From: Soren Stoutner Date: Thu, 16 Jun 2016 19:02:45 +0000 (-0700) Subject: Add the Guide. X-Git-Tag: v1.7~2 X-Git-Url: https://gitweb.stoutner.com/?a=commitdiff_plain;h=a44d1cbf2fdd6e460d88adcae1b84bff1802813f;p=PrivacyBrowserAndroid.git Add the Guide. --- diff --git a/.idea/dictionaries/soren.xml b/.idea/dictionaries/soren.xml index e7d27c91..b0b4df8f 100644 --- a/.idea/dictionaries/soren.xml +++ b/.idea/dictionaries/soren.xml @@ -1,6 +1,7 @@ + adsense androidversion anonymized appbarlayout @@ -13,14 +14,20 @@ coordinatorlayout eadd exynos + imbedded + imbedding intl khtml konqueror linearlayout + logins mozilla nojs + orbot + panopticlick redmine relativelayout + robinlinus samsung securitypatch snackbar @@ -28,7 +35,9 @@ tablayout techrepublic textview + webkay webkitversion + whatismyip zenlte diff --git a/app/src/free/assets/about_privacy_policy.html b/app/src/free/assets/about_privacy_policy.html index 4d88a0ff..1ae8b3aa 100644 --- a/app/src/free/assets/about_privacy_policy.html +++ b/app/src/free/assets/about_privacy_policy.html @@ -36,16 +36,18 @@

Privacy Browser Free

Privacy Browser Free does not collect any user information.

Privacy Browser Free displays a banner add across the bottom of the screen using the Google's AdMob network, which has its own privacy policy. Note that unless you have opted out of interest-based ads, the advertiser will receive a copy of your unique device advertising ID, which allows them to track your device across apps. AdMob reports anonymized summaries of the following information. Stoutner may use this information for any purpose.

Total impressions
Total clicks
Activity by country

Google Play Ratings

Google Play has its own privacy policy. Google provides developers with anonymized summaries of the following information related to user ratings. Stoutner may use this information for any purpose.

Country
Language
Tablets (eg. Tablets 10" and above)

Google Play Reviews

Google Play has it own privacy policy. In addition to the name of the reviewer, the rating, and the text of the review (which are all available publicly), Google provides some or all of the following information to the developer. Stoutner may use this information for any purpose.

Version code (eg. 7)
Version name (eg. 1.6)

+ + + + + + + + + + diff --git a/app/src/main/assets/about_changelog.html b/app/src/main/assets/about_changelog.html index c927cd9b..302cb5ef 100644 --- a/app/src/main/assets/about_changelog.html +++ b/app/src/main/assets/about_changelog.html @@ -18,11 +18,11 @@ - + diff --git a/app/src/main/assets/about_contributors.html b/app/src/main/assets/about_contributors.html index 0c13f6d8..81b4c238 100644 --- a/app/src/main/assets/about_contributors.html +++ b/app/src/main/assets/about_contributors.html @@ -18,20 +18,21 @@ - + } +

Principle Developers

Privacy Browser is primarily developed by Soren Stoutner.

Contributors

Contributors are welcome to submit both code and translations.

\ No newline at end of file diff --git a/app/src/main/assets/about_license.html b/app/src/main/assets/about_license.html index 8663c613..094ec166 100644 --- a/app/src/main/assets/about_license.html +++ b/app/src/main/assets/about_license.html @@ -18,33 +18,35 @@ - + +

Copyright

License

Privacy Browser is released under the GPLv3+ license. The full text of the license is at the bottom of this document.

Attributions

The icons in Privacy Browser come from the Android Material icon set, which is released under the CC-BY license.

diff --git a/app/src/main/assets/about_links.html b/app/src/main/assets/about_links.html index 856bf4cd..312ece0a 100644 --- a/app/src/main/assets/about_links.html +++ b/app/src/main/assets/about_links.html @@ -18,11 +18,11 @@ - + } + diff --git a/app/src/main/assets/about_permissions.html b/app/src/main/assets/about_permissions.html index 7e8d921b..b40f8bf6 100644 --- a/app/src/main/assets/about_permissions.html +++ b/app/src/main/assets/about_permissions.html @@ -18,22 +18,26 @@ - +

Have full network access

android.permission.INTERNET

Required for the WebView to access the internet. Without this permission, Privacy Browser would be âNo Browser: Protecting Your Privacy by Staying Completely Off the Internetâ.

Required for the WebView to access the internet. Without this permission, Privacy Browser would be âNo Browser: Protecting Your Privacy by Staying Completely + Off the Internetâ.

Install shortcuts

com.android.launcher.permission.INSTALL_SHORTCUT

Required to add shortcuts for websites to the launcher desktop.

