Google Maps learns to bike

Google Maps does free offline navigation, sort of. You need a live internet connection to calculate routes, and you can only download 6 map areas of about 80 MB each. The maps for some countries are only available online, because Google Maps won't let you download them.

But the free competitors use OpenStreetMap, which has some issues of its own. OpenStreetMap is sometimes very outdated and non-urban areas are often terra incognito. Especially outside the USA and the nortwestern part of Europe.

Google Maps calculates routes for driving and walking, but bike routes were limited to two countries only.

That changed. Google Maps now knows the bike lanes in twelve countries. Nine of the ten new countries with bike navigation are in Europe, the tenth is Australia. Canada and the USA already had bike navigation.

The calculated bike routes are not always good. For example, Google Maps doesn't know about the bike lanes in the park next to my house, so it sends me to the busy street that runs next to it. The green dotted lines for bike-friendly streets without bike lanes look rather clumsy, especially when you zoom out.

Maybe Google will improve their bike route calculation. And add offline route calculation. Until then there are times when you may be better off with OsmAnd.

• Google Maps

I don't want your app, I already have a web browser

What's with websites that want you to install an app that loads a single site and no more than that?

Surf to any online forum on your phone and there's a good chance it will pop up some annoying Tapatalk spam.

Anything Tapatalk can do is possible with some HTML5 in any web browser, but at least Tapatalk lets you surf multiple forums in one app.

But what are sites like The Verge thinking?

The Verge has a mobile app. They could advertise it with a small banner or a line of text on their mobile site, but instead they shove it in your face with something that's even worse than a popup ad.

Popup ads are horrible, but at least you can click 'em away and arrive straight at the site you wanted to go to, because the popup and the site that spawns it load at the same time.

The Verge loads a screen nagging you about its app, and when you tap the "screw you, take me to the page I asked for" link it starts loading the page you're after, even though it knows you wanted to go there from the very beginning. You may continue to your target destination later, but next time you fire up your browser the ordeal starts all over again.

The Verge is not the only site that annoys the hell out of me. Plenty of other sites use the same obnoxious method to advertise their app. I'd welcome a mobile browser plugin that auto-skips all these nag screens. It would be even better if that plugin can make the Tapatalk popups drop dead too.

There's no way to make these popups and nag screens disappear yet, but at least you can kill most banner ads with apps like AdAway.

Your private data on your Android phone is up for grabs

What if I didn't root my phone or tablet and I've set a pattern lock, PIN, or password. My data is safe, right?

Nope.

USB debugging breaks your lockscreen

USB debugging lets your computer manage things on your Android phone or tablet. That can be very useful, but it can be very dangerous too.

Have a pattern lock? Good for you. Even the FBI can't crack it. Unless you leave USB debugging switched on, because then even the spotty teenager next door can throw some adb at your phone and pwn it without limits. Having a rooted phone helps the burglars, but root is not required to crack your pattern lock. To make things worse, a similar procedure kills your PIN or password lock as well. Take home message: if you leave USB debugging on your lockscreen is wide open.

And as if that's not bad enough, keeping USB debugging active lets any toddler flash your phone. A new system partition together with your old data partition that holds your address book, messages, etcetera... ouch!

A custom recovery recovers too much

USB debugging switched off, now my data is safe, right?

Nope, it isn't.

If the bad guy can reboot into recovery he's in. No USB debugging needed. And if you have a custom recovery installed (and if you read this blog you probably have) your data is up for grabs too. Any thief can boot into your recovery menu and mount the data partition. Or make a Nandroid backup of your entire phone and extract your data from the backup. Apps like Titanium can restore some very private data from Nandroid backups, even if the Nandroid was made on another phone. To close this security hole, future versions of ClockWorkMod recovery and the likes should let you set a PIN or password so you can keep the unwanted out of your recovery.

Open bootloader is open phone

And even password-protected recoveries are not enough. If your bootloader can be unlocked, a thief could unlock it, flash a custom recovery, and he's in.

