6 ms·

I asked a network info app developer why it's not possible to at least track and control network connections on iOS, like Little Snitch does (or did) for MacOS.

I asked a network info app developer why it's not possible to at least track and control network connections on iOS, like Little Snitch does (or did) for MacOS. "iOS doesn't support that". Well, duh? I don't even know what to think. Knowing where the iOS device connects to will be a huge help "cracking down" on BS apps! And then I read in the comments that it might be virtually impossible for Apple to detect malicious/privacy breaking behavior, or consumers should go pay for apps that are good. Right.

saagarjha 8y ago
It's easy to figure out what an iOS device is connecting to: use a network extension that inspects network traffic. And given that Apple has none of the restrictions they impose on third party developers, they can essentially do what Little Snitch does on macOS.
- dschuetz 8y ago
  There is no way to control the iOS firewall via extensions in iOS. Meaning, it's still not supported, and what you see as "essentially" the same misses the point. I want to block connections of specific apps. What iOS can do is reveal connections made by the network device to the outside. Duh. Set up Wireshark on some AP and get the same info.
  - sitkack 8y ago
    Niche startup idea, VPN for your mobile device that can analyze and block traffic. Block entire countries, 3rd parties, etc. Give realtime feedback on their dashboard as applications are loaded. Could also be useful as a developer application profiling tool.
    - dschuetz 8y ago
      Facebook attempted such a thing already, and was caught exploiting it. VPN apps for the purpose of traffic control and monitoring are dangerous as they rely on some other party. I could do the same thing without ever needing a service for that. Setting up a monitored VPN gateway is no rocket science for me, I could do that, but the folks using crappy apps couldn't. And I would still need a way to map traffic to specific apps to identify unnecessary/malicious traffic. There is no other way as only via the internal iOS firewall. I wonder how the team behind that report managed to do that what they claim they did.
      - sitkack 8y ago
        Using a clean installed of the OS, removing network access for almost everything and installing a single app, and baselining background network traffic, I don't think it would be difficult or too noisy to see application specific network activity.
    - willstrafach 8y ago
      > Niche startup idea, VPN for your mobile device that can analyze and block traffic. This is indeed what we (originators of this location tracking research) do.
      - sitkack 8y ago
        Do you have it as a service, or a set of OpenVPN scripts I can install? I could see a nice Grafana dashboard of my outbound traffic. Install your cert on my device, break into sessions and then further analyze traffic.
        willstrafach 8y ago
        This will be a commercial service, in order to fund ongoing research efforts allowing us to quickly discover and block all possible forms of tracking, phishing, and other malicious traffic. That said, in the future, lists will be published for folks with the ability and time to operate a Pi-Hole for themselves, if preferred.
        sitkack 8y ago
        Your shame list will be golden! Please post to HN when you launch, I'll sign up.
  - saagarjha 8y ago
    Make a VPN extension and drop all traffic you don’t want. Viola, a poor man’s firewall.
- angott 8y ago
  A good overview of that API here: https://kean.github.io/post/network-extensions-into https://kean.github.io/post/network-extensions-into

saagarjha 8y ago

It's easy to figure out what an iOS device is connecting to: use a network extension that inspects network traffic. And given that Apple has none of the restrictions they impose on third party developers, they can essentially do what Little Snitch does on macOS.

dschuetz 8y ago
There is no way to control the iOS firewall via extensions in iOS. Meaning, it's still not supported, and what you see as "essentially" the same misses the point. I want to block connections of specific apps. What iOS can do is reveal connections made by the network device to the outside. Duh. Set up Wireshark on some AP and get the same info.
- sitkack 8y ago
  Niche startup idea, VPN for your mobile device that can analyze and block traffic. Block entire countries, 3rd parties, etc. Give realtime feedback on their dashboard as applications are loaded. Could also be useful as a developer application profiling tool.
  - dschuetz 8y ago
    Facebook attempted such a thing already, and was caught exploiting it. VPN apps for the purpose of traffic control and monitoring are dangerous as they rely on some other party. I could do the same thing without ever needing a service for that. Setting up a monitored VPN gateway is no rocket science for me, I could do that, but the folks using crappy apps couldn't. And I would still need a way to map traffic to specific apps to identify unnecessary/malicious traffic. There is no other way as only via the internal iOS firewall. I wonder how the team behind that report managed to do that what they claim they did.
    - sitkack 8y ago
      Using a clean installed of the OS, removing network access for almost everything and installing a single app, and baselining background network traffic, I don't think it would be difficult or too noisy to see application specific network activity.
  - willstrafach 8y ago
    > Niche startup idea, VPN for your mobile device that can analyze and block traffic. This is indeed what we (originators of this location tracking research) do.
    - sitkack 8y ago
      Do you have it as a service, or a set of OpenVPN scripts I can install? I could see a nice Grafana dashboard of my outbound traffic. Install your cert on my device, break into sessions and then further analyze traffic.
      - willstrafach 8y ago
        This will be a commercial service, in order to fund ongoing research efforts allowing us to quickly discover and block all possible forms of tracking, phishing, and other malicious traffic. That said, in the future, lists will be published for folks with the ability and time to operate a Pi-Hole for themselves, if preferred.
        sitkack 8y ago
        Your shame list will be golden! Please post to HN when you launch, I'll sign up.
- saagarjha 8y ago
  Make a VPN extension and drop all traffic you don’t want. Viola, a poor man’s firewall.
angott 8y ago
A good overview of that API here: https://kean.github.io/post/network-extensions-into https://kean.github.io/post/network-extensions-into