41–50 of 110 posts
I've enjoyed using an app for iOS that installs a "VPN" which is configured to run a local DNS proxy. It gives you a log of every request on the phone and allows you to block domain wildcards. It's fascinating to peer into the dark alleys of your iPhone.
To clarify, outside of the CDN providers or AWS calls and the big 3 (Facebook, Google, Apple), the vast majority of the calls seem to be to marketing providers or developer tools Branch - these guys provide deep links into phones and tools to analyze who clicked on the links and if they worked. mParticle, Appsflyer, Braze formerly Appboy, Appboy all provide internal app marketing teams tools like mobile push or analy…
Earlier quoted context omitted.
Maybe they’ve made connections into the insurance industry. For them it might be interesting what your location profile looks like.
What substantial aggregate profit do you think they can make by analyzing detailed location data? I'm asking because I'd assume for most of their customers it just doesn't reveal much. Everyone shops at supermarkets, Target vs Walmart isn't going to reveal a whole lot more than a residential address.
The car insurance could know if you visit dragstrips, which might imply specific driving habits. Or how often you visit the gas station, from which could be estimated your mileage. Or if you already report your mileage, might be used to estimate you fuel consumption, which could imply specific driving habits.
The health insurance might know if you visit the same bad-neighbourhood address as some known-heroin-users do. Or if you just visit the tobacco shop.
We live in a 'fantastic' world where the same people who have made a billion dollar business model of behavioral targeting and creepily stalking people 24/7 aggressively push things like https claiming to care about user privacy and security.
Where Android can be promoted as 'open' in-spite of abusing all the driving principles of open source. Tech folks cannot be unaware of the massive and ever growing surveillance ecosystem in operation and many are infact actively building it, and pretense of surprise by such articles only serves to affect some kind of fabricated normalcy.
To clarify, outside of the CDN providers or AWS calls and the big 3 (Facebook, Google, Apple), the vast majority of the calls seem to be to marketing providers or developer tools Branch - these guys provide deep links into phones and tools to analyze who clicked on the links and if they worked. mParticle, Appsflyer, Braze formerly Appboy, Appboy all provide internal app marketing teams tools like mobile push or analy…
As a developer knowing the ability of some of these developer tools they have the same ability to log sensitive privacy data as marketing tools. All tools that log to a central server have a high potential of abuse and should have similar oversite to prevent abuse.
I've enjoyed using an app for iOS that installs a "VPN" which is configured to run a local DNS proxy. It gives you a log of every request on the phone and allows you to block domain wildcards. It's fascinating to peer into the dark alleys of your iPhone.
Which app did you use? I’ve done similar things with Charles and Burp Suite.
I've got it on my list to play with Charles proxy. I'm curious to peer into a few of the requests if possible. But I've read that, especially with mobile apps, they may use cert pinning which defeats something like Charles.
Regarding iOS: I stopped using iPhones and (edit typo) quot the ecosystem altogether (apart from an app I still sell in apple app store) because with the lack of an untethered Jailbreak I could no longer install "Firewall IP" and I could not edit the hosts file. Regarding Android: I switched to Android for the "NoRoot Firewall" and since most Android phones are Root-able I can also edit my hosts file. The article giv…
I can highly recommend NetGuard on android, it's non-root and free software. I wish there was a system that lets me whitelist specific hosts per app.
Also, downloading netguard from github will give you the option to use hostfile to block providers (not available via Play Store).
Separately, if you have root should look into XprivacyLua from the same dev
Earlier quoted context omitted.
Sorry for asking, but what secure reasons would that be? If Apple wanted, they could prohibit the last point by requiring all apps to delete TLS handling to the OS and failing the review otherwise.
It stops people who have root certificates installed on their phone (e.g. the Facebook research app from a couple weeks ago) from being able to monitor traffic.
Also, we already have several systems to manage app access to things that could potentially be misused. Why not manage user certificates the same way?
E.g., pop up a consent prompt before letting an app install anything - or, if that is too annoying, don't give apps access to the functionality at all and exclusively manage certificates via the system UI.
> It stops people who have root certificates installed on their phone... [emphasis mine]
Indeed. That's my point. I'd consider this a bug, not a feature.
1. Use AdGuard DNS. https://news.ycombinator.com/item?id=18788410
2. Do not install the app if there's a website equivalent you could use (Facebook, Banking Apps).
3a. Force Stop or Disable apps you use frequently despite web equivalents (Google Maps).
3b. Enable permissions required by apps used occasionally only when in use. Disable them again, once usage is complete (Banking Apps).
4. Use websites on mobile on Firefox with uBlockOrigin/uMatrix, PrivacyBadger, CanvasBlocker, WebRTC blocker.
5. Prefer using 'lite' versions of apps, if you must use an app (Uber Lite).
6. Try to use apps that do not require GooglePlayService or slowly force yourself to (OpenStreetMaps).
7. Use privacy-oriented apps as a replacement to apps that you you use very frequently (Signal, ProtonMail, DuckDuckGo) or use a separate user-profile for those apps (WhatsApp) altogether. https://news.ycombinator.com/item?id=18873433
8. Use LawnChair as your default launcher (or some such privacy oriented launcher).
----
Of course there's a big matter of Google services running the show underneath, and you couldn't get rid of that unless you went the microG+LineageOS route. https://news.ycombinator.com/item?id=15617615
Also see:
EFF's Surveillance Self-defense https://ssd.eff.org/en#index
Dumber Phone: https://nomasters.io/posts/dumber-phone/