Geekly articles weekly

关于安装和使用LineageOS 16，F-Droid

我提请您注意有关使用LineageOS操作系统（以下简称LOS）和F-Droid应用程序的示例在使用智能手机时如何最佳地切换到自由软件的说明。

我认为，即使您无法自己安装LOS，也将使您感兴趣，因为本文还讨论了标准的Android设置，使用有用的应用程序的设置和方法，F-Droid应用商店，不可限制的Android权限以及对您可能有用的其他细微差别。

目录：

一般资讯
升级到免费固件的原因
设备选择
- 选择设备时要考虑的主要因素
- 设备选择
安装LOS固件
- 固件更新
- 解锁引导加载程序（解锁引导加载程序）
-LOS安装示例
- 什么地方可能出问题
- 上市前准备
- 关于设备加密
LineageOS
- 标准LOS设置
- 根/根/超级用户权限/超级用户
- 引导程序（bootloader）
机器人
VPN插槽
AFWall +（Android防火墙+）和集成防火墙
- 内置 - 防火墙
-AFWall +
Adway
Orbot，Tor浏览器和proc / net问题
- 奥博特
-proc /净问题
-Tor浏览器
芬内克和溴铁矿
- 芬内克
- 溴
Google Apps（Google Apps / Gapps）
Yalp商店/ Aurora商店
应用程序中的跟踪器
权限控制，PrivacyGuard，AppOpsX
- 权限类型
- 限制权限的工具
-Android标准权限机制
- 隐私卫士
-AppOpsX（com.zzzmode.appopsx）
- 权限列表
- 不能限制的是
- 级别的API / SDK
- 关于需要跟踪权限
SD卡/ USB存储
工作资料和庇护所（net.typeblog.shelter）
XprivacyLua
ADB（Android调试桥）
在LOS中完全放弃Google
-DNS
- 专属门户
-GPS
-AOSP Webview
-Project Fi
备份（备份）或备份
个人文件的单独加密
无线电模块固件和低级书签
其他固件
- 复制
-GrapheneOS
- 不是Android设备和固件
-iPhone呢？
前景展望
一般建议
为什么最好使用最新版本的LOS和当前设备
我的经验
潜在的问题是我的答案
过渡技术和部分（临时）解决方案
给IT人员的问题
链接清单

我建议您在这里（或在阅读我的文章之后）预阅读这些文章：

→ 关于LineageOS，MicroG
→ F-Droid中的有趣程序列表 （不仅限于F-Droid）
→ 关于使用不太清晰的语言的Android体系结构 ，我建议您阅读本周期的所有4部分。 这里用技术术语对所有内容进行了描述，但是如果您想大致了解Android的设备和体系结构，我仍然建议您深入研究。

我将尝试在这些文章中补充设备选择，固件，安全性和隐私设置，一些软件设置等内容，并且还将提供风险识别方法，即使在没有专有组件的免费固件中也可能出现这种方法。

在手册中，我将参考操作系统和程序的设置项目的英文和俄文名称，因为目前可以在英文论坛上获得关于问题的最完整帮助，并且寻找问题的解决方案会更加熟悉。

将分别考虑LineageOS 16的版本（部分考虑到15.1版中的某些要点）并分别基于Android 9 Pie。 所描述的某些方法（更确切地说，几乎是除Privacy Guard之外的所有方法）不仅适用于LineageOS，而且适用于Android 9 Pie上的其他固件。

我试图以“线性”方式撰写文章，这样我就可以感知信息，而不必从一个地方跳到另一个地方。 但是由于许多事物是相互关联的，因此完全避免了发送。 如果在某个时候发现一些难以理解的内容，请尝试阅读本文的结尾。 即使在阅读了整篇文章之后，如果还有明显的差距，请指出我没看过的地方。

一般资讯


LineageOS [ 1 ]，[ 3 ]-基于AOSP（Android开放源代码项目）的固件，由发烧友完成。 LineageOS是CyanogenMod项目的延续。 此固件并非适用于所有设备，因为为每个设备创建此类固件是发烧友的工作。

升级到免费LineageOS固件的原因


  1. 隐私权。 LineageOS基于Android的“干净”版本-AOSP，没有来自Google的应用程序和来自商业公司的其他应用程序。 缺少专有组件会增加隐私性（与其他技术结合使用）。

    Android系统（AOSP）基于Linux，并以免费许可[ 4 ]和开放源代码（open-source）进行分发。 LineageOS基于AOSP（CAF的一些附加功能-Code Aurora论坛针对基于Qualcomm硬件的那些设备）。 也就是说，LineageOS是一种固件，只是其中没有添加Goolge的专有服务（就像某些人认为的那样，这种服务没有切入）。 它是开源的事实，使您可以查看AOSP和LineageOS的整个源代码，以了解是否存在“技巧”（书签）。 如果您不信任编译固件的人，则可以根据源代码编译（从源代码编译）设备的固件。 顺便说一句，许多这样做，但主要是在固件中添加/删除某些内容。
  2. 安全性 在某些情况下，LineageOS会发布制造商不再支持的设备的固件更新。 如果您已经有很长时间没有安全更新的设备，则可以检查是否已使用最新的安全更新在设备上更新了LineageOS固件。

    另外，如果您要购买新的智能手机，则可以选择LineageOS支持的设备，并且LineageOS社区很可能会长期支持该设备。
  3. 附加功能。 固件中还有其他组件，例如，Trust（信任），Call Recorder（呼叫记录器）（记录呼叫，语音记录器）和其他较小的改进。 信任（+ Privacy Guard）允许您集中查看和管理安全性和隐私设置。 通话记录器-记录通话。 受保护的应用程序-您只能通过单独的代码或指纹来访问单个应用程序。 界面的自定义，暗模式（暗主题）和其他有用的功能。
  4. 事先保护自己免受孤立或自我孤立。

    隔离度。 限制西方公司使用服务已有先例。 示例-禁止在克里米亚使用西方服务。 禁止在华为产品中使用西方服务。 没有人保证明天会对更大范围的用户或公司施加相同的限制。

    自我隔离。 鉴于最近各国禁止和敌对“敌对”国家提供服务的趋势，没有人能保证明天将在某些领土上继续使用西方服务和计划。

    这是改用自由软件以减少对一个国家政客的依赖的另一个原因。

设备选择


我根据我的经验为您提供一种选择新设备来安装LineageOS的方法。 这些技巧本质上仅是建议性的，我不主张绝对客观。

选择设备时要考虑的关键因素


  1. 设备上存在固件。

    LineageOS既有“官方” [ 3 ]版本，也有“非官方”版本。 手续是：

    -团队使用其密钥编译并“签名”固件，并将其放置在其网站上[ 5 ]
    -对于“官方”支持的设备，论坛上有相对较好的支持[ 7 ]。 您也可以在论坛xda [ 9 ]，w3bsit3-dns.com [ 11 ]和电报频道的单独设备上直接寻求开发人员的支持。 这种支持并不意味着他们会回答您的问题。 但是，如果提出的问题正确且带有详细的问题描述，则回答的可能性往往为100％。 不幸的是，绝大多数开发人员都是说英语的人。 在这些论坛中，不仅开发人员，而且其他有经验的用户都可以为您提供帮助。

    -“官方”支持的设备具有“空中下载”（OTA更新）自动更新的功能，也就是说，与Google的普通Android一样，可以通过手机本身的单独菜单项简单地进行安全更新。

    非官方-由爱好者编写。 没有无线更新，有时包含病毒。 检查这种固件是否包含病毒几乎是不可能的。 除非您自己为没有得到官方正式支持的设备组装了固件（只能由优秀的IT专家来完成）。

    我强烈建议选择官方网站上提供的设备[ 5 ]。 这是固件稳定性和设备支持持续时间的因素之一，也是固件不是多余的事实。 在某些情况下，如果该设备很流行，并且有人为其制作了非官方版本，那么一段时间后，非官方版本的开发人员就会加入LineageOS开发团队（更准确地说，是设备的维护者），固件会正确执行并变为“官方”。 这意味着，如果在选择设备时，您的眼睛只注视着只有LineageOS非官方版本的特定型号，那么您可以在英语论坛xda-developers中搜索该设备上的信息，以备将来可能发布“官方”版本。 这种情况并不罕见。

    设备上的其他信息将为您提供帮助：链接[ 13 ]，[ 15 ]，[ 17 ]。

    在其他站点上也展示了带有非官方版本LineageOS的设备，但是我不知道使用了哪些数据来编译这些列表，因此我不推荐他们，也不能建议您通常使用非官方固件。
  2. 设备的LineageOS版本。 目前，设备可以使用LineageOS 15.1和16固件版本，这两个版本均支持安全更新，但LineageOS 15.1基于Android 8.1 Oreo，而LineageOS 16基于Android 9 Pie。 最好选择LineageOS 16版本的设备，因为Android版本越高，就消除了更多的隐私威胁和更多有趣的功能。 我稍后会写。
  3. 设备内部的版本。 一些使用相同名称的制造商生产具有不同“填充物”的几种不同版本。 例如，三星银河S5 LTE有很多版本。 有几种版本：A）klte，其中包括修订版（G900AZ / F / M / R4 / R7 / T / V / W8，S902L），B）kltechn，其中包括修订版（G9006V / 8V），依此类推。 代码名称用于快速识别。 对于上述Galaxy S5 LTE，有klte，kltekor，kltedv，kltechn，kltekdi的几种版本。 也许还有其他版本的Galaxy S5 LTE，但没有LineageOS固件。 因此，购买设备时，请与特定的销售商联系。
  4. 能够解锁引导程序。 购买之前，您需要澄清是否可以解锁引导加载程序。 即使设备具有LineageOS固件，也不意味着您将有机会安装它！ 为了安装LineageOS，您需要具有未锁定的引导程序。 对于某些手机，只需执行一项操作即可轻松完成。 但是有些制造商为他们的某些（或大多数）设备制定了用于解锁引导加载程序的完整程序。 为此，您需要在制造商的网站上注册，在电话上输入信息（或在计算机上安装特殊程序），发送解锁引导加载程序的请求并等待0秒钟至1个月。 华为先前允许您解锁引导加载程序，但随后完全关闭了这种可能性。 有变通办法，您可以在其上购买代码的网站进行解锁。 这些解决方法不断变化；对于不同的设备，解决方法也有所不同。 在这种情况下，权衡利弊，确定是否可以解锁引导加载程序，需要多长时间（如果您经过官方的解锁程序），要在第三方站点上解锁的代码要花多少钱才能绕开，等等。
  5. 设备的普及。 该设备越受欢迎，支持该设备的机会就越长。 更为重要的是在此设备上使用LineageOS的普及。 使用统计信息可以在官方网站上查看[ 19 ]。 还有一个非官方的，但更具代表性的站点[ 21 ]。 注意，A）一些名称由代码字（代号）表示。 B）还介绍了那些没有正式支持但已使用的设备。
  6. 馅。 在所有其他条件相同的情况下，我建议选择带有Qualcomm芯片的设备。 这些芯片上的设备平均比其他芯片上的设备受支持的时间更长。
  7. 其他固件和初始固件。 如果该设备还有其他固件（除了LOS），则意味着有很多人在“挖掘”该设备的固件内部，这增加了找到出现问题的解决方案的机会。 注意新设备上最初安装了哪种固件也很重要。 最好，如果智能手机是Android One程序的一部分。 这意味着，针对此类设备的Google将迫使制造商发布安全更新，并在两年内将其更新为新版本的Android。 这些更新将帮助LineageOS开发人员更长久地支持该设备。 请注意，进入Android One程序的事实并不能保证可以解除引导加载程序的锁定，并且设备中的固件不是原始的。 例如，作为Android One程序一部分的诺基亚智能手机无法安装替代固件。
  8. 该设备的新颖性。 请记住，LineageOS发烧友正在发展，并且在某些时候，这些发烧友可能已更改了自己的设备（损坏，丢失，购买了新设备）。 在这种情况下，他们可能对进一步支持此设备不感兴趣。 例如，正式支持小米Redmi Note 5（Pro）的时间不超过一年（尽管它也有非官方的LineageOS固件）。 但是，自2013年以来就一直支持LG G2（d802）这样的设备，甚至具有LineageOS-16的最新版本。为了获得尽可能长的支持，建议您购买相对较新的设备，该设备仍在国际上销售。
  9. 其余参数与设备的用户特征有关。 例如，RAM大小，处理器速度，支持的LTE频率等等。 我建议购买具有至少32 GB内部存储器的手机，这样您就不必使用“云”了，从而降低了数据泄漏的风险。 请注意，可能不支持智能手机上的某些特定功能，例如红外线，基于头骨形状的面部解锁（除了照片），具有多个镜头的相机的特殊效果。 但是在最新版本的Android中，其中一些功能（例如，完全支持多个后置摄像头镜头）已嵌入系统本身，并且很可能不会出现任何问题。

设备选择


接下来，我为您提供一种选择智能手机来购买和安装LineageOS的可能方法。 假设您需要一款中端价格不超过15,000卢布的智能手机。

  1. 我们打开网站并使用LineageOS [ 21 ]进行统计，并开始从更流行到更不流行浏览智能手机。 目前正式支持名称中具有单独链接的智能手机。
  2. 当前官方支持最多的是OnePlus One。 我们看一下发布年份-2014。但是，它们不在俄罗斯销售，据我所知，它们也不在国外销售。 让我们继续前进。
  3. 在俄罗斯受欢迎和出售的清单上的下一个是Xiaomi Redmi Note 4. 2017版本。 但是对于此模型，只有LineageOS 15.1版本（尽管安全补丁也会按时发布）。 假设这适合我们（但是我将在下面描述更新版本的LineageOS的优点）。 我们转到w3bsit3-dns.com论坛（和其他论坛），查找此特定型号，然后看到该设备有两个版本-MTK芯片和Qualcomm Snapdragon芯片上。 再次，我们检查Snapdragon芯片上的版本是否在俄罗斯出售（仅此版本有LineageOS）。 我们致电卖家，询问Snapdragon上的版本是否准确以及该设备是针对哪个市场的（您需要购买全球版本，因为该版本具有比支持的4G频率更高的频率）。 注意该版本。
  4. 我们正在进一步寻找。 小米Poco F1太贵了。 小米Redmi 4（X）-与小米Redmi Note 4相似的情况。ZUKZ2 Plus-在俄罗斯不销售。 OnePlus 3 / 3T太贵了。 因此，依次到达小米Mi A1。 在纯Android上出售，包含在Android One程序中，无需等待引导加载程序解锁，论坛上没有重要消息。

结果，如果我选择的设备价格不超过15,000卢布，那么我会选择小米Redmi 4（X），小米Redmi Note 4和小米Mi A1。

注意：这只是选择设备的一种可能方法，对于LOS团队有时会停止在手机上发布更新或您无法解锁引导加载程序的事实，我概不负责。 .