\ No newline at end of file diff --git a/app/src/main/assets/about_privacy_policy.html b/app/src/main/assets/about_privacy_policy.html index e4e1e106..83ecfdaa 100644 --- a/app/src/main/assets/about_privacy_policy.html +++ b/app/src/main/assets/about_privacy_policy.html @@ -18,32 +18,34 @@ - +

Privacy Browser

Privacy Browser does not collect any user information.

Google Play Ratings

Country
Language
Tablets (eg. Tablets 10" and above)

Google Play Reviews

Version code (eg. 7)
Version name (eg. 1.6)

Cleaning Out the Cruft

Clear and Exit does the following things:

Removes all cookies.
Removes all DOM storage.
Clears the cache, including disk files.
Clears the back/forward history.
Destroys the internal state of the WebView.
Closes Privacy Browser. For Android Lollipop and newer (version >= 5.0 or API >= 21), Privacy Browser is also removed from the recent app list.

JavaScript Is Powerful

Back in the early days of the internet, web pages were static, meaning they they contained text and images that displayed on the screen + but didn't change or interact with the user. Of course, only so much that is interesting can happen with static content. + Several different technologies were developed to facilitate dynamic web pages. JavaScript was one of these technologies.

JavaScript is a programming language. Many web servers host programs written in JavaScript, which are sent to devices as part of the web page. + The device runs the JavaScript on its local processor and follows the commands of the program, which can animate images on the website, + popup a menu, and do many other useful things.

JavaScript Is Dangerous

Of course, the concept of running arbitrary programs from a website is potentially dangerous. So there are limitations placed on JavaScript + to keep it from doing things like installing viruses on the device. However, it turns out that these limitations are overly broad. + Below is a screenshot from webkay, which is a website that demonstrates the type of information that + JavaScript can produce about a device.

For privacy purposes, the ideal would be to browse the internet with JavaScript disabled. However, there are some websites that legitimately require + JavaScript to accomplish their purposes and others that don't work correctly without JavaScript even though they could be programmed to do so. + Privacy Browser addresses this by making it easy to toggle JavaScript on and off. Tapping the privacy shield will toggle it between blue + or yellow (both of which indicate + that JavaScript is disabled) and red (JavaScript enabled) and and reload the website. + Looking at the different information webkay can collect with JavaScript enabled and disabled is informative.

Browsing the internet with JavaScript disabled, and only enabling it if needed, goes a long way to protecting user privacy. In addition, JavaScript + is used to load much of the annoying advertisements and extra cruft that comes along with most modern websites. With it disabled, websites will + load faster, consume less network traffic, and only contain less annoying advertisements, instead of those that do things like cover up the text of the + entire web page.

First-Party Cookies

Cookies can be divided into two types. First-party cookies are cookies set by the website in the URL bar at the top of the page.

From the early days of the internet, it became obvious that it would be advantageous for websites to be able to store + information on a computer for future access. For example, a website that displays weather information could ask the + user for a zip code, and then store it in a cookie. The next time the user visited the website, weather information + would automatically load for that zip code, without the user having to enter the zip code, and without the need for + the user to create an account on the website (which would be overkill for such a simple task).

Like everything else on the web, clever people figured out all types of ways to abuse cookies to do things that users + would not approve of if they knew they were happening. For example, a website can set a cookie with a unique serial + number on a device. Then, every time a user visits the website on that device, it can be linked to a unique profile + the server maintains for that serial number, even if the device connects from different IP addresses, as cell phones often do.

Some websites with logins require first-party cookies to be enabled for a user to stay logged in. Cookies aren't the only only way + a website can maintain a user logged in as they move from page to page on the site, but if a particular website has chosen to + implement logins in that way, enabling first-party cookies on that site will be the only way to use the functionality.

If first-party cookies are enabled but JavaScript is disabled, the privacy icon will be yellow + as a warning.

Third-Party Cookies

Third-party cookies are set by portions of a website that are loaded from servers different from the URL at the top of the page. + For example, most website that have advertisements load them from a third-party ad broker, like Google's + Ad Sense. Every time the website loads, it requests the ad + broker to display some ads. The ad broker analyzes any information they may have about the user, looks at the current + rate advertisers are willing to pay for their ads, and selects those to display. The section of the website that displays + the ads is loaded from the third-party broker's server instead of the main server.

Because most of the advertisements on the internet are displayed from only a few brokers, it didn't take long for them to realize + that they could set a tracking cookie on the user's device and know every place that user goes. Every time an ad loads from a broker, + the first thing it does it check to see if if the device already has a unique serial number in a tracking cookie. If it does, it looks up + the profile for that serial number and makes a note of the new site. This is why a user can do a search on one website for a + product that they typically don't look for, like walnuts, and then suddenly start seeing advertisements for walnuts on every + website they visit.

