3 ms·

I wouldn't trust Microsoft for privacy today. I think the "best" option for now would be an Android phone without Google services. And as a developer you don't

by jraph 8y ago

I wouldn't trust Microsoft for privacy today. I think the "best" option for now would be an Android phone without Google services. And as a developer you don't have to play to put your app in the F-Droid repository (you may want to donate though). In 2019, the Librem 5 will probably be a good (expensive?) option too.

twsted 8y ago
Yours is the "best" option to be able to tinker with your device, which is a laudable goal. It is not the best option for a secure device, for which some restrictions are necessary.
- jraph 8y ago
  You don't need root and developer options on such a device. If your device is well supported, you may have regular OTA updates with latest security patches (which is not always the case with stock Android by the way). Using only apps from F-Droid, I'm reasonably sure no app is doing something shady. Google is probably not spying on you as much as on a regular Android phone. No need for having a Google account to install apps, by the way. Depending on the device, SELinux policies can be enforced (and probably are on a well supported device). F-Droid requires enabling insecure sources but this is not a problem if you don't download random APKs from the Internet and on Oreo, it seems insecure sources are handled with a permission given per app. Insecure sources can be enabled in any regular Android device anyway. (edit: and actually, I think enabling insecure sources is not necessary if F-Droid Privileged Extension is flashed on the device (https://f-droid.org/en/packages/org.fdroid.fdroid.privileged.ota/ https://f-droid.org/en/packages/org.fdroid.fdroid.privileged...) I can't verify what are doing the numerous proprietary blobs all over the place, but this is true on any current Android phone so far (and this is my motivation to put "best" inside quotes actually). Why would this option not be secure enough compared to a regular Android phone? Sure you have to deal with an unlocked bootloader, but if someone gets physical access to the phone, they can unlock it anyway. They will not get access to the data since it is encrypted (it should, anyway!). (p.s. for posterity: I meant "pay", not "play" in my previous message)
  - deleted 8y ago
    [deleted]

by jraph 8y ago

twsted 8y ago

Yours is the "best" option to be able to tinker with your device, which is a laudable goal. It is not the best option for a secure device, for which some restrictions are necessary.

jraph 8y ago
You don't need root and developer options on such a device. If your device is well supported, you may have regular OTA updates with latest security patches (which is not always the case with stock Android by the way). Using only apps from F-Droid, I'm reasonably sure no app is doing something shady. Google is probably not spying on you as much as on a regular Android phone. No need for having a Google account to install apps, by the way. Depending on the device, SELinux policies can be enforced (and probably are on a well supported device). F-Droid requires enabling insecure sources but this is not a problem if you don't download random APKs from the Internet and on Oreo, it seems insecure sources are handled with a permission given per app. Insecure sources can be enabled in any regular Android device anyway. (edit: and actually, I think enabling insecure sources is not necessary if F-Droid Privileged Extension is flashed on the device (https://f-droid.org/en/packages/org.fdroid.fdroid.privileged.ota/ https://f-droid.org/en/packages/org.fdroid.fdroid.privileged...) I can't verify what are doing the numerous proprietary blobs all over the place, but this is true on any current Android phone so far (and this is my motivation to put "best" inside quotes actually). Why would this option not be secure enough compared to a regular Android phone? Sure you have to deal with an unlocked bootloader, but if someone gets physical access to the phone, they can unlock it anyway. They will not get access to the data since it is encrypted (it should, anyway!). (p.s. for posterity: I meant "pay", not "play" in my previous message)
- deleted 8y ago
  [deleted]