8

I use Tor on Android because it's easily configurable for Duck Duck Go and Twitter with Orbot. It's possible to use it with a stable Firefox version too but I can't because I use the beta version.

On the other side, as it is a vanilla (I mean non-rooted) Android from a Google device, does it make sense to use Tor? Anyway I will send a lot of logged in data to Google or other organizations.

Is it useful? Isn't it dangerous for others Tor users if some data transit through my phone ?

6

There are a couple of circumstances in which it could be useful that spring to mind.

  • You wish to prevent your Cellphone Network (AT&T, Verizon, Vodafone etc) from observing any data sent that isn't normally protected - think your web browsing for example.

  • Android is quite configurable as to what data is sent to Google. You've stated you will be sending a lot of data to Google - but you can still configure what data that is. For example, you could disable the location functionality (GPS etc), so that while your cellphone provider will know your location (due to cell-tower triangulation), Google won't.

It's about risks. If you think Google knowing your data is more acceptable than your cellphone network, then Tor could still be useful. Is Google more or less likely to surrender user data than your cell network? The answer will vary depending on your country and threat model.

Certainly, there is a high chance in your case that someone watching the Exit Node <-> Google connection will be able to find out what your google account email is. But if your threat is from your government, who have powers to compel cell networks or ISPs in your country, then it may be that just using Tor to tunnel out of the country is enough protection for your situation.

4

As Samuel Walker notes, it's probably better than nothing, depending on your circumstances and threat model. You might be interested in the Guardian Rom project. There's a thread at Wilders Security Forums. It was on hold for a while, but seems to be moving again. Here's a quote from a recent update from x942 aka Kyle Davidson:

1) Full disk Encryption and PDE are integrated at the user level in the settings app. No need for a computer to set it up any more.

2) Root works, enabled by default in superuser app (open source one).

3) Yubikey OTP support is now added into the settings app as well. If you use a lock screen pin/password you can now choose to add yubikey as a second factor or as a "skip" token so you can skip entering the password/pin if you use the yubikey instead. The YubiKey will work in OTP mode (using yubicloud) or using HMAC Challenge-Response instead so we can auth offline/no data connection needed.

4) Under settings -> security we have added a menu for lock screen pin and one for encryption settings. These pins are independent now. Encryption settings lets you choose the password for encryption. This only effects the OS you booted. So if you are in your Hidden OS this changes the Hidden OS password. If you are in the Outer OS this changes the Outer OS password.

5) We are about 20% done adding Ina [sic] GUI front-end for IPTables in the settings app.

6) We are 2% done migrating databases over to SQLCipher.

7) Panic Button - This is a lockscreen/homescreen widget that can be configured to shutdown/wipe the phone if pressed. It also can prompt the user ever 'x' minutes to enter a pin. If the pin is not entered in 30 seconds or the duress pin is entered the phone shutsdown immediately (or wipes optionally). Sort of a dead man's switch.

  • 1
    Excellent addition! I hadn't heard of this project before, I'll have to look into it when I have time. – Megan Walker Oct 23 '13 at 19:25
  • Excellent! I'm very pleased to discover a project like this one :D – smonff Nov 3 '13 at 20:51
3

It's becoming more and more a necessity to use Tor on mobile devices, so yes it makes sense. Even though there are lots of privacy-anonymity risks with doing so, people could develop solutions over time as more people start using Tor on Android.

You must be very careful and informed about how Android works, what is being sent to internet, etc.

My best advice would be installing a good firewall application to whitelist connections and a network monitor to find out what's going on and how to prevent them.

I also highly recommend adding iptables rules to the firewall application (You can search for good examples). You should block incoming connections and accept the established,related states only. This fixes lots of unwanted connections happening on Android, but it might break syncing applications.

  • What would you recommend as a good firewall application and a network monitor? I'm always afraid that some process would be hiden – smonff Nov 3 '13 at 20:53
  • 1
    Network Log for recording or monitoring: on F-Droid - on Google Play My favorite Android Firewall: on Google Play - on Github I don't know why this firewall isn't on F-Droid but the only alternative would be AFWall+ which is on F-Droid: f-droid.org/repository/browse/?fdid=dev.ukanth.ufirewall – Anonymous Nov 3 '13 at 21:50
  • 1
    It might be tricky to use the network monitor correctly, you have to configure iptables for best results (again you can use the firewall scripts like I did). I thought I couldn't prevent lots of connections until I found out most of them were actually not happening. You have to find the correct iptables order – Anonymous Nov 3 '13 at 22:03
  • 1
    The situation might be even better than I thought with the latest improvements in the firewall that I suggest. Didn't test but the INPUT chain support is finally added on version 2.3.1 – Anonymous Nov 3 '13 at 22:16
  • 1
    Without root, you have no control, you are not the owner, and you must be afraid of much more things than root itself. Having a good root manager (Superuser), a good app permission manager (LBE Security Master) would be good enough – Anonymous Nov 3 '13 at 22:42
3

Even if you consider Android security totally broken Tor is still useful, at least:

  • For circumvention.
  • As a political statement.
  • For adding hay to the haystack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.