In addition to ad brokers, social media sites discovered they could get in on the action. A few years ago, the major social media sites + like Facebook and Twitter convinced a large number of websites that it would be in there best interest to place little social media + icons on their pages. These are not just images. They contain imbedded code that + links back to the social media site, and, among other things, loads a third-party cookie on the device. These cookies are placed even if the user does + not have an account with the social media platform. Over time, companies like Facebook (which also run an ad network) have built up quite a large number + of detailed profiles about people who have never even + created an account on their site.

There is almost no good reason to ever enable third-party cookies. On devices with Android KitKat or older (version <= 4.4.4 or API <= 20), WebView + does not differentiate + between first-party and third-party cookies. Thus, enabling first-party cookies will also enable third-party cookies.

DOM Storage

Document Object Model storage, also known as web storage, is like cookies on steroids. Whereas the maximum combined storage size for all cookies from + a single URL is 4 kilobytes, DOM storage can hold between 5-25 megabytes per site. + Because DOM storage uses JavaScript to read and write data, enabling it will do nothing unless JavaScript is also enabled.

True Privacy

Privacy Browser is designed to let you take as much control of your privacy as possible while still browsing the internet. + When you connect to a website, certain pieces of information which are necessary to facilitate the connection are transferred to the server. + For example, the server will receive your IP address and a port number, which are necessary so it knows where to send the response. + This information is often logged by the server, allowing the website developer to produce reports showing how often a webpage was loaded + and how many different IP addresses accessed it.

However, most website operators want to track your web browsing across multiple websites, not just on a single server. There are many techniques they use to do so. + Some of them involve requesting or placing extra information on your device that facilitates this tracking. Almost all browsers will voluntarily participate in this tracking + without informing the user they are doing so. Privacy Browser is designed to grant the user as much information and control over these tracking techniques as possible.

WebView Limitations

Privacy Browser uses Android's built-in WebView to render websites. There are some limitations in the controls WebView exposes for managing privacy settings. + Once Privacy Browser has matured to take full advantage of all the privacy options WebView does offer, some consideration might be made to imbedding a customized WebView + or using a different rendering engine.

The Best Is Yet to Come

Privacy Browser is still in its infancy. Most of the best features are yet to be implemented. They include the following:

SSL certificate controls.
Fine grained controls for cookies and DOM storage.
Automatically loading of privacy settings by URL.
Encrypted sync between devices.
Tabbed browsing.

A full list of planned features and bug reports is available on redmine.stoutner.com.

Masking IP Addresses

Although it isn't a perfect science, IP addresses can be turned into physical addresses with increasing accuracy. + There are public databases that show which ISP owns which IP address with a + good sense of which region they use it in. There are private databases with more accurate information. And, of course, + the ISP knows the exact service address of each IP address.

VPN services can mask a device's IP address from a web server. When a VPN service is engaged, all traffic is encrypted and routed + through the VPN server. The web server only sees the IP address of the VPN server. This is sufficient for maintaining anonymity + from web server operators and advertisers, but it isn't sufficient for maintaining anonymity from oppressive regimes which might + be able to lean on VPN operators to turn over their logs showing the original IP addresses. Those looking for safety from such + regimes or desiring to blow the whistle on government agencies need something more.

The Tor (The Onion Router) network was designed for just such purposes. It bounces encrypted web traffic through at least three independent servers + that volunteer bandwidth to the project. None of the servers have enough information to identify both the IP address of the original computer + and the final destination. Therefore, any government agency wanting to access the information would have to compromise all the machines in the + link, which are dispersed over the globe. This doesn't provide perfect privacy, but it gets pretty close.

The Tor project has an app for Android called Orbot, which is available on F-Droid + and everywhere else Privacy Browser is distributed. Orbot can operate in three modes.

Proxy mode Apps have to request to proxy their traffic through Orbot, meaning that each app developer has to add code to + their project to make it work.
Transparent proxy mode Orbot intercepts traffic from other apps as it heads out onto the network and redirects it to the + Tor network. Apps do not need to be modified by their developer to work with transparent proxy mode, but it does require that Orbot have + root access on the device.
VPN mode Orbot registers itself as a VPN using Android's builtin VPN interface. Apps do not need to be modified by the + developer to work with Orbot in VPN mode and root is not required.

Currently, Privacy Browser works with Orbot in transparent proxy and VPN modes. Support for the standard proxy mode will be added in a + future release.

Because traffic is being routed through several Tor nodes, using Tor is often much slower than going straight to the internet.

Privacy Browser Free includes a banner advertisement across the bottom of the screen that is populated by Google's + AdMob network. By default, Google provides the advertising ID + of the device to the ads displayed through this network. This allows advertising companies to build a profile of + the device that show which apps are installed (that display ads), how often they are used, and which ads the user is interested in.

Users can choose to disable the advertising ID in Settings, Google, Ads.

The purpose of the free version of Privacy Browser is to allow people to test the features of the app. The standard version can be purchased + on the major app stores or downloaded for free from + F-Droid.

