Related
Hello
The other day i surfed to google from my XDA exec.
mobile internet rocks!!
i was wondering how does google know that i surfed in from a pda, cause i think it sent me to
www.google.co.uk/pda
the web page probably detected your screen size and redirected you to a page that was more friendly to you PDA browser. i wish more sites would do this.
www.google.com/pda for us US residents.
LOL
Not the screen size but the type of your internet browser, in this case Pocket IE.
Correct--it's not the screen size.
Although a LOT of your information is sent over the wire, much more than most of us realize, your resolution information is unknown to most websites, unless you explicitly allow it to be given via some kind of an executable that transmits such information. An example would be an embedded ActiveX object in IE for Windows.
Back on topic, yes, your browser information is known, not only to Google, but to every other website you visit. Not only that, the website also knows where you came from (i.e. the http addy) and where you went when you left it. There's a whole bunch of information deemed to be private that we would rather keep to ourselves (such as our surfing habits) that's known to any website that installs a cookie (a common thing nowadays) on your computer.
This is also how Google knows where you are. For example, when I log on, Google send me to the local Saudi page at http://www.google.com.sa/ It knows this information by doing a reverse lookup on your IP address, and comparing it against known databases of geographically assigned IPs. Since IP addresses are assigned and tied to geographical locations, it's easy enough to do, although it's still very disconcerting to see.
Be careful folks, even your searching habits are being tracked by Google. I have nothing to hide, so I don't care, but many folks do. Witness the recent Federal inquiry into the searching habits of the users of major search engines. Yahoo and MSN gave up that information quickly enough but Google is resisting. I don't think it will be able to hold out for very long though.
Imagine...now the fact that you searched for p0rn on the 'net is well known to anyone in the know. Scary, isn't it?
This Privacy Newsbyte brought to you courtesy of XDA-Dev's online donation campaign. Donate or be left in the dust!
thanks monakh
so google can detect both my mobile ip address (is there such a thing?) and my browser, correct?
monakh said:
the website also knows where you came from (i.e. the http addy)
Click to expand...
Click to collapse
Correct, through the referrer...
monakh said:
and where you went when you left it.
Click to expand...
Click to collapse
Only if you click a link on the site itself, -and- it is handled via a special handler.
No information is sent to a website when you leave it through e.g. a bookmark in your browser, or by typing in a new URL.
Please correct me if I'm wrong
You are correct.
hey i mailed myself (google account) using my adsl modem and using the gprs/3g connection to check the header to see if i could spot an originating ip address
i found one common ip address
Received: by 10.xy.za.b with HTTP; Sat, 18 Feb 2006 05:34:45 -0800 (PST)
i guess this is the google server, correct?
is there any way to prise the originating ip address from an email
That's why there is a registry hack to set Pocket Internet Explorer works like Internet Explorer 6.0.
Tuningszocske said:
That's why there is a registry hack to set Pocket Internet Explorer works like Internet Explorer 6.0.
Click to expand...
Click to collapse
Not entirely... I mean, you could - of course. But it also means that many sites will fail to send you PDA-specific content - which, with most plans/top-ups, means heavy costs.
Identifying PIE as IE6 is more used for stupid websites who check whether the browser is IE6 or above, regardless of whether that is actually required by the site.
There's three parts, the compatibility bit ('(Default) = Mozilla/4.0'), the browser string ('Version = MSIE 6.0') and the platform ('Platform = Windows NT 5.0'). If you leave the last bit intact ('Platform = Windows CE'), then you should still be able to get into stupid sites, while having PDA-friendly sites send you the PDA content.
oh i had not thought about the popups
i guess we wont get(suffer) popups with mobile ie5?
i just posted to this bulletin board to check my ip address
from the pc it looks like this 82.1a.bcd.efg
and fro my cda it looks like 193.abc.def.ghi
That's fine because presumably your mobile device and your home PC are on different networks so they sport different IPs.
