General-purpose usage notes and tips
To allow root access, open the Developer options in the settings. There, press Root access. In the pop-up menu, select either Apps only, ADB only or Apps and ADB, depending on how you want to restrict root access. See ADB for more information about root access with ADB.
Tips for encrypting the device
By default on Android, the encryption password is the same as the lockscreen password. As users tend to use a simple PIN, password or pattern for the lockscreen, the encryption can be easily circumvented with a brute-force attack.
Replicant allows to set an encryption password that is not tied to the lockscreen:If a separate encryption password is in place and a PIN or password is set for the lockscreen, another security measure is active: After five unsuccessful attempts to unlock the screen, the device is rebooted and the attacker is faced with the much stronger encryption passphrase. This makes brute-force attacks on the lockscreen much harder.
The default Browser has JavaScript enabled and runs the JavaScript that is loaded when you visit a website. Replicant has no mechanism to check if the complex JavaScript programs that are included in some websites are free software. See the JavaScript Trap article for more general freedom-related information about JavaScript.
Not only browser apps might run non-free JavaScript. Some apps include an embedded view that loads websites which is called webview. Although app developers can disable JavaScript for the webview, JavaScript is usually enabled in the webview. So you might run non-free software inside a webview.
For these reasons, it is recommended to disable JavaScript by default in the browser settings. As most browser exploits require JavaScript to work, you can also prevent that malicious websites can make use of security issues with your browser. Unfortunately, the currently used webview in Replicant has many security issues. See #1780 for more information. So disabling JavaScript helps a lot in securing your device.
Some apps have a setting that allows to use an external browser to view websites. This ensures that the embedded webview is not used and websites are loaded with a browser you can configure and that allows to disable JavaScript.
If you need to enable
AdAway
You should now be able to use the camera again.
The mostly used barcode scanner app ZXing has a slow preview. The privacy-friendly QR Scanner has a faster preview.
Viewing videos in the gallery or in the browser is not possible. See #1539 for background information.
Only the VLC app is known to be able to play videos on Replicant. Make sure to disable hardware acceleration in the settings to prevent crashes.
VLC is currently disabled in the F-Droid repository because only outdated versions are available. You need to enable the archive repository in the repository settings to be able to install VLC from F-Droid.