HackaApp mobile apps security testing service - Testing

Hi, guys, I've launched security testing service (hackapp.com) for mobile apps, which can download and analyse (static) app right from store (iTunes or Play). It can be useful for security-concerned developers, information security officers and bughunters.
Mission is to create security testing tool, which
- Informs developer about actual problems and fixes, without huge mind blowing listings and traces
- Doesn't require any maintaining environment on developers side
- Can be simply added into development cycle, like "Yet another testing tool"
Current version performs static analysis and identifies critical and suspicious information in bundle:
- Certificates and keys
- Authentication secrets
- License Control
- Compilation flaws, and other.
Known Bugs:
- It can't download paid apps
- It can't download apps restricted for regions (iTunes)
- It can't download apps restricted for devices (Play)
I hope you'll find it usefull and I'm counting on your feedback
You can read more about it hackapp.com/about or in blog blog.hackapp.com

Related

TeamSpeak Systems [Europe]: Senior Android Developer

NOTE: European residency required as you will be working with our Germany-based dev team. English fluency required. German fluency is ideal but not required.
HOURS: Full time preferred, part time will also be considered.
JOB DESCRIPTION:
We are looking for an experienced Android developer to create a mobile version of our popular, cross-platform client which is primarily used for voice chat (VoIP). You will have the opportunity to look at sample code for an already existing version of this mobile app (former developer code) which utilizes a client lib for most of its operational, non-GUI features. Our intent, however, is for you to recreate this app with a more polished GUI look and feel, in addition to adding numerous missing features which will bring the app up to par with its iOS counterpart.
RESPONSIBILITIES:
- Review and understand our existing Windows/Mac/Linux client-server voice chat product, how it operates, and what sorts of features and functionality our existing users will expect for its Android version.
- Work with our development team to determine initial set of requirements, and contribute ideas for improving the Android app's usability and overall user experience.
- Write clean, modular code to implement the desired requirements with little supervision, and submit periodically to dev team for review via subversion.
- Engage in primary, core testing of the app although our development team will also conduct some testing and report bugs/issues back to you as well.
- Work with our support team to document and fix bugs with reasonable turnaround. You will need to setup, manage, and maintain your own bug-tracking software (eg - Mantis or similar). Our support team will require access to this system and assist in reporting bugs and issues for you to work on.
REQUIREMENTS:
- You must reside in Europe since you will be working with our Germany-based dev team.
- At least 4 years in mobile development experience, with 2 years in-depth experience in Android development.
- Demonstrated track record for developing and releasing Android applications. You will be asked for sample work and code.
- Strong understanding of Android OS, developing in ADS, interactive application development paradigms, memory management, network programming, audio playback and microphone hardware integration, concurrency and multi-threading.
DESIRED QUALITIES:
- Strong interpersonal and communication skills.
- Ability to work within a small collaborative team and have a great passion in producing quality products.
- Demonstrated experience in working with others to solve challenging technical problems related to performance and usability.
- Self-starter with the ability to assess and resolve complex technical problems.
COMPENSATION:
You will be compensated as follows:
- A fixed, one-time fee to be paid in 3 parts.
Part 1 to be paid once the developer agreement is signed.
Part 2 to be paid once the initial, documented and agreed upon set of requirements has been completed.
Part 3 to be paid upon release of the Android app to the public.
- Ongoing percentage-based rev share based on actual (net) income received from app sales.
- Details to be negotiated and determined prior to hire.
Applicants should apply by submitting their resume or inquiry to the Business Development department via TeamSpeak’s ticket system at
http://support.teamspeakusa.com
Thank you for your time and consideration.

Skotkonung Ltd. [UK]: Mobile App Developers

Job Title:
Mobile App Developer
Job purpose:
We are looking for a mobile app developer to design, develop and maintain Android and iPhone apps. The developer will manage the entire app lifecycle right from concept stage until delivery and post launch support. Apps will be mainly content based and integrated closely with the web sites. In addition to delivering the product the successful candidate will be heavily involved in driving the mobile strategy forward.
Reporting line:
Managing Director.
About us:
We have just established a new company in the UK (Registered in Dec-2011) and we are looking for an enthusiastic app developer to join our team.
We would be keen to hear from:
• candidates looking to complete an apprenticeship during their work with us; or
• those looking for part-time work and would like flexibility around working hours; or
• self-employed candidates looking to share their time with other projects.
Location:
Theale in Berkshire, UK.
Special Requirements:
We may require the candidates to provide references and/or undergo security clearance prior to formal contact issuing.
Main tasks and responsibilities:
• Working closely with database/web server developer leading the other platform development.
• Deliver across the entire app life cycle –concept, design, build, deploy, test, release to app stores and support.
• Working with database/web server and directors to conceptualise, build, test and realise products.
• Gather requirements around functionality and translate those requirements into elegant functional solutions.
• Build prototypes at tech scoping stage of projects.
• Working along the web developers to create and maintain a robust framework to support the apps.