IPs are a dead giveaway. In many cases, your position can be 'somewhat' and primitively triangulated to within 5 square miles of where you are. This may not be necessarily true for mobile networks, but those networks know where you are at all times anyway. In fact, there is now regulation in the US that mandates all handset makers to manufacture hardware with GPS functionality built-in. Between the two and a half dozen GPS satellites and your cellular network, you can run but you can't hide
This is, of course, so emergency services can reach you in time of need (in case you are unable to make the call to 911/999).
Of course...
monakh said:
This is, of course, so emergency services can reach you in time of need (in case you are unable to make the call to 911/999).
Click to expand...
Click to collapse
off-topic...
Technically it's so they can find you if you do call 911/999/112/whathaveyou but are unable (due to injuries, or duress, etc.) to state your location.
Being able to find you at any time is an added perk but it needs court orders even if you have been reported and officially designated a "missing person". Getting such a court order can take many hours, being declared a missing person can take 24 hours up to 48 hours (depends on the country and exactly what reasons you have to believe the person in question is truely missing).
ZeBoxx said:
monakh said:
This is, of course, so emergency services can reach you in time of need (in case you are unable to make the call to 911/999).
Click to expand...
Click to collapse
off-topic...
Technically it's so they can find you if you do call 911/999/112/whathaveyou but are unable (due to injuries, or duress, etc.) to state your location.
Click to expand...
Click to collapse
Ahh yes, I stand corrected.
It's so we CAN make the call and are unable to state the location. That WOULD make sense. However, like you said, there are legal hurdles, although at least in the U.S., they are fewer and far between.
is there any ip address list out there which tells me which ip addresses are allocated to which country?
are ip addresses bunched like telephone numbers
e.g. +1 is north america
+3 and +4 is europe
+96 & +97 middle east
nope, that's not how they work
organisations can get an IP from their service provider, who get blocks from their service providers, who get bigger blocks from places like RIPE, who in turn get huge blocks from ARIN.
But if it's a specific IP you're interested in, try VisualRoute
Me and my buddies are doing an independent study at our university this winter. It will basically consist of designing and implementing an application for android phones. We have an idea, but will need to set up a server to store usernames and passwords. We are all computer science majors, but networking is not our strong point. What do y'all think is the best way to set this server up?
Thanks in advance
lighttpd with memcached .apk's for fast install delivery. 2 second cache (minimum) for server side stuff (such as service status or something)
These apps allow you to remotely access your phone from a web browser. However, they all run a web server on the phone, and I cannot connect to any of the over 3g (Verizon).
LazyDroid Web Desktop
Remote Desktop
Remote Web Desktop
I want to move the web server off phone, and (hopefully) onto private sites.google.com site. App Engine might be necessary, but I'm hoping this could be done solely in JS.
The hosting site would provide the UI, and interact with the phone using C2DM (the magic that powers Chrome2Phone, GMail, and installing apps from the web Market).
The UI is pretty obvious. It just needs a whiz to create HTML, Javascript, etc.
The C2DM backend is a still a bit mystifying to me... and searching for c2dm and javascript does not yield any obvious working implementations. But it seems plausible. Push a command to the phone, phone returns/uploads data to website, and UI updates.
Then there is the Android end. Well, there are the 3 projects above, Tasker for a quasi-hackish approach, and RPC (promising, but it seems like a WIP).
Thoughts? Volunteers? Geniuses?
Ooo... 2 birds with one stone!
This would also kill 2 birds with one stone.
No more typing in dynamic IP addresses! You get to use DNS to handle the connections. Bookmark your site in your desktop browser (it is always the same!). And set a preference in the Android app.
On lazydroid i've in planning some kind of trick that will let you connect behind firewall ... similar to a vpn...
CloudsITA said:
On lazydroid i've in planning some kind of trick that will let you connect behind firewall ... similar to a vpn...