The only phone that appears safe is a phone with a locked bootloader, no custom recovery installed, and USB debugging switched off. Wouldn't it be time for Android to encrypt its data partition?

Wipe!

If your phone gets lost or stolen and your private data should stay private, Don't assume the locks on your phone will hold. Try to do a remote wipe as soon as possible. Apps like avast can help you erase your tracks before they fall into the wrong hands. Even if your remote wipe succeeds, the thief may already have made a backup to pry open at his leisure. So if your phone goes missing, don't forget to change the passwords for all your accounts everywhere, starting with your email.

Hotspot Shield VPN adds fake quit button and goes online behind your back, use Hideman VPN instead

Shoot the messenger

Sometimes you can't trust the local WiFi connection but you need to check your mail anyway. That's when Virtual Private Networks are useful. They solve the old problem of keeping your messages secret when you can't trust the messenger.

A VPN app encrypts your internet traffic before it gets sent to the WiFi router. Vice versa, the VPN server returns your web traffic in encrypted form and only your phone can decrypt it. This way a rogue access point can't steal your data, although the VPN service can.

VPN servers usually want your money for their services, but there are some free options. Hideman VPN gives you 5 hours of secure internet for free. Hotspot Shield VPN doesn't have any time limits. Too bad it doesn't know when to stop.

Won't go away

Old versions of Hotspot Shield had an exit button to shut down the app. Updates removed the option to quit the program, so its background service would keep running and your notification bar would stay polluted with its very ugly red icon.

Needless to say, negative Play Store ratings and matching comments started piling up, so Hotspot Shield brought the quit button back.

Well, sort of.

The quit button doesn't work. It removes the red icon from your status bar, but the app keeps running. Most apps stay inactive when you dismiss them, but Hotspot Shield keeps kicking when it shouldn't.

When you quit Hotspot Shield its red status bar icon returns after a while, all by itself. And if you look at your network traffic you'll find that Hotspot Shield phones home after it should have been shut down. It comes with a lot of autostart triggers too. Autostart on boot. Autostart on installing, updating, and removing apps. And it won't let you switch any of these autostart triggers off.

As for the data it sends out when it's not supposed to be running, the makers of Hotspot Shield don't tell you what's in those packets.

Tame or kill

You can kill all of Hotspot Shields unwanted behaviour by uninstalling the app. Competing app Hideman VPN doesn't autostart on boot, and when you exit the app you really exit the app. It doesn't spoil your notification bar with ugly icons either.

But Hideman only gives you five free hours of VPN per week. If you want more, you can try to keep Hotspot Shield under control.

When you quit Hotspot Shield it keeps running in the background, but if you switch WiFi off Hotspot Shield goes away. If you switch WiFi back on the app stays away, at least for a while, because it doesn't (yet) have a network state autorun trigger.

You can try to switch its autorun triggers off. Not from within the app, but Gemini App Manager is a very useful tool to tame Hotspot Shield and other unruly apps.

And of course you can always force the app away with the force stop button in the Android application settings. Or automate it with a third party tool, because Hotspot Shield VPN is one of the reasons why task killers sometimes make sense.

Update: Even when I switched off all autostart functions that I could find, Hotspot Shield kept relaunching its background process (called AF Service), and the red icon kept coming back to my status bar. Hotspot Shield kept going online even though I was not using its VPN service, which is totally unacceptable. Judging from the Play Store comments I'm not the only one.

Because Hotspot Shield VPN behaves like malware it is no longer installed on my phone. The five hours per week from Hideman VPN are enough for me, and their quit button really works.

• Hotspot Shield VPN (very intrusive autostart behaviour)
• Hideman VPN (only runs when you want it to run)

• control autostart triggers with Gemini App Manager

Avast anti-theft goes online

Catches viruses and thieves

Opinions on the usefulness of antivirus apps for Android are as fragmented as Android itself, but most people agree that the extra features of these apps are useful even if you don't use the anti-virus part.