• Create compelling device specific user interfaces and experiences by building the interface with focus on usability features.
• Standardising the platform and in some cases apps to deliver across multiple brands with minimal duplication of effort.
• Optimising performance for the apps.
• Keep up to date on the latest industry trends in the mobile technologies.
• Explain technologies and solutions to technical and non-technical stakeholders.
Person specification:
Desirable:
• Proven commercial software development experience – desktop and mobile
• Published examples of mobile applications on the App store or the Android market
• Excellent knowledge in information architecture, human computer interaction and usability design principles
• A track record of delivering successful consumer and or business products
Essential:
• Ability to use analytic data and user testing to inform design decision
• A passion for new consumer technology and the emerging media landscape
• Ability to multi task and good time management skills
• Ability to work on their own and as a part of the team
• Excellent scoping and estimation skills
• Excellent testing/ QA skills
• Excellent communication skills (verbal and written) to liaise with various stakeholders.
Examples of skills required:
iOS –
• Strong OO design and programming skills in Objective-C
• Familiar with iOS SDK (UIKit, Cocoa Touch, Core Data, Core Location, etc)
• Familiar with xcode
Android –
• Strong OO design and programming skills in Java (J2EE/ J2ME)
• Familiar with the Android SDK
• Knowledge of SQLite, MySQL or similar database management system
• Familiar with Eclipse
Common -
• Understanding of other compiled languages
• Experience on web service integration (SOAP, REST, JSON, XML)
• Experience of development using web technologies
• Good understanding of OO programming and design patterns
• Good understanding of HTML5, JavaScript, jQuery, Ajax and PHP
• Experience building web and native apps
• Experience using social media APIs
• Ads integration using a 3rd party ad server (DART)
• Using version control (e.g. SVN)
• Excellent debugging and optimisation skills
Desirable skills:
• LAMP development experience
• PHP frameworks (e.g. Zend)
• PHP template engines (e.g. Smarty)
• Creative design skills
• Working with a content management system
• Working in a media/ publishing environment
Competencies for success:
• Creativity
• Learning on the Fly
• Technical Learning
• Action Orientated
• Dealing with Ambiguity
• Presentation Skills
• Peer Relationships
• Time Management
• Written Communications
•Problem Solving
To apply for this position, please email your CV, a covering letter stating your salary expectations and example of published work to [email protected]. No calls or canvassing please.

[SDK] Promocodes for your app

Hello!
I'm software developer from Russia, and made one very popular app in local market. Very soon I realized that I need an ability to give licensed version of app for my friends or reviewers or someone else.
Unfortunately AppHub doesn't provide such functionality(private distribution is pain in ass), so I created a webservice for myself.
After two days I realized that it may be useful for other developers, so here it is:
promo.g33k.ru (here I wanted to post url, but I can't due to low post count. You may find it in my profile->interests)
Now it has:
- JSON/SDK with RSA1024/SHA1 sign for additional security checks
- Binary SDK available
- Russian localization(if anyone cares ) (btw, if you can help translating to other language(s) or correct english misspellings - i will appreciate this).
Now this service works in beta mode.
So for developers I have two questions:
1) Is such service useful for you?
2) How to develop it further, in which way?
Not yet clear
I am sorry, but after reading your post and also checking your website I am still not sure what you offer. For me there is just not enough information to understand and then judge the usefulness of your service.
Maybe you could give a step-by-step scenario: Dev does this, then interested user does that, dev then this ...
Ok, I'll try to describe a little more details:
1) Developer wants to add capability of promo codes in his app(to give some specific users full licensed app).
The first problem is that developer need his own server for checking of promo code validity(hardcoding is not an option, of course).
2) So, Developer registers in my service, add his app's guid to his app list and create a promo code for specific app via web.
3) Developer adds support for promo codes in his app by:
a) adding an text box for user to enter promode
b) adding a web request to specific URL for promocode activation
c) adding to his license check web request for checking is current user activated a promo code.
Benefits for developer:
- Add support for promo codes without owning a server.
- Simple way to give full version of program to friends
Benefits for users:
- User may found promo code for specific app somewhere and use it to get full version of app in simple manner.
Benefits for reviewers/portals:
- Developers can easily give promo code for reviewing purpose or as giveaway for news post.
Clear now
Thanks for the additional info, now it's clear
Well yes, sounds useful. Properly implemented is probably really easier than Microsoft's "closed beta" mechanism, and of course can be used for other, non-beta apps as well.
The icing on the cake would be a "frame application" as sample code that basically does nothing more than asking for a promo code and then check against the list of valid codes on your server.
Sounds intresting but how do you ensure security?
chabun, I thought about security and situation is same as with default checking for trial - there is no security Man-in-the-Middle and direct cracking of xap will work, and there is no way out. I could use RSA signing for MitM, but still cracking of xap is very easy option today, so no one really interested will try to use MitM. When WP8 SDK will be out(I believe it will be in several weeks) - some developers may implement trial checks in native code - this will be much harder to crack.