LOS


LOS LOS, 4pda, xda-developers, reddit.com/r/LineageOS ( ).

firmware


() . , Google Android , , ( Android). LOS, . , , , (firmware). Wi-Fi « ». .

« », . .

: Huawei ( Honor), . , . - Huawei (, LOS), 4pda, xda-developer , . , firmware.

(unlock bootloader)


对于某些设备，您需要通过特殊程序解锁引导加载程序。

在小米设备的示例中（示例指令[ 23 ]）：

  1. 我们在电话上创建一个小米帐户，并注明您的电话号码，电子邮件。
  2. 我们收到带有注册码的SMS。
  3. 验证帐号
  4. 我们转到en.miui.com/unlock，进入您的帐户。有时网站以中文显示可能会有问题。我们正在寻找菜单项目以切换到英语版本。
  5. 从en.miui.com/unlock/download_en.html下载程序。请注意，该程序仅适用于Windows计算机，并且需要Internet访问。
  6. Mi Unlock Install Drivers, .
  7. MIUI developer settings ( / )
  8. — > -> « USB», «Enable OEM unlock», .
  9. . fastboot ( + fastboot).
  10. 在Mi Unlock程序中，您需要使用您的帐户登录。接下来，应在程序中确定智能手机。您按下“解锁”按钮，确认几次，然后等待结果。如果智能手机相对较新，则将向您显示一条警告，指示智能手机解锁之前还有N秒钟的时间。可以是72小时到1440。相对较旧的型号应立即或在72小时内解锁。

互联网上有很多这样的说明。我提出此程序是为了警告某些细微差别。

  • , , . . , ( wi-fi , GPS, ) . Mi Unlock . ( ) Windows ( ), LineageOS, MAC Wi-Fi ( Wi-Fi ), .
  • :


    • Mi Unlock. USB . Mi Unlock ( ). Mi Unlock ( SHIFT, — > ).
    • fastboot. , 25 .
    • Mi Unlock — proxy .
    • Xiaomi 30 .

: , - , ( ).

.

Xiaomi Redmi 4 (X) [ 25 ]. , LOS — xda-developer 4pda. , LOS — . , - , , . () LOS (, 15.1 16).

: ( ) — . , Galaxy A7 (2017) — a7y17lte. , .

LOS


[ 25 ] .



  1. , adb fastboot .

    adb fastboot [ 27 ], [ 29 ]. ( . ), . Windows [ 31 ].
  2. «»- « »- « Android ( Android Debug Bridge (ADB))» («System»- «Developer options» — «Android debugging (Enable the Android Debug Bridge (ADB) interface)»)



, .

(RECOVERY)

1. TWRP . , - , TWRP ( ). ( ) TWRP 4pda xda-developer.

2. USB.

3.1. , Linux/macOS :

adb devices

. ( Linux), Windows , sudo adb devices Linux/macOS.

, 1 .

3.2. :

adb reboot bootloader

fastboot. fastboot + .

- .

4. :

fastboot devices

. , 1 .

5. ( TWRP) . ( ).

fastboot flash recovery twrp-x.x.x-x-santoni.img

«twrp-x.x.x-x-santoni.img» — TWRP, .

: «C:\Users\ \Desktop\twrp-x.x.x-x-santoni.img» .

( A/B) TWRP . TWRP , TWRP . — TWRP :

fastboot boot "C:\Users\ \Desktop\twrp-x.x.x-x-santoni.img"

6. TWRP, , recovery + .

LOS

1. LOS c . : Google Apps ( arm64). [33]

Google. , LOS — Google. LOS, CyanogenMod , . [35 — Features] LOS, Privacy Guard (« »). , Google Apps (Gapps) , .

MicroG[37] LOS[39]. Google, , Google. , 100% Google ( Google). ( ) .

2. — + . TWRP — TWRP :

fastboot boot "C:\Users\ \Desktop\twrp-x.x.x-x-santoni.img"

3. Wipe

4. Format Data, «yes». .

5. Wipe Advanced Wipe.

6. Cache System, «» .

7. ADB Sideload LOS . «Advanced», «ADB Sideload». :

adb sideload "C:\Users\ \Desktop\filename.zip"

«C:\Users\ \Desktop\filename.zip» — LOS «zip»

. - «firmware not installed». - . (4pda,reddit, xda-developer) .

8. . : - Google Apps, ! , «Advanced», «ADB Sideload»

adb sideload "C:\Users\ \Desktop\gapp.zip"

«C:\Users\ \Desktop\gapp.zip» — Google . LOS , Factory reset, Google .

9. : LOS AddonSU ( arm64)[41] , .

adb sideload "C:\Users\ \Desktop\addonsu-16.0-arm64-signed.zip"

: (root) . , , (firewall) (permission manager). . LOS AddonSU, Magisk. LOS AddonSU. , .



  • 4) « (RECOVERY)» 4.5) :
    fastboot oem unlock.

    , .
  • (Gapps ), . , . 3 — arm, arm64 x86.
  • , Wipe, Advanced Wipe Format Data. . , ( soft brick). , .
  • - , , , bootloop ( ), soft brick ( ), hard brick ( ). Bootloop soft brick - , .

    hard brick. . . . — ( hard brick) . - , . «bootloop» . . , LOS. Soft brick . -, 99% . hard brick . soft brick - zip-, Android 7 LOS 16. , .
  • LOS AddonSU , , . LOS ( ). ADB, . TWRP, Wipe, adb sideload

    adb sideload "C:\Users\ \Desktop\addonsu-16.0-arm64-signed.zip"
  • , TWRP . . , TWRP , , LOS. - , TWRP . , TWRP, :

    1) Android 8 LOS 15 ( Android 8)
    2) Android 9 LOS 16 ( Android 9)
    3) LOS 15.1 (Android 8.1) LOS 16 (Android 9)
    4) TWRP .

  • , LOS ( 15.1 16) . (, LOS 16). () ( ) . «» () firmware (Bootloader + Modem + DSP), ( 50-70 ) . adb sideload . . — «» .

    : , , (LOS) LOS . LOS (CyanogenMOD) , Android .
  • TWRP, LOS, recovery ( TWRP, ), - recovery. LOS , . . xda-developer 4pda TWRP . TWRP — 2 .

    LOS recovery TWRP.

, LOS .


但这还不是全部。不包括智能手机：
在F-Droid官方网站[ 43 ]的计算机上，下载F-droid应用程序本身。这是一个应用程序商店。商店被调用了，但是所有应用程序都是免费的并且处于开源状态。

从同一站点下载：

  1. AFWall +（dev.ukanth.ufirewall）[ 45 ]
  2. AdAway（org.adaway）[ 47 ]
  3. AppOpsX（com.zzzmode.appopsx）[ 49 ]
  4. 从guardianproject组织的网站的[ 51 ] 文件夹中，下载最近运行的Orbot。目前（2019年9月8日），只有最新版本的16.0.5-RC-2才可以在我的设备上使用最新版本[ 53 ]

.

— QKSMS[55] .

— Slight backup[57] . , . «» «».

— vcf , bluetooth. Nextcloud — .

.

  1. . . , -, . .
  2. Wi-Fi, . Wi-Fi .
  3. . ( LOS)
  4. LineageOS ( ).
  5. ( , ).
  6. Privacy Guard .
  7. ( ). , .
  8. ( ). , LOS 16 ( ). .
  9. . . ( , — ) SIM Toolkit SIM App Dialog . ( ). Apps & Notifications →See all # apps → «Show system».

    , . (AFWall+, AdAway, Orbot, AppOpsX) Files/.
  10. AFWall+. , (Lan/localhost, Wi-Fi ) Orbot VPN AdAway F-Droid. . AFWall+ .
  11. Android, PrivacyGuard AppOpsX , .
  12. Orbot, VPN, VPN AdAway F-Droid. VPN Orbot , VPN.
  13. AdAway. DNS .
  14. LOS .
  15. AdAway . :
    connectivitycheck.gstatic.com — Captive portal
    time.android.com —
    izatcloud.net — Qualcom A-GPS. A-GPS.

    play.googleapis.com, www.google.com — google. .

    — Wi-Fi .
  16. Wi-Fi ( )
  17. ( , ) AdAway. , AdAway
  18. LOS ( Android) ( LineageOS).
  19. ( ) F-Droid . ( Privacy Guard «»), , , . .
  20. — Shelter ( , — Shelter).
  21. . . - ( example.com) AdAway AdAway. .

    AFWall+ DNS Orbot, [59]. Tor , , www.deviceinfo.me [60]
    F-Droid ( ) — [61] Exodus Privacy[63], ClassyShark3xodus[65]. , . , AdAway, AdAway .
  22. ( , , ).



. , . Android . , - ( ) . ( Encryption ()). , , . Android , ( ). , . Android, . , , . ( ) Android .

, — . , ( / ) .

SD LOS — Adoptable Storage. SD , . «». SD .

SD , , .

, , . — , , .

, , . ( ), . .

: !!!

LineageOS


LOS


让我们看一下LOS设置，该设置主要涉及安全性和隐私性。其中许多内容适用于Google AOSP的全新版本。我将考虑LOS 16的版本。

在“设置”中，将搜索设置。

网络与互联网（网络与互联网）


— Wi-Fi

— Wi-Fi preferences ( Wi-Fi)
— Turn on Wi-Fi automaticaly ( Wi-Fi ) — .

— — Open network notification ( ) — .

Wi-Fi ( Wi-Fi).

— Mobile network ( )

— Wi-Fi calling ( Wi-Fi) — .

— Carrier video calling () — .

— Access Points Names ( (APN))

( ) . — AdAway . , , . — .

Connected devices ( )


— NFC — NFC . , NFC, .

— Bluetooth , . ( ) .

Apps & notifications ( )


— Notifications ()

— On lock screen ( )
Hide sensetive content ( ). , . , .

— Default apps ( )

, . .

«Browser app ()» «None ()» «Tor browser». , - , ( «None ()») «Tor browser». — - , , «example.com», «vk.com/away.php?to=example.com» , - IP . , ( , ). «», , .

- 高级（

App ） -应用权限。我将与PrivacyGuard和AppOpsX一起单独描述此项目。

-特殊的应用程序访问权限（
电池访问权限）
在Android中，用于自动关闭应用程序的控件随版本而变化。各种Doze功能，机器学习，应用程序使用情况统计信息等等。规则更改，添加了一些内容，删除了一些内容。我只是厌倦了猜测Google的下一步行动。目前，我不更准确地使用这些功能：我并不严重依赖它们。在本段中，我仅添加需要在后台运行的邮件服务和其他应用程序。

--设备管理应用程序
除了可以100％确定的应用程序之外，此应用程序不应具有任何其他应用程序。这是非常危险的许可。实际上，此许可可以更改设备中的任何设置。例如，在本段中，我只允许住房。是的，通常，即使您没有发出此许可，对这个许可的请求也已经非常可疑。

--在其他应用程序上显示
我没有任何需要该功能的应用程序。在某些情况下，病毒应用程序会使用此功能，例如，拦截输入的密码。

--请勿打扰-DND（请勿打扰）
. . , , .

— — Modify system settings ( )
, . .

— — Notification access ( )
. , .

— — Picture-in-picture ( )
Display over other apps ( ). , . , . .

— — Premium SMS access ( SMS) —
— Unrestricted data ( )
/ - / . ( ) («» — « » — « » — « ») ( ) «» . .
-安装未知的应用程序（
某些程序能够提供其他程序的安装。以前，此设置一次仅适用于所有第三方应用程序，但是现在在最新版本的Android中，可以单独访问每个应用程序。无论如何，任何应用程序（除了Google Play，我不建议安装）都不能在后台安装应用程序。肯定会弹出一个带有安装请求的窗口。在这一点上，我仅有机会购买Shelter和F-Droid。 （更多信息将在下面）。要发送安装请求，默认情况下是系统文件管理器。

--使用权限
访问常规设备使用历史记录数据。不要给任何人。好吧，或者是一些特殊的程序，它们可以为您分析设备的使用情况。仔细访问此功能。

--VR帮助程序服务（VR帮助程序服务）
我对此一无所知。我分别不使用VR，我不向任何人授予访问权限。

--目录访问
一个非常有趣的新限制，例如“图片”，“电影”等文件夹的访问。这是一个仅在Android 9 Pie中出现的新限制。事实是，现在，为了使应用程序能够将图片保存在“图片”中，应用程序要求对所有文件的完全访问权限！ Google决定对上述文件夹进行单独的限制。但实际上，没有应用程序开发人员急于限制自己，而是要求完全访问所有文件夹。目前，Android用户为25亿[ 67 ]。其中，有10％使用的是最新版本的Android Pie [ 69]。也就是说，对于2.5亿潜在用户（其数量只会增长），您可以重新制作应用程序并至少显示出某种形式的隐私承诺。但是不，他们对我们吐口水。

很清楚，为什么应用程序需要访问这些文件夹。如果删除应用程序时图片仍然保留（随机或特殊），则相同的Messenger将图片保存在此处。人们不想丢失令人难忘的照片。但是，为什么实际上没有应用程序可以将其数据保存在应用程序本身的内部存储器中？以臭名昭著的电报。没有这样的设置。他选择保存的内容和保存位置（即使秘密聊天中的文件也对其他应用程序可见，我将对此进行介绍）。我开始考虑如何最好地确保使用此类应用程序（需要访问内存）的可能性，但不要给予他们相同的访问权限。找到了一篇文章[ 71] . , , . , - , . ( ). . Telegram , Share () Telegram. !
Android 10 Q . . , , ? .

, . , . .

— scoped storage, Android 10 Q, Android 11. ( ).

— — Wi-Fi control ( Wi-Fi)
Google. , Android 9 ( LOS 16), // Wi-Fi,
1) Wi-Fi control ( Wi-Fi). (CHANGE_WIFI_STATE)
2) (ACCESS_FINE_LOCATION ACCESS_COARSE_LOCATION)
3) ( , ) .

Android 8.1 (LOS 15.1) 1- , 2-+3. . Google , Wi-Fi, .

. ( ), Wi-Fi, .

, , .

Battery ()


— Battery manager (Battery manager)

— Manage apps automaticaly ( )
. . Android , , . , , .

— Battery saver and perfomance ( )
— Extreme power saver ( ).

, , / . , , . Android 7 Nougat , ( Google) - . - , .

, , .