Verizon Tracking Headers

Verizon, one of the major mobile carriers in the United States, adds a unique tracking header to all HTTP traffic on their network. The Electronic Frontier + Foundation has written about the privacy implications of this practice. Due to public pressure + Verizon has created a way to opt out of this tracking.

Browser Identification

When web browsers connect to websites, they send a user agent, which identifies the browser and the + rendering capabilities it possesses. They website can use this information to decide which version of the + website to send to the browser. For example, many websites have different versions for desktop and + mobile browsers.

By default, Privacy Browser uses the built-in user agent that comes with the WebView installed on the + device. You can see what it is by going to the Settings screen and setting the User + agent to WebView Default. The screenshot below shows a Nexus 6P running Android 6.0.1 + with Android System WebView 51.0.2704.81 installed.

There is enough information in the user agent that someitmes only a few visitors to a website will be the same. If the user agent + is combined with another piece of non-unique identifying information, often it results in a unique fingerprint. + The Electronic Frontier Foundation created a tool called Panopticlick + to demonstrate how much information can be gleaned from these sources. If this test is run with JavaScript enabled the + amount of information that is disclosed increases greatly.

Privacy Browser allows you to change the user agent. There are several preset options that match common browsers and operating systems. + Privacy Browser also has its own user agent, which is simply PrivacyBrowser/1.0. For tracking purposes, anything that is rare is easier + to track. If Privacy Browser becomes common and many people use PrivacyBrowser/1.0 as their user agent, it will be a good choice for privacy. + For now, choosing something that has lots of hits on a web server, like Edge 13 on Windows 10, allows the device to + blend in with the crowd. Firefox or Chrome provide less privacy because they auto-update and their version numbers change so quickly + that it is likely the user agents included in Privacy Browser will often be out of step with the majority of user agents in the + server logs.

A second reason to change the user agent is to convince the web server to send the desktop version of the web page, which often works + better on modern smart phones than the mobile version. For this purpose, PrivacyBrowser/1.0 works well, because web servers typically + default to the desktop version unless they recognize a phone browser agent.

Android's WebView does not allow the user agent to be blank. If it is, WebView simply sends the default user-agent to the server.