As for server part there are following possible problems
- App's ID squatting(same as domain, someone else could reserve developer's app's guid). Don't know yet what to do with this, may be think about it later when this happens?
- Promocode's for App ID bruteforce - could be easily avoided via server throttling, if this ever happens - i'll add such checks
- Server DDoS - every webmaster's nightmare, I hope this never happens(or my Amazon AWS will pour my purse empty
rbrunner7, nice idea, I'll add a sample app as soon as possible on site.
This looks like an interesting concept
Sent from my SGH-i917 using XDA Windows Phone 7 App
Yop, you can never avoid direct cracking... However, RSA signing would be good I'd say as it will avoid MitM - with MitM you could create simple tools which can be used by every noob outhere. Cracking xaps requires some skill and it will need an unlocked WP7 as well.
I can see this working i have been thinking about something similar also. You can encrypt the data on device before sending it off to the cloud, you can than verify the encrypted data with a password and compare it to the codes registered on the server. Than link a code to a certain device id (once the code becomes 'registered') if a certain code is already coupled to a deice id and the device is not the same than the app will jump back into trial mode. Otherwise one can use the paid mode.
This can defenetly work and will prevent reselling th codes. Although it requires a server. And users can still hack/patch the app ofcourse but that will require an unlocked device so I should not worry to much about it.
Also to prevent spoofing you can frequently check with the server if this device is legitetmately registered.
Marvin_S said:
I can see this working i have been thinking about something similar also. You can encrypt the data on device before sending it off to the cloud, you can than verify the encrypted data with a password and compare it to the codes registered on the server. Than link a code to a certain device id (once the code becomes 'registered') if a certain code is already coupled to a deice id and the device is not the same than the app will jump back into trial mode. Otherwise one can use the paid mode.
This can defenetly work and will prevent reselling th codes. Although it requires a server. And users can still hack/patch the app ofcourse but that will require an unlocked device so I should not worry to much about it.
Also to prevent spoofing you can frequently check with the server if this device is legitetmately registered.
Click to expand...
Click to collapse
That's what I thought of... private/public key
chabun, so, for example, how about following scenario:
for each developer server creates public/private key pair.
when checking license on server: if success server encodes userid with developer private key
when checking license in app: server response decoding via public key(hardcoded in app) and comparing to userId. if ok -> licensed.
You might want to ask @ngreader guys on twitter. They do have this concept implemented in their app.
diverofdark said:
chabun, so, for example, how about following scenario:
for each developer server creates public/private key pair.
when checking license on server: if success server encodes userid with developer private key
when checking license in app: server response decoding via public key(hardcoded in app) and comparing to userId. if ok -> licensed.
Click to expand...
Click to collapse
I'm not sure if it would be good to encode the request to the server as well but otherwise it sounds really cool now... I'll use this service when I need this (and tell my friends about it)
Here is one way to do it http://stackoverflow.com/questions/599837/how-to-generate-and-validate-a-software-license-key
wpxbox said:
Here is one way to do it http://stackoverflow.com/questions/599837/how-to-generate-and-validate-a-software-license-key
Click to expand...
Click to collapse
Well, what they suggest is not as good as diverofdark's service which is a lot more secure and still easy to use for the customers...
Greetings everyone!
Today I updated promo.g33k.ru, now it has:
- more detailed about page,
- SDK now includes RSA1024/SHA1 sign for additional security checks
- Binary SDK available
- Russian localization(if anyone cares ) (btw, if you can help translating to other language(s) or correct english misspellings - i will appreciate this).
- Many minor bugfixes.
So, from now this service works in beta mode
diverofdark said:
Greetings everyone!
Today I updated promo.g33k.ru, now it has:
- more detailed about page,
- SDK now includes RSA1024/SHA1 sign for additional security checks
- Binary SDK available
- Russian localization(if anyone cares ) (btw, if you can help translating to other language(s) or correct english misspellings - i will appreciate this).
- Many minor bugfixes.
So, from now this service works in beta mode
Click to expand...
Click to collapse
Thanks! I will check this out
Hey diverofdark
It would be nice if you update the first post in the thread with all information. That's the way it's usually done in the forum.
A possible user (here dev ) can read it and without having to browse the whole thread, he can use your promocode service...
Thanks for mentioning it, I updated the first post.

Testing Methodology

Hi,
I'm new to (app) development, just wondering but is there a standard methodology when it comes to testing apps? I have finished my first app but aside from using heavily I'm not sure how to structure a test.
Thanks in advance for any pointers.
What exactly do you mean with testing? They are different types of testing:
1.) Unit Tests - When you write a function you should better write a unit test (e.g. with JUnit) - but this is for all type of code, not only for apps
2.) Automated Tests - You can build automated tests with e.g. Selenium Appium (you can google it and fit tutorials)
3.) Alpha & Beta-Tests by users - The Google Play Store allows to publish APKs to Alpha & Beta-Tests where you can specify which users should be able to download & test the App. This allows you to share your APK with other people before making it available for all
There are different tools/approach followed by software provider for testing mobile apps based on their types like Native apps,Mobile web apps and Hybrid apps .