Virus killer avast comes with a firewall that knows the difference between home networks and roaming, an app permissions scanner, a call filter, and much more. Its anti-theft system can find, lock, and block your phone to keep the thieves out, or make it scream so you can retrieve it from under the couch. If your phone is rooted you can make the anti-theft function survive a factory reset.

Online

The anti-theft functions could be activated by SMS only, but avast promised that web-based remote control would be ready in early 2012. They're six months late, but it's finally there.

Make an avast account and you can log into avast.com to do all sorts of things from their web portal. Lock your phone to keep the thieves out. Force the data connection on to help your missing phone keep in touch with you. Block access to the settings menus. And if your phone won't come back you can send a remote wipe command to keep the bad guys out of your private data. Too bad avast won't send a backup to your Dropbox account before it wipes your phone. Maybe in the next version?

Bonus feature: you can send out a command to turn USB debugging off. That may sound like a useless feature for geeks, but it can stop thieves from hooking your phone to a computer to bypass your lock pattern or pin code.

Where's my phone?

Of course avast can make your phone send out its coordinates to find it on the map. The locate command activates your GPS, and if your phone is out of satellite range it will use WiFi and mobile data for a location estimate.

Unfortunately GPS-less location requires that the network location service is already running, because avast can't switch it on for you. Avast anti-theft would improve a lot if it can bypass Androids network location lock. Avast knows how to take advantage of root access, so this shouldn't be too hard to add.

• avast! (Google Play Store)
• avast.com

Half-baked RealPlayer out of beta testing

Flashback

Remember RealPlayer? That annoying media player from the days of Windows 98 that always tried to hijack all your music and movie file associations?

It's on Android too. Beta test versions have been floating around since ages, and now its makers think that Real is ready for commercial release. They're really, really wrong.

RealPlayer plays your music and movies, and it shows your pictures too. Too bad it doesn't do any of these jobs well.

First encounter

Among the permissions that Real wants is permission to autostart. Maybe there's a good reason for it, but the Real people didn't take the trouble to explain why.

When you run the app for the first time it scans your memory card for media files, and this takes quite some time. Android indexes your music, movies, and pictures in a database that any media player and gallery app can read, but RealPlayer rolls its own.

When it's done scanning you can look and listen. Most of the start screen organises your music, with two small buttons on the bottom for your movies and pictures.

The free version has ads. For some inexplicable reason RealPlayer decided to show me ads in japanese, even though it's obvious from my IP address that I'm from Amsterdam, The Netherlands. AdAway doesn't block these ads yet, but I'm sure an update will take care of that.

Most apps either show ads or leave some features out of the free version. RealPlayer does both. The free version shows an ugly ad banner and it's stripped of features.

Music

RealPlayer lists your music by artist, album, song title, genre, and playlist. Including the genre tag is a good thing which many music players ignore. Android music players also tend to ignore the composer tag (even my ancient Nokia read the composer tag, so why don't Android players?), and RealPlayer is no exception. Not a big problem for your average R&B track, but composers are a big deal in classical music and DJ compilations. Organising your music in folders with composer names doesn't help, because RealPlayer ignores your folder structure too. This is where the app could have made a difference, but it doesn't.

It doesn't show your album art either. You may have your album covers stored in your MP3 tags, but RealPlayer ignores them. RealPlayer can show album art, but only if you fork out cash for the paid version.

The equalizer only works in the paid version too. If you want a music app with an equalizer for free, try TTPod.

There's a built-in music identification tool similar to Shazam and SoundHound. It taps into the Gracenote database, but this feature requires payment too. TrackID from Sony gets you into the same Gracenote music database for free.

You can scrobble your music to last.fm straight from RealPlayer, and it doesn't want any of your money for that.

