Tag: android

Orbot: An Anonymous Proxy for Android using Tor

I’d like to make this post without much fanfare. Just looking to share information on the work I’ve been doing with the fantastically radical team over at the Tor Project, as part of my work on the Guardian Project. We have successfully ported the native C Tor app to Android and built an Android application bundle that installs, runs and provides the glue needed to make it useful to end users…. secure, anonymous access to the web via Tor on Android is now a reality. (Update: Tor doesn’t magically encrypt all of your Internet activities, though. You should understand what Tor does and does not do for you.)

However, there is still much work to be done… read on!

1) Tor 0.2.2.5-alpha release contains all the necessary code for building the Tor binary exe using the Android C SDK. I utilized http://github.com/tmurakam/droid-wrapper toolchain wrapper scripts to make life easier. This will produce the output Tor exe that can run on Android w/o needing root.

Update: Thanks to Jake, you can now read the updated Orbot BUILD doc for the step by step build how to.


(thanks to ioerror for the pic)

At this point, we are pretty convinced that the performance and efficiency of the C binary is quite significantly better than the Java-based ports of Tor running within Dalvik… this translate to a better experience for the user, with no noticeable increase in battery drain or lag on the rest of the device while Tor is running in the background.

2) Orbot – this is the new Android app which bundles the Tor binary, handles its proper installation on the device and then provides a gui for starting/stopping, view the log and torrc, etc. It also provides a built-in HTTP Proxy and is licensed under the Tor license.

home.jpgtor-on.jpglog.jpg

Just to be clear – we aren’t using the NDK or a shared library… we are actually extracting a binary and managing it via Runtime.getRuntime().exec() calls. This is 100% supported – who knew?! More info on how to do this here

The first code is up here… all is working, but def needs much polish:
https://svn.torproject.org/svn/projects/android/trunk/Orbot/

This post is in part a call for developers to contribute to the continued development of Orbot, so we can get it to a 1.0 state. The other big task is to modify the open-source, privacy focused Shadow browser, from the University of Cambridge DTG group, in order to make it work with our HTTP proxy. That would be a really great step forward, as right now, we have to ask users to set their global APN (read: https://svn.torproject.org/svn/projects/android/trunk/Orbot/INSTALL)

Thanks for everyone’s help and support to get here. I’d like to keep pushing on to a public release via the App Market very soon. Let me know if you’d like to contribute in any way – code, screen designs, icons, testing….

Domo arigato, Mr. Orbot-o!!

ITP2800 – Week 5 – Building Mobile Apps

Homework for Week 5

  • Catch up on previous weeks’ readings and homework that you haven’t turned in yet
  • Continue to develop and plan your cause with a target on being able to concisely explain it for your midterm and the next Speed Geek!
  • Review the content presented in class and decide on the approach (server vs client or mixed) and the tools which you will utilize.
    • All: develop the user stories and basic mockups of your service – “iterate with pencil” before moving into fancier renderings
    • Server Developers: setup an IMified account and review the developer documentation
    • Client Developers: setup the Android SDK, then download and build the gReporter source code


Another exciting week at ITP. This week the classes was visited by Evan Henshaw-Plath aka Rabble, who both spoke of his personal experiences with mobile technology and activism, and also provided critical feedback to students on their projects during our first Speed Geek.

The second half of the class focused on preparing for the development of actual mobile applications and services. While students are free to choose any software or hardware approach they want, the two platforms that will be covered in class are IMified and Google Android.

Here is the audio of the second hour of class as I walk through the links and slide presentations embedded below:

Referenced links:

This first presentation provides an overview on approaching the development of mobile applications considering all of the unique factors of using a small, portable device on the go:

The second presentation uses the gReporter application to discuss the development of location and media-capture applications on the Google Android platform.

Finally, for beginning to design and mockup applications, here’s a list of solutions for the iPhone (thanks to TechJini blog)  that can also apply to Android:

  1. Use Interface Builder or Dashcode (Mac only)
  2. Use Balsamiq mockup tool (Mac, windows, linux) – http://www.balsamiq.com (http://www.balsamiq.com/blog/2009/03/01/iphone-controls-new-icons-and-much-more/)
  3. Use Omnigraffle (Mac only) and import an iPhone stencil – (http://www.omnigroup.com/applications/omnigraffle/download/ and http://www.graffletopia.com/search/iphone)
  4. Use paper and a stencil- http://www.designcommission.com/shop/iphone-stencil-kit/
  5. Use a pre-printed sketch paper – http://labs.boulevart.be/index.php/2008/06/05/sketch-paper-for-the-mobile-designer/
  6. Use photoshop and the iPhone PSD – http://www.teehanlax.com/blog/?p=1628
  7. Use Adobe Fireworks – http://blogs.adobe.com/fireworks/2008/08/iphone_gui_as_adobe_fireworks.html and http://www.building43.com/videos/2009/06/23/mockup-iphone-app-adobe-fireworks/
  8. Although not there yet, you can try http://iphonemockup.lkmc.ch/
  9. Use the stencil kit from Yahoo! which is available in a variety of formats – http://developer.yahoo.com/ypatterns/wireframes/
  10. Use the sketchbook available at http://www.mobilesketchbook.com/

