Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tracking my phone's silent connections

kushaldas.in

Post reply on HN
Print view View original

91–100 of 110 posts

Re: Tracking my phone's silent connections

#91

Post by scrollaway »

alasdair_ wrote: post #81
hueving wrote: post #74

Earlier quoted context omitted.

>think the largest third party analytics providers would revolt Would anyone care? I don't think a game company is going to refuse to publish on iTunes or Google Play because some tool they use for analytics stops working. Nothing against analytics companies, but they just aren't a relevant party in Apple's (or Google's) ecosystem.

> Would anyone care? I don't think a game company is going to refuse to publish on iTunes or Google Play because some tool they use for analytics stops working. I don't see why these companies can't simply push all analytics to their own servers then out to the analytics company, bypassing apple/google. Most of the biggest mobile games companies have custom analytics engines and likely do this anyway.

That doesn't really solve the battery life / analytics duplication problem.

Furthermore, from experience, duplication within a single app often happens all on its own because, say, different departments use different toolchains with different integrations, thus want different analytics providers and it's easier to just have the app send to both. It's inefficiencies all the way down because the only one to really pay for this is the user, and the user doesn't know they're paying for this (be it in battery life, PII leakage, etc).

Re: Tracking my phone's silent connections

#92

Post by goldenbikeshed »

mirimir wrote: post #79

Whenever I read stuff like this, I'm reminded how user-hostile Android and iOS are. Even compared to Windows. Or at least, to Windows XP and 7. Not that many years ago, I had imagined that microcomputers and cellphones would merge. But I was expecting something like Linux. Or at worst, like Windows. And it clearly didn't work out that way. We have smartphones that are never really owned by users. They run apps that h…

How about getting a Librem 5 Purism?

Re: Tracking my phone's silent connections

#93

Post by jakejarvis »

LeoPanthera wrote: post #86
jakejarvis wrote: post #61

Earlier quoted context omitted.

Wouldn't that loophole work on all DNS-based blockers/black-holes on any platform, namely Pi-hole (and the hosts file for that matter)?

Yes. I use a DNSBL in my router (pfBlockerNG), and I've been considering writing a small script to resolve every IP in the blocklist and then block outgoing connections to those IPs. Of course this is only useful at home. As soon as my phone leaves the house, everything is open again.

Ooh, good idea. Would probably only have to write ~1 time per day to a separate, parallel list. Or have a small VPS do the work continuously and push changes to a Git repo so others can pull it however often they want.

I’d love to take a look if you end up doing that!

Re: Tracking my phone's silent connections

#94

Post by aaaaaaaaaaab »

lbacaj wrote: post #35

To clarify, outside of the CDN providers or AWS calls and the big 3 (Facebook, Google, Apple), the vast majority of the calls seem to be to marketing providers or developer tools Branch - these guys provide deep links into phones and tools to analyze who clicked on the links and if they worked. mParticle, Appsflyer, Braze formerly Appboy, Appboy all provide internal app marketing teams tools like mobile push or analy…

>letsencrypt (free SSL certificates)

Wait, what? How would a client app get SSL certs from letsencrypt?

Re: Tracking my phone's silent connections

#95

Post by mr_toad »

aaaaaaaaaaab wrote: post #94
lbacaj wrote: post #35

To clarify, outside of the CDN providers or AWS calls and the big 3 (Facebook, Google, Apple), the vast majority of the calls seem to be to marketing providers or developer tools Branch - these guys provide deep links into phones and tools to analyze who clicked on the links and if they worked. mParticle, Appsflyer, Braze formerly Appboy, Appboy all provide internal app marketing teams tools like mobile push or analy…

>letsencrypt (free SSL certificates) Wait, what? How would a client app get SSL certs from letsencrypt?

And what does a client need with a CA-signed cert?

Re: Tracking my phone's silent connections

#96

Post by mr_toad »

DavideNL wrote: post #39

Apple promotes privacy (which is great), but at the same time they behave like a dictatorship by not providing an opt-out of the iOS walled garden, which they do provide with System Integrity Protection on macOS. What he is doing will not prevent apps from extracting information and uploading it to their servers. For example, by using an ip address instead of a hostname/domain, an app/service can exclude themselves f…

Apple could easily add a per-app permission for network access just like they do with mobile data.

Re: Tracking my phone's silent connections

#97

Post by fancyfish »

hellcow wrote: post #34
HenryBemis wrote: post #21

Regarding iOS: I stopped using iPhones and (edit typo) quot the ecosystem altogether (apart from an app I still sell in apple app store) because with the lack of an untethered Jailbreak I could no longer install "Firewall IP" and I could not edit the hosts file. Regarding Android: I switched to Android for the "NoRoot Firewall" and since most Android phones are Root-able I can also edit my hosts file. The article giv…

That's exactly why I uninstalled Robinhood, Spotify, Venmo and half the other apps on my phone. Netguard showed me those apps were notifying Facebook every time I opened them. Facebook has no business knowing when I'm making trades, listening to music, sending money or anything else.

This is what I did as well, and for the services I still needed, I found the mobile sites nearly equivalent in looks and features. Especially for banking, shopping, and reading sites. I added links to my homescreen in lieu of apps, and that way I know they're not using my phone in the background. The downside is getting hounded to install the app when I visit certain mobile sites.

Re: Tracking my phone's silent connections

#98

Post by therein »

kekebo wrote: post #30
pw6hv wrote: post #2

Actually would be interesting to see the content of the HTTP packets that are not encrypted! I wonder what kind of information is shared by our smartphones without it being properly secured...

A lot. Running my phone traffic through mitmproxy was a rather sobering experience, especially what leaks on boot before firewall and ad blocker are ready. On Android you can even inspect a lot of encrypted traffic using mitmproxy and the cert in generates, although some apps (like signal) use cert pinning in a way that i haven't managed to get around yet.

Same for Apple. Just add a root authority and you can even decrypt iCloud traffic.

Re: Tracking my phone's silent connections

#99

Post by Proven »

SubiculumCode wrote: post #71
kop316 wrote: post #55

Earlier quoted context omitted.

I think you misunderstand me. What I mean is you wipe the phone, reinstall either AOSP or LineageOS (or other custom ROM), do NOT install any Google Apps (to include Google Play Services, Google Store, Google Maps, etc.). Use F-Droid ( https://f-droid.org/ ) as your App Store. I have been using OsmAnd ( https://osmand.net/ ) as my map service.

Im annoyed how much cheaper phones cant be rooted

That's why they're cheap. The manufacturer or telco loads them with shitware to earn some extra bucks.

Re: Tracking my phone's silent connections

#100

Post by RhodesianHunter »

Havoc wrote: post #32

Was surprised how much the xiaomis phone home. Enough to create a huge spike in the pi hole stats. 92% (!!!) of the requests that phone generates got blocked. Laptop is at 5% (admittedly with an adblocker too), iphones at 1%.

You're surprised about something made in China by a Chinese company phoning home?

I really don't mean to be rude but... have you not been paying attention?

Post reply on HN