61–70 of 110 posts
Earlier quoted context omitted.
Apps like AdGuard Pro let you block domains for all apps by intercepting and blocking DNS locally on iOS.
it's not a proper solution (apps can simply communicate with their servers public ip instead of looking up a domain name.)
In my home network I use a hosts file to block unwanted tracking. I use a file from this [1] project, which makes it easy to filter out the type of content you don't want. The nice thing about this is that it blocks requests from any device in my network, especially from those which cannot be configured with a firewall or adblocker. [1] https://github.com/StevenBlack/hosts
Earlier quoted context omitted.
What substantial aggregate profit do you think they can make by analyzing detailed location data? I'm asking because I'd assume for most of their customers it just doesn't reveal much. Everyone shops at supermarkets, Target vs Walmart isn't going to reveal a whole lot more than a residential address.
If location is correlated with time, they could know the speed at which you travel. The car insurance could know if you visit dragstrips, which might imply specific driving habits. Or how often you visit the gas station, from which could be estimated your mileage. Or if you already report your mileage, might be used to estimate you fuel consumption, which could imply specific driving habits. The health insurance migh…
Car insurance gets a lot of information from past claims, age and sex/gender, they aren't going to make a bunch of money turning away a few people that go to dragstrips.
In the US, health insurers are specifically prevented from considering such things in setting their premiums, they get to consider age and smoking. Carriers that offer plans to the general public are also subject to a "guaranteed issue" provision, they are not able to refuse coverage to anyone that can pay.
To clarify, outside of the CDN providers or AWS calls and the big 3 (Facebook, Google, Apple), the vast majority of the calls seem to be to marketing providers or developer tools Branch - these guys provide deep links into phones and tools to analyze who clicked on the links and if they worked. mParticle, Appsflyer, Braze formerly Appboy, Appboy all provide internal app marketing teams tools like mobile push or analy…
With regard to your last paragraph: that would probably be an excellent application of Ben Thompson's aggregation theory. It would increase Apple and Google's moat by making them the hardware gatekeeper for all mobile app analytics. And battery life is also a strong cover for the business reasons for doing it. But the public claim, "it saves battery life!" would not make it defensible for most analytics companies, in…
To clarify, outside of the CDN providers or AWS calls and the big 3 (Facebook, Google, Apple), the vast majority of the calls seem to be to marketing providers or developer tools Branch - these guys provide deep links into phones and tools to analyze who clicked on the links and if they worked. mParticle, Appsflyer, Braze formerly Appboy, Appboy all provide internal app marketing teams tools like mobile push or analy…
With regard to your last paragraph: that would probably be an excellent application of Ben Thompson's aggregation theory. It would increase Apple and Google's moat by making them the hardware gatekeeper for all mobile app analytics. And battery life is also a strong cover for the business reasons for doing it. But the public claim, "it saves battery life!" would not make it defensible for most analytics companies, in…
I was not thinking about the anti-trust implications by not allowing folks to send data back but perhaps there is a middle ground.
It could also increase transparency for consumers by allowing the opt in opt out on the device for each app and letting customers know “this app is tracking your clicks on it”.
The one point about them essentially getting all data, don’t you think they are already doing this? Look at the amount of calls the iPhone is doing back to Apple or the amount of data Android is shipping to Google. I believe they literally are already doing all of it, this would just be a way to give developers access to what they want transparently and reduce the number of unnecessary calls, all the calls would still happen but server side.
I'm not sure how the situation is with Apple, but it always bothered me that on Android, apps can implement their own logic for TLS certificate validation. Apps can use this to hardcode key-pinning and make it effectively impossible (short of patching the app) to inspect an encrypted connection, even if you're the owner of the device. I feel the push for DoH will make this even worse - because then you won't even kno…
Well, yeah, you need to go beyond a traffic sniffer because if a traffic sniffer was enough, where is the security gain?
Apps using custom certificates is a best practice and absolutely essential for communicating securely with devices that can not participate in the web CA (because, duh, they are not websites). Think your local network WiFi camera.
Earlier quoted context omitted.
I tried no root firewall and found that Google groups literally everything under a kitchen sink service that talks to blind IPs with SSL. There is no way to allow Maps without inviting Google to share your bed with you.
I think you misunderstand me. What I mean is you wipe the phone, reinstall either AOSP or LineageOS (or other custom ROM), do NOT install any Google Apps (to include Google Play Services, Google Store, Google Maps, etc.). Use F-Droid ( https://f-droid.org/ ) as your App Store. I have been using OsmAnd ( https://osmand.net/ ) as my map service.
I'm not sure how the situation is with Apple, but it always bothered me that on Android, apps can implement their own logic for TLS certificate validation. Apps can use this to hardcode key-pinning and make it effectively impossible (short of patching the app) to inspect an encrypted connection, even if you're the owner of the device. I feel the push for DoH will make this even worse - because then you won't even kno…