- ( Android 8.1,9 LOS 15.1, 16) , .

— Automatic power saver ( )
. - Orbot, VPN - Google Play ( ) / «» . . . «Apps & notifications ( )->Battery optimization ( )» (Orbot ) . — , . - , — .

— Performance profile ( )
, . «Balanced ()», 1) , .

2) , , . , ( LOS 16), . , - 20% 85%.

Security & Location ( )


— Screen lock ( )

—None (), Swipe ( ), Pattern ( ), PIN (PIN-), Password (). LOS 16 - Pattern, PIN Password, . . - Pattern ( ), PIN (PIN-), Password ().

— Lock Screen Preferences ( )

— On lock screen ( ) — «Apps & notifications ( )». , .

— Add users from lock screen (. . . )
. .

— Work notifications ( )
«On lock screen ( )». Work profile ( ). « », , .

— Fingerprint ( )
, . , (, PIN, ). - — .

, , ( . PIN). . , ( ), , 1 , , .

-, . . , . , , «» , , , .

无论如何，如果您安装指纹解锁，请打开“锁定”功能（请参阅以下说明）。

- 信任（信任）

-SELinux
一种附加机制，用于确保设备上访问控制的正确操作。状态应为“正在执行”，左侧的图标为绿色。如果不是这种情况，请在论坛上寻找解决方案。确保您下载了常规固件（强烈建议使用官方LOS）。有时您只需要更新固件。

-根访问（超级用户模式）
在此菜单项中，您无法进行任何更改，仅显示谁被授予了root权限。您可以在系统→开发人员选项→根访问权限中更改这些设置。稍后我会写有关root的文章。提前运行，我会说最好只在此部分中安装Apps。

-Android安全补丁程序（Anrdroid安全软件包）
此菜单显示您是否已消除最新的已知漏洞。显示两项：
-Platform（平台）
-Vendor（制造商）
如果在本段中显示一切不正常，请在论坛上寻找解决方案。如果您拥有LOS的正式版本，通常只需将更新“空中广播”（OTA更新）就足够了。有时您需要单独下载固件（从制造商那里更新）并安装。 LOS固件中很快包含Google正在准备的每月安全更新。比大多数其他固件（甚至是原装）要快得多。

-加密。必须包括在内。

-隐私卫士。我将足够详细地单独描述此设置，在这里我还将考虑其他限制访问权限的机制。

-LineageOS统计信息（发送统计信息）
能够将统计信息发送到LOS服务器。您可以自由决定是否向他们发送此数据。 （当您第一次打开固件时，还应该询问有关此内容）。在那里您可以看到发送了什么数据。我不喜欢此列表中设备和移动运营商的唯一指纹。另一方面，关于设备使用情况的更准确的统计信息将有助于了解用户的偏好，并且在选择设备时可能会帮助其他人。由您决定。

-短信限制。

每分钟发送SMS消息的限制。显然，各种病毒都经常使用此功能，以至于它们引入了单独的限制。或者用户不小心发送了巨大的SMS（SMS中的每70个字符都被视为一个单独的SMS）。

--位置

启用位置的默认设置。

— «Battery saving mode ( )» — GPS Wi-FI, bluetooth . . Wi-FI, bluetooth ( Gapps microg). . 3 — 1) GPS, 2) Wi-FI, bluetooth 3) . Android Wi-Fi ( ) . , Osmand , . . , Android ( Gapps) - , Wi-Fi.
— «Scanning ()» — Wi-Fi Bluetooth Wi-Fi Bluetooth. - . , Google , , . , , — . Wi-Fi Bluetooth.

— App-level permissions ( )
( Android) .

— Show passwords ( )

, . . , - . - , ( ), . , , , , .

— Device admin apps ( ) — , «Apps & notifications ( )»-«Special app access ( )»

— SIM card lock ( SIM-)

/ -. 20 , . ( — [73]). - ( ) — . , , , , , ( ) - .

— Trust agents ( )

这是一个绕过密码或指纹扫描器解锁设备的应用程序。标准固件通常可以访问Google Smart Lock应用程序。这样可以在特定位置或特定Wi-Fi路由器旁边将手机解锁。我建议您不要使用此功能，并禁用此设置中的所有程序。他们可以窃取该设备并在您的房子附近（或您注册为受信任的位置附近）解锁该设备。

- 屏幕固定（锁定应用程序）

此功能在LOS 16中不起作用（尽管在某些设备上，此功能仍可能起作用）。此功能旨在仅修复一个应用程序，而不能切换到另一个应用程序。如果您只需要通过一个程序就可以将设备提供给孩子，则很有用。

帐目


. . , , . Android 6 Marshmallow, , . «if an app shares the signature of the authenticator» [75]
, «signature of the authenticator», , ? .

实际上，对帐户列表的访问（除了来自应用程序本身的帐户），不受Android的标准限制。Google认为我们-败类（显然是Google代表我们的败类）不应该考虑这一点。我将进一步描述访问权限限制（您可以而且需要在Privacy Guard或AppOpsX中对其进行限制）。预先，我只是说要仔细监视哪些应用程序创建了帐户，以及哪些有权查看帐户列表。

系统名称


- 语言和输入

-虚拟键盘（虚拟键盘）
--Android键盘（AOSP）（Android键盘（AOSP））
-高级（高级设置）-打开“显示应用程序”图标。这是必要的，以便以后使用标准的Android工具从应用程序列表中快速限制键盘对Internet和联系人的访问非常方便。

另外，在键盘设置中，您可以删除常用单词的句子
-“文本更正”-“个人建议”
, - , — . : . , - , , «», «» . , -, . , .

— Buttons ()

— Power button ( )
— Lockdown ()
, . — , «// » «Lockdown ()», , . . , , . — .

— Status bar ( )

— Network traffic monitor ( )
Display mode ( ) . , - - , - , . .

Status bar ( ) . , , , ( «»).

— Date & time

我们删除了“自动日期和时间（网络日期和时间）”，我们删除了“自动时区（网络日期和时间）”。从理论上讲，这些设置应关闭Google服务器的自动时间设置。但是它不在那里。无论如何，即使设置被禁用，系统也会尝试使用ntp定期与Google服务器联系。这可以从日志AFWall +和Adaway中看到。

注意：您将必须手动设置日期和时间。当您下载TWRP时，日期和时间可能会误入歧途。取出电池时，日期和时间也可能会误入歧途。事实是，如果日期和时间错误，Orbot和Tor浏览器将无法启动。您可以尝试找出问题所在，但最常见的问题是系统中的错误时间。

- 开发人员选项（面向开发人员）

, , «» . , . , «», «» .

— Advanced restart ( )
recovery . , .

— Running services ( )
Android- . . - - , — . , .

— WebView Implementation ( WebView)
, JavaScript, Google. , . , . , - , - . LOS WebView AOSP Chromium. «» WebView ( WebView Bromite). , (, K-9 Mail) WebView. Bromite WebView.

— Root access ( )
:
Disabled ()
Apps only ( )
ADB only ( ADB)
Apps and ADB ( ADB)
, Apps only ( ). root .

— Manage root access ( )
, root () Privacy Guard . .

— Android debugging ( Android)
ADB ( AppOpsX). , .

— Debugging notify ( )
, , - ADB
— Revoke USB debugging authorization ( USB-).

ADB , + ADB .

. , . . , .

— Kill app back button ( «»)
( ) «». , , , .

, , ( ) .

Root// /superuser


— . Android ( ) . -, (soft brick), -, .

-, , , — , , .

, . , Google , . , « » Google , . , ( Captive Portal, Miracast Chromecast Google ). , , . , Afwall+, Adaway, AppOpsX.

, 3- :
Temporary root — . .

Full root — , , system.

Shell root — , , system. r/w (read and write), read. , , A/B [77]. -.

- , , : Adaway. hosts.

A/B Android 9 (LOS 16) system ( system/etc/hosts ) ( addonSU LOS), LOS 15.1 . Magisk, , system .

. LOS 2 :

1) addonSU — LOS . , LOS, open-source, ( ). Magisk . , addonSU , Netflix , . , NFC . SafetyNet : iSU [79], [81], iSU.

2) Magisk. , , - system, , . . , , NFC. , Android 9 (, DoH), root. . 100% , , (, system AdAway). , Magisk core-only, system .

, hosts, full root AddonSU, ( A/B LOS 15.1) - TWRP hosts Magisk. .

LOS Magisk :[83].

:

a) 2 addon- . «» addonSU, Magisk, - .

) SuperSU ( ), ( ).

) , . — adb sideload zip .

addonSU, , Netflix Ivi , system Adaway Magisk.

LOS , root (Apps only) root ADB. , - , ADB. « », - . ADB, . , ADB, , .

, . LOS, xda-developers , LOS. , . AddonSU . Magisk. . , — 11 Linux kernel - IP, AFWall+. , — 11 Linux kernel , DNS NTP ( ). , «0». IP, , IP , - . IP — . : - !!! , LOS Magisk. . .

() , . F-Droid . - ( ), , , .

- Magisk ( - ), Magisk. - Magisk open source .

Bootloader ()


(unlock bootloader) (Custom ROM), LOS. , ( Samsung Knox), , . , , - .

, LOS ( , ) (lock bootloader), Google Pixel.

? , , - . , . / , , . — ( ) 20 , , ( , Wi-Fi, ). , , . , , — . (, ), .

. , « ».

: LOS, 100 , . ( Nexus Pixel)

F-Droid


F-droid — () Android (). F-droid :

1)
2) (), .

— , open source. , , . - / /.

29 2010, , Android.
() open source , ( ). , .

f-droid , f-droid , . , , .

f-droid , F-Droid «» , - «» . , , . - , — «Antifeatures» ( /)[85]. :

Ads (This app contains advertising/ ) — . , . , f-droid. f-droid . , , .

Tracking (This app tracks and reports your activity/ ) — -. « » - , «Tracking», , , . , , «» Google analytics, f-droid. , «Tracking» - , , ( ).

, . , , f-droid.

NonFreeNet (This app promotes non-free network services/ ) — , «» . , Telegram f-droid, . , , telegram . Telegram . , . : f-droid Conversations. , , . XMPP . Conversations «NonFreeNet» , Telegram ( Matrix Riot , ). , «NonFreeNet» , - , . «NonFreeNet» , f-droid . , XMPP Conversation , ( open source ), (, ). ( ) .

(NonFreeNet). — . , Facebook . Facebook, .

NonFreeAdd (This app promotes non-free addons/ ) — , (, ). , OSMand, Fennec f-droid. , , . , / Fennec ( ), .

NonFreeDep (This app depends on other non-free apps/ ) — , - /, . , «Open In WhatsApp», - WhatsApp, WhatsApp-. , () WhatsApp. . «Open In WhatsApp» - «WhatsApp», .

UpstreamNonFree (The upstream source code is not entirely Free/ ) — , f-droid () . , , open source - / . «» f-droid , . , , . : , f-droid , , f-droid , /.

NonFreeAssets (This app contains non-free assets/ ) — - , . , , . «» , , , . . .

KnownVuln — , . f-droid, , . , , , .

DisabledAlgorithm — , . «KnownVuln».

NoSourceSince (The source code is no longer available, no updates possible/ , )— . , .

, . — f-droid. , , .

f-droid f-droid open-source, . , () f-droid — M-Droid [87], G-Droid [89]. f-droid , . 1 : F-Droid. .

  • F-Droid. . . , , . F-droid , F-Droid « » (Reproducible builds) [91]. - F-Droid , . .
  • F-Droid Archive. f-droid . f-droid, . . , , - . , , , , . , .
  • Guardian project Official Releases. f-droid, . Guardian, Orbot Tor browser Android. , Guardian project , . .
  • Guardian project Archive — f-droid, . Guardian . F-droid Archive , . , ( ), .
  • Bromite [93] — Bromite [95]. Chrome Google . , . WebView AOSP Chromium WebView Bromite .[97]
  • MicroG — [99], [101]. MicroG Google push-, Wi-Fi, . .
  • IzzyOnDroid — [103], [105] — open source ( ). , ( Github), ( .apk) . : , ( Google Play). , , apk ( f-droid), , «». , , , . 100- . , . , - , , , . .

    .

, , [107], [109], [111], .

F-Droid open-source Android , - (Reproducible builds). open-source , f-droid (, , f-droid). issues Github-e, Gitlab- Git .

F-Droid, open-source .



Settings ():

— Manage installes apps ( )
— Repositories () — / , .

— Automaticaly fetch updates ( ) — . —
— Include incompatible versions ( ) — ( x86, ).

— Include anti-feature apps ( ) — , antifeatures. . . , — .

— Use Tor ( Tor) — Tor (proxy) localhost (127.0.0.1) c 9050, onion . , Orbot. , Tor , -VPN ( VPN) Orbot, .

— Enable HTTP Proxy ( HTTP-) — HTTP , Proxy Host ( ) Proxy Port ( ).

— Prompt to send crash reports ( ) — . , . .

— Prevent Screenshots ( ) — ( LOS ) , F-Droid. , , . , Android .

— Hide with search button ( ) Panic button settings ( ) — , F-Droid , . . - , , . , .

— Keep cached apps ( ) — . 1 . , - . , - ( VPN) . . Android downgrade ( ) . , , . ( ), , . ( oandbackup
(dk.jens.backup) ).

.apk data/data/org.fdroid.fdroid/files mnt/sdcard/Android/data/org.fdroid.fdroid/cache/apks

Expert mode ( ).

— Unstable updates ( ) — . , , . , Google Play , F-Droid . , - , , , .

— Allow repos to install/uninstall apps ( ) — / . , , - , . , , ( ) . , .

, , . , .

F-Droid ( apk, ) Wi-Fi, bluetooth USB USB-OTG . , . , «Nearby ()»

:

F-Droid:
— . , F-Droid CDN-. «» — .

— , . , . F-Droid .

— , , .

— . , , / , .
-, - , F-Droid, - F-Droid ( , ).

:
- Android ( Google Play) . F-Droid, . Android, F-Droid.

— F-Droid , , «». Google , (, ) , . Google Play , , !!!
- F-Droid (source code) . (issues), .

F-Droid.

, . ( )[113]. :

  1. Anysoftkeyboard ( , F-Droid)+ [115]. LOS, . — ( Google SwiftKey).
  2. Amaze[117], File Manager [119]. , . - . , .
  3. PDF MuPDF viewer [121], MuPDF mini, [123]
  4. QR , — Barcodegen [125]. .
  5. QR Barcode Scanner [127]. .
  6. QR — SecScanQR [129]
  7. Net Monitor [131] — , IP . , , HTTP ( HTTPS) . , ! proc/net.!
  8. VLC [133] — , F-Droid. , . - .
  9. J2ME — J2ME Loader [135] — /, Nokia Siemens. , — , .
  10. — Simple Calendar — [137]. Android , - , . ( ), .