Any testing method you consider will have pros and cons associated with it, and you will come to know that there is not a single testing approach to completely satisfy. Therefore, you can consider such qa services that combines different testing options as a whole and provide the best overall results.
The types of testing that can be performed on mobile app are:
usability testing
compatibility testing
performance testing
security testing etc.
- Mobile Emulators can be used for mobile testing.
-For unit testing on iOS, tools like Kiwi and OCMock can be useful.
-For Android, tools like JUnit with Mockito, Robolectric etc are available.
Almost every software testing company now a days offers different mobile app testing services and also provide help through their blogs, whitepapers, news letters etc.

[ROM][FP4][A13] iodéOS = LineageOS 20 + MicroG + adblocker [04/04/2023]

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Introduction
iodéOS is a privacy-focused operating system powered by LineageOS and based on the Android mobile platform. iodéOS aims at protecting the user's privacy with a built-in adblocker and by freeing the smartphone from snitches.
The objectives in the conception of this ROM are threefold:
To keep the stability and security level of LineageOS, by minimizing the modifications made to the system. Apart the system modifications required by the adblocker, we mainly only added a few useful options commonly found in other custom ROMs, made some cosmetic changes, modified a few default settings to prevent data leaks to Google servers.
To ease a quick adoption of this ROM by new users. We especially target users that are concerned by the protection of their privacy, but are not reluctant to still use inquisitive apps like Google ones. We thus included MicroG as well as a coherent set of default apps (all open source, with one exception), and simplified the initial setup of the system. Particularly, an initialization of MicroG has been made with GCM notifications allowed by default, a privacy-friendly network location provider (DéjàVu) pre-selected, as well as Nominatim Geocoder.
To provide a new and powerful way of blocking ads, malwares, data leaks of all kinds to many intrusive servers. We are developing an analyzer, tightly integrated into the system, that captures all DNS requests and network traffic, as well as a user interface (the iodé app). Compared to some other well-known adblockers, this has the advantages of:
Avoiding to lock the VPN for that use. You can even use another adblocker that uses VPN technology alongside our blocker.
Being independent of the kind of DNS server used by the system or set by an independent app: classical DNS on UDP port 53 or any other one, DNS over TLS (DoT), DNS over HTTPS (DoH), ..., as we capture the DNS requests before they are transmitted to the system function that emits the DNS request. What we do not support, is DoH when it is natively built into applications, i.e. when an app communicates directly with a DoH server, without asking name resolution to the system. It would require to decrypt HTTPS packets between such an app and the DoH server, which may create a big security hole.
Precisely mapping DNS requests and network packets to the Android apps that emitted (or received) them.
Deciding which apps have a filtered network usage (by default, all apps), and which ones can communicate with blacklisted servers.
Since its first versions, we added many features to the iodé blocker: several levels of protection, fine-grained control over the hosts that should be blocked or authorized, displaying statistics on a map to see the quantity of data exchanged to which countries, clearing statistics... We are actively developing the blocker, and new functionalities will be regularly added.
Features
Changes in LineageOS to prevent data leaks:
Default DNS server: Google's DNS replaced by Quad9's 'unblocked' servers in all parts of the system.
A-GPS: patches to avoid leaking personnal information like IMSI to supl server.
Captive portal login: connectivitycheck.gstatic.com replaced by captiveportal.kuketz.de for connectivity check.
Dialer: Google default option replaced by OpenStreetMap for phone number lookup.
Pre-installed apps:
We included many useful default apps, but our choice cannot suit everyone; so we added the possibility to remove them. It can be done at the end of the phone setup, or at any time by going to Parameters -> Apps & Notifications -> Preinstalled apps.
MicroG core apps: GmsCore, GsfProxy, FakeStore.
NLP backends for MicroG : DejaVuNLPBackend (default), MozillaNLPBackend, AppleNLPBackend, RadioCellsNLPBackend, Nominatim Geocoder.
App stores : FDroid (with F-Droid Privileged Extension) and Aurora Store.
Browser: our own fork of Firefox (with Qwant as default search engine, many other ones added, telemetry disabled, parts of telemetry code removed) instead of Lineage’s default browser Jelly.
SMS: QKSMS instead of Lineage's default SMS app.
Email: p≡p (Pretty Easy Privacy).
Camera: our own fork of Open Camera, with a few tweaks.
Maps/navigation: Magic Earth GPS & Navigation (the only one free but not open source).
Keyboard: OpenBoard instead of AOSP keyboard.
PDF: Pdf Viewer Plus.
Personnal notes: Carnet.
{Ad/Malware/Data leak}-blocker: iodé.
News: to keep users informed about our developments, as well as a FAQ.
Meteo: Geometric Weather.