Click to expand...
Click to collapse
I tried it again last week, and it is still unsuccessful. Webkey is currently the only application that I can successfully use to reach my phone.
Now, I could be wrong, but I believe all of these apps run a web server on the phone. I get a lovely, private 10.x.x.x IP address, which I can't reverse the route to. I have tried and failed to get DynDNS to work.
I have been looking into a solution since my original post. I have not had any time to do code squat, but I have loosely figured out all of the parts.
The big architectural difference I have been seeking is removing the server from the phone. I am not an Android expert, but I don't believe it even requires a running service. (Thank you, C2DM.)
With the app-webservice separation, you can work a "protocol" that reduces the overall bandwidth used... and thus improve battery life. Put all the "hard work" on a webserver, and (things get fuzzy here) possibly push it off onto the client browser (JS).
C2DM Browser Links
I could probably make something like WebKey but with C2DM and some more features. If you want you can give suggestions and I'll start making on saturday (after my exams). It would probably be possible in javascript for the actual sending from server and php just for logging in to your google account. The phone would just be registered on the server and no services (just as you wanted )
nebkat said:
I could probably make something like WebKey but with C2DM and some more features. If you want you can give suggestions and I'll start making on saturday (after my exams). It would probably be possible in javascript for the actual sending from server and php just for logging in to your google account. The phone would just be registered on the server and no services (just as you wanted )
Click to expand...
Click to collapse
I am not sure "more features" is necessarily the direction I'm headed. I am focused on making a "seamless" experience (i.e. less separation of phone and computer).
I was headed to App Engine (Python bias + easy Google integration). I have a project created. I haven't pulled together the various examples to make the core, but it seems <naive>simple</naive>. Stir in some templates, CSS, a sprinkling of JS, and voila!
The big "tricky" part that I can't convert from f***ing magic to a clear approach is the data link in the server. I want to avoid any storage to a Google disk, or otherwise, even temporarily. No stored data = easy privacy policy.
nebkat, if you're really chomping at the bit to code, here's my Android client concept.
- C2DM is a wake-up call. (cheat an borrow ChromeToPhone's ID to begin with)
- Connect to web server, send "I'm here," and wait for further instructions (Channels API/Comet/AJAX/.........)
- make the command set extensible
- each command is blockable in the client. (Permission control is set on the phone, not remotely.)
- After N minutes of no activity, send a "good bye," disconnect from the server, and fade into the background.
Don't worry, I'm very experienced with the server side stuff and I know exactly what you want. The only information stored on the sever side would be google account, the device c2dm registration id and some logging features just for statistics. A password could be set on the phone that would be sha512 hashed on the ajax request and would be sent to the phone. Even if a hacker found the hash, it would be useless without being logged in to the persons google account or knowing the server side auth token.
For now i'll just make the reciever, processor and command output and later on the extra security and ui stuff. It will work exactly the same way as Chrome2Phone except it will have server side php and the different commands. The connection from pc to phone will be something like this.
user command -> ajax request -> php c2dm request -> phone
phone -> php server http request -> controller page status
BTW I'm saving up for a Nexus S, how much would people pay for this type of app? There would definitely be a free version, but I just need to get the Nexus S because I have a Galaxy Spica now and it isn't the best for app development. I'm new to how stuff at xda works, would a donate version get me enoguh for the Nexus?
nebkat said:
Don't worry, ... <snip> ... auth token.
Click to expand...
Click to collapse
Alrighty then. I'm feeling like I can stop contemplating implementing this.
BTW I'm saving up for a Nexus S, how much would people pay for this type of app? There would definitely be a free version, but I just need to get the Nexus S because I have a Galaxy Spica now and it isn't the best for app development. I'm new to how stuff at xda works, would a donate version get me enoguh for the Nexus?
Click to expand...
