rooting and privacy

[oxyrius]

Hi guys,

I just joined the forum mainly for one reason: I am a little concerned about permissions management of my apps and for safety in general.

Regarding permissions management I was thinking of installing Xprivacy, but it requires rooting, and I can't evaluate well its risks. I've read a few posts here on Android Central, but I ask you:
1) maybe I missed a some posts: can anyone give me the links to the most important ones?
2) I think a problem is that rooting gives to apps the ability to access the most hidden layers of the os; how can I tell if an app has permission to do so or not?
3) I also read some discussion of Xprivacy, but no post very enlightening; if someone wants to say something it would be very welcome.

Another concern relates to the password to access the app. If I lose my phone anyone can access to my apps, once unlocked the pin; so:
1) is there a way to "lock" the apps, so that every time I want to use, say, Facebook or email, I have to enter a password (without logging out)?
2) Might a person (who find my phone) be able to read my data? How? You could avoid? (I think the best solution is encryption, just tell me if there are other possibilities)

Thank you in advance

 

[Rukbat]

Regarding permissions management I was thinking of installing Xprivacy, but it requires rooting

And Xposed which, the last time I checked it on Android 5+, was an iffy proposition.

2) I think a problem is that rooting gives to apps the ability to access the most hidden layers of the os; how can I tell if an app has permission to do so or not?

If it's running on an unrooted phone, it doesn't make use of root permissions.

3) I also read some discussion of Xprivacy, but no post very enlightening; if someone wants to say something it would be very welcome.

There are other apps, that don't require root, that restrict the data an app can receive.

1) is there a way to "lock" the apps, so that every time I want to use, say, Facebook or email, I have to enter a password (without logging out)?

Yes, there are apps that password each app separately. (I can't recommend any, since I don't use any, because I don't have anything on my phone I'd be worried about someone getting into. [I'm not a Luddite - I have a few hundred apps installed, just nothing that will give you the password to my bank account.])

2) Might a person (who find my phone) be able to read my data?

That depends on the person. The average cellphone user? No. An analyst at the NSA? Easily. Me? Possibly, if I got motivated to try.

How?

Break an easy password or pattern.

You could avoid?

Don't have anything on your phone that would endanger you or your finances if someone else got it, and immediately report any compromise (like a stolen cellphone), the way you would a compromised credit card..

(I think the best solution is encryption, just tell me if there are other possibilities)

Encryption has 2 glaring problems.

1. If you forget the password, you're locked out of your own data, so you MUST have a FULL backup of passwords, etc., at all times.

2. Encryption works the same as other apps - sometimes it messes up and, even though you're putting in the right password, it won't let you in. See #1.

 

[oxyrius]

First of all, thanks for your reply; actually, I haven't been clear enough and I forgot some important points.

POINT 1 - PRIVACY
I've a Samsung Galaxy 4 Mini with Android 4.4.2 (no update available). I am oriented to Xprivacy because:
- I haven't found any (free) app that works on my OS and doesn't require root;
- it seems quite good from comments.
If other apps could be better in my case, any suggestions will be appreciated. In any case, it seems I need root.

POINT 2 - SAFETY
My last question was really poorly worded: I'll try to make it clearer.
I regularly use spotify, facebook, email (and sometimes a VPN); I don't use other apps so much. I also haven't sensitive data.
I am concerned for emails and data to sign in on my various accounts (passwords and usernames). In case somebody break my password, can he/she:
- Use my accounts to do everything he/she want (read emails, send messages, delete emails)?
- Read and change my passwords?
- Change my accounts settings?
- Steal my accounts (so that I cannot control it anymore)?
I don't have to escape from NSA. I just need some tricks in case I loose the phone or somebody steals it (I am a very inattentive person).

Tricks I am already using:
- try to be less inattentive;
- use a password to lock my screen;
- have 2 emails: the one I use to sign in on various accounts is not synced with my phone;
- avoid to save sensitive data on my phone.
You have my phone? You can't sign in (e.g.) on my bank account. But you can still read usernames and passwords and change settings on personal email, facebook and VPN (if you break the display password).

I suppose that an app to lock the different apps would help, and to encrypt data would help too (I don't need any back up, since I don't have any data stored in the phone). Maybe, some other tricks are better for me. Maybe, I am just paranoid and a password is more than enough.

I hope it is more clear. Let me know what you think, thanks again.