Pre-included FDroid repository:
The apps that we tweak or develop (microG services, the browser based on Firefox, the News app, Open Camera ...) are available through a repository that we included in FDroid (check the "Apps for iodéOS" category). For this purpose and to avoid name conflicts of some apps, we also had to make a few changes in FDroid.
Useful options from other custom ROMs:
Smart charging (disables charging when a given level is reached, to protect battery health).
Fingerprint vibration toggle.
Swipe down to clear all in recent apps (Android 10 only).
Installation Instructions
To download and flash our latest build, see https://gitlab.com/iode/ota.
You can also find here direct links to the latest builds.
Supported devices
Fairphone FP3/FP3+
Fairphone FP4
Google Pixel 3
Google Pixel 4
Google Pixel 5
Google Pixel 6
Google Pixel 6a
OnePlus 9
OnePlus 9 Pro
Samsung Galaxy A5/A7 2017 (a5j17lte/a7j17lte)
Samsung Galaxy S9/S9+ (starlte/star2lte)
Samsung Galaxy Note 9 (crownlte)
Samsung S10e/S10/S10+ (beyond{0,1,2}lte)
Samsung Note 10 (d1)
Samsung Note 10+ (d2s)
Sony Xperia XA2 (pioneer)
Sony Xperia XZ1 (poplar)
Sony Xperia XZ2 (akari)
Sony Xperia XZ3 (akatsuki)
Xiaomi Mi9 (cepheus)
Teracube 2e
Xiaomi Mi 10T 5G / Mi 10T Pro 5G
Xiaomi Mi 10 Lite 5G
Sources
iodéOS: https://gitlab.com/iode/os
LineageOS: https://github.com/lineageos
device tree: https://gitlab.com/iode/os/public/devices/fairphone/device_fairphone_FP4
kernel: https://github.com/WeAreFairphone/android_kernel_fairphone_sm7225
Bug Reporting
You can post a message in this thread or (preferred) open an issue here.
Credits
LineageOS is a free, community built, aftermarket firmware distribution of android, which is designed to increase performance and reliability over stock android for your device.
All the source code for LineageOS is available in the LineageOS Github repo. If you would like to contribute to LineageOS, please visit their Wiki for more details.
This ROM would be nothing without the tremendous work made on MicroG, and all the other open source apps that we included. We are very grateful to their authors.
Contributors
Direct contributors: @iodeOS, @vince31fr
Indirect contributors (too numerous to list): All the people that contributed to the device tree, to LineageOS, and to the included open source apps.
Sponsoring
You can help in the development of this ROM by paying us a coffee here: https://paypal.me/iodeOS.
Screenshots
Downloads :
iodéOS
04/04/2023 (build 20230401):
Installation procedure: move to a fastboot script (read instructions: https://gitlab.com/iode/ota)
Blocker: improved use of blocking lists (sub-domains blocking)
FDroid: fixes an issue on apps update
LineageOS synchronized with March security patch included
All apps updated
07/02/2023 (build 20230131):
Upgrade to iodéOS 4.0 based on Android 13 / LineageOS 20
Blocker:
Improved blocking settings. You can now choose 'Standard' blocking (ads, trackers, malwares, etc) or 'Reinforced' blocking (same objective but more extensive), and then select additional categories.
The 'Porn' category has been extended to a wider 'Sensitive content' one, that also includes fake news, gambling, drugs, piracy, torrent..., with mainly child protection in mind.
The 'Extreme' category has been removed, as it is now part of the reinforced blocking.
Improved blocking lists. We merge several acknowledged and up-to-date sources, and have diversified our sources to produce more complete lists. The standard list has however been reduced a bit, to avoid as much as possible interference with apps expected behavior.
Added a new network location provider: Local NLP Backend. It is an improved version of the DéjàVu NLP backend which was already available in iodéOS. Like DéjàVu, it builds a local database connecting localizations learned from other NLP backends and apps using GPS, and mobile antennas/Wifi; but also has an active mode (not preselected) that can trigger GPS requests. To configure it: Settings -> System -> microG -> Location modules
LineageOS synchronized with January security patch included
All apps updated
New devices support: Pixel 3, 6, 6a
16/12/2022 (build 20221215):
Blocker: added multiple selection in settings / domain customization. Long-press on a domain, select several domains or all, apply actions (block all, authorize all...)