Click to collapse
Since I was learning the ins and outs of App Engine, I read their quota rules and realized if this were popular it would require funding. I don't know where you are going to your web server, but I assume you'll have to pay someone to keep it running. But I had thought about $$$ already.
"Give away the razor, and sell them the blades."
Make the app free, no feature restrictions.
You get your money through various "membership" levels on the server. (See the account levels at fastmail.fm for an example.) So, you can use the app for free, but you only get, say, 2-3 MB of traffic per day, and only X sessions per day. Need more? See the pricing chart.
user command -> ajax request -> php c2dm request -> phone
phone -> php server http request -> controller page status
Click to expand...
Click to collapse
user command -> php server http request -> phone
phone -> php server http request -> controller page status
user command -> php server http request -> phone
lather, rinse, repeat.
C2DM is not deterministic, and acts up in low signal conditions. So, I made a decision to only use C2DM to initiate a session. Once both ends are connected to the server, everything goes over HTTP.
Oh.... and not that we need another Lookout/Phone Finder, but a shared-secret SMS code for the case where "they" have shut down the data connection.
I have my own server nebkat.com and there is nothing on it anyway.
The only other way to make "push" requests to the phone is with WebSockets. It would probably be better than c2dm because we have full control over what gets sent (google limits some requests). The advantage of WebSockets is that they send no header information which means that we could send our messages in 20 to 30 bytes.
I'll look into more detail on friday.
With web sockets won't you need to ensure the phone has a routable, external IP address? I know, for one, t-mobile does not expose an external IP address for their phones. Unless, of course, if the phone is connected over WiFi. C2DM works great for me (I have used a couple of apps with it and it is really useful).
MrGibbage said:
With web sockets won't you need to ensure the phone has a routable, external IP address? I know, for one, t-mobile does not expose an external IP address for their phones. Unless, of course, if the phone is connected over WiFi. C2DM works great for me (I have used a couple of apps with it and it is really useful).
Click to expand...
Click to collapse
No, WS is server initiated and the ip address' shouldn't make a difference.
MrGibbage said:
With web sockets won't you need to ensure the phone has a routable, external IP address? I know, for one, t-mobile does not expose an external IP address for their phones. Unless, of course, if the phone is connected over WiFi. C2DM works great for me (I have used a couple of apps with it and it is really useful).
Click to expand...
Click to collapse
You need an valid external IP address if you are attempting to initiate contact with your phone, which is why the 4-5 apps I've mentioned do not work on carriers like t-mo and verizon.
But the phone can establish a connection, and the carrier NATs (or whatever) will handle the routing for outgoing and incoming data.
I think the right questions are: Will Verizon/T-Mo allow the ports and protocol for WebSockets? Do Android and desktop browsers implement the draft API correctly and consistently?
I like C2DM. I works well when you have a good connection. But there are 3 issues with it.
1) The message size limit is 1024 bytes. Not ideal for file transfers.
2) In a poor signal areas, since the service retries sending messages, you will get delayed and/or duplicate messages. I work in a large "concrete" building, so I get this behavior often enough that I don't want to rely on it.
3) I believe there is a limit on the number of messages you can send. So, hunting around the filesystem could hit this limit (but unlikely in reality... I hope.)
It would be interesting to see exactly how those apps handle all of the data. Do they only use C2DM, or do they hand over to another protocol?
Ok my exams are over and I am starting with it. I'll give updates on this thread
I'm having with trouble getting VPN to work on my Nook Color, running cm7.1 encore stable. It seems every time I enter my password to connect, the status changes to 'Connecting...' and freezes the nook. Has anyone gotten VPN to work on CM7.1? I'm outside the US so I would like to run VPN to connect to Hulu and Crackler...
Any help on this would be appreciated
BUMP
I'm having the same issue with CM 7.1.0.1 (stable). Like the original poster stated in his post every time I connect to a VPN my Nook Color freezes and I have to do a hard reboot.
I use VPN a lot on my Android devices so it would be great if someone could tell me how I can get it to work on the Nook Color.