, F-Droid simplemobiletools. . , . .

— , VPN (OpenVPN, Wireguard ), ( ), , , , Wikipedia (Kiwix), , (Tower collector[139]), , , , , i2p , SIP , — Silence ( ), (/launcher), . . Google Play ( ). Google Play , . F-Droid 2000 — .

— [141] /, F-Droid.

VPN


Android VPN. VPN, . VPN -VPN, , NetGuard ( + ), Blokada, DNS66 ( ). , , «» VPN, - VPN. VPN. , ( ) VPN, + «» .

(tethering) — VPN, . ( Orbot iptables ( AFWall+) VPN).

, , VPN VPN.

AFWall+ (Android Firewall +) Firewall


Google , «» . , , Google Play, . !!!.. , . , . , . , , PDF . , , () (Storage), . :

Firewall


Android — Android Firewall. Android ! LOS ( ). «Settings/»- «Apps & notifications/ » , «Data usage/ » LOS 5 :

  1. Wi-Fi data/ Wi-Fi — Wi-Fi
  2. Cellular data/ —
  3. Background data/ — , ( ).
  4. VPN data — VPN.
  5. Unrestricted data usage/ — . « »

, . , . , / «Core/», , «Background data/ ». «» Google .

LOS . , . , (). — , LOS, VPN ( VPN — NetGuard).

AFWall+


AFWall+ — / iptables[143]. (root), system, . , VPN.

, -.

  • «Wi-Fi control/ Wi-Fi» — Wi-Fi.
  • «LAN control/ » — LAN localhost. «Wi-Fi control/ Wi-Fi», .
  • «Mobile date/ » — (2G,3G,EDGE,LTE,4G).
  • «Roaming control/ » — . «Mobile date/ », .
  • «VPN control/ VPN» — VPN, VPN . , . , VPN.
  • «Tor control/ Tor» — Tor, Tor. ( — Tor, Tor)


«All/» — .

«Core/» — , Linux.

«System/» — .

«/User» — .


Preferences/
-UI Preferences/
— Enable notifictations/ — , / . , «Block selected ( )» ( ), - , .

— Rules progress/ — , . ( ) «». « ».

— Show filters/ — «///».

— Show UID for apps/ UID — UID. . .

— Confirm AFWall+ disable/ AFWall+ — , - «» .

— Rules/Conectivity (/)

«LAN control/ », «VPN control/ VPN», «Tor control/ Tor». Roaming control , - , - , , . .

, !

-Log/
— Turn on loh service/ — , «». . , LOS - NTP , ( 1.1.1.1, ip, «». ( AFWall+) .

— Enable show toast/ — - , , AFWall-. , (toasts). . - ( Tethering/ Wi-Fi) . , , . , AFWall+ - . , , ( ). , - .

— Security/
. , . - , . , LOS , ( ), . ( LOS ).

— Experimental/
— Fix startup data leak/ — ! , AFWall : , , , . , , AFWall+ , 1-2 . . «Startup directory path for script/ » , «Fix startup data leak/ ». system r/w (read/write).

:

1) , ( ). / «Core/».

2.1) Wi-Fi /
2.2) «» Wi-FI .

3) , «» hosts ( AdAway). , hosts , IP. , IP 1.1.1.1. (DNS Cloudflare).

4) « /run at startup» Privacy Guard ( Privacy Guard «Start at power up») AppOpsX.

— Enable inbound connections/ — (Samba, sshd, AirDroid ), .

Enable multi-user support/ — , . , (multiple-users) ( ). AFWall+ «Block selected ( )» ( ). 2- 2- VPN, ( ) .

Dual apps Support/ — « », MIUI, Island . , « » . — AFWall+ , ( ). : , () ( ), , , . . , 2 . - , , proc/net IMEI .

— System/ User/ . - «System/». AFWall+ . «M» UID, [101001] Phone Services (M).

— Profiles/ — , ( 4-). — 1- . AFWall+.

2 :

1) Allow selected ( ) — , . « », . , - . . , LOS 15.1 - «Core/» «System/».
2) Block selected ( ) — . , « , ».

. , Android .

, VPN, Orbot, Google , .

. «Allow selected ( )» Wi-Fi .

«[-10] (Any app) Same as selecting all apps/ ( ) — , ». « , », .

, «Block selected ( )», , «Allow selected ( )» ( LOS 16) . , , Android . . LOS ( Android).

«[0] (root) Apps running as root/ root », , root.

«[-11] (kernel) — Linux kernel/ () — Linux». . , , - «».

, UID, / . [1000] Android. .

, , .

  1. [12] « (tethering) DHCP+DNS services/ () — DHCP+DNS» «[0] (root) Apps running as root/ root » «Wi-Fi» — , Wi-Fi.
  2. [10010] «Download manager». « » . . , VPN Tor, [10010] Download manager ( Wi-Fi ), Download manager IP!!! , — .
  3. [1021] « (gps) — GPS/GPS» ( ) — , A-GPS. , .
  4. [10070] Captive portal login — , Wi-Fi. , - Wi-Fi , - // . Captive portal. , , «» Google ( ). , -, ( ).
  5. - API Android LAN (, AppOpsX Termux).
  6. «Core/» Tor AFWall+.

, AFWall+ Orbot VPN .

AFWall+ Orbot Google LOS 16 ( LOS 13 15.1)

  • «Allow selected ( )»
  • Orbot , -VPN Orbot. AFWall+ Orbot LAN, Wi-Fi, , VPN.
  • VPN , , F-Droid, [10008] Updater .
  • , VPN Tor ( ) Wi-Fi / .
  • ( (M) ) Wi-Fi / , VPN. ( ).
  • [12] « (tethering) DHCP+DNS services/ () — DHCP+DNS» «Wi-Fi» [10010] «Download manager» - .

, . 99% 99%- VPN/Orbot, VPN/Orbot , . , , . - — .

— «Tor control/ Tor». Tor, Tor, Orbot -VPN « Tor» . , (Wi-Fi ) «» «Tor control/ Tor». Tor.

, « DNS/DNS leak». Tor, DNS ( / IP , ), .[145]. .

AFWall+ «Set customs Scripts/ » , Tor -VPN DNS. . Orbot VPN, « VPN» Tor, VPN, . , AFWall+ iptables.

DNS, Tor, VPN .

:
) Tor [146]. Tor/Orbot.

AFWall+ — . .

VPN — VPN VPN VPN, VPN ( LOS Orbot).

AdAway


hosts . — hosts. , , system, r/w (read and write).

—

  • VPN
  • «»
  • ( , symlink hosts)

—

  • . , , [149], [151], [153].
  • , .
  • « » ( ). . , + 1-2 .
  • .
  • wildcard . . , «example.com», «example.com/cartinka_reklama01.jpg». «example.com» «example.com/cartinka_reklama01.jpg». ( ), wildcard .

    AdAway 2-, 3-, 4- ( ) . , «google.com», «account.google.com» «www.google.com» «www.account.google.com» . «*.google.com»
  • , «», IP. AdAway google.com, , IP 8.8.8.8
  • — Google Android DoH (DNS over HTTPS), QUIC ( Youtube). hosts. , Google Android , .

, hosts, AdAway .

Preferences

— Hide welcome card ( ) — .

— Check for updates ( ) — , .

— Allow whitelisting ( ) — , , . , « ». — - - / , «» «» « », - . . -, , (, ).

[155] ( ).

— «Target hosts file ( hosts)» «Custom target/ » — hosts. , , , hosts symlink (- — ) hosts.

— Enable webserver ( ) — , « » , . «». .

— Enable crash reports/ — , . - , .

:

Host sources ( )
3 ()
URL
SSL
Description
License
adaway.org/hosts.txt
Y
Special hosts file for AdAway containing mobile ad provider
CC Attribution 3.0
hosts-file.net/ad_servers.txt
Y
hpHosts
Allowed AdAway project to use it as default
pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext
Y
Yoyos Hosts file
MCRAE GENERAL PUBLIC
LICENSE (version 4.r53)

( , ).

, ( Fennec Tor browser + uBlockOrigin + uMatrix). Bromite ( ) ( ). AdAway LOS ( LOS ).

, [157],[159], [161]. Google Qualcomm ( A-GPS LOS) [163].

, ( ) hosts. , - . , Fennec+uBlock Origin, Bromite + AdAway.

. , hosts :
127.0.0.1 yandex.ru
.

— Your lists ( )

, . , .

) Blacklist ( ) — .

) Whitelist ( ) — .

) Redirects () — . . .

— Log DNS requests ( DNS) — / . , . .

LOS «» LOS. - . - , . , - , . F-Droid «» .

, ( ), .

:

  1. connectivitycheck.gstatic.com — Captive portal. (Captive portal) Wi-Fi -. — , Wi-Fi . Wi-Fi , . , « ».
  2. time.android.com — (NTP) — , .
  3. time.izatcloud.net, xtrapath1.izatcloud, xtrapath2.izatcloud, xtrapath3.izatcloud, gpsonextra.net, path1.xtracloud.net . A-GPS, GPS ( « »). GPS , . , ( A-GPS).
  4. firefox.settings.services.mozilla.com, shavar.services.mozilla.com, addons.cdn.mozilla.net — Fennec ( IceCat) (), ( !!!, issues F-Droid). . F-Droid. . ( — )
  5. F-Droid ( ), hosts AdAway, ( , ) (uBlock Origin, Bromite ).

-Scan for adware ( Adware) — «» . , , - , .

Orbot, Tor Browser proc/net


Orbot


Orbot — Guardian Project Tor Android . (Guardian Project) Tor Android — Orfox. Tor Tor Android.

Orbot Tor ( Orbot). Orfox .

Orbot Tor . , . — 16.0.5-RC-2.

Orbot . , ( 2- ) «Bootstrapped 100%: Done». :

1) , « Tor» — Tor.

1.1) « Tor», . host: 127.0.0.1, port 8118.

2) VPN mode (VPN ), , Tor ( ) Tor-Enabled Apps/ Tor. VPN Orbot Android VPN . «Always-on VPN/ VPN» ( VPN ) «Block connections without VPN/ VPN» ( , Orbot. - ). Tor -VPN ( , VPN ).

3) iptables ( AFWall+) , Tor VPN , « Tor». , , DNS Tor.

:
-«Use Bridges/ » . - , 4- ( 3 ) .

. - Orbot , , . , . - ( - ), , «Global (Auto)». .

, . - . Tor . . , . , .

«Settings/»

— Start Orbot on Boot/ Orbot — , Orbot .

— Open Proxy on All Interfaces — , , (tethering) Tor.

— Entrance Nodes/ — () Orbot . . .

— Exit Nodes/ — () Orbot . . .

— Exclude Nodes/ — () Orbot . . , - , .

— Strict Nodes/ — Orbot . Orbot , Orbot . .

— Use Bridges/ — , , ( ). /.

— Relaying/ — ( ). .

— Isolate destination addresses/ — , . . , , IP ( ). , yandex.ru - «», , «», IP . IP ( VPN).

, «» .

, , - ( , ) - proc/net. IP proc/net. .

— No Network Auto-Sleep/ — Orbot «» . . Captive Portal connectivitycheck.gstatic.com, , «». .

: Orbot , .

proc/net


proc/net — , - proc/net IP IP . . . Net Monitor (org.secuso.privacyfriendlynetmonitor)[131] . IP . « » () . VPN-, Orbot, Privacy Guard, xPrivacyLua . — , IP . : IP IP . 99% , !!! IP , , 99%-, 100% . , .
Google Android 9 P, «» Google Android 10 Q ( LOS 17).[165]

, ? [166], , Facebook . , .

, Android 10 Q . — NetworkStatsManager ConnectivityManager classes. ( AppOpsX). - Google !!! Level API ( ). [165] Android 10 Q , :
«The following changes affect all apps running on Android Q, even if they target Android 9 (API level 28) or lower.»
, Google. , Android 10 .

?

  1. , .
  2. - — open-source F-Droid.
  3. - - open-source , « » ( , IP ). , « » . .
  4. Tor . Tor Android Tor ( F-Droid, , Orbot , ). Tor, , proc/net! proc/net IP ( ).

Tor Browser


Android Guardian Project 1) Orbot 2) Orfox. Orfox — - Firefox, Orbot. Orfox . Tor (Guardian Project Tor project) Tor Android . Tor Browser Android Firefox, Orbot ( Orbot), .

F-Droid Tor Browser:

1) Tor Browser
2) Tor Browser (Alpha)

Firefox, Tor . ( Alpha ).

Orfox , Tor, ( ). Tor () Mozilla, NoScript, ( ), DuckDuckGo ( WebRTC). Security Settings ( ).

() . , . , . , . «» , (browser fingerprint) ( ). JavaScript [167].

, Tor Browser proc/net, AdAway ( hosts).

4 :

1) Tor Browser (Alpha) uBlockOrigin, uMatrix ( ) .

2) Tor Browser . .

3) Fennec uBlockOrigin, uMatrix ( ) Orbot , Tor. , ( Tor).

4) Bromite — , Firefox- (Tor Browser Fennec Firefox). .

, , - .

Tor:

  1. Tor!!![169]. , Tor .
  2. , , Tor . , , .
  3. Tor . (, Tor, I2P, Yggdrasil, Zeronet).

: Tor Browser , .

Fennec Bromite


, .

Fennec


Fennec ( Fennec F-Droid) — Firefox ().

(Settings)

— Sign in () — Firefox Sync , , . « » Mozilla[171]. Firefox Sync[173].

, .

1) Firefox Sync
2) Nextcloud — .
3) Turtl — , .
4) Wallabag — Pocket. , . .

Firefox Sync , . , — . Mozilla ( Firefox) . - Google, addons.mozilla.org/en-US/firefox. . Firefox Sync Tor.
Firefox- .

Nextcloud, ( ). .

— Search/ — DuckDuckGo. DuckDuckGo, . Google, , Mail.ru, Yahoo Bing .

Fennec,

, DuckDuckgo.com. «Page/» — «Add a Search Engine/ … ». -. , , ( utm , ).

— Show search suggestions/ — , - , « 8 999 77 5-55-55» . . , cookies ( ) . .

— Privacy/
— Do not track/ — . , . ? , , , , . , ( ), .

— Tracking protection/ — Disconnect. Google . ( uBlockOrigin).