PdfViewerPlus: improved security by updating core libraries
Network settings: added a switch to disable connectivity check (and thus captive portal detection)
LineageOS synchronized with December security patch included
All apps updated
New devices support: Pixel 4 & 5, OnePlus 9 & 9 Pro
24/11/2022 (build 20221121):
The wide-angle lens now operates with the preinstalled camera app (OpenCamera)
Improvements in the blocker user interface (iodé app)
LineageOS synced with September security patch included
All apps updated
17/10/2022 (build 20221014):
Blocker:
Network blockings following their type (Wifi, mobile data, VPN) added
Default blockings definition for new apps
Personnalized recipients management improved
iodé's app access restrictions by password added
Search filters added in report and map
Display theme selection
Automatic and 'real-time' refresh of the whole app
Performance and fluidity improvements of the app
LineageOS synced with September security patch included
All apps updated
27/07/2022 (build 20220726):
SafetyNet certification activated: allows many apps, notably banking ones, to fully work
Setup wizard: the push notifications configuration page now also activates SafetyNet (fine-grained control in Settings->System->microG)
OpenCamera: the 'Use alternative flash method' in photo settings is no more necessary and can be disabled, allowing flash optimization
News app: German translations
LineageOS synced with July security patch included
All apps updated
21/07/2022 (build 20220530):
Upgrade to Android 12 / LineageOS 19.1
Setup Wizard: new page to configure push notifications through microG
Lockscreen settings: switch added to disable fingerprint unlock when screen is off
Improved German translations
Bug fixes and improvements
LineageOS synced with May security patch included
All apps updated
02/05/2022 (build 20220407):
News app reworked
Setup Wizard: new iodé introduction
iodé blocker: pull to refresh replaced by automatic refresh in report tab
Teracube 2e 2022 batch released, video playback in browser and video recording fixed
Music app : playlist crash fixed
Open Camera : crash when tapping thumbnail of a newly recorded video fixed, photos and videos now editable
LineageOS synced with March security patch
All apps updated
02/02/2022 (build 20220126): initial publicly available build of iodéOS for FP4.
Add-ons
recovery-fp4-permissive.img: as the recovery we include in the rom is securized and does not allow flashing a package not signed by us, here is a more permissive recovery that allows flashing anything. It can be started in bootloader mode, by running 'fastboot boot recovery-fp4-permissive.img'.
Hi @vince31fr and thank you for this good news.
I just install your Os, what is the difference between your privacy tool and a trackerControl or Netguard app ?
Is there a way to block all by default on your privacy tool and allow one by one ? (i used to do that with tracker Control on /e/ os).
Thanks.
vince31fr said:
Introduction
iodéOS is a privacy-focused operating system powered by LineageOS and based on the Android mobile platform. iodéOS aims at protecting the user's privacy with a built-in adblocker and by freeing the smartphone from snitches.
The objectives in the conception of this ROM are threefold:
To keep the stability and security level of LineageOS, by minimizing the modifications made to the system. Apart the system modifications required by the adblocker, we mainly only added a few useful options commonly found in other custom ROMs, made some cosmetic changes, modified a few default settings to prevent data leaks to Google servers.
To ease a quick adoption of this ROM by new users. We especially target users that are concerned by the protection of their privacy, but are not reluctant to still use inquisitive apps like Google ones. We thus included MicroG as well as a coherent set of default apps (all open source, with one exception), and simplified the initial setup of the system. Particularly, an initialization of MicroG has been made with GCM notifications allowed by default, a privacy-friendly network location provider (DéjàVu) pre-selected, as well as Nominatim Geocoder.
To provide a new and powerful way of blocking ads, malwares, data leaks of all kinds to many intrusive servers. We are developing an analyzer, tightly integrated into the system, that captures all DNS requests and network traffic, as well as a user interface (the iodé app). Compared to some other well-known adblockers, this has the advantages of:
Avoiding to lock the VPN for that use. You can even use another adblocker that uses VPN technology alongside our blocker.
Being independent of the kind of DNS server used by the system or set by an independent app: classical DNS on UDP port 53 or any other one, DNS over TLS (DoT), DNS over HTTPS (DoH), ..., as we capture the DNS requests before they are transmitted to the system function that emits the DNS request. What we do not support, is DoH when it is natively built into applications, i.e. when an app communicates directly with a DoH server, without asking name resolution to the system. It would require to decrypt HTTPS packets between such an app and the DoH server, which may create a big security hole.
Precisely mapping DNS requests and network packets to the Android apps that emitted (or received) them.
Deciding which apps have a filtered network usage (by default, all apps), and which ones can communicate with blacklisted servers.
Since its first versions, we added many features to the iodé blocker: several levels of protection, fine-grained control over the hosts that should be blocked or authorized, displaying statistics on a map to see the quantity of data exchanged to which countries, clearing statistics... We are actively developing the blocker, and new functionalities will be regularly added.
Features
Changes in LineageOS to prevent data leaks:
Default DNS server: Google's DNS replaced by Quad9's 'unblocked' servers in all parts of the system.
A-GPS: patches to avoid leaking personnal information like IMSI to supl server.
Captive portal login: connectivitycheck.gstatic.com replaced by captiveportal.kuketz.de for connectivity check.
Dialer: Google default option replaced by OpenStreetMap for phone number lookup.
Pre-installed apps:
We included many useful default apps, but our choice cannot suit everyone; so we added the possibility to remove them. It can be done at the end of the phone setup, or at any time by going to Parameters -> Apps & Notifications -> Preinstalled apps.
MicroG core apps: GmsCore, GsfProxy, FakeStore.