If you can use OpenVPN, that works very well for me via the OpenVPN Settings app.
swaaye said:
If you can use OpenVPN, that works very well for me via the OpenVPN Settings app.
Click to expand...
Click to collapse
My provider charges extra for OpenVPN so I'm stuck for now trying to get PPTP VPN to work on my NC.
I straight up have the answer for you. DroidVPN is in beta right now, search them on the forums. They will provide you with VPN for free. They require that you email them for a registration code and that's it.
Highly recommended. Quick connection and nice servers. Download and browsing speed mostly equivalent to what I was getting before.
Give them a try. You will need a tun.ko in your system/lib/module folder, but it is built into the kernel. I just bring that up so it doesn't seem to be a stumbling block to anyone looking into the app.
mateorod said:
I straight up have the answer for you. DroidVPN is in beta right now, search them on the forums. They will provide you with VPN for free. They require that you email them for a registration code and that's it.
Highly recommended. Quick connection and nice servers. Download and browsing speed mostly equivalent to what I was getting before.
Give them a try. You will need a tun.ko in your system/lib/module folder, but it is built into the kernel. I just bring that up so it doesn't seem to be a stumbling block to anyone looking into the app.
Click to expand...
Click to collapse
I already have a prepaid subscription to a VPN provider (StrongVPN) which allows me to have an IP address from anywhere in the world. I watch shows on the BBC iPlayer which only streams to UK IPs. I also used this before to watch Netflix while in Europe with a US IP.
This DroidVPN sounds fine for folks that aren't needing international IPs although I don't know how many servers they have and what type of speeds one can expect using them.
I've been doing some short investigating around the X2 Pro.
It seems like the device connects to some Chinese servers throughout the day. During my tests, these happened at random times: 18:53, 19:37, 18:47.
The IP it connected to was 223.202.200.150 and the connection was encrypted with TLS so I couldn't see the contents of the packets but I know it was connecting via HTTP.
That IP seems to be an Alibaba Cloud Computing server run by Oppo (ColorOS).
It's around 430 bytes sent each time over different ports. Initially it's 443 (as expected for TLS) but then changes to ports 40634, 40712, 41798, or 42036. It seems to be random.
The server it was connecting to was https://classify.apps.coloros.com/. It seems to fire whenever you install a new app. It's likely fetching an app category and storing it somewhere. This would be how it makes those auto-named app folders in the launcher, I assume.
------------------------------------------------------------------------------------------------------------------------
Following on from this, I adjusted my Wireshark filter to include any server with "oppo", "realme", "coloros", or any IPs in China and found some more servers:
Server Name: guif-eu.coloros.com
Server Name: languagef-eu.coloros.com
Server Name: ifota-eu.coloros.com (OTAs i assume)
Server Name: ifota-eu.realmemobile.com (more OTAs...?)
Server Name: ifsau-eu.coloros.com
Server Name: i6-eu.weather.oppomobile.com (I think we can guess this one...)
Server Name: state.dc.oppomobile.com
Server Name: confe.dc.oppomobile.com
There's even more than this which I've included in my full list in the 2nd post.
Some of these refuse to connect in the browser, and others return 401 unauthorised headers. It would be interesting at least to know exactly what data is being sent to each of these servers. Each of the servers are AWS Cloud Compute servers based in France. I'm not sure if the location is whichever is closest to the user, but I'd assume so.
The issue is that the Chinese gvmt can request the data on any server that is hosted in China. For all we know, the AWS servers could just be a non-suspicious front end which forwards all the data to their actual servers in China, trying to hide that from us. We just don't know.
(Thanks to Gamr13 on the Realme Discord for giving me the idea )
classify.apps.coloros.com
Request sent when an app is installed. Likely to check what 'category' it is for auto-naming folders on the stock launcher.
********
guif-eu.coloros.com
Unknown.
