8 ms·
My phone is spying on me, so I decided to spy on it
- Latteland 8y agoI am interested to see the result. I might pay for a vpn that I control that blocked things.
- hrrsn 8y agoIf you don't mind DIY, Pihole + OpenVPN is a good solution: https://docs.pi-hole.net/guides/vpn/overview/ https://docs.pi-hole.net/guides/vpn/overview/
- swlkr 8y agoI'm partial to algo: https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- thefz 8y agoTake a look at the brilliant Wireguard: https://www.wireguard.com/ https://www.wireguard.com/
- pimeys 8y agoI'm using Blockada for that, which acts as a vpn, but just filters all requests through a big hosts file. https://blokada.org/ https://blokada.org/
- curiousigor 8y agoThis looks interesting. Is there something similar for iOS?
- pimeys 8y agoI doubt. Play Store doesn't allow the full version of Blokada so you need to install it from F-Droid or directly from their web site.
- sirn 8y agoYou can use DNSCloak[1] for this. It runs a local DNSCrypt client and acts as iOS VPN. You can run your own DoH server that blocks tracking domains, or use a public DoH server that does, or use a well-known provider that provides DoH (e.g. Cloudflare DNS, Google DNS and OpenDNS does) with your own blacklist[2] [1]: https://itunes.apple.com/us/app/dnscloak-dnscrypt-doh-client/id1330471557 https://itunes.apple.com/us/app/dnscloak-dnscrypt-doh-client... [2]: https://itunes.apple.com/us/app/dnscloak-dnscrypt-doh-client/id1330471557 https://itunes.apple.com/us/app/dnscloak-dnscrypt-doh-client...
- DavideNL 8y ago> You can run your own DoH server that blocks tracking domains Do you mean your own dns server which will be accessible to (anyone on) the public internet?
- sirn 8y agoThat's certainly an option if you want to run public DNS-over-HTTPS server, but you don't have to do that – DNSCloak do provide a way to specify a local blocklist. DNS-over-HTTPS spec also mentioned that you can use a standard HTTP authentication if you want to run a DOH server but want to keep it private (although I've never tried this)
- DavideNL 8y agoA do-it-yourself solution is Algo https://github.com/trailofbits/algo https://github.com/trailofbits/algo Algo has a feature to install ad-blocking for all dns queries.
- jaipilot747 8y agoAfter recommending Blokada to someone, I realized the version on the Play Store can only change your DNS. The full version is on F-Droid.
- HenryBemis 8y agoAnd a little something for our hosts files: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/ Use with care, as you may break things. I've been using it as-is with no disruptions/problems.
- seppin 8y agoIf you use an ad blocker in browser it does the same thing. Native ad blocking only works when an app uses an obvious third party plugin for them. The native stuff all stays
- eximius 8y agoUse Wireguard with DNS enabled and then run `unbound` on your server. You control the blacklist. No ads, etc. Works on all platforms.
- Jazgot 8y agoWireGuard is nice, but unfortunately consumes battery very fast.
- zx2c4 8y agoThe kernel module version uses less, if you have a phone that supports it. The userspace version uses much less than ordinary VPNs -- because it doesn't send traffic when you're not using it -- but it's still Android userspace networking, which uses battery, unfortunately.
- eximius 8y agoI haven't noticed a difference, really. Maybe it's just the new phone period where everything works well and it'll all go to hell later...
- fit2rule 8y agoI'm seeing potential for VPN providers to bolt this reporting on as a regular service. Maybe this is already set up in things like Streisand? Honestly, more and more people need to have the ability to administer their phones this way - for too long, its been a black box. (If we still had real OS vendors, it'd be handy if this were builtin to the OS, duh...)
- newnewpdro 8y ago> (If we still had real OS vendors, it'd be handy if this were builtin to the OS, duh...) RedHat, Canonical, and Microsoft are not "real" OS vendors?
- mmjaa 8y agoRedHat, Canonical and Microsoft make phones?
- ry_ry 8y agoUbuntu Touch & Windows Mobile (heh) are/were a thing though.
- StudentStuff 8y agoUbuntu Touch never got off the ground, and Windows Mobile was a mess to try and load apps onto (having wasted waaaay too much time messing with that years ago). On the topic of Ubuntu Phone, the reimplementation of Signal for it tried really hard to look exactly the same, except core features like calling and media were broken or had issues. https://github.com/janimo/textsecure-qml https://github.com/janimo/textsecure-qml
- fit2rule 8y agoYeah, we all know these are dead in the water. What I mean was, the old OS vendor ethos just doesn't exist any more - its no longer about giving the user the tools required to get the best value out of their computer, but rather give the computer the tools required to get the best value out of the user... RedHat/Canonical are real OS vendors. Microsoft is an also-ran ad-agency wannabe. Google: same. Apple: I give them a pass, but only because they seem to be taking privacy seriously - if only they'd give the user more control over what's going on with their devices, and stop doing things designed, clearly, to just sell more hardware ..
