Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Navy bans TikTok from government-issued mobile devices

reuters.com

Post reply on HN
Print view View original

151–160 of 170 posts

Re: U.S. Navy bans TikTok from government-issued mobile devices

#151

Post by dahfizz »

thaumasiotes wrote: post #31
angry_octet wrote: post #21

Doesn't matter, they have it on their personal phone. App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. The whole idea of unrestricted network access is stupid.

> The whole idea of unrestricted network access is stupid. I've been coming around to a similar idea. I'd like a setup something like this for my desktop: 1. Some devices representing network connections. One or more are "real"; others may be VPNs. 2. Per-application settings governing which network devices, if any, the application may use. Default to none. For example, the common way to use a VPN is like this: 1. St…

Reading your comment melts my mind as a Linux user.

You can't just set your vpn connection as the default route? What's even the point if it's not the default route?

Applications (at least on Linux) have no idea what device they are using. They just request a connection to an IP and it's the kernels job to route that request correctly.

Re: U.S. Navy bans TikTok from government-issued mobile devices

#152

Post by kevin_thibedeau »

rsanek wrote: post #131
freedomben wrote: post #128

Earlier quoted context omitted.

This is one of my favorite things about Android. It's trivial to restrict access using AFWall+ . You can block all access, mobile data access, WiFi access, it any combination thereof on a per app basis. Highly recommend it.

Unfortunately requires root though, which means for the vast majority of Android users this is not an option.

NoRootFirewall is much the same. If you can install LineageOS it lets you revoke fine grained permissions without the app knowing.

Re: U.S. Navy bans TikTok from government-issued mobile devices

#153

Post by hrktb »

manwe150 wrote: post #145
SpicyLemonZest wrote: post #102

Earlier quoted context omitted.

> App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. Yeah, this is really bizarre to me. I was trying to check on volume levels through walls in my apartment, so I wanted to find some random decibel measuring app and lock it down so I don't have to worry too much about trusting it. But somehow Apple's permission model, which provides a whole pile of privilege switch…

Honest question: but what’s the threat model for wanting an OS to block this? I’ve so far only thought of leaking IP address and Bitcoin mining. But any website already easily has both capabilities (with somewhat arbitrary open sockets after the WebSockets handshake). Is the expectation that an app implementation should have less permissions than an equivalent website and so be the “safer” option?

Isn’t it the same as any other access permission ?

For instance is there any specific model behind blocking device location, short of just not wanting to share the info ?

I’d see not wanting an app to send anything related to your device nor that it was even opened to be of the same kind.

Re: U.S. Navy bans TikTok from government-issued mobile devices

#154

Post by monoideism »

rsanek wrote: post #131
freedomben wrote: post #128

Earlier quoted context omitted.

This is one of my favorite things about Android. It's trivial to restrict access using AFWall+ . You can block all access, mobile data access, WiFi access, it any combination thereof on a per app basis. Highly recommend it.

Unfortunately requires root though, which means for the vast majority of Android users this is not an option.

Plus, regardless of background or technical expertise, rooting your phone dramatically decreases security.

Downvoters: so what security features do you lose and gain when you root your phone? You've weighed the pros and cons, right?

Re: U.S. Navy bans TikTok from government-issued mobile devices

#155

Post by SpicyLemonZest »

manwe150 wrote: post #145
SpicyLemonZest wrote: post #102

Earlier quoted context omitted.

> App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. Yeah, this is really bizarre to me. I was trying to check on volume levels through walls in my apartment, so I wanted to find some random decibel measuring app and lock it down so I don't have to worry too much about trusting it. But somehow Apple's permission model, which provides a whole pile of privilege switch…

Honest question: but what’s the threat model for wanting an OS to block this? I’ve so far only thought of leaking IP address and Bitcoin mining. But any website already easily has both capabilities (with somewhat arbitrary open sockets after the WebSockets handshake). Is the expectation that an app implementation should have less permissions than an equivalent website and so be the “safer” option?

I want to ensure that the app is just locally computing the decibel level, rather than streaming out data about what it's hearing.

I would ideally want websites to also have a "no more network access after your initial load" mode, but as you say that's fundamentally incompatible with modern web development. So I kinda just accept the loss there.

Re: U.S. Navy bans TikTok from government-issued mobile devices

#156

Post by jraby3 »

SpicyLemonZest wrote: post #102
angry_octet wrote: post #21

Doesn't matter, they have it on their personal phone. App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. The whole idea of unrestricted network access is stupid.

> App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. Yeah, this is really bizarre to me. I was trying to check on volume levels through walls in my apartment, so I wanted to find some random decibel measuring app and lock it down so I don't have to worry too much about trusting it. But somehow Apple's permission model, which provides a whole pile of privilege switch…

You can turn off WiFi and then revoke cellular data for a specific app. Not the same thing but still effective, especially if you are only going to use an app once.

Re: U.S. Navy bans TikTok from government-issued mobile devices

#158

Post by netheril96 »

SpicyLemonZest wrote: post #102
angry_octet wrote: post #21

Doesn't matter, they have it on their personal phone. App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. The whole idea of unrestricted network access is stupid.

> App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. Yeah, this is really bizarre to me. I was trying to check on volume levels through walls in my apartment, so I wanted to find some random decibel measuring app and lock it down so I don't have to worry too much about trusting it. But somehow Apple's permission model, which provides a whole pile of privilege switch…

Maybe I understand you wrongly, but when I open the setting of individual app in iOS, I can revoke both cellular and WiFi access for it.

Re: U.S. Navy bans TikTok from government-issued mobile devices

#159

Post by _akei »

snowron6 wrote: post #125
_akei wrote: post #109

Earlier quoted context omitted.

[flagged]

>China is ruled by a Communist party and they subscribe to communism That's just outright incorrect. https://www.wikiwand.com/en/Socialist_market_economy#/Market...

What is incorrect about my statement? In case you don’t know or want to be reminded, the name of the ruling party in China is called ‘China Communist Party’.

Re: U.S. Navy bans TikTok from government-issued mobile devices

#160

Post by nl »

dahfizz wrote: post #151
thaumasiotes wrote: post #31

Earlier quoted context omitted.

> The whole idea of unrestricted network access is stupid. I've been coming around to a similar idea. I'd like a setup something like this for my desktop: 1. Some devices representing network connections. One or more are "real"; others may be VPNs. 2. Per-application settings governing which network devices, if any, the application may use. Default to none. For example, the common way to use a VPN is like this: 1. St…

Reading your comment melts my mind as a Linux user. You can't just set your vpn connection as the default route? What's even the point if it's not the default route? Applications (at least on Linux) have no idea what device they are using. They just request a connection to an IP and it's the kernels job to route that request correctly.

Of course Windows can (and does usually) use a VPN as an active route. The poster just doesn't know what they are talking about.

In particular this sentence is complete nonsense:

I'm sick of the idea that Windows perceives an internet connection somehow, hides it from me, and automatically makes it available to everything that asks for "the internet". But I don't actually know how to do this. Someone is working really, really hard to make sure I don't affect who uses what device.

As usual, MS has pretty decent documentation on this: https://docs.microsoft.com/en-us/windows-hardware/drivers/mo...

I don't particularly like the GUI_centric nature of much of it, but the complaint itself is completely ill-informed.

Post reply on HN