Pictures and movies

The picture gallery in RealPlayer is as barebones as it can be. It shows all your pictures in a giant grid and that's the only view you get. You may have your pictures sorted out in folders like "ski trip with girlfriend," "beach party with beer and weed," and "embarrasing family dinner," but RealPlayer won't look at your folder organisation. When you open a picture there's only one way to zoom: with the on-screen buttons. Each and every Android gallery app I ever tried lets you zoom in and out by pinching the screen, but RealPlayer decided to leave out this standard touchscreen feature.

RealPlayer won't show any picture details like date, time, and resolution either.

The built-in movie library shows your videos by folders. Unfortunately it mixes up some thumbnails by displaying the thumbnail image of another video. It also tends to show movies in full screen mode even when it distorts the picture. You can repair the aspect ratio with a few taps on your screen, but RealPlayer has the annoying habit of forgetting your settings so you'll have to do it all over again next time you play the same video.

The verdict

If you can make the ugly ad banner go away RealPlayer looks really slick, but when you look through the eye candy you'll find that there's not much underneath. It may be sold as "ready," but the free version lacks so many standard features that there's no point buying the full version unless you like to pay to be a beta tester. The music player is no match for other music apps, and even the stock gallery that came with your phone is better than the spartan picture viewer and movie player of RealPlayer. The app may be out of beta testing, but it's nowhere near ready yet. Take it for a test drive if you like, but don't give them any money.

• RealPlayer

Flash for Android is dead, dig up a copy from the graveyard

Yes, Flash is old, buggy, slow, and it sucks your battery dry. So is it a good thing that Adobe pulled Flash out of the Google Play Store?

Flash is also unavoidable because many websites still use it, and some will keep using Flash until the end of times.

For example, the typical bar and restaurant site requires Flash to read the menu and book a table. These sites will ditch Flash eventually, but it's gonna take a while.

Artists use lots of Flash. Paintings, photos, poetry, literature, without Flash your online culture choices are very limited. And because art sites live a lot longer than the artists who built them you're gonna need Flash for years to come.

Games? Movies? Not all of them will be converted to HTML5 or other formats, so you'll need an old Flash player to see what was hot when your grandparents were young.

But with Flash no longer available in the Play Store you'll have to get your fix of Flash somewhere else. Fortunately that's really easy.

Adobe maintains an archive of old Flash versions. It has all the Android installers too, so you can simply download the APK file, check the "unknown sources" box in Androids app settings screen, and hit install. Don't forget to set your Flash Player privacy and security settings.

If Adobe ever pulls the Android Flash installers from their site there are plenty of sites, forums, P2P networks and other sources to dig up a corpse copy of Flash.

Keep in mind that your web browser needs to support Flash for the plugin to work. Chrome doesn't, and Opera crashes when it bumps into Flash. Current versions of Dolphin Browser, Firefox for Android, and the stock browser up to Android 4.0 (Ice Cream Sandwich) support Flash, but new versions may break it so backup your browser before you update it.

• Flash for Android on adobe.com

(if this link stops working, leave a comment or hit the contact link on the bottom of this page and I'll add other links)

PBPlayer gains ads, loses purpose

Video and audio player PBPlayer used to be a simple and effective media player with a minimal set of Android permissions. It didn't ask for your location and it never went online. But not anymore.

Thumbs and times

A recent update added video thumbnail images, which you can switch off if you like the app to stay clean and minimalist. The video list of PBPlayer now shows the duration of your movies too, but not the length of your audio files.

The video thumbnail images generated by PBPlayer will appear in your gallery apps because the makers of PBPlayer forget to add a .nomedia file to the PBThumbnails folder. You can remove the unwanted thumbnails by adding an empty (text) file or empty folder called .nomedia (including the leading dot) to the PBThumbnails folder on your memory card.

Ads sneaked in

The "what's new" section of the Google Play Store page is empty. The general app description lists some of the updates, but not all. It fails to mention that the app uses two new Android permissions (full internet access and network location) and it fails to explain what those permissions are used for. A look at the scan results of Addons Detector gives the answer. Online access and spying on your whereabouts was added for one reason only: advertising. PBPlayer used to be free of ads, but now it throws banners from AdMob and AdSense on your screen.