— Cookies/ — Enabled, excluding 3rd party/,

— Clear private data on exit/ . . , . , ( , Android , «»), . «Quit/» , . - - , . , «Quit/».

— «Mozilla Location Service/ Mozilla» — Wi-Fi GPS Wi-Fi. . - ( Google , ), - , .

— «Fennec Health Report/ » — . .

— Advanced/
— Restore tabs/ — .

IceCat, Firefox. [113] — , Fennec - , Firefox ( Fennec).

HTTPS Everywhere, uBlockOrigin ( ), uMatrix ( -). WebRTC (about:config → media.peerconnection.enabled → false). NoScript ( uMatrix) XSS, uMatrix, XSS.

.

Bromite


Google Chrome. Fennec, ( , Chrome Android ). , Fennec ( habrahabr).

:

— Search engine/ — DuckDuckGo.

— Privacy/
— Close all open tabs on exit — . «Exit/»
— Search and URL suggestions/ URL — .

— Use page prediction/ — .

— Access payment method/ — .

— Usage and crash reports/ — . .

— Open links in incognito tabs always — . « (cookies, , ) ». .

— Do Not Track/ — . , .

— Tap to Search/ — .

JavaScript, , Bromite , . JavaScript .

Google (Google Apps/Gapps)


LOS Google ( Google — Google Fi). — . LOS .

, (), .

Google

1) (, , Chrome) Google , .

(Youtube ).

2) . . , , Google ( Google) , , .

: Gapps. Google ( , Bing, Openstreetmap ). , . Google Apps ( ).

3) Push . , ( , ) . , . Google GMC [175]. Google, / Google, Google . , .

, .

F-Droid . , , Google . Gapps Google ( ), «» , Gapps 1-2 , , , Gapps.

4) Wi-Fi . GPS. , GPS — !!! GPS 10, . — 2 . — 10-15 . , , , , .

LOS ( ) 3

  • opengapps — «open» — Google, . Pico[177], . Pico , Google . , Google-. ( ).
  • Mind The Gapps — Google. opengapps.
  • microg — , - open-source!!! , (). , . opengapps, Google. Google , . , push Google , . , Google . Wi-Fi Google , . opengapps Mind The Gapps — Google . .

    : LOS microg. [179]. — microg singature spoofing, «» Google, LOS . «» . - ( ) . singature spoofing . LOS microg, -.

    microg LOS, opengapps.

    :

    — microg () LOS LOS [39] — «LineageOS for microG». , microg — LOS «» LOS. .

    — LOS microg ( Nanodroid) .

    , microG ( ) [181]. open source push ( GCM).

Gapps. F-Droid, . ( + ) Gapps . , , — Gapps.

, — Wi-Fi . UnifiedNlp ( microG) + Wi-Fi ( ). , signature spoofing LOS.

Yalp store/Aurora Store


Gapps, Google Play Market. , Google Play. . , Google Play:

1) Yalp store (com.github.yeriomin.yalpstore)
2) Yalp Store (fork) (com.github.kiliakin.yalpstore) — Yalp store , () .
3) Aurora Store (com.aurora.store)

. , Google , , , .

. - , Google . , ( ) . , MicroG, Gapps ( Google Play Market).

( ) Google Play split apk — apk . Yalp , Yalp , .


( 99% ) Google Play . [61]. Exodus Privacy[63], ClassyShark3xodus[65]. !!! . , , [183]. ?
-AppMetrica
-Facebook Ads
-Facebook Analytics
-Facebook Login
-Facebook Share
-Flurry
-Inmobi
-Yandex Ad
, ? Facebook Ads, Facebook Analytics, Facebook Login, Facebook Share — . Flurry — Yahoo. Inmobi — Mumbai, India. , , Facebook Yahoo?

MAPS.ME Mail.ru [185]. ))

, - , - «Crash», «Bug» — .

Facebook [187]. . Facebook ? [189]. Facebook- , -.

Exodus — , - , — . Exodus, . , .

(Permission control), PrivacyGuard, AppOpsX


— . . , «Special app access ( )».


:

  1. Normal — «». , Google ( ) .

    , , Bluetooth, Wi-Fi , , [191]. «» .
    «» Android- ( «Special app access ( )»). PrivacyGuard AppOpsX ( ADB).
  2. Dangerous — ( «» ). , Android Android. Android . , SMS. SMS , , MMS .
    : - , ( ), /. Android !!! . ( ) — ( PrivacyGuard).
  3. Signature — «». , , . (, Android-), . / , , . , ( ) Magisk Xposed Framework. Signature Spoofing. Magisk Xposed Framework MicroG.

    , « », - , . .
  4. Special — . Signature, - . . , - Android- « », .


:
Apps & notifications ( )->Special app access ( ). , , (CHANGE_WIFI_STATE).

Android


Android :Apps & notifications ( )->Advanced ()->App permissions ( )
Danger (). , . :
«Additional permission», - , [193].

Privacy Guard ( )


LOS: Security & Location ( )->Trust (Trust)->Privacy Guard ( ) ( — PG)
, LOS. , LOS, /.

LOS - — .

«Enabled by default ( )».

«Show notifications ( )». , - PrivacyGuard. PrivacyGuard . , - , «».

«Show built-in apps ( )». , . - . - , Android . , Wi-Fi , ( ). .

. , .

. /, 3- :
) Allowed () —
) Ingored ( Disallow) () —
) Always ask () — , .

Always ask () , - , -, . , . , - (), / , . ( ), . «».

«Advanced ()», , .

Privacy Guard «» , , , .

Privacy Guard «» . , «Start at power up ( )» — «RECEIVE_BOOT_COMPLETED» «Run at startup» Android. , . , , .

:

, «» , Android Privacy Guard . [195] [197] , :
) — , PG — :
) — , PG — :

) — , PG — : , PG, .

) — , PG — :
) — , PG — :
e) — , PG — :
LOS 16 , , - . ) : — , PG — : .

LOS 16 . - , .

:
— LOS 14, 15.1 Privacy Guard. 15.1 , 14- ( ).

— Gapps, , «» PG, Bootloop LOS ( [199]). . , Android Gapps Google, .

— , . Google Android , , . API level ( ). , - , , , .

— PG [201] ( ) Android- LOS .

, , F-Droid, , Android PG.

AppOpsX (com.zzzmode.appopsx)


, PG, , PG. , change your audio settings ( ) , , .

: , Mock location ( , — ), (NEIGHBORING_CELLS) — .

, AppOpsX, :

  1. - . « » PG Wi-Fi, AppOpsX .
  2. Gapps ( UnifiedNlp location provider) , .

AppOpsX , PG Android, . :
Read clipboard ( ) Modify clipboard ( ). Android 10 Q, AppOpsX Android 9 Pie.

, AppOpsX, PG, AppOpsX, PG. .

, - AppOpsX, , . .

.

— Automatically turn off permissions ( ) — AppOpsX . Android 9 Pie AppOpsX ( root) .

— Close permission template automaticaly ( ) — Automatically turn off permissions ( )
-Use ADB mode ( ADB) — AppOpsX , ADB. ADB over network (ADB ) AppOpsX Use scipt start server ( ). AFWall+ AppOpsX localhost LAN control/ .

— Allow running in the background ( ) — , «Automatically turn off permissions ( )»
-Root compatibility mode ( ) — AppsOpsX, . LOS 16 (Android 9) . Automatically turn off permissions ( ).

— Show system apps ( ) — LOS, . , , System . LOS (, ), .

, , .