NLP backends for MicroG : DejaVuNLPBackend (default), MozillaNLPBackend, AppleNLPBackend, RadioCellsNLPBackend, Nominatim Geocoder.
App stores : FDroid (with F-Droid Privileged Extension) and Aurora Store.
Browser: our own fork of Firefox (with Qwant as default search engine, many other ones added, telemetry disabled, parts of telemetry code removed) instead of Lineage’s default browser Jelly.
SMS: QKSMS instead of Lineage's default SMS app.
Email: p≡p (Pretty Easy Privacy).
Camera: our own fork of Open Camera, with a few tweaks.
Maps/navigation: Magic Earth GPS & Navigation (the only one free but not open source).
Keyboard: OpenBoard instead of AOSP keyboard.
PDF: Pdf Viewer Plus.
Personnal notes: Carnet.
{Ad/Malware/Data leak}-blocker: iodé.
News: to keep users informed about our developments, as well as a FAQ.
Meteo: Geometric Weather.
Pre-included FDroid repository:
The apps that we tweak or develop (microG services, the browser based on Firefox, the News app, Open Camera ...) are available through a repository that we included in FDroid (check the "Apps for iodéOS" category). For this purpose and to avoid name conflicts of some apps, we also had to make a few changes in FDroid.
Useful options from other custom ROMs:
Smart charging (disables charging when a given level is reached, to protect battery health).
Fingerprint vibration toggle.
Swipe down to clear all in recent apps (Android 10 only).
Installation Instructions
To download and flash our latest build, see https://gitlab.com/iode/ota.
You can also find here direct links to the latest builds.
Supported devices
Teracube 2e
Fairphone FP3/FP3+
Fairphone FP4
Samsung Galaxy A5/A7 2017 (a5j17lte/a7j17lte)
Samsung Galaxy S9/S9+ (starlte/star2lte)
Samsung Galaxy Note 9 (crownlte)
Samsung S10e/S10/S10+ (beyond{0,1,2}lte)
Samsung Note 10 (d1)
Samsung Note 10+ (d2s)
Sony Xperia XA2 (pioneer)
Sony Xperia XZ1 (poplar)
Sony Xperia XZ2 (akari)
Sony Xperia XZ3 (akatsuki)
Xiaomi Mi9 (cepheus)
Xiaomi Mi 10T 5G / Mi 10T Pro 5G
Xiaomi Mi 10 Lite 5G
Sources
iodéOS: https://gitlab.com/iode/os
LineageOS: https://github.com/lineageos
device tree: https://gitlab.com/iode/os/devices/fairphone/device_fairphone_FP4
kernel: https://github.com/WeAreFairphone/android_kernel_fairphone_sm7225
Bug Reporting
You can post a message in this thread or (preferred) open an issue here.
Credits
LineageOS is a free, community built, aftermarket firmware distribution of android, which is designed to increase performance and reliability over stock android for your device.
All the source code for LineageOS is available in the LineageOS Github repo. If you would like to contribute to LineageOS, please visit their Wiki for more details.
This ROM would be nothing without the tremendous work made on MicroG, and all the other open source apps that we included. We are very grateful to their authors.
Contributors
Direct contributors: @iodeOS, @vince31fr
Indirect contributors (too numerous to list): All the people that contributed to the device tree, to LineageOS, and to the included open source apps.
Sponsoring
You can help in the development of this ROM by paying us a coffee here: https://paypal.me/iodeOS.
Screenshots
Click to expand...
Click to collapse
Very nice MOD, it is stable and fast... it has high compatibility with Open Camera and the store inside IodeOS I liked it a lot.
A944684 said:
Hi @vince31fr and thank you for this good news.
I just install your Os, what is the difference between your privacy tool and a trackerControl or Netguard app ?
Is there a way to block all by default on your privacy tool and allow one by one ? (i used to do that with tracker Control on /e/ os).
Thanks.
Click to expand...
Click to collapse
One of the main difference is that the VPN connection is not used by the iodé blocker, so you can use any external VPN provider you want. We also provide the wireguard kernel module.
Another difference is that it is integrated into the system, so there's no need to root the phone for that purpose.
By default, all blacklisted hosts are blocked. You can then have a fine-grained control over the hosts you want to block/unblock.
vince31fr said:
One of the main difference is that the VPN connection is not used by the iodé blocker, so you can use any external VPN provider you want. We also provide the wireguard kernel module.
Another difference is that it is integrated into the system, so there's no need to root the phone for that purpose.
By default, all blacklisted hosts are blocked. You can then have a fine-grained control over the hosts you want to block/unblock.
Click to expand...
Click to collapse
EDIT : Ok i have found my answers and opened a issue ticket for ungoogled chromium.
@vince31fr
I am using this for almost two weeks now, everything works great. Thank you a lot.
But I would like to pass SafetyNet, might there be official support for this in the future?