- blihp 8y agore: opening up Safari on the iPhone 'any website you have in your bookmarks can track that' I assume that's because it's checking/refreshing favicons? If that's all it is there's nothing nefarious about it but he sure is opaque in his statement.
- manicdee 8y agoNothing nefarious about it except that simply requesting a favicon means you have made a request, so now that site knows where you are. There’s really no need to request the favicon unless there is an actual page requested from the site.
- shaftway 8y agoFavicons are used as status icons for a lot of things these days, and in a bunch of cases it makes sense to refresh it. GMail offers it with a counter of how many unread emails you have, and a lot of our internal tools offer it as a thumbnail view of the status of the most recent job run.
- yayana 8y agoThey aren't supposed to be used that way so it would also make sense (and be safer from spear fishing) to request them with no cookie state and call it a day.
- bennofs 8y agoNice project. I considered doing something similar but in Android at least some apps use certificate pinning and thus mitmproxy would break them. How does this work in ios?
- openplatypus 8y agoHow does this work? If application has certificate pinning then MITM is not feasible, correct? Would love if someone could enlighten me :)
- boomboomsubban 8y agoCorrect, he mentions some data will be unavailable to him, and mitmproxy mentions that certificate pinning is a problem.
- _kbh_ 8y agoYou could use frida, it works on jailbroken and non jailbroken phones but is much more feature rich on jailbroken devices. https://www.frida.re https://www.frida.re
- spondyl 8y agoA lot may have changed but here's a few blog posts on various MITM/cert pinning bypasses that some people have done: https://blog.tendigi.com/starbucks-should-really-make-their-apis-public-6b64a1c2e923 https://blog.tendigi.com/starbucks-should-really-make-their-... https://jeffhuang.com/extracting_my_data_from_the_hello_sense.html https://jeffhuang.com/extracting_my_data_from_the_hello_sens... https://blog.dewhurstsecurity.com/2015/11/10/mobile-security-certificate-pining.html https://blog.dewhurstsecurity.com/2015/11/10/mobile-security... I just had these bookmarked from when I was wondering the same thing
- proxygeek 8y agoThis is really interesting! Have been doing something similar myself on my own phone (Android) for about a month using the wonderful NetGuard app ( https://f-droid.org/en/packages/eu.faircode.netguard/ https://f-droid.org/en/packages/eu.faircode.netguard/) which allows one to see the source and destination for each request from all apps. It doesn't display the content type enough, afaik
- ahreflink 8y agoNetGuard is amazing, really can't recommend it enough. You can use it to specify which apps are allowed to use WiFi/data, and whether they're allowed to use all the time or only if screen is active. It also allows you to set a hosts file URL and update it with a single click. It has improved my battery life, I rarely see ads (both when using the browser and when using apps), and it force me to use old.reddit.com since reddit.com is blocked by my host file.
- stephengillie 8y agoDefault settings prevent posting to Imgur through their app. What other normal functionality does this break, and why?
- ahreflink 8y agoimgur and reddit have become evil, so I wouldn't say it's surprising that their websites/apps stop working when you begin to block tracking and analytics. Both of these companies seem to go out of their way to break functionality for users that try to protect their privacy. I recommend you blame imgur rather than NetGuard.
- victor106 8y agoAnyone know of a similar app for iPhone?
- rickdg 8y agoDon't think such an app would be accepted by Apple. Why are using iPhone if you want ownership over your device?
- zeveb 8y agoThis, BTW, is IMHO why recent Android versions refuse to use self-installed certificates for all traffic: to prevent you from knowing what apps are sending back home. It's not in Google's interest for you to control your phone and know what it's doing.
- jarito 8y agoOr it could be the reason they've said they did it - this was a primary vector for malware authors to compromise user's information and devices. Not everything is a conspiracy.
- brokenmachine 8y agoThen why not offer a confirmation box to add certificates, and let the user decide?
- xnzakg 8y agoProbably because users will just follow instructions they found on some sketchy website without actually reading the text in the confirmation box.
- brokenmachine 8y agoThen a confirmation box saying, "only do this if you know what you're doing - it can have dire security consequences". Just because some people are idiots who don't read what's in front of them, doesn't mean others should be impacted. We all know the real reason it's not an option.