. + * + * This file is part of Privacy Browser . + * + * Privacy Browser is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * Privacy Browser is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Privacy Browser. If not, see . + */ + +package com.stoutner.privacybrowser; + +import android.os.Bundle; +import android.support.design.widget.TabLayout; +import android.support.v4.app.Fragment; +import android.support.v4.app.FragmentManager; +import android.support.v4.app.FragmentPagerAdapter; +import android.support.v4.view.ViewPager; +import android.support.v7.app.ActionBar; +import android.support.v7.app.AppCompatActivity; +import android.support.v7.widget.Toolbar; + +public class GuideActivity extends AppCompatActivity { + @Override + protected void onCreate(Bundle savedInstanceState) { + super.onCreate(savedInstanceState); + setContentView(R.layout.guide_coordinatorlayout); + + // We need to use the SupportActionBar from android.support.v7.app.ActionBar until the minimum API is >= 21. + Toolbar supportAppBar = (Toolbar) findViewById(R.id.guide_toolbar); + setSupportActionBar(supportAppBar); + + // Display the home arrow on supportAppBar. + final ActionBar appBar = getSupportActionBar(); + assert appBar != null;// This assert removes the incorrect warning in Android Studio on the following line that appBar might be null. + appBar.setDisplayHomeAsUpEnabled(true); + + // Setup the ViewPager. + ViewPager aboutViewPager = (ViewPager) findViewById(R.id.guide_viewpager); + assert aboutViewPager != null; // This assert removes the incorrect warning in Android Studio on the following line that aboutViewPager might be null. + aboutViewPager.setAdapter(new guidePagerAdapter(getSupportFragmentManager())); + + // Setup the TabLayout and connect it to the ViewPager. + TabLayout aboutTabLayout = (TabLayout) findViewById(R.id.guide_tablayout); + assert aboutTabLayout != null; // This assert removes the incorrect warning in Android Studio on the following line that aboutTabLayout might be null. + aboutTabLayout.setupWithViewPager(aboutViewPager); + } + + public class guidePagerAdapter extends FragmentPagerAdapter { + public guidePagerAdapter(FragmentManager fm) { + super(fm); + } + + @Override + // Get the count of the number of tabs. + public int getCount() { + return 8; + } + + @Override + // Get the name of each tab. Tab numbers start at 0. + public CharSequence getPageTitle(int tab) { + switch (tab) { + case 0: + return getString(R.string.overview); + + case 1: + return getString(R.string.javascript); + + case 2: + return getString(R.string.local_storage); + + case 3: + return getString(R.string.user_agent); + + case 4: + return getString(R.string.tor); + + case 5: + return getString(R.string.tracking_uids); + + case 6: + return getString(R.string.clear_and_exit); + + case 7: + return getString(R.string.planned_features); + + default: + return ""; + } + } + + @Override + // Setup each tab. + public Fragment getItem(int tab) { + return GuideTabFragment.createTab(tab); + } + } + +} diff --git a/app/src/main/java/com/stoutner/privacybrowser/GuideTabFragment.java b/app/src/main/java/com/stoutner/privacybrowser/GuideTabFragment.java new file mode 100644 index 00000000..47d8ba7e --- /dev/null +++ b/app/src/main/java/com/stoutner/privacybrowser/GuideTabFragment.java @@ -0,0 +1,97 @@ +/** + * Copyright 2016 Soren Stoutner . + * + * This file is part of Privacy Browser . + * + * Privacy Browser is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * Privacy Browser is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Privacy Browser. If not, see . + */ + +package com.stoutner.privacybrowser; + +import android.os.Bundle; +import android.support.v4.app.Fragment; +import android.view.LayoutInflater; +import android.view.View; +import android.view.ViewGroup; +import android.webkit.WebView; + +public class GuideTabFragment extends Fragment { + private int tabNumber; + + // GuideTabFragment.createTab stores the tab number in the bundle arguments so it can be referenced from onCreate(). + public static GuideTabFragment createTab (int tab) { + Bundle thisTabArguments = new Bundle(); + thisTabArguments.putInt("Tab", tab); + + GuideTabFragment thisTab = new GuideTabFragment(); + thisTab.setArguments(thisTabArguments); + return thisTab; + } + + @Override + public void onCreate(Bundle savedInstanceState) { + super.onCreate(savedInstanceState); + + // Store the tab number in tabNumber. + tabNumber = getArguments().getInt("Tab"); + } + + @Override + public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) { + // Setting false at the end of inflater.inflate does not attach the inflated layout as a child of container. + // The fragment will take care of attaching the root automatically. + View tabLayout = inflater.inflate(R.layout.guide_tab_webview, container, false); + WebView tabWebView = (WebView) tabLayout; + + // Tab numbers start at 0. + switch (tabNumber) { + case 0: + tabWebView.loadUrl("file:///android_asset/guide_overview.html"); + break; + + case 1: + tabWebView.loadUrl("file:///android_asset/guide_javascript.html"); + break; + + case 2: + tabWebView.loadUrl("file:///android_asset/guide_local_storage.html"); + break; + + case 3: + tabWebView.loadUrl("file:///android_asset/guide_user_agent.html"); + break; + + case 