The inclusion of advertising isn't mentioned anywhere in the app description. I'd be all for a Google Play Store requirement that forces every app developer to disclose all sources of in-app advertising before you install it. But even without such a formal requirement it's good manners to disclose the presence and source of your advertising in advance.

Of course you'll never notice the ads if you root you phone and run AdAway or DroidWall to keep PBPlayer offline, but that works for any other media player too and there are plenty of apps that blow PBPlayer out of the water.

Missing alternatives

Given the number of downloads (in the order of 10.000 as I write this) it is very unlikely that the makers of PBPlayer will make any money from their ads. Their user base is way too small for that, and by adding ads to an app that's outperformed by the competition the number of users will remain low.

A donation link that launches your web browser (so the app itself doesn't need any internet or location permissions) would be much more effective for an app with such a small user base. Alternatively, the makers of PBPlayer could sell an ad-free paid version of their app, but for some reason they didn't do that.

Verdict

By adding ads without offering a paid ad-free version PBPlayer lost its only purpose, that of an offline player for local content. It is no longer a match for apps for like MX Video Player, so PBPlayer is no longer on my phone. I now use MoboPlayer (DroidWalled offline) for locally stored movies, and MX Video Player for online video streams. You could do it the other way 'round, because there is not much difference between Mobo and MX unless you have some very exotic codec requirements.

• PBPlayer
• MX Video Player
• MoboPlayer

Ice Stream gets you movies, tv shows, music, ...

Update: Ice Stream stopped working. A future version of the app may fix it, so stay tuned. VideoMix is a good replacement.

Icefilms.info links to lots of movies, tv shows, concerts, documentaries, and other video content that you can stream to your phone or download.

Whether thats legal or not depends on your local laws. In my country it's legal to download any work of art for personal use, offset by a levy on blank DVDs and other storage media. Things may be different where you live, so check your local laws first.

You can download videos, but you can also stream them to start watching without waiting for the download to finish.

The app breaks once in a while. This is usually quickly fixed by an update, but sometimes it takes a long time before it works again.

SlideMe lets you download the APK directly to your memory card and GetJar hosts the app as well. You'll need a video player that can deal with DivX. MX Player is a good choice to watch videos from Ice Stream.

• Ice Stream download on SlideMe
• Ice Stream on GetJar
• Ice Stream support on forums.icefilms.info
• MX Player

Update: Ice Stream stopped working. A future version of the app may fix it, so stay tuned. VideoMix is a good replacement.

Hideman VPN and Hotspot Shield VPN: surf safe over unsafe internet connections

Ancient problem: how do you send confidential information when you can't trust the messenger? Modern solution: virtual private networks turn unsafe traffic on public WiFi in bars and coffeeshops into secure encrypted connections. Unfortunately most VPN services want your money, but there are some exceptions. Hideman VPN and Hotspot Shield give you VPN for free, usually at decent speed.

Hideman VPN gives you 5 hours of secure internet per week for free. That doesn't sound like a lot, but it's enough for online banking and shopping. For most other web surfing you don't need a secure connection, so five free hours a week will do the job for almost everyone.

The app is so simple that anyone can VPN on Android. Launch, connect, go online, and disconnect when you're done. Connection speed varies, but in my tests it's adequate for surfing the web, email, and doing stuff with your Android online banking app. It's too slow for video streams or downloading movies and music, but why would you need a VPN for that if you're on public WiFi?

Hotspot Shield VPN doesn't have any time limits. It's ad-supported, but I've never seen an ad in this app. I guess AdAway is doing what it's meant to do ;)
Minor problem: Hotspot Shield can be really slow (disconnecting and reconnecting usually speeds things up a bit), but slow and safe is better than fast and leaky. Major problem: Hotspot Shield doesn't have an off switch and keeps a big ugly red icon in your notification bar. Hotspot Shield is one of the reasons why task killers can be useful.

