encryption) not supported ZRTP yet.
ZRTP (end-to-end encryption) not supported ZRTP yet.
[https://code.google.com/p/sipdroid/ sipdroid] (Open Source) does not support ZRTP yet. Although there is a [https://code.google.com/p/sipdroid/issues/detail?id=63 ticket].
[sipdroid](https://code.google.com/p/sipdroid/)(Open Source) does not support ZRTP yet. Although there is a [ticket](https://code.google.com/p/sipdroid/issues/detail?id=63).
== E-Mails ==
## E-Mails
No encryption possible yet. Last AGPG from 2010 and no source code. [https://guardianproject.info/2012/03/15/adventures-in-porting-gnupg-2-1-x-to-android/ guardianproject] wants to bring GPG to Android, they are not done yet.
No encryption possible yet. Last AGPG from 2010 and no source code. [guardianproject](https://guardianproject.info/2012/03/15/adventures-in-porting-gnupg-2-1-x-to-android/) wants to bring GPG to Android, they are not done yet.
[https://play.google.com/store/apps/details?id=info.guardianproject.cacert CACertMan] (Open Source), manger for (SSl) certificates
[CACertMan](https://play.google.com/store/apps/details?id=info.guardianproject.cacert)(Open Source), manger for (SSl) certificates
== Remote Storage (WebDAV) ==
## Remote Storage (WebDAV)
[https://code.google.com/p/cryptonite/ cryptonite] (Open Source), EncFS and TrueCrypt on Android, TODO: untested
[cryptonite](https://code.google.com/p/cryptonite/)(Open Source), EncFS and TrueCrypt on Android, TODO: untested
TODO free service, open source app to encrypt stored content on a remote location
TODO free service, open source app to encrypt stored content on a remote location
== OpenVPN ==
## OpenVPN
[https://code.google.com/p/android-openvpn-installer/ OpenVPN Installer] (Open Source) and [https://code.google.com/p/android-openvpn-settings/ android-openvpn-settings] (Open Source), TODO: both untested.
[OpenVPN Installer](https://code.google.com/p/android-openvpn-installer/)(Open Source) and [android-openvpn-settings](https://code.google.com/p/android-openvpn-settings/)(Open Source), TODO: both untested.
== Maps / Navigation ==
## Maps / Navigation
There are several alternatives to Google Maps, a few Open and closed source alternatives can be found in the [https://wiki.openstreetmap.org/wiki/Android openstreetmap wiki]. Some even with offline features, offline navigation. (Offline is more privacy friendly.)
There are several alternatives to Google Maps, a few Open and closed source alternatives can be found in the [openstreetmap wiki](https://wiki.openstreetmap.org/wiki/Android). Some even with offline features, offline navigation. (Offline is more privacy friendly.)
== Missing Stuff ==
## Missing Stuff
Add here, if you are missing any privacy friendly Open Source android apps.
Add here, if you are missing any privacy friendly Open Source android apps.
== Also See ==
## Also See
* [https://guardianproject.info/wiki/Android_Security_App_User_Guide guardianproject Android Security App UserGuide], useful information on Orbot, not so Open Source oriented.
*[guardianproject Android Security App UserGuide](https://guardianproject.info/wiki/Android_Security_App_User_Guide), useful information on Orbot, not so Open Source oriented.
* [https://safermobile.org/ SaferMobile helps you use mobile technology more securely.], useful general information on mobile security, not so Open Source oriented.
*[SaferMobile helps you use mobile technology more securely.](https://safermobile.org/), useful general information on mobile security, not so Open Source oriented.