4: + tabWebView.loadUrl("file:///android_asset/guide_tor.html"); + break; + + case 5: + tabWebView.loadUrl("file:///android_asset/guide_tracking_uids.html"); + break; + + case 6: + tabWebView.loadUrl("file:///android_asset/guide_clear_and_exit.html"); + break; + + case 7: + tabWebView.loadUrl("file:///android_asset/guide_planned_features.html"); + break; + + default: + break; + } + + return tabLayout; + } +} diff --git a/app/src/main/java/com/stoutner/privacybrowser/MainWebViewActivity.java b/app/src/main/java/com/stoutner/privacybrowser/MainWebViewActivity.java index de910d50..993c363b 100644 --- a/app/src/main/java/com/stoutner/privacybrowser/MainWebViewActivity.java +++ b/app/src/main/java/com/stoutner/privacybrowser/MainWebViewActivity.java @@ -204,18 +204,15 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation // Update the progress bar when a page is loading. @Override public void onProgressChanged(WebView view, int progress) { - // Make sure that appBar is not null. - if (appBar != null) { - ProgressBar progressBar = (ProgressBar) appBar.getCustomView().findViewById(R.id.progressBar); - progressBar.setProgress(progress); - if (progress < 100) { - progressBar.setVisibility(View.VISIBLE); - } else { - progressBar.setVisibility(View.GONE); + ProgressBar progressBar = (ProgressBar) appBar.getCustomView().findViewById(R.id.progressBar); + progressBar.setProgress(progress); + if (progress < 100) { + progressBar.setVisibility(View.VISIBLE); + } else { + progressBar.setVisibility(View.GONE); - //Stop the SwipeToRefresh indicator if it is running - swipeToRefresh.setRefreshing(false); - } + //Stop the SwipeToRefresh indicator if it is running + swipeToRefresh.setRefreshing(false); } } @@ -225,19 +222,15 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation // Save a copy of the favorite icon for use if a shortcut is added to the home screen. favoriteIcon = icon; - // Place the favorite icon in the appBar if it is not null. - if (appBar != null) { - ImageView imageViewFavoriteIcon = (ImageView) appBar.getCustomView().findViewById(R.id.favoriteIcon); - imageViewFavoriteIcon.setImageBitmap(Bitmap.createScaledBitmap(icon, 64, 64, true)); - } + // Place the favorite icon in the appBar. + ImageView imageViewFavoriteIcon = (ImageView) appBar.getCustomView().findViewById(R.id.favoriteIcon); + imageViewFavoriteIcon.setImageBitmap(Bitmap.createScaledBitmap(icon, 64, 64, true)); } // Enter full screen video @Override public void onShowCustomView(View view, CustomViewCallback callback) { - if (appBar != null) { - appBar.hide(); - } + appBar.hide(); // Show the fullScreenVideoFrameLayout. assert fullScreenVideoFrameLayout != null; //This assert removes the incorrect warning on the following line that fullScreenVideoFrameLayout might be null. @@ -271,9 +264,7 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation // Exit full screen video public void onHideCustomView() { - if (appBar != null) { - appBar.show(); - } + appBar.show(); // Show the mainWebView. mainWebView.setVisibility(View.VISIBLE); @@ -474,6 +465,10 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation MenuItem clearCookies = menu.findItem(R.id.clearCookies); clearCookies.setEnabled(cookieManager.hasCookies()); + // Enable DOM Storage if JavaScript is enabled. + MenuItem toggleDomStorage = menu.findItem(R.id.toggleDomStorage); + toggleDomStorage.setEnabled(javaScriptEnabled); + // Run all the other default commands. super.onPrepareOptionsMenu(menu); @@ -505,7 +500,7 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation if (javaScriptEnabled) { Snackbar.make(findViewById(R.id.mainWebView), R.string.javascript_enabled, Snackbar.LENGTH_SHORT).show(); } else { - if (domStorageEnabled || firstPartyCookiesEnabled) { + if (firstPartyCookiesEnabled) { Snackbar.make(findViewById(R.id.mainWebView), R.string.javascript_disabled, Snackbar.LENGTH_SHORT).show(); } else { Snackbar.make(findViewById(R.id.mainWebView), R.string.privacy_mode, Snackbar.LENGTH_SHORT).show(); @@ -559,9 +554,6 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation // Apply the new DOM Storage status. mainWebView.getSettings().setDomStorageEnabled(domStorageEnabled); - // Update the privacy icon. - updatePrivacyIcon(); - // Reload the WebView. mainWebView.reload(); return true; @@ -640,6 +632,12 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation startActivity(downloadManagerIntent); break; + case R.id.guide: + // Launch GuideActivity. + Intent guideIntent = new Intent(this, GuideActivity.class); + startActivity(guideIntent); + break; + case R.id.settings: // Launch SettingsActivity. Intent settingsIntent = new Intent(this, SettingsActivity.class); @@ -653,10 +651,6 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation break; case R.id.clearAndExit: - // Clear DOM storage. - WebStorage domStorage = WebStorage.getInstance(); - domStorage.deleteAllData(); - // Clear cookies. The commands changed slightly in API 21. if (Build.VERSION.SDK_INT >= 21) { cookieManager.removeAllCookies(null); @@ -664,6 +658,10 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation cookieManager.removeAllCookie(); } + // Clear DOM storage. + WebStorage domStorage = WebStorage.getInstance(); + domStorage.deleteAllData(); + // Clear