Hideman VPN is better than Hotspot Shield, but it's a good idea to keep both apps. When your free hours on Hideman run out you can switch to Hotspot Shield for a slower but functional secure connection.

To check that your VPN connection is working as it should, head to ip.cih.ms before and after you switch on your VPN app. The IP address reported by ip.cih.ms should change when you connect to a VPN.

• Hideman VPN
• Hotspot Shield VPN

Android VoIP app Viber adds eye candy, forgets function

Viber vs. Skype

VoIP and chat app Viber tries to push Skype out of the way. They're still a million miles away from there, because even my 76 year old aunt knows how to Skype whereas Viber users are few and far between.

But Skype is going downhill now that its Android app is infected with ads, lost its tabs, and won't let you switch off its annoying startup and shutdown noises. Leave it to Microsoft to shoot themselves in the ass. Remember Hotmail? Know anyone who uses Windows Phone?

Viber calls sound as good as VoIP on CSipSimple as long as both ends of the line have a speedy internet connection. If one party switches to 3G it sounds terrible real quick, though. Distortion, echo, and a lot of other unwanted sound effects that make my girlfriend sound like Darth Vader and reminds me of Skype. Viber could use a good low bandwidth codec for when one end of the conversation is on a slow mobile data connection, because its current low bandwidth codec doesn't do the job.

Eye candy added, off switch left out

The latest couple of Viber updates add group messaging, eye candy (custom background, contact pictures), bug fixes, and the time stamp in chats now appears on all messages.

Unfortunately Viber keeps refusing to add an off switch that truly switches off the app. You can exit Viber, but its Cloud To Device Messaging service keeps running. Without countermeasures you'll still receive Viber calls when you don't want them, like when roaming abroad on an expensive international data connection. Its autostart function doesn't come with a toggle either, so Viber starts on boot whether you want it or not unless you control it with an autostart manager like Gemini App Manager. The only way to silence Viber is by pulling your entire phone offline, toggling Viber internet permissions with firewalls like DroidWall, LBE Privacy Guard, and avast, or freezing and unfreezing Viber with apps like App Quarantine. These workarounds work, but wouldn't it be a lot better if Viber would let us use the app the way we want to without having to open a hatful of tricks?

Missing basics

Viber doesn't do any call or message filtering. Anyone who's got your phone number can contact you on Viber without any way to block the unwanted.

It won't let you set your own ringtones and message sounds either. You're stuck with the sounds that come with Viber, and there's no way to receive Viber messages silently.

There's no public API for Viber yet. This means that other apps can't tap into Vibers network, so Viber makes the problem of chat and VoIP fragmentation worse. One app for SIP, one app for Skype, one app for Viber, no app for all. Nimbuzz and fring tried to fight the need for a homescreen full of chat and VoIP apps, but the stubborn makers of Viber and Skype turned back the clock.

SMS alert

Viber captures incoming SMSs. It needs to do this once to receive the activation SMS (similar to apps like WhatsApp), but Viber keeps doing so when it no longer needs to. If you use the anti-theft feature of avast (or any other SMS-based remote locate/wipe app) this can spell trouble, and avast lists Viber as a threat to its anti-theft function. Viber may fix this issue by leaving your SMSs alone, or they may ignore it in the same way they ignore the requests for an off switch that works. Time will tell.

Viber alternatives

Viber works on Android, iPhone, and PCs that run Windows. No Linux, no Mac, no Blackberry, and it's not compatible with the hundreds of millions of Symbian phones that may be outdated but will keep running for the next couple of years.

CSipSimple is my choice for VoIP calls using the standard SIP method. Skype is still unavoidable because of the number of people that use it. Skype doesn't use your phone number as a user name, but this has the advantage that you can make throwaway Skype accounts for people that you don't trust with your phone number. Vonage seems to be Vibers main competitor. Unlike Viber, it comes with an off switch that works. Vonage doesn't have many users yet, so spread the word. For text messaging, WhatsApp and imo beat Viber hands down.

• Viber Media, Inc.
• Viber (Google Play)