My thoughts on the Google Android v. Cyanogen Kerfuffle

A few of you know that I’m a huge fanboy of something called the CyanogenMod. If you have a Goodle Android phone, like the T-Mobile G1 or myTouch, watch out, because before you know it, I’ll have it rooted and running an alternate version of the operating system.CyanogenMod is like Ubuntu for mobiles – the sexiest, smoothest running “distro” you can get your hands on, and that you want to show off to all your friends running lesser, closed, proprietary operating systems (especially ones distributed by Apple). CyanogenMod exists because Android is an open-source mobile operating system – in fact, it is the only commercially viable open-source mobile operating system. When the words “open-source” and “commercially viable” exist in close proximity to each other, I usually start talking too fast and wave my arms excitedly.

Recently, a kerfuffle arose where in some overeager/ever-vigiliant IP lawyers at Google sent the developer of Cyanogen a CeaseAndDesist letter, because in his custom distro of Android he included certain closed source applications that are NOT part of Android. Unfortunately, the closed source applications weren’t just some utilities or demo applications, but actually GMail, Google Maps, YouTube and the Android Market. It could be stated that these are pretty much the essential end-user experience for the common user. In addition, some of the companies behind the hardware device drivers in the ROM are also beginning to complain.

However, Cyanogen, being the innovative, clever hacker he has revealed himself to be, along with the hundreds of other Android MOD hackers out there, are bound to come up with a clever solution to this mess shortly. After all, when you purchase an Android phone off the shelf, you buy the right to a license of those applications, and should be able to continue using them on your device, regardless of the underlying operating system flavor you are running. (To keep abreast of the latest developments, which seem to be taking new twists and turns each hour, you should check http://twitter.com/cyanogen)

Finally, I just wanted to state some points about my perspective on the “open source”-ness of Android and the possibilities for any project looking to distribute custom MODs of it , including my own Guardian Project:

  • Android is not completely open-source; we’ve all known that for awhile, specifically b/c the entire baseband layer and radio firmware are closed source. These are the pieces that manage the GSM radio, controlling all the actual interface into the wireless network. This is just the reality of the mobile phone industry today. (Mad props to OpenMoko and BugLabs for making actual, true completely open-source mobile software and hardware.)
  • Having custom MODs of Android released without the Google pieces in there by default is actually a good thing… Android has always been perceived as being too tied into Google by default. I want to build the non-Google Google Phone. If Yahoo had a clue, they’d release their own open-source client applications for their mail and map services and make a Yahoogle Phone.
  • There are plenty of excellent, truly open-source alternatives out there for the market, maps and video players. This will give those solutions opportunities to shine. Specifically checkout the OpenStreetMap-based AndNav and AndAppStore an open alternative to the Market. PixelPipe offers uploads to YouTube, Blip, Flickr and many other media sharing sites. Finally, K9Mail is a open-source email client that works just fine with GMail’s IMAP service.
  • Android is fundamentally built to route around Google’s centralized control… you don’t NEED a marketplace. You can download and install apps directly via a URL link, send them via Bluetooth, install them from an SD card and so forth.
  • Just the fact that it is possible for Cyanogen and the tens of other MOD and theme distributors out there to do what they are doing is completely freaking fantastic. We have to thank and commend Google for that. Compared to the glacial speed of OS update release cycle, etc. of Palm when I worked there, Cyanogen is moving at warp speed, embracing the best practices of agile and duct tape progamming.

That’s all I have for now… I’d love to hear from you. Perhaps I being too kind? Any other excellent true open-source alternatives out there for the Google closed apps? What do you think about the possibility for a Yahoogle phone?

Guardian Project: SMS Encryption (non-)Options for Android

My first post was titled “Guardian Approved” as I did want to highlight applications that were of a certain quality or caliber. Unfortunately, in the realm of secure, private, encrypted short messaging (SMS), I can’t really say I have anything to approve! The best, most trusted solution out there (from CryptoSMS.org) hasn’t been ported to Android yet, and the rest of the offerings either cost too much, aren’t targeted directly at SMS, are closed source or generally poorly written alpha quality applications.