cache. The argument of "true" includes disk files. mainWebView.clearCache(true); @@ -743,7 +741,7 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation drawerLayout.closeDrawer(GravityCompat.START); } else { // Load the previous URL if available. - assert mainWebView != null; //This assert removes the incorrect warning on the following line that mainWebView might be null. + assert mainWebView != null; //This assert removes the incorrect warning in Android Studio on the following line that mainWebView might be null. if (mainWebView.canGoBack()) { mainWebView.goBack(); } else { @@ -821,7 +819,7 @@ public class MainWebViewActivity extends AppCompatActivity implements Navigation if (javaScriptEnabled) { privacyIcon.setIcon(R.drawable.javascript_enabled); } else { - if (domStorageEnabled || firstPartyCookiesEnabled) { + if (firstPartyCookiesEnabled) { privacyIcon.setIcon(R.drawable.warning); } else { privacyIcon.setIcon(R.drawable.privacy_mode); diff --git a/app/src/main/java/com/stoutner/privacybrowser/SettingsFragment.java b/app/src/main/java/com/stoutner/privacybrowser/SettingsFragment.java index f72337c2..132de65c 100644 --- a/app/src/main/java/com/stoutner/privacybrowser/SettingsFragment.java +++ b/app/src/main/java/com/stoutner/privacybrowser/SettingsFragment.java @@ -39,6 +39,13 @@ public class SettingsFragment extends PreferenceFragment { // Initialize savedPreferences. savedPreferences = getPreferenceScreen().getSharedPreferences(); + // Allow the user to access "dom_storage_enabled" if "javascript_enabled" is enabled. The default is false. + final Preference domStorageEnabled = findPreference("dom_storage_enabled"); + domStorageEnabled.setEnabled(savedPreferences.getBoolean("javascript_enabled", false)); + + // Allow the user to access "third_party_cookies_enabled" if "first_party_cookies_enabled" is enabled. The default is false. + final Preference thirdPartyCookiesEnabled = findPreference("third_party_cookies_enabled"); + thirdPartyCookiesEnabled.setEnabled(savedPreferences.getBoolean("first_party_cookies_enabled", false)); // Set the current user-agent as the summary text for the "user_agent" preference when the preference screen is loaded. final Preference userAgentPreference = findPreference("user_agent"); @@ -110,56 +117,45 @@ public class SettingsFragment extends PreferenceFragment { // Listen for preference changes. preferencesListener = new SharedPreferences.OnSharedPreferenceChangeListener() { @Override - // Remove Android Studio's warning about the dangers of using SetJavaScriptEnabled. + // Remove Android Studio's warning about the dangers of using SetJavaScriptEnabled. We know. @SuppressLint("SetJavaScriptEnabled") public void onSharedPreferenceChanged(SharedPreferences sharedPreferences, String key) { - // Several keys need to update the toggleJavaScript icon. - MenuItem toggleJavaScript = MainWebViewActivity.mainMenu.findItem(R.id.toggleJavaScript); - switch (key) { case "javascript_enabled": // Set javaScriptEnabled to the new state. The default is false. MainWebViewActivity.javaScriptEnabled = sharedPreferences.getBoolean("javascript_enabled", false); + // Toggle the state of the "dom_storage_enabled" preference. The default is false. + final Preference domStorageEnabled = findPreference("dom_storage_enabled"); + domStorageEnabled.setEnabled(sharedPreferences.getBoolean("javascript_enabled", false)); + // Update mainWebView and reload the website. MainWebViewActivity.mainWebView.getSettings().setJavaScriptEnabled(MainWebViewActivity.javaScriptEnabled); MainWebViewActivity.mainWebView.reload(); - // Update the toggleJavaScript icon. - if (MainWebViewActivity.javaScriptEnabled) { - toggleJavaScript.setIcon(R.drawable.javascript_enabled); - } else { - if (MainWebViewActivity.firstPartyCookiesEnabled || MainWebViewActivity.domStorageEnabled) { - toggleJavaScript.setIcon(R.drawable.warning); - } else { - toggleJavaScript.setIcon(R.drawable.privacy_mode); - } - } + // Update the privacy icon. + updatePrivacyIcon(); break; case "first_party_cookies_enabled": // Set firstPartyCookiesEnabled to the new state. The default is false. MainWebViewActivity.firstPartyCookiesEnabled = sharedPreferences.getBoolean("first_party_cookies_enabled", false); - // Update the checkbox in the options menu. - MenuItem firstPartyCookiesMenuItem = MainWebViewActivity.mainMenu.findItem(R.id.toggleFirstPartyCookies); - firstPartyCookiesMenuItem.setChecked(MainWebViewActivity.firstPartyCookiesEnabled); + // Toggle the state of the "third_party_cookies_enabled" preference. The default is false. + final Preference thirdPartyCookiesEnabled = findPreference("third_party_cookies_enabled"); + thirdPartyCookiesEnabled.setEnabled(sharedPreferences.getBoolean("first_party_cookies_enabled", false)); // Update mainWebView and reload the website. MainWebViewActivity.cookieManager.setAcceptCookie(MainWebViewActivity.firstPartyCookiesEnabled); MainWebViewActivity.mainWebView.reload(); - // Update the toggleJavaScript icon. - if (MainWebViewActivity.javaScriptEnabled) { - toggleJavaScript.setIcon(R.drawable.javascript_enabled); - } else { - if (MainWebViewActivity.firstPartyCookiesEnabled || MainWebViewActivity.domStorageEnabled) { - toggleJavaScript.setIcon(R.drawable.warning); - } else { - toggleJavaScript.setIcon(R.drawable.privacy_mode); - } - } + // Update the checkbox in the options menu. + MenuItem firstPartyCookiesMenuItem = MainWebViewActivity.mainMenu.findItem(R.id.toggleFirstPartyCookies); + firstPartyCookiesMenuItem.setChecked(MainWebViewActivity.firstPartyCookiesEnabled); + + // Update the privacy icon. + updatePrivacyIcon(); break; case "third_party_cookies_enabled": @@ -189,16 +185,8 @@ public class SettingsFragment extends PreferenceFragment { MainWebViewActivity.mainWebView.getSettings().setDomStorageEnabled(MainWebViewActivity.domStorageEnabled); MainWebViewActivity.mainWebView.reload(); - // Update the toggleJavaScript icon. - if (MainWebViewActivity.javaScriptEnabled) { - toggleJavaScript.setIcon(R.drawable.javascript_enabled); - } else { - if (MainWebViewActivity.firstPartyCookiesEnabled || MainWebViewActivity.domStorageEnabled) { - toggleJavaScript.setIcon(R.drawable.warning); - } else { - toggleJavaScript.setIcon(R.drawable.privacy_mode); - } - } + // Update the privacy icon. + updatePrivacyIcon(); break; case "user_agent": @@ -333,4 +321,19 @@ public class SettingsFragment extends PreferenceFragment { super.onResume(); savedPreferences.registerOnSharedPreferenceChangeListener(preferencesListener); } + + private void updatePrivacyIcon() { + // Define a reference to the toggleJavaScript icon. + MenuItem toggleJavaScript = MainWebViewActivity.mainMenu.findItem(R.id.toggleJavaScript); + + if (MainWebViewActivity.javaScriptEnabled) { + toggleJavaScript.setIcon(R.drawable.javascript_enabled); + } else { + if (MainWebViewActivity.firstPartyCookiesEnabled) { + toggleJavaScript.setIcon(R.drawable.warning); + } else { + toggleJavaScript.setIcon(R.drawable.privacy_mode); + } + } + } } diff --git a/app/src/main/res/layout/about_coordinatorlayout.xml b/app/src/main/res/layout/about_coordinatorlayout.xml index 94556343..4ec9d4d1 100644 --- a/app/src/main/res/layout/about_coordinatorlayout.xml +++ b/app/src/main/res/layout/about_coordinatorlayout.xml @@ -20,7 +20,7 @@ + to make the status bar a transparent, darkened overlay. --> + android:padding="16dp" > + xmlns:tools="http://schemas.android.com/tools" > @@ -83,7 +83,7 @@ android:paddingStart="4dp" android:paddingEnd="0dp" android:paddingLeft="4dp" - android:paddingRight="4dp"> + android:paddingRight="4dp" > + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/app/src/main/res/layout/guide_tab_webview.xml b/app/src/main/res/layout/guide_tab_webview.xml new file mode 100644 index 00000000..3c9846a4 --- /dev/null +++ b/app/src/main/res/layout/guide_tab_webview.xml @@ -0,0 +1,26 @@ + + + + + + \ No newline at end of file diff --git a/app/src/main/res/values-v19/styles.xml b/app/src/main/res/values-v19/styles.xml index 86223d31..d039bcbd 100644 --- a/app/src/main/res/values-v19/styles.xml +++ b/app/src/main/res/values-v19/styles.xml @@ -19,18 +19,16 @@ along with Privacy Browser. If not, see . --> - - diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml index eb2a4585..eaaf2cd7 100644 --- a/app/src/main/res/values/strings.xml +++ b/app/src/main/res/values/strings.xml @@ -64,20 +64,24 @@ Cancel Create + + Privacy Browser Guide + Overview + Local Storage + Tor + Tracking UIDs + Planned Features + Privacy Enable JavaScript by default JavaScript allows websites to run programs (scripts) on your device. Enable first-party cookies by default - Cookies allow websites to store information on your device. - First-party cookies come from the server listed in the address bar. - Devices with versions of Android older than Lollipop (version 5.0) will also enable third-party cookies with this setting. + Devices with versions of Android older than Lollipop (version 5.0) will also enable third-party cookies with this setting. Enable third-party cookies by default - Third-party cookies allow parts of websites that aren\'t the main website, like advertisements, to store information on your device. - This setting requires Android Lollipop (version 5.0) or higher. This setting has no effect if first-party cookies are disabled. + This setting requires Android Lollipop (version 5.0) or higher. It has no effect if first-party cookies are disabled. Enable DOM storage by default - Document Object Management storage, also called web storage, is an enhanced form of cookies - that allows websites to store larger and more complex types of information, like pictures, on your device. + JavaScript must be enabled for DOM storage to function. User agent

WebView Default diff --git a/app/src/main/res/values/styles.xml b/app/src/main/res/values/styles.xml index d11ddae2..371d0134 100644 --- a/app/src/main/res/values/styles.xml +++ b/app/src/main/res/values/styles.xml @@ -24,14 +24,9 @@ @color/blue - - + +

Privacy Browser Free

Advertisements

Google Play Ratings

Google Play Reviews

Principle Developers

Contributors

Copyright

License

Attributions

Have full network access

Install shortcuts

Privacy Browser

Google Play Ratings

Google Play Reviews

Cleaning Out the Cruft

JavaScript Is Powerful

JavaScript Is Dangerous

First-Party Cookies

Third-Party Cookies

DOM Storage

True Privacy

WebView Limitations

The Best Is Yet to Come

Masking IP Addresses

Advertisements

Verizon Tracking Headers

Browser Identification