, Android, PG AppOpsX
And_ENAnd_RUPG_ENPG_RUAppOpsX_ENAppOpsX_RUDescription
normal-ACCESS_LOCATION_EXTRA_COMMANDSAccess extra location provider commands. , () A-GPS. . .access extra location provider commands----A good example for poor documentation, as even books on Android application development state: The Android documentation doesn’t tell us which location commands are “extra,” so we’ll ask for all of them.The documentation of Locus Map gives a hint, though: allows disabling the A-GPS data status and forcing system to load new.
normal-ACCESS_NETWORK_STATEView network connections(Wi-Fi, 3G, 4G). . . , .view network connections----Allows applications to access information about networks, including if a network is available (or just connecting), what type of network the device is connected to, if any (WiFi, 3G, LTE), if it's in Roaming, and also reasons for a failed connection attempt (if any).Good use: The application may check the state of your connection before trying to access the internet, and e.g. restrict itself to WiFi for some actions.Bad use: Only in combination with other permissions (e.g. data collection for profiling).
normal-ACCESS_NOTIFICATION_POLICYMarker permission for applications that wish to access notification policy.DND ( ). Do Not Disturb access — DND ( « »). , , DND.-------
normal-ACCESS_WIFI_STATEView Wi-Fi connectionsWi-Fi , Wi-Fi . Android .view Wi-Fi connections (Wi-Fi control)Wi-Fi ( ( Wi-Fi)— ( AppOpsX Scan Wi-Fi networks)— ( AppOpsX Wi-Fi)WIFI_SCANWIFI_SCANThis could be requested by any application that uses internet access. The application may check the state of your connection before trying to access the internet. It's comparable to ACCESS_NETWORK_STATE, just for WiFi.
normal-BLUETOOTHPair with Bluetooth devicesBluetooth Bluetooth ( , /).pair with Bluetooth devicesBluetooth----Allows the app to view the configuration of Bluetooth on the phone, and to make and accept connections with paired devices.
normal-BLUETOOTH_ADMINAccess Bluetooth settingsBluetooth, ( / ). .access Bluetooth settingsBluetooth----Allows applications to discover and pair bluetooth devices.
normal-BROADCAST_STICKYSend Sticky Broadcasts- . Level API 20. .send sticky broadcasts----?
normal-CHANGE_NETWORK_STATEChange network connectivity/ Wi-Fi/ . .hange network connectivity----Allows applications to change network connectivity state.Good Cop: Enable network connection only when needed, according to the requirements of the user.Bad Cop: Cause extra costs (especially when in roaming) just for mischievous glee; secretly transfer data (in conjunction with INTERNET).
normal-CHANGE_WIFI_MULTICAST_STATEAllow Wi-Fi Multicast reception, Wi-Fi. / / . , Wi-Fi (CHANGE_WIFI_STATE), .allow Wi-Fi Multicast receptionWi-Fi----Allows applications to enter Wi-Fi Multicast mode. This allows to send data packages to multiple recipients simultaneously, without using additional bandwidth. Useful e.g. for streaming servers supporting multiple clients. It also enables to receive network packages not intended for the own device (sniffing).Uses more power than non-multicast-mode.
normal-CHANGE_WIFI_STATEConnect and disconnect Wi-Fi/ Wi-Fi, [][https://developer.android.com/guide/topics/connectivity/wifi-scan] , Wi-Fi.connect and disconnect from Wi-Fi/ Wi-FiChange Wi-Fi stateWi-Ficonnect and disconnect from Wi-Fi/ Wi-FiAllows applications to change Wi-Fi connectivity state. Think of it as CHANGE_NETWORK_STATE for WiFi.
normal-DISABLE_KEYGUARDDisable your screen lock. . .------Allows applications to disable the keyguard.This permission is of medium-high importance. It allows an app to disable the «lock screen» that most phones go into after going to sleep and been turned on again. This lockscreen can sometimes be a password screen, or a PIN screen, or just a «slide to unlock» screen.
normal-EXPAND_STATUS_BARExpand/collapse status bar. .------Allows an application to expand or collapse the status bar.This appears to be a system permission – not for use by regular applications.By collapsing the status bar, an app might have a full-screen mode; an evil app might as well use it to hide the appearance of certain status icons from the user.
normal-FOREGROUND_SERVICEForeground ServiceGoogle Android 9 P . , . Android .run foreground service--run foreground serviceRequired by apps targeting Android P or higher which want to run a foreground service. (A foreground service performs some operation that is noticeable to the user (like playing a sound track). Foreground services continue running even when the user isn't interacting with the app, but must display a Notification.)
normal-GET_PACKAGE_SIZEMeasure app storage space. .------Allows an application to find out the space used by any package.This permission does not seem to have any risk associated with it.
normal-INSTALL_SHORTCUTInstall Shortcuts. .install shortcuts----Allows an application to install a shortcut in Launcher (Homescreen).This is a custom permission for the default Android Laucher (the home screen). It would allow an app to put an icon or shortcut there. While not dangerous, this can sometimes be a sign of a potentially malicious or adware app, which could e.g. create a shortcut that looks like Google Play, but of course launches something completely different.
normal-INTERNETFull
network access		. ! Android ( ). iptables (AFWall+) . PG AppOpsX .Have full network access----Allows applications to open network sockets. Any application that accesses the internet for any reason will have to request this permission.This is of course required to loads ads (which is why most apps request this), but can also be used to spy on personal data. Special caution is advised when this permission is requested at the same time as others which access personal data.
normal-KILL_BACKGROUND_PROCESSESClose other apps. .close other apps----Allows an application to call killBackgroundProcesses (String).This permission is a bit of a tricky one. Often this is used by what are called «task killers». Conversely this permission has some potential to maliciously close anti-virus or other security related apps. This should be treat caution. Few users should ever need an app with this permission. Rather, it could be an indicator of malicious intent (especially if not requested by a task killer or system performance tuning app).
normal-MANAGE_OWN_CALLSroute calls through the system– . ( , ), , .route calls through the system----?
normal-MODIFY_AUDIO_SETTINGSChange your audio settings. AppOpsX ( Bluetooth, , , )change your audio settings--Allows an application to modify global audio settings.
normal-NFCControl Near Field CommunicationNFCcontrol Near Field CommunicationNFC-Toggle NFCNFCcontrol Near Field CommunicationNFC-Allows applications to perform I/O operations over NFC.The distance which NFC is able to work is only a few centimeters so that devices (or a device and a tag) must effectively be touching each other to communicate. Due to the distance, this technology is not particularly dangerous. However it does present a small risk and it is something that should used with caution.
normal-READ_SYNC_SETTINGSRead sync settings. ( ), .read sync settings----Allows applications to read the sync settings.This permission mostly allows the application to know if you have background data sync (such as for Facebook or Gmail) turned on or off. Might be a indicator that the app wants to adjust its behavior accordingly and respect your wishes concerning when to sync and when not. Note that this only allows access to the sync settings – not to synchronized data.
normal-READ_SYNC_STATSRead sync statistics( ). ( ), .read sync statistics----Allows applications to read the sync stats for an account, including the history of sync events and how much data is synced.This permission is related to READ_SYNC_SETTINGS but not particularly dangerous itself. There is a minor risk that some personal information could be gleaned from the sync stats, but the information is unlikely to be valuble. Sync in this case relates to syncing of contacts and other types of media on the phone.
normal-RECEIVE_BOOT_COMPLETEDRun at startup/ .run at startupStart at power uprun at startupAllows the app to start itself as soon as the system has finished booting. This can make it take longer to start the phone and allows the app to slow down the device by constantly running.
normal-REORDER_TASKSReorder running apps. .------Allows an application to change the Z-order of tasks. Malware could use this to push some ads o.a. into foreground to be displayed to the user.
normal-REQUEST_COMPANION_RUN_IN_BACKGROUND-- . . .-------
normal-REQUEST_COMPANION_USE_DATA_IN_BACKGROUND-- . . .-------
normal-REQUEST_DELETE_PACKAGESAllows an application to request deleting packages.. , . .------Allows an application to request deleting packages. Apps targeting APIs Build.VERSION_CODES.P or greater must hold this permission in order to use Intent.ACTION_UNINSTALL_PACKAGE or PackageInstaller.uninstall (VersionedPackage, IntentSender)). As this action should launch the application installer, the user should be asked to confirm each install.
normal-REQUEST_IGNORE_BATTERY_OPTIMIZATIONSRequest exclusion from battery optimizations. , . .------Grants an app the permission to request being excluded from battery optimizations (aka Doze mode). The user has to approve this.
normal-SET_ALARMSet an alarm. , . .set an alarm----Allows an application to broadcast an Intent to set an alarm for the user.This permission seems to be of low risk because it doesnt allow the setting of the alarm directly. Rather it allows the opening of the alarm app on the phone.
normal-SET_WALLPAPERSet Wallpaper. .set wallpaper----Allows applications to set the wallpaper. Low risk, if any (except for shocking background images, maybe).
normal-SET_WALLPAPER_HINTSAdjust your wallpaper size. .adjust your wallpaper size----Allows applications to set the wallpaper hints. Lacking documentation, the best guess is this is about settings for size and position.
normal-TRANSMIT_IRUse IR Transmitter. .------Allows using the device's IR transmitter, if available. Useful for infrared remote controls.
normal-USE_FINGERPRINTAllows an app to use fingerprint hardware.. USE_BIOMETRIC, .use fingerprint hardware.Use fingrprintuse fingerprint hardwareAllows
an app to use fingerprint hardware, but does not give the requesting app access to the enrollment/fingerprint administration flow.
normal-VIBRATEControl vibration.control vibrationUse haptic feedbackcontrol vibrationAllows the app to control the vibrating function of the device.
normal-WAKE_LOCKPrevent device from sleeping.prevent phone from sleepingKeep your device awakeprevent phone from sleepingAllows using PowerManager WakeLocks to keep processor from sleeping or screen from dimming.Useful e.g. for navigation apps, to keep device and screen on without the user needing to tap it every minute.Of course this has strong effects on battery endurance, especially when used frequently.
normal-WRITE_SYNC_SETTINGSToggle sync on and off/ , . , , / . .toggle sync on and off/----Allows applications to write the sync settings.This permission relates to backup and sync of certain types of information like contacts. It allows an app to write settings for how that account and the data are sync and backed up. This is a common permission for social services or contact managers or any other type of app with an account associated with it. Alone, this permission doesn't allow an app access to contacts or other sensitive data. Rather, it just relates to how that data is backed up. Nevertheless, care should be taken as always.
dangCALENDARREAD_CALENDARRead calendar events plus confidential information. , , /Read calendar events and detailsRead calendarRead calendar events and detailsAllows an application to read the user's calendar data.This permission is of moderate to high importance. While most people would consider their calendar information slightly less important than their list of contacts and friends, this permission should still be treated with care when allowing applications access. Additionally, it's good to keep in mind that calendar events can, and often do contain contact information.
dangCALENDARWRITE_CALENDARAdd or modify calendar events and send email to guests without owners/ . ,add and modily calendar events and send email to guests without owner’s knowledge/ .Modify calendaradd and modily calendar events and send email to guests without owner’s knowledge/ .Allows an application to write (but not read) the user's calendar data.Apps using this permission can add calendar events, but not read them. So as long as the READ_CALENDAR permission is not requested along, risk should be moderate. However, a malicious app can cause a lot of confusion if you suddenly find a lot of calendar alerts in your notification bar.
dangCALL_LOGREAD_CALL_LOGRead Call Logs.Read call logRead call logread call logAllows an application to read the user's call log.Implicitly granted with READ_CONTACTS when both minimum and targeted SDK level are 15 (ICS) or lower.
dangCALL_LOGWRITE_CALL_LOGWrite call log.write call logModify call logwrite call logAllows the app to modify your phone's call log, including data about incoming and outgoing calls. Malicious apps may use this to erase or modify your call log.This permission is not much of a danger by itself, but rather could be used to hide other malicious behavoir. However it has a legitimate purpose for dialer replacements or voice over IP apps (like Google Voice).
dangCALL_LOGPROCESS_OUTGOING_CALLSReroute outgoing calls. , VOIP ( ).reroute outgoing calls--reroute outgoing callsAllows an application to monitor, modify, or abort outgoing calls.This permission is of high importance. This would allow an app to see what numbers are called and other personal info. Generally this permission should only be seen on apps for VOIP (Voice Over Internet Protocol) like Google Voice or dialer replacement type apps.For incoming calls, see MODIFY_PHONE_STATE.
dangCAMERACAMERATake pictures and videos.take pictures and videos-Access the cameraTake pictures and videos-Required to be able to access the camera device.This permission is of moderate importance. As it states, it lets an app control the camera function on your phone. In theory this could be used maliciously to snap unsuspecting photos, but it would be unlikely and difficult to get a worthwhile picture or video. However, it is not impossible to make malicious use of cameras.Legit uses include a.o. camera apps and barcode readers.
dangCONTACTSREAD_CONTACTSRead your contacts.read your contactsRead contactsRead your contactsAllows an application to read the user's contacts data.This permission is of high importance. Unless an app explicitly states a specific feature that it would use your contact list for, there isn't much of a reason to give an application this permission. Legitimate exceptions include typing or note taking applications, quick-dial type applications and possibly social networking apps. Some might require your contact information to help make suggestions to you as you type. Typical applications that require this permission include: social networking apps, typing/note taking apps, SMS replacement apps, contact management apps.To see what‘s all accessible with this permission, take a look at the app [permission.READ_CONTACTS]http://www.1mobile.co.id/permission-read-contacts-164022.html), which unfortunately is no longer available at Google Play.
dangCONTACTSWRITE_CONTACTSModify your contactsmodify your contactsModify contactsModify your contactsAllows an application to write (but not read) the user's contacts data.Unless an app explicitly states a specific feature that it would use your contact list for, there isn't much of a reason to give an application this permission. Legitimate exceptions include typing or note taking applications, quick-dial type applications and possibly social networking apps. Some might require your contact information to help make suggestions to you as you type. Typical applications that require this permission include: social networking apps, typing/note taking apps, SMS replacement apps, contact management apps.See also WRITE_CALENDAR.
dangCONTACTSGET_ACCOUNTSFind accounts on the device. Android , . , . , , .find accounts on the deviceGet accountsFind accounts on the deviceAllows access to the list of accounts in the Accounts Service.Applications that require some type of authentication from accounts that are «connected» to the
device. A list of the accounts are ususally displayed so you can choose the account to use with the application. To really use those credentials, the USE_CREDENTIALS permission is required.An evil app could use this permission to spy on you (what are you using?).
dangLOCATIONACCESS_FINE_LOCATIONPrecise location (GPS and network-based)GPS, Wi-Fi .access precise location (GPS and network-based)( GPS)Fine locationGPSGPSAllows an app to access precise location from location sources such as GPS, cell towers, and Wi-Fi.This permission can be used by applications that display location based ads by publishers like Admob (Google). It is also used by applications that want your exact location. Examples would be Navigation applications, «Check-In» apps like 4square.
dangLOCATIONACCESS_COARSE_LOCATIONApproximate location (network-based)Wi-Fi .access approximate location (network-based)( )Coarse locationAccess approximate location (network-based)( )Allows an app to access approximate location derived from network location sources such as cell towers and Wi-Fi.This permission is usually used by applications that display location based ads by publishers like Admob (Google).
dangMICROPHONERECORD_AUDIORecord audiorecord audioRecord audiorecord audioAllows an application to record audio.While this permission is not typically dangerous, it is a potential tool for eavesdropping. However recording audio has legitimate uses such as note taking apps or voice search apps. As a side note recording audio is typically a significant drain on the battery.Bad Cop: In conjunction with the INTERNET permission, this could be used to eavesdrop on the user.
dangPHONEREAD_PHONE_STATERead phone status and identity, : IMEI, SIM ID, , .read phone status and identityRead phone stateRead phone status and identityAllows read only access to phone state.This permission gives access to your device's identifiers (IMEI/IMSI, SIM ID, voice mailbox number, your phone number and, if a call is in progress, the remote number. It‘s not necessarily required for things like call state (whether a call is in progress/pending), network operator, or the network provider used – according to the app permission.READ_PHONE_STATE (no longer listed on Google Play), which shows what this permission is needed for (and what not); also see here.This permission is automatically granted to apps targeted at Android 1.6 or before.
dangPHONEREAD_PHONE_NUMBERSAllows read access to the device's phone number (s).– READ_PHONE_STATE. (). .----read phone numbersAllows read access to the device's phone number (s). This is a subset of the capabilities granted by READ_PHONE_STATE but is exposed to instant applications.As it's named a subset of READ_PHONE_STATE, the numbers accessed are the ones belonging to you, i.e. assigned to your SIM card (and not your contacts list).
dangPHONECALL_PHONEDirectly call phone numbers. , , “”.directly call phone numbersMake a phone callsdirectly call phone numbersAllows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed.This permission is of high importance. This could let an application call a 1-900 number and charge you money. However, this is not as common a way to cheat people in today's world as it used to be. Legitimate applications that use this include: Google Voice and Google Maps.Another important point to note here is that any app can launch the phone screen and pre-fill a number for you. However, in order to make the call, you would need to press «Send» or «Call» yourself. The difference with this permission is that an app could make the entire process automatic and hidden.
dangPHONEANSWER_PHONE_CALLSAllows the app to answer an incoming phone call.. .????answer phone callsAllows the app to automatically answer an incoming phone call, i.e. without user interaction. This is a runtime permission, so no app does get it granted automatically.
dangPHONEADD_VOICEMAILAdd Voicemail.add voicemailAdd voicemailadd voicemailAllows the app to add messages to your voicemail inbox.
dangPHONEUSE_SIPMake/receive Internet callsSIP .----make/receive SIP callsSIPUse SIP for internet telephony.
dangSENSORSBODY_SENSORSbody sensors (like heart rate monitors). , , , .------Allows the app to access data from sensors you use to measure what's happening inside your body, such as heart rate.
dangSMSSEND_SMSSend SMS messagesSMS . , “view” (), ,Send and view SMS messagesSMS-Write SMS/Send SMSSMSsend and view SMS messagesSMS-Allows an application to send SMS messages.This could let an application send an SMS on your behalf, and much like the phone call permission, it could cost you money by sending SMS to for-pay numbers. Certain SMS numbers work much like 1-900 numbers and automatically charge your phone company money when you send them an SMS.
dangSMSRECEIVE_SMSReceive text messages (SMS)MMS . MMS , .receive text messages (SMS)SMS-Receive SMSSMSreceive text messages (SMS)SMS-Allows an application to monitor incoming SMS messages, to record or perform processing on them.This permission is mostly a privacy concern. Any app that can read your SMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply «SMS replacment» apps (such as Handcent) and would naturally need this permission to function. Other apps sometimes use this as a way of sending a special code to you device. This can be used by a paid app by sending a code to unlock the full version of an app. Or, this can be used by security apps to listen for a special shutdown codes in case your phone is stolen.More details on this permission can be found a.o. in this post on StackExchange.
dangSMSREAD_SMSRead your text messages (SMS or MMS)SMS MMS.read your text messages (SMS or MMS)SMS MMSRead SMSSMSRead your text messages (SMS or MMS)SMS MMSAllows an application to read SMS messages.This permission is mostly a privacy concern. Any app that can read your SMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply «SMS replacment» apps (such as Handcent) and would naturally need this permission to function. Other apps sometimes use this as a way of sending a special code to you device. This can be used by a paid app by sending a code to unlock the full version of an app. Or, this can be used
by security apps to listen for a special shutdown codes in case your phone is stolen.Check the app permission.READ_SMS to see what information can be obtained with this permission.
dangSMSRECEIVE_WAP_PUSHReceive text messages (WAP)MMS WAP. , MMS------Allows an application to monitor incoming WAP push messages.Sending and receiving MMS is based on WAP. The information that there‘s a MMS message available for download, is sent as WAP Push to the device.
dangSMSRECEIVE_MMSReceive text messages (MMS)MMS . MMS , .receive text messages (MMS)MMS-Receive SMS ( PG, MMS)SMS ( PG, MMS)receive text messages (MMS)MMS-Allows an application to monitor incoming MMS messages, to record or perform processing on them.This permission is mostly a privacy concern. Any app that can read your MMS messages could gather a lot of information about you. However there are quite a few legitimate reasons an app may request this. Some apps are simply «SMS/MMS replacment» apps (such as Handcent) and would naturally need this permission to function.See also RECEIVE_SMS.
dangSTORAGEREAD_EXTERNAL_STORAGERead the contents of your usb storage. USB , SD , SD .read the contents of your SD cardSD-Read external storageread the contents of your SD cardSD-Allows an application to read from external storage. This permission was granted to all apps by default up to Android 4.3. This changed with Android 4.4 (API level 19), which now requires that applications explicitly request read access using this permission. If an application already requests write access, it will automatically get read access as well.Good/Bad Cop: An MP3 player of course should have access to your music files stored there – but along with that, it could also access all other data stored on the card. Which means, you should never store sensible data (unencrypted) on your SDCard.
dangSTORAGEWRITE_EXTERNAL_STORAGEModify or delete the contents of your USB storage. USB , SD , SD .modify or delete the contents of your SD cardSD-Write to external storageModify or delete the contents of your SD cardSD-Allows an application to write to external storage.This will allow applications to read, write, and delete anything stored on your phone's SD card. This includes pictures, videos, mp3s, documents and even data written to your SD card by other applications. However, there are many legitimate uses for this permission. Many people want their applications to store data on the SD card, and any application that stores information on the SD card will need this permission unless they restrict themselves to their app specific directory provided by the system. Applications that typically need this permission include (but are not limited to) camera applications, audio/video applications, document applications.Warning: Any app targeting Android 1.5 or below (possibly 1.6 as well) will be granted this permission BY DEFAULT and you may not even be warned about it. It is important to pay attention to what version of Android an app is targeting to know if this permission is being granted. You can see this on the Market website in the right hand column.
sign-BIND_ACCESSIBILITY_SERVICEBind to an Accessibility Service-------Allows the holder to bind to the top-level interface of an accessibility service. Must be required by an AccessibilityService, to ensure that only the system can bind to it.
sign-BIND_AUTOFILL_SERVICE---------
sign-BIND_CARRIER_SERVICES---------
sign-BIND_CHOOSER_TARGET_SERVICE---------
sign-BIND_CONDITION_PROVIDER_SERVICE---------
sign-BIND_DEVICE_ADMINInteract with device admin-------Allows the holder to send intents to a device administrator. Must be required by device administration receiver, to ensure that only the system can interact with it.For further details, also see: What permissions are granted to an app with device administration privileges?
sign-BIND_DREAM_SERVICE---------
sign-BIND_INCALL_SERVICE---------
sign-BIND_INPUT_METHODBind to an Input Method-------Allows the holder to bind to the top-level interface of an input method. Must be required by an InputMethodService, to ensure that only the system can bind to it.
sign-BIND_MIDI_DEVICE_SERVICE---------
sign-BIND_NFC_SERVICEBind NFC Service-------Must be required by a HostApduService or OffHostApduService to ensure that only the system can bind to it.
sign-BIND_NOTIFICATION_LISTENER_SERVICEBind Notification Listener Service-------Must be required by an NotificationListenerService, to ensure that only the system can bind to it.
sign-BIND_PRINT_SERVICEBind Print Service-------Must be required by a PrintService, to ensure that only the system can bind to it.
sign-BIND_SCREENING_SERVICE---------
sign-BIND_TELECOM_CONNECTION_SERVICE---------
sign-BIND_TEXT_SERVICEBind to a Text Service-------Allows the holder to bind to the top-level interface of a text service (e.g. SpellCheckerService). Must be required by a TextService to ensure that only the system can bind to it.
sign-BIND_TV_INPUT---------
sign-BIND_VISUAL_VOICEMAIL_SERVICE---------
sign-BIND_VOICE_INTERACTION---------
sign-BIND_VPN_SERVICEBind to a VPN service-------Allows the holder to bind to the top-level interface of a Vpn service. Must be required by a VpnService, to ensure that only the system can bind to it.
sign-BIND_VR_LISTENER_SERVICE---------
sign-BIND_WALLPAPERBind to wallpaper-------Allows the holder to bind to the top-level interface of wallpaper. Must be required by a WallpaperService, to ensure that only the system can bind to it.
sign-CLEAR_APP_CACHEDelete all app cache data-------Allows an application to clear the caches of all installed applications on the device.This permission is of low importance. It allows an app to clear the cache of apps on the phone or tablet. The cache is a place that an app stores recently used data for faster access. Clearing the cache can sometimes (very rarely) fix bugs related to those files. Clearing these files generally presents no risk other than
to slow the performance of the phone or tablet (as apps will need to re-create the caches when used).
sign-MANAGE_DOCUMENTSManage Documents-------Allows an application to manage access to documents, usually as part of a document picker.
sign-READ_VOICEMAIL---------
sign-REQUEST_INSTALL_PACKAGESAllows an application to request installing packages.. , .Install unknown apps Apps & notifications→Advanced→App permissions→→--request install packageAllows an application to request installing packages. Apps targeting APIs greater than 25 (Android 7/Nougat) must hold this permission in order to use ACTION_INSTALL_PACKAGE. As this action launches the application installer, the user should be asked to confirm each install.
sign-SYSTEM_ALERT_WINDOWDraw over other apps. Pictire-in-Picture, Android .Display over other appsDraw on topThis app can appear on top of other appsAllows an application to open windows using the type TYPE_SYSTEM_ALERT, shown on top of all other applications.This permission allows an app to show a «popup» window above all other apps, even if the app is not in the foreground. A malicious developer/advertiser could use it to show very obnoxious advertising. Almost no apps should require this permission unless they are part of the Android operating system. An example of a system alert would be the alert you are shown when your phone or tablet is out of battery and is about to shut down.Also see: Android.SE «Drawing over other apps»
sign-WRITE_SETTINGSModify system settings.Modify system settingsmodify system settingsmodify system settingsAllows an application to read or write the system settings.Global settings are pretty much anything you would find under Android's main 'settings' window. However, a lot of these settings may be perfectly reasonable for an application to change. Typical applications that use this include: volume control widgets, notification widgets, settings widgets, Wi-Fi utilities, or GPS utilities. Most apps needing this permission will fall under the «widget» or «utility» categories/types.
sign-WRITE_VOICEMAIL---------
AppsOpsX-READ_CLIPBOARDRead clipboard. Android 10 Q----Read clipboard?
AppsOpsX-WRITE_CLIPBOARDModify clipboard. Android 10 Q----Modify clipboard?
?PACKAGE_USAGE_STATSUpdate component usage statistics. PG.Usage access ( )( )Get usage statsPACKAGE_USAGE_STATSPACKAGE_USAGE_STATSAllows the modification of collected component usage statistics. Not for use by normal applications.Most likely refers to app statistics, e.g. how often an app was started.


