[Replicant] CyanogenMod privacy

[Max Mehl]

Hi dimonik,

very interesting findings. I try to evaluate the DNS stuff you found as
best as I can.

# dimonik, dimonik <dimonik at letiko.com> [06.01.2015 @ 21:42]:
> I was curious and put first connection traffic through Wireshark,
> and saw this DNS requests made by device:
>
> 2.android.pool.ntp.org <http://2.android.pool.ntp.org>

NTP time server with which the phone seems to sync. Normally it should
be sufficient to sync the time with your mobile connection provider.
Maybe from GSP or the Camera (with GPS tagging function), see below.

> clients3.google.com <http://clients3.google.com>

According to Torproject this could be when connecting to a Wifi access
point [1]. They also show how to deactivate this (besides other very
useful things).
Another possibility is Google analytics, see below.

> gllto.glpals.com <http://gllto.glpals.com>

Probably GPS or Camera's GPS function, as some seaches in the Cyanogen
source code state. I'm not developer enough to track his down to a
specific app.

> download.cyanogenmod.org <http://download.cyanogenmod.org>

If you use the stock Cyanogenmod without freecyngn [2], your phone has a
Cyanogenmod account. This provides some functions like remote search and
delete phone. With freecyngn, you can safely remove the account and some
other stuff like the Analytics.


Maybe you also want to have a look at Nikos's tutorial how to free your
Cyanogenmod phone [3]. For example, how to remove the automatic
connection to Google's DNS.

Hope this helps.


Best regards,
Max


[1]
https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy
[2] https://github.com/mar-v-in/freecyngn
[3] http://www.roussos.cc/2014/05/08/free-your-android/

-- 
Max Mehl - Free Software Foundation Europe - www.fsfe.org
About me: http://fsfe.org/about/mehl | Blog: blog.mehl.mx
Support us:  http://fsfe.org/support | Homepage:  mehl.mx

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://lists.osuosl.org/pipermail/replicant/attachments/20150106/2c242410/attachment-0001.asc>