********
languagef-eu.coloros.com
Unknown.
********
ifota-eu.coloros.com
Request sent when checking for new system updates. Unknown why there's two servers -- maybe a remnant from ColorOS?
********
ifota-eu.realmemobile.com
Request sent when checking for new system updates. Unknown why there's two servers -- maybe a remnant from ColorOS?
********
ifsau-eu.coloros.com
Unknown.
********
i6-eu.weather.oppomobile.com
Weather service.
********
i6.weather.oppomobile.com
Weather service.
********
file-eu.weather.oppomobile.com
Weather-related. I hope this isn't what it sounds like it could be... (file?)
********
state.dc.oppomobile.com
Unknown.
********
confe.dc.oppomobile.com
Unknown.
********
smartcardf-eu.apps.coloros.com
Unknown.
********
proxyeu.apps.coloros.com
Unknown. Sounds like it could be an EU-based proxy for forwarding connections to China.
********
clonephonefs.coloros.com
Unknown. Seems to correspond with the Clone Phone notification when you first set up your phone.
********
guifsf-coloros-com.oss-ap-southeast-1.aliyuncs.com
Unknown. Alibaba Cloud Computing service.
********
wow ! that is nice to discover .. i noticed my phone keep uploading something specially at night !
Yes, they 100% collect, forward (between jurisdictions) and store information located on their servers in the People's Republic of China.
Information includes, and is not limited to, usage behaviour, face/fingerprint ID, voice, financial info (when you buy products), location, sleep patterns etc. Pretty much everything you can think of.
All of this is explained in their Privacy Policy and they state everything they are allowed to take.
Go to About Phone>Legal information.
When you use this Colour or Realme UI Operating System, you agree to these terms.
And according to the User Agreement, one is technically not even allowed to analyze the software (i.e. O.P.'s post information) or have pornography on the phone.
You can (probably?) negate this by switching to another OS, but unless you do it straight out of the box, it might already be too late: For entering your information even once, like during 1st day startup, will have your information stored in the PRC servers for an undisclosed amount of time (probably forever).
Anyody know how to stop this from happening?
onnoêzeler said:
Anyody know how to stop this from happening?
Click to expand...
Click to collapse
no, you can't prevent it, privacy no longer exists, profiling is the market of the new century, big brother Google knows it well
Somebody pointed out on telegram their image thumbnails are getting stored in logs Folder and getting uploaded as well.
Might be for their face matching and sorting algorithm in stock gallery, because this is the first phone or app which i see does on device machine learning by sorting pics According to their faces (in the case if it doesn't upload images for)
Be it google photos, Xiaomi gallery ,etc, all identify faces after you upload the pics on their cloud.
I wish I had seen this thread before I ordered the phone…
If the phone is rooted, you could probably use AdAway to block those domains and IP address, but will fingerprint and face unlock still work? Or even without root you could use DNS66 or DNSfilter, both available on F-Droid, to block those domains and IP address. When my phone arrives, I will test this solution.
Can I use adb to remove certain offending apps without unlocking the bootloader? (Thinking about Widevine L1 vs L3)
nuserame said:
I wish I had seen this thread before I ordered the phone…
If the phone is rooted, you could probably use AdAway to block those domains and IP address, but will fingerprint and face unlock still work? Or even without root you could use DNS66 or DNSfilter, both available on F-Droid, to block those domains and IP address. When my phone arrives, I will test this solution.
Can I use adb to remove certain offending apps without unlocking the bootloader? (Thinking about Widevine L1 vs L3)
Click to expand...
Click to collapse
If you care this much about privacy, you could unlock and use N no of custom roms available for this device.
Everything will work, except L3.
As for files which are uploaded, all from the ColorOS folder(don't know how it is in rui as I was using it for few hours while it was in beta stage) that's in internal storage are being uploaded. Some of files there are encrypted which leads my thoughts to be very sensitive data.