I’ve quickly realized that a quality SMS encryption application for Android (along with interoperability with other mobile phone platforms) is a critical application for the Guardian Project to focus on. One of the really cool aspects of building apps for Android is that you can completely replace the core applications on the device, meaning that an encryption-enabled SMS application isn’t relegated to a third-party status within the device. It can actual take over and replace the built in “Messaging” application and seamlessly handle SMS traffic and transparently handling encryption of messages to and from those addresses you have done a key exchange with.

Where Its At

In the meantime, here is a quick breakdown of what is available on Android today:


  • While not used for encryption, ChompSMS represents an excellent example of a “power-up” replacement for the built-in Android messaging application. It does offer an ability to send SMS through their Internet-based SMSC gateway. This means that as long as you have an mobile Internet data connection, you can send SMS messages without being monitored by the local mobile carrier, and even send SMS over a WIFI connection.


  • Encrypted SMS – $1.99 – “Parents Spy Much? Here’s your solution!” – This app is clearly targeted at the “passing secret notes in class” audience and not meant for anything serious. The encryption used seems to be of the basic letter substitution pig-latin variety, which could be cracked in about two seconds by someone with a pencil and paper.
  • Platinum RSA SMS – Free – “Encrypted text messaging service for your Android device. 1024 bit RSA math” – While the potential for this app seems good and the heavy use of the phrase “RSA math” indicates they know SOMETHING about encryption, the user interface is very confusing, even for me a seasoned user of terrible mobile user interfaces.
  • TXTCrypt – $9.99!

    “With TXTcrypt just enter your message and a password for it , now the encrypted message can only be decoded with that password , just tell it to someone , and send them message encrypted with it , they can use TXTcrypt to decode it..”. This application is very powerful and well written. However, it costs way too much for what it offers. No key change, no proper integration with SMS… it is just a basic password-based plain text encryption tool.



CryptoSMS

As mentioned before, there is a quality, open-source solution available called
CryptoSMS. From their site: “Cryptosms provides public/private key encryption, key generation and key management. it sends and receives encrypted sms and public keys, de- and encrypts files, offers key verification via fingerprints and provides a secure login. ”

Unfortunately, CryptoSMS is only available for J2ME-based phones today, which Android is not. There is a J2ME emulation app for Android, but it is a terrible user experience. What this is all adding up to is that the Guardian Project must/will plan to contribute to and otherwise support porting efforts of CryptoSMS to Android… while the user experience and integration with Android OS concepts like intents and content providers will take some work, the core engine of CryptoSMS appears to be just what is needed.

If you are in the New York area, and would like to learn more about CryptoSMS, you can attend a workshop this Thursday evening, August 13th, at The Change in Williamsburg, Brooklyn. More information available here…

Guardian-approved: Walkie-Talkie App for Android

As part of rolling out the first-phase of The Guardian Project, I will be writing short reviews of existing applications for Android-based mobile phones that share our general goals or desired functionality. The goal of Guardian, in short, is to enable safe and secure communication for activists, organizers and advocates working for good around the world through the mobile phones they carry in their pockets.

The Guardian project has no official relationship with these apps or their creators, but as we work towards developing our own unique software, we want to make sure to shine the spotlight on existing efforts that we admire and which are currently available. We’d also happily collaborate with any of them (or *you* if you are a developer reading this), and have them join our open-source efforts.

The first application is Walkie Talkie Push to Talk, which is a great alternative take on real-time VOIP or standard phone calls. Physical walkie talkie radios and Nextel-style PTT services have long been a valuable tool for many activists, and this application bring that capability to a global scale. Walkie Talkie can be used over GRPS, EDGE, 3G or Wifi networks, as well – whatever is available at the time.

Here’s a short description from the developer:

Walkie Talkie Push to Talk is a mobile application that allows walkie talkie style voice communications. Simply hold down the “Record & Send” button and speak. Messages can be sent to a group of people. Received messages are automatically played. If program is running, incoming messages arrive as soon as 15 seconds. If program is not visible, it polls in the background every 1 minute (to save battery).

The back-end messaging system used by this application is actual POP or IMAP, in other words email! If you utilize a secure IMAP/S connection with the application, then the voice communications are transmitted securely over the wireless network and Internet. If you use a service like Gmail (which offers secure IMAP access), then your access is hidden within the millions of other users accessing Gmail, as well.

Not drawing attention to your network traffic is often as important as securing your data. Also, while Gmail isn’t always the ideal service to use if you wish to retain full control of your data, it is much more difficult for an authority to block than a single proxy or a private server.

A few screenshots below:

Learn more about Walkie Talkie and download it from the Android Market today.