Lockdown: Open-source firewall that blocks app tracking, ads, snooping
1–10 of 79 posts
Re: Lockdown: Open-source firewall that blocks app tracking, ads, snooping
#2Is there anywhere with an in-depth overview of what this does? Does it just fail DNS request and block known IPs? How are the lists maintained and updated? With TLS and it surely not mitm-ing connections, that's all it can do correct?
Re: Lockdown: Open-source firewall that blocks app tracking, ads, snooping
#3Is there anywhere with an in-depth overview of what this does? Does it just fail DNS request and block known IPs? How are the lists maintained and updated? With TLS and it surely not mitm-ing connections, that's all it can do correct?
> With TLS and it surely not mitm-ing connections, that's all it can do correct?
Unless it also acts as a web-proxy, yes.
Re: Lockdown: Open-source firewall that blocks app tracking, ads, snooping
#4Is there anywhere with an in-depth overview of what this does? Does it just fail DNS request and block known IPs? How are the lists maintained and updated? With TLS and it surely not mitm-ing connections, that's all it can do correct?
> With TLS and it surely not mitm-ing connections, that's all it can do correct? Unless it also acts as a web-proxy, yes.
It can possibly access all your activity, contacts, microphone, and camera... Hard pass from me at the moment. :/
Re: Lockdown: Open-source firewall that blocks app tracking, ads, snooping
#5So pihole then.
Re: Lockdown: Open-source firewall that blocks app tracking, ads, snooping
#6Is there anywhere with an in-depth overview of what this does? Does it just fail DNS request and block known IPs? How are the lists maintained and updated? With TLS and it surely not mitm-ing connections, that's all it can do correct?
> With TLS and it surely not mitm-ing connections, that's all it can do correct? Unless it also acts as a web-proxy, yes.
it uses the `NetworkExtension` framework to intercept all your communications and potentially modify them.
Re: Lockdown: Open-source firewall that blocks app tracking, ads, snooping
#7For an open source app distributed on the App Store, is there actually any way of verifying that what you get on your phone is the same as the source code you can read?
Re: Lockdown: Open-source firewall that blocks app tracking, ads, snooping
#8Earlier quoted context omitted.
> With TLS and it surely not mitm-ing connections, that's all it can do correct? Unless it also acts as a web-proxy, yes.
It can possibly access all your activity, contacts, microphone, and camera... Hard pass from me at the moment. :/
It's a start. It's good that it's open source, but that's necessary not sufficient to establish trust for something which requires such significant privileges.
You also want to be able to know who the authors are, to evaluate them for trustworthiness, and to evaluate their processes to see how well hardened they are against malicious contributions.
Re: Lockdown: Open-source firewall that blocks app tracking, ads, snooping
#9For an open source app distributed on the App Store, is there actually any way of verifying that what you get on your phone is the same as the source code you can read?
Checksum of a binary package against checksum of a reproducible build?
Re: Lockdown: Open-source firewall that blocks app tracking, ads, snooping
#10Is there anywhere with an in-depth overview of what this does? Does it just fail DNS request and block known IPs? How are the lists maintained and updated? With TLS and it surely not mitm-ing connections, that's all it can do correct?
The source indicates that they check-in DNS blocklists as JSON files [0] and txt files (one of which has Facebook IPv4s) [1]. So, the updates to those would require app updates, I guess, unless there's OTA for the blocklists somewhere in the code that I missed.
My experience with running client-side DNS based blockers are they consume additional battery and need a lot of RAM if you block with aggressive lists that have more than 1M+ domains. Besides, DNS based blockers can be circumvented by apps that do their own resolution over DoH or use clever techniques like CNAME cloaking [2]. Some nameservers such as the one run by Cloudflare flatten the CNAMES [3], effectively rendering even nextdns' solution ineffective [4].
I must also note that, Cloudflare does hide origin-IP if they are setup to reverse-proxy the traffic, which then would render IP based blocklists ineffective, too, unless Cloudflare's IPs are blocked, as well.
The folks who build the lockdownhq apps are also the makers of https://confirmedvpn.com.
u/willstrafach's https://guardianapp.com (VPN and ad-blocking), u/poitrus's https://nextdns.io (no VPN but imo the best DNS based content-blocker in the market today), and https://adguard.com (cross platform all-in-one network security suite) are other comparable alternatives.
Disclosure: I run a competing ad-blocking service.
---
[0] https://github.com/confirmedcode/lockdown-ios/tree/master/Lo...
[1] https://github.com/confirmedcode/lockdown-ios/tree/master/Lo...
[2] https://trackingthetrackers.com/
[3] https://blog.cloudflare.com/introducing-cname-flattening-rfc...
[4] https://medium.com/nextdns/cname-cloaking-the-dangerous-disg...