And what would be the best/easiest way for me to get it working? Do I need to root the device to install microg droidguard or are there any other ways?
vince31fr said:
fpcamera-magisk-v1.zip: Original Fairphone camera as a Magisk module. This won't necessarily be maintained...
Click to expand...
Click to collapse
Thank you for this Magisk module. However, the ultrawide camera does not work as intended: I can see the picture from this lens, but the camera does not take or save pictures. After I press the shutter button, nothing happens.
TheVelvetFog said:
Thank you for this Magisk module. However, the ultrawide camera does not work as intended: I can see the picture from this lens, but the camera does not take or save pictures. After I press the shutter button, nothing happens.
Click to expand...
Click to collapse
There are some problems indeed. I removed the module, not usable yet.
Wolf2001 said:
@vince31fr
I am using this for almost two weeks now, everything works great. Thank you a lot.
But I would like to pass SafetyNet, might there be official support for this in the future?
And what would be the best/easiest way for me to get it working? Do I need to root the device to install microg droidguard or are there any other ways?
Click to expand...
Click to collapse
I did not concentrate on passing safetynet yet, maybe later. Don't hesitate to share your findings here if you find a working method ;-) There are some magisk modules that could be tried, ...
I didn't know iodé at all - until now... Wow, what a nice ROM! I really love the approach iodé is taking...
Thank you
Just a quick question: will there be OTA updates for this beta release?
I wanted to give the promising looking iodé a try but installation fails repeatedly with
Code:
E: Signature verifcation failed
E: error 21
Install from ADB completed with status 2.
Installation aborted.
I tried both the "permissive" recovery posted here earlier AND the iode-2.3-20220126-FP4-recovery.img from https://github.com/iodeOS/ota/releases/tag/v2-FP4
I also checked the SHA256s
In recovery, I went to "Apply update from ADB", then
Code:
adb sideload iode-2.3-20220126-FP4.zip
As expected, adb finishes sideload at 47%.
With no other recoveries or iodé builds available, I am currently at the end of the road. Do you have any ideas for me?
matoq said:
I wanted to give the promising looking iodé a try but installation fails repeatedly with
Code:
E: Signature verifcation failed
E: error 21
Install from ADB completed with status 2.
Installation aborted.
I tried both the "permissive" recovery posted here earlier AND the iode-2.3-20220126-FP4-recovery.img from https://github.com/iodeOS/ota/releases/tag/v2-FP4
I also checked the SHA256s
In recovery, I went to "Apply update from ADB", then
Code:
adb sideload iode-2.3-20220126-FP4.zip
As expected, adb finishes sideload at 47%.
With no other recoveries or iodé builds available, I am currently at the end of the road. Do you have any ideas for me?
View attachment 5546665
Click to expand...
Click to collapse
silly me ... on close inspection: I was in stock recovery. a PROPER REBOOT TO RECOVERY switched me into LOS recovery and the install went fine right away.
As weird of a question as this is (since I'm asking about GAPPS on an intentionally no-GAPPS ROM) is anyone able to get this ROM working with Android Auto using this method?
microG + Android Auto fully working
This is how you can use Android Auto with microG and connect your phone with your car. Prerequisites: Android 10+ Newest microG core (https://github.com/microg/GmsCore/releases) A custom recovery to flash a zip file Let's begin: For Android...
forum.xda-developers.com
I admittedly need this for daily driving and am worried about not being able to roll back to stock
Edit: Also, how's battery life compared to stock?
@vince31fr @iodeOS
Great work! I'm looking forward to try the ROM when my FP4 arrives later this week.
It appears that the link to the device tree is dead: https://gitlab.com/iode/os/devices/fairphone/device_fairphone_FP4
Can you push it to Gitlab or is it intentionally not published yet?
Maybe some of your improvements could also be helpful to create a native LineageOS rom for the FP4.
xblax said:
@vince31fr @iodeOS
Great work! I'm looking forward to try the ROM when my FP4 arrives later this week.
It appears that the link to the device tree is dead: https://gitlab.com/iode/os/devices/fairphone/device_fairphone_FP4
Can you push it to Gitlab or is it intentionally not published yet?
Maybe some of your improvements could also be helpful to create a native LineageOS rom for the FP4.
Click to expand...
Click to collapse
Effectively we forgot to make this repo public, thanks for pointing this out. We did not make substantial improvements to the original dt (http://github.com/WeAreFairphone/android_device_fairphone_FP4, based on https://gitlab.e.foundation/e/devices/android_device_fairphone_FP4), but LineageOS should build fine.
Is there or will there be an Android 12 version of this being released?
smallz2k said:
Is there or will there be an Android 12 version of this being released?
Click to expand...
Click to collapse
There's a beta version 3.0 available:
Release v1 · vincentvidal/iode_ota
Contribute to vincentvidal/iode_ota development by creating an account on GitHub.
github.com
Does somebody know how vendor patches will be provided?
I know from Samsung devices, it is not so easy.
*** New Update : 02/05/2022 ***
Available as OTA (see OP)​

Categories

Resources