[203], [205] ,[207], [209] .

, :

ACCESS_WIFI_STATE — View Wi-Fi connections
CHANGE_WIFI_STATE — Connect and disconnect Wi-Fi
INTERNET — Full network access — Android ( LOS) AFWall+
RECEIVE_BOOT_COMPLETED-Run at startup — , , 100% (, , Orbot, AFWall+,AdAway )
READ_PHONE_STATE — Read phone status and identity — . , .

WAKE_LOCK-Prevent device from sleeping — , .

READ_CLIPBOARD-Read clipboard — «» . .

RECEIVE_MMS — . Android ( LOS). MMS .

Dangerous () , .

, . .


«» — , :

  1. . XprivacyLua, , , . . , .
  2. , , , .
  3. Android, , [211], [213]

    ,
    - 2015-2016 Xiaomi . . , , «» . «», - ( «» «», ). - . . , , ! ( MIUI ), . . IT -20, (, , )!!! , . — , . - . , — .

    , . , - — .


, Android 10 Q ( Android 5,6,7,8,9).[215]
  1. proc/net. . GrapheneOS, Pixel 3a, Pixel 3a XL, Pixel 3 Pixel 3 XL.
  2. Scoped storage [217] — «» . , , , . :
    ) level API = 28 ( Android 9), .

    ) - [219] 1- 2020 .
  3. ACCESS_BACKGROUND_LOCATION [221] — , . - 2020 , .
  4. - - [223]. , . Android 10 Q.
  5. , EMEI, Wi-Fi MAC, . Android 10 Q, .
  6. ID , Wi-Fi Bluetooth .
  7. . . , , / , ( AppOpsX) , / .
  8. .

. Android 6 7, . Android , - , , .

Level API/sdk


Google Android - , - , - , - . Android Level API.[225]
Android - , . — Scoped storage. Android 10 Q Level API=29. , , Android 10 Q Android 10 Q . - Level API=28, Android 10 Q . SD-, (, , ). , , , ! Level API ?: Google Play Android Level API , API. Google - .

, Android, Level API .

Level API «apps_Packages Info
(com.oF2pks.applicationsinfo)»[227]. , Level API ( SDK) .

Level API/SDK Google Play .


«» Telegram . , telegram , , . , alex0ff [229] 2014 .

F-Droid [231].

( ) — :

  • data/data. , Android , «» SD . , , SD . ( Samsung, ). , - . 3 . . (, ).
  • sdcard ( , ) Android/data
    ( sdcard/Android/data/org.telegram.messenger)
    ) / (Telegram-) , .

    ) ( , )!!!
  • sdcard ( Android/data). , sdcard «Telegram». , ( , ).

:

) sdcard/Telegram. . . . [211], [213]. , — . Facebook proc/net IP ( ). , Facebook ( WhatsApp Instagram) ? .

) . ( ) sdcard/Android/data/org.telegram.messenger!!! . data/data/org.telegram.messenger, ? .

, , , :
, Telegram WhatsApp. , ( , WhatsApp ). WhatsApp 99%-, . .

, Telegram WhatsApp. ( ).

. , . Conversations AdAway.

. ( ) WhatsApp-[233]. — WhatsApp. , WhatsApp, WhatsApp- ( ), WhatsApp-, .

, , , .

, WhatsApp iPhone.

SD-card/usb-storage


, SD-, SD (). «usb-storage». SD SD (, ). Android sdcard . SD , - , SD ( — ), SD . , SD .

[69].

(Work profile) Shelter (net.typeblog.shelter)


Android , « ». , — . , , . «» , Shelter (net.typeblog.shelter) F-Droid.

«Install unknown apps ( )» Device admin apps ( ). , . , open source ( Island).

, , 5 . ( Android) . .

LOS 14, 15.1 16 .

?

—
—
—

() :

— proc/net — IP .
— IMEI
— .

, , , . , EMEI. , , (Wi-Fi ) .

. Accounts () . «Work profile settings ( )» «Contact search ( )»
Shelter , .

Shelter:

  • VPN . VPN — , VPN VPN , VPN. VPN .
  • ( , ) . , .
  • .

:

1) AdAway — AdAway , .

2) AFWall+ — AFWall+ , . — AFWall , . , .

AFWall+ «Dual apps Support/ »

3) PrivacyGuard — , PG. PG - . Advanced () .

4) AppOpsX — «Users ()», «Work profile».
, AppOpsX.

5) Orbot VPN — , Orbot — Tor Orbot- Tor.

, — «RECEIVE_BOOT_COMPLETED Run at startup»

, VPN/Tor.

, , IP proc/net.

XprivacyLua


XprivacyLua — Xposed.

, «» . Android, ( [235]).

XprivacyLua signature spoofing, , , , - .

XprivacyLua proc/net.

XprivacyLua Android, .

ADB (Android Debug Bridge)


ADB [237], [239]
, adb LOS, .

, - «» , adb [241] (, ADB Run, VirusTotal . , ). , , . Facebook — :). Google Play «/» , - ADB, . 4pda .

PG AppOpsX, adb. . [243]. revoke — .

ADB, ADB, , .

Google LOS


, LOS Google (Gapps), , Google. , LOS / Google /[245]. , LOS 14, 15.1 16. ( ).

DNS


DNS — Google DNS. , DNS 8.8.8.8

Google , IP. , .

Android Wi-Fi DNS . DNS Google-. Orbot ( AFWall+) — , DNS Google. , dnsleaktest.com[59].

LOS 16 DNS , DNS, DoT — DNS over TLS. .[247]. DoT DoH ( IP). «» Google-.

LOS Android DoT Google, Cloudflare (1.1.1.1). — Cloudflare , , . Cloudflare. ( ).

Settings > Network & internet > Advanced > Private DNS «Off», DNS .

DNS — . Orbot DNS IP , IP Tor.

Captive Portal


Captive Portal — . Captive Portal, . «https://captiveportal.kuketz.de».

A-GPS


A-GPS — A-GPS . — IMEI!!! , Google . A-GPS . GPS ( AFWall+) . . , Android ( ), A-GPS.

AOSP Webview


AOSP Webview — LOS AOSP Webview. Chromium. . . , 4-5 Webview. Webview . — K-9 Mail.

AOSP Webview Google . AdAway — AOSP Webview K-9 Mail Google.

AOSP Webview Bromite Webview[97], .

AOSP Webview , 1- : WebView , WebView. DuckDuckGo [249] Google[251].

Project Fi


Project Fi — Google LOS . , [245]. . , , , , LOS.

Backup ()


- , . TWRP — [253],[255].

:

— ( LOS 15.1 LOS 16)
— firmware
— ,
— ,
— ( Nextcloud), , .

— , ( ). , , , «» .

, . , LOS 15.1 LOS 16, LOS . , .

, — .

, TWRP , . ( ADB), .


, (, ) , EDS Lite (com.sovworks.edslite) . , Android. , , .


, - ? !

  • , , Replicant (backdoor/) Samsung .[257],[259].

    . Replicant, Android . . ( ), - — . .
  • «». , (GSM, 3G, LTE) . (, ). , .[261] , . , , , , . . - Mail.ru .
  • «» . Wi-Fi[263]. , - -. — Firmware ( LOS) LOS ( ).

, Wi-Fi GSM ( ) USB . . , ( , ).


Replicant


Android 6, LOS 13[265],[267]. , . , Android 6 ( Replicant Android 4.2)

GrapheneOS


( ) Android. (, proc/net). Pixel 3a, Pixel 3a XL, Pixel 3 and Pixel 3 XL[269]. (AdAway ). Gapps, . GrapheneOS Android 10 Q. - Pixel 3a, .

Android


Librem 5 — Linux[271], [273]. . — , Wi-Fi (). , (700$). , .

Ubuntu touch — , ( Ubuntu Phone[275]). ( ) . [277]. , , .

iPhone?


, Apple , Google, Siri, :

  • Apple «», . Apple Uber “” , Uber, ( ).[279]
    [281]. , Uber , «» Apple .

    , Apple, «, ».

    , «», .
  • 2 «» [283] . .
  • Siri «» [285]. ( ) - «Apple Siri», . : ) Apple ) , «» . — iPhone , - « », 100 - « ». - « *, , , , . , , Apple »? .
  • , iOS 13 ( ):
    ) [287]. .

    ) SSID BSSID Wi-Fi, [289].
  • Jailbreak (- ), , [291]. , . , . - .
  • , jailbreak- ( ).[293]. iOS , . Apple, .
  • iPhone . , .

. — Apple , ( ) .




— . Google Apple ( ) . — Android 10 Q . , .

Linux (PureOS, Ubuntu Touch).

( ). 150$ , 5 400$.



- - «» . Librem 5 Linux, ARM, Arm Holdings. Arm Holdings , [295]. , . - ( RISC-V), - .

. , ( ) .

— Google , , . Android Android-AOSP[297]. Android Miracast ( Chromecast), QUIC, DoT, DoH, DNS . , Android 11. , Google Fuchsia[299] Google (, Chromium ). Android . Google: Chrome, Google [301].

— . Huawei . Xiaomi , 3 . Xiaomi , . Nokia . Samsung .

, LOS.


- [303] — , , « ». , , , .

— .

— , [305].

— F-Droid. F-Droid.

— . , , , ( , ).

— - , ( Uber).

— Gapps .

— Magisk . — , .

— .

— , . , LOS. Huawei , Huawei - ( 3 ). , . , 2 . !!! , — 1000 , LOS — , , , LOS Android . , , . , — «» — . — - ?

