Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sensor Tower owns ad blocker and VPN apps that collect user data

buzzfeednews.com

Post reply on HN
Print view View original

11–20 of 125 posts

Re: Sensor Tower owns ad blocker and VPN apps that collect user data

#11

Post by judge2020 »

saagarjha wrote: post #8
userbinator wrote: post #6

This is basically a MITM proxy, which I'd say is really essential for true adblocking and content filtering, especially on the locked-down mobile platforms and with the rise of HTTPS. The question is then who runs the proxy and whether you trust them. I've been doing the same with Proxomitron for years, although in that case I run the proxy, I certainly trust myself, and --- I'm not sure about whether these apps even…

It should be entirely possible to run the MITM proxy completely on-device, in which case you don't need to trust anything.

This is generally possible (With how Wireguard-based VPNs currently work) but Apple would much rather you use the Safari content blocker API for defining rules.

Re: Sensor Tower owns ad blocker and VPN apps that collect user data

#12

Post by cortesoft »

saagarjha wrote: post #8
userbinator wrote: post #6

This is basically a MITM proxy, which I'd say is really essential for true adblocking and content filtering, especially on the locked-down mobile platforms and with the rise of HTTPS. The question is then who runs the proxy and whether you trust them. I've been doing the same with Proxomitron for years, although in that case I run the proxy, I certainly trust myself, and --- I'm not sure about whether these apps even…

It should be entirely possible to run the MITM proxy completely on-device, in which case you don't need to trust anything.

How do you block the app from phoning home with the data? You have to trust it not to do that.

Re: Sensor Tower owns ad blocker and VPN apps that collect user data

#13

Post by mrob »

chimen wrote: post #10
matheusmoreira wrote: post #3

Proprietary ad blockers cannot be trusted. It is better to use something like AdAway and Firefox with uBlock Origin.

Even that setup fails: https://blog.dnsadblock.com/you-are-still-being-tracked-even...

Already fixed in uBlock Origin: https://github.com/gorhill/uBlock/releases/tag/1.25.0

Re: Sensor Tower owns ad blocker and VPN apps that collect user data

#14

Post by nabeelms »

chimen wrote: post #10
matheusmoreira wrote: post #3

Proprietary ad blockers cannot be trusted. It is better to use something like AdAway and Firefox with uBlock Origin.

Even that setup fails: https://blog.dnsadblock.com/you-are-still-being-tracked-even...

That issue was fixed in the latest release of uBlock Origin. That's why it required the additional permissions for DNS.

Re: Sensor Tower owns ad blocker and VPN apps that collect user data

#15

Post by saagarjha »

cortesoft wrote: post #12
saagarjha wrote: post #8

Earlier quoted context omitted.

It should be entirely possible to run the MITM proxy completely on-device, in which case you don't need to trust anything.

How do you block the app from phoning home with the data? You have to trust it not to do that.

You sandbox the VPN extension.

Re: Sensor Tower owns ad blocker and VPN apps that collect user data

#16

Post by hug »

saagarjha wrote: post #15
cortesoft wrote: post #12

Earlier quoted context omitted.

How do you block the app from phoning home with the data? You have to trust it not to do that.

You sandbox the VPN extension.

Sandbox it from what, exactly? The ability to access things you care about and arbitrary internet addresses are intrinsic to a proxy.

If you stop it being able to see your traffic, it stops working.

If you stop it being able to get to the Internet, it stops working.

Re: Sensor Tower owns ad blocker and VPN apps that collect user data

#17

Post by 3fe9a03ccd14ca5 »

judge2020 wrote: post #11
saagarjha wrote: post #8

Earlier quoted context omitted.

It should be entirely possible to run the MITM proxy completely on-device, in which case you don't need to trust anything.

This is generally possible (With how Wireguard-based VPNs currently work) but Apple would much rather you use the Safari content blocker API for defining rules.

I can never trust anything downloaded from the App Store to MITM my traffic, so I’ll take the safari content blocker.

Re: Sensor Tower owns ad blocker and VPN apps that collect user data

#18

Post by saagarjha »

hug wrote: post #16
saagarjha wrote: post #15

Earlier quoted context omitted.

You sandbox the VPN extension.

Sandbox it from what , exactly? The ability to access things you care about and arbitrary internet addresses are intrinsic to a proxy. If you stop it being able to see your traffic, it stops working. If you stop it being able to get to the Internet, it stops working.

You load a list of rules into it, and the only thing it is allowed to do is make a classification of where the URL should go (if you're paranoid, make this classification strictly binary). It cannot write any state out, nor connect to the internet itself.

Re: Sensor Tower owns ad blocker and VPN apps that collect user data

#19

Post by Dylan16807 »

saagarjha wrote: post #18
hug wrote: post #16

Earlier quoted context omitted.

Sandbox it from what , exactly? The ability to access things you care about and arbitrary internet addresses are intrinsic to a proxy. If you stop it being able to see your traffic, it stops working. If you stop it being able to get to the Internet, it stops working.

You load a list of rules into it, and the only thing it is allowed to do is make a classification of where the URL should go (if you're paranoid, make this classification strictly binary). It cannot write any state out, nor connect to the internet itself.

What you are describing is not a VPN extension, and it's not a MitM proxy.

Re: Sensor Tower owns ad blocker and VPN apps that collect user data

#20

Post by rubyn00bie »

This is literally, one among many reasons (ha!), why I use Firefox. Every other browser vendor is a for-profit entity, and as such will limit good ad-blocking measures as Safari and Chrome have done recently with their new "security" policies.

This is also why I don't use a VPN I don't run (or certainly not one that hasn't been audited with a good reputation), and I certainly would never fucking dream of using a free VPN unless all the traffic over it is absolutely worthless.

... How many of these things install root certs where even after you've canceled your subscription you're still accepting their bullshit?

On the other hand, this could make for a hilarious experiment using adversarial neural networks to troll the assholes mining data from the VPNs.

Post reply on HN