LOS


— ( ) LOS. Android One. , LOS , LOS Android. Android 10 Q , , LOS 17 ( Android 10 Q). , LOS 15.1, LOS 16, - LOS 17 ( Android 10 Q).


, Ivi, Gapps. 10 — ( ). 70% , , «». Orbot , - .

F-Droid, :

1) . , . . — Gapps . - — , . /.

2) . F-Droid OSM (Openstreetmaps), , . , . — OSM . , — . : Google - (, ). Mapbox ( OSM), Google , , , Mapbox. OSM Mapbox — , Google . , , . №2 — [307]. Google . — ( «» ). — , , . . , OSM. , OSM , . . OSM — , . . .

, OSM. , , , .

, , , , , , . ?

—


, . — . — .

: , … ( ).

: , , . -, 70% LOS, Android iPhone ( WhatsApp). , LOS , Android . . , . .

: (), , … ( )
: . LOS ( , ).

: , .

: -, . -: ? , «» — , , , , . , , . « — .» , .

: , , « »? , .

: . , . , . , - ( , F-Droid). , , . 100% — . 95%, 15%.

: () . . . , , .

: . , . . « ?», « WhatsApp-e» , . , . . .

, , . . — , « ».

: Tor , , 6 . .

: — , . . , . , . , — / i2p, zeronet, yggdrasil /. , .

: Tor ? ?
: . , 2 2,2 . , Tor . Tor . Tor , DDOS . . — - ( Tor ). -, , «» . - — . 2 — .

: .

: - , . - , . — . . . , - LOS, — . . . , — , . - — . F-Droid. Fennec uBlockOrigin . LOS. - 4-5 . — , «» . , . Google . , ( , , ). . - ( «» ), ( ) .

: Google «» Android. LOS.

: «» . , Facebook (, , IP ) «» SwiftKey ( ), «». . . , xakep.ru .

: ?
: . , . . , , . ( ). , — .

()


. . , ( [309]).

  • — .

    . Privacy Guard. . .

    . F-Droid (, — AnySoftKeyboard, — QKSMS, — Open Camera, , — Fennec+Tor browser, K-9 Mail, VLC ). , .

    , - LOS — . , 4pda xda-developers ( ). reddit.com, [311].

    Shelter ( )
    — AdAway, AppOpsX, AFWall+.

    root — NetGuard. AFWall+, F-Droid AdAway ( hosts)[313]. , NetGuard VPN, NetGuard VPN. Orbot+ Tor browser .
  • , Google ( Gapps LOS) — LOS , 1 . , . .

    ( ) Gapps — 1-2 .


, :

1) (, Orbot ). ? Android 9 - ? SuperFreezZ (superfreeze.tool.android)?
2) , SIM ( Defcon 21). SIM ?
3) - ? - ?

UPD: [241] ADB Run. ! VirusTotal. , . CryptoParanoia .


[1] ru.wikipedia.org/wiki/LineageOS
[3] lineageos.org
[4] source.android.com/setup/start/licenses
[5] download.lineageos.org
[7] www.reddit.com/r/LineageOS
[9] forum.xda-developers.com/lineage
[11] 4pda.ru/forum/index.php?act=search
[13] docs.google.com/spreadsheets/d/1swcOWw_KcSaE8otSa-1rthq7bLLmfsNZMWnVF5XCd1o
[15] piotr-yuxuan.imtqy.com/choose-a-new-phone
[17] anton-z-s.imtqy.com/linext/#
[19] stats.lineageos.org
[21] www.lineageoslog.com/statistics
[23] texnoera.com/kak-razblokirovat-zagruzchik-na-xiaomi
[25] wiki.lineageos.org/devices/santoni/install
[27] wiki.lineageos.org/adb_fastboot_guide.html
[29] androidp1.ru/ustanovshhik-adb-na-kompyuter
[31] dl.google.com/android/repository/platform-tools-latest-windows.zip
[33] wiki.lineageos.org/gapps.html
[35] lineageos.org/Summer-Survey-2-Results
[37] microg.org
[39] lineage.microg.org
[41] download.lineageos.org/extras
[43] f-droid.org
[45] f-droid.org/en/packages/dev.ukanth.ufirewall
[47] f-droid.org/en/packages/org.adaway
[49] f-droid.org/en/packages/com.zzzmode.appopsx
[51] guardianproject.info/releases
[53] guardianproject.info/releases/Orbot-16.0.5-RC-2-tor-0.3.4.9-fullperm-universal-release.apk
[55] f-droid.org/en/packages/com.moez.QKSMS
[57] f-droid.org/en/packages/de.shandschuh.slightbackup
[59] dnsleaktest.com
[60] www.privateinternetaccess.com/pages/whats-my-ip
[61] reports.exodus-privacy.eu.org/en
[63] f-droid.org/en/packages/org.eu.exodus_privacy.exodusprivacy
[65] f-droid.org/en/packages/com.oF2pks.classyshark3xodus
[67] expandedramblings.com/index.php/android-statistics
[69] developer.android.com/about/dashboards
[71] habr.com/ru/company/solarsecurity/blog/427431
[73] www.iguides.ru/main/security/khotite_maksimalno_zashchititsya_ot_khakerov_zablokiruyte_sim_kartu_pin_kodom
[75] developer.android.com/reference/android/Manifest.permission.html#GET_ACCOUNTS
[77] source.android.com/devices/tech/ota/ab
[79] github.com/fgl27/isu
[81] forum.xda-developers.com/android/apps-games/isu-simple-app-to-deactivate-activate-t3478348
[83] www.reddit.com/r/LineageOS/comments/a4rlox/requesting_a_good_explanation_on_why_magisk_is_bad
[85] f-droid.org/ru/docs/Anti-Features
[87] f-droid.org/en/packages/com.mdroid
[89] f-droid.org/en/packages/org.gdroid.gdroid
[91] f-droid.org/docs/Reproducible_Builds/?title=Deterministic,_Reproducible_Builds
[93] fdroid.bromite.org/fdroid/repo?fingerprint=E1EE5CD076D7B0DC84CB2B45FB78B86DF2EB39A3B6C56BA3DC292A5E0C3B9504
[95] github.com/bromite/bromite
[97] github.com/bromite/bromite/wiki/Installing-SystemWebView
[99] microg.org/fdroid/repo?fingerprint=9BD06727E62796C0130EB6DAB39B73157451582CBD138E86C468ACC395D14165
[101] microg.org/fdroid.html
[103] apt.izzysoft.de/fdroid/repo?fingerprint=3BF0D6ABFEAE2F401707B6D966BE743BF0EEE49C2561B9BA39073711F628937A
[105] android.izzysoft.de/repo/info
[107] android.izzysoft.de/articles/named/list-of-fdroid-repos
[109] forum.f-droid.org/t/known-repositories/721
[111] f-droid.org/wiki/page/Known_Repositories
[113] habr.com/ru/post/440280
[115] f-droid.org/en/packages/com.anysoftkeyboard.languagepack.russian2
[117] f-droid.org/en/packages/com.amaze.filemanager
[119] f-droid.org/en/packages/com.github.axet.filemanager
[121] f-droid.org/en/packages/com.artifex.mupdf.viewer.app
[123] f-droid.org/en/packages/com.artifex.mupdf.mini.app
[125] f-droid.org/en/packages/de.cryptobitch.muelli.barcodegen
[127] f-droid.org/en/packages/com.google.zxing.client.android
[129] f-droid.org/en/packages/de.t_dankworth.secscanqr
[131] f-droid.org/en/packages/org.secuso.privacyfriendlynetmonitor
[133] f-droid.org/en/packages/org.videolan.vlc
[135] f-droid.org/en/packages/ru.playsoftware.j2meloader
[137] f-droid.org/en/packages/com.simplemobiletools.calendar.pro
[139] f-droid.org/en/packages/info.zamojski.soft.towercollector
[141] www.reddit.com/r/fdroid
[143] ru.wikipedia.org/wiki/Iptables
[145] github.com/ukanth/afwall/issues/957
[147] github.com/ukanth/afwall/issues/940
[149] www.reddit.com/r/LineageOS/comments/c0y6o4/adaway_on_ab_devices
[151] www.reddit.com/r/LineageOS/comments/clhy1y/i_cannot_edit_the_hosts_file_even_with_root_access
[153] www.reddit.com/r/LineageOS/comments/ca810c/edit_hosts_file
[155] github.com/AdAway/AdAway/wiki/ProblematicApps
[157] www.reddit.com/r/androidapps/comments/92yv38/which_lists_do_you_use_on_adaway
[159] github.com/AdAway/AdAway/wiki/HostsSources
[161] 4pda.ru/forum/index.php?showtopic=275091&st=4580#entry62522395
[163] gitlab.com/Jorgu81/hosts/raw/master/HostsGoogle
[165] developer.android.com/preview/privacy/data-identifiers#proc-net-filesystem
[166] www.kuketz-blog.de/android-erlaubt-apps-vollen-zugriff-auf-die-netzwerkaktivitaet
[167] www.deviceinfo.me
[169] roskomsvoboda.org/48296
[171] hacks.mozilla.org/2018/11/firefox-sync-privacy
[173] www.reddit.com/r/privacy/comments/81w6tb/for_the_paranoids_install_your_own_firefox_sync
[175] ru.wikipedia.org/wiki/Google_Cloud_Messaging
[177] github.com/opengapps/opengapps/wiki/Package-Comparison
[179] www.reddit.com/r/LineageOS/comments/8p4169/what_is_lineages_position_on_signature_spoofing/e088xyh
[181] prototypefund.de/project/microg
[183] reports.exodus-privacy.eu.org/en/reports/85066
[185] reports.exodus-privacy.eu.org/en/reports/91964
[187] reports.exodus-privacy.eu.org/en/reports/85068
[189] www.facebook.com/about/privacy/update
[191] developer.android.com/guide/topics/permissions/overview#normal_permissions
[193] developer.android.com/guide/topics/permissions/defining
[195] www.reddit.com/r/LineageOS/comments/9oss72/willshould_privacy_guard_be_removed_from_los_or
[197] www.reddit.com/r/LineageOS/comments/9oss72/willshould_privacy_guard_be_removed_from_los_or/e7x97bo
[199] www.reddit.com/r/LineageOS/comments/6o30uk/locking_google_play_services_in_privacy_guard
[201] www.reddit.com/r/LineageOS/comments/7m9023/difference_between_application_permissions_and
[203] android.izzysoft.de/applists/perms
[205] www.wandera.com/mobile-security/app-and-data-leaks/app-permissions
[207] stackoverflow.com/questions/21227367/when-is-bluetooth-admin-android-permission-required
[209] stackoverflow.com/questions/3490913/what-is-a-sticky-broadcast
[211] www.iguides.ru/main/security/bolee_1000_prilozheniy_dlya_android_sobirayut_lichnye_dannye_polzovateley_bez_ikh_soglasiya
[213] www.ftc.gov/system/files/documents/public_events/1415032/privacycon2019_serge_egelman.pdf
[215] developer.android.com/preview/privacy/checklist
[217] developer.android.com/preview/privacy/scoped-storage
[219] developer.android.com/reference/android/R.attr.html#requestLegacyExternalStorage
[221] developer.android.com/preview/privacy/device-location
[223] developer.android.com/preview/privacy/background-activity-starts
[225] ru.wikipedia.org/wiki/__Android
[227] f-droid.org/en/packages/com.oF2pks.applicationsinfo
[229] habr.com/ru/post/240521
[231] github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/master/README.md
[233] habr.com/ru/news/t/451810
[235] github.com/M66B/XprivacyLua/blob/master/XPRIVACY.md
[237] developer.android.com/studio/command-line/adb
[239] 4pda.ru/forum/index.php?showtopic=383300
[241] androidp1.ru/kak-udalit-vstroennoe-prilozhenie-android-bez-root-prav
[243] github.com/TilesOrganization/support/wiki/How-to-use-ADB-to-grant-permissions
[245] www.reddit.com/r/LineageOS/comments/cl5c90/degoogling_lineageos_instructions_august_2019
[247] en.wikipedia.org/wiki/Public_recursive_name_server
[249] github.com/duckduckgo/Android/issues/315
[251] bugs.chromium.org/p/chromium/issues/detail?id=960720
[253] android-example.ru/useful-articles/kak-sdelat-backup-twrp
[255] androidp1.ru/sozdanie-rezervnoy-kopii-v-twrp-i-vosstanovlenie-android
[257] androidp1.ru/bekdor-v-smartfonah-samsung-galaxy
[259] www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor
[261] www.devever.net/~hl/nosecuresmartphone
[263] rebeltech.ru/uyazvimosti-v-drayverakh-k-wifi-chipam-broadcom-pozv
[265] ru.wikipedia.org/wiki/Replicant
[267] www.replicant.us/supported-devices.php
[269] grapheneos.org
[271] en.wikipedia.org/wiki/Librem#Librem_5_smartphone
[273] en.wikipedia.org/wiki/PureOS
[275] en.wikipedia.org/wiki/Ubuntu_Touch
[277] ubports.com/devices/promoted-devices
[279] vc.ru/27180-apple-razreshila-uber-sledit-za-ekranom-polzovateley-iphone-v-fonovom-rezhime
[281] appleinsider.ru/ios/uber-otslezhivaet-vas-dazhe-posle-zaversheniya-poezdki.html
[283] habr.com/ru/news/t/465629
[285] habr.com/ru/news/t/465447
[287] thenextweb.com/privacy/2019/08/07/apple-will-limit-voip-background-data-collection-from-whatsapp-snapchat-et-al-in-ios-13
[289] developer.apple.com/videos/play/wwdc2019/712
[291] www.ferra.ru/news/mobile/apple-sluchaino-vosstanovila-staryi-sposob-vzloma-iphone-28-08-2019.htm
[293] habr.com/ru/news/t/464473
[295] habr.com/ru/news/t/455704
[297] www.reddit.com/r/fossdroid/comments/c332yr/what_impedes_google_from_moving_other_aosp_apis/erozilc
[299] ru.wikipedia.org/wiki/Google_Fuchsia
[301] habr.com/ru/news/t/454468
[303] habr.com/ru/post/452610
[305] habr.com/ru/news/t/463557
[307] www.kommersant.ru/doc/3280622
[309] habr.com/ru/post/452610/#anchor24
[311] www.reddit.com/r/LineageOS/comments/a1u528/due_to_the_removal_of_30_devices_i_have_decided
[313] github.com/M66B/NetGuard/blob/master/ADBLOCKING.md

Source: https://habr.com/ru/post/zh-CN465945/

More articles:


All Articles