4 ms·

One of the reasons why I switched from iPhone to Android is the firewall. On my jailbroken i-devices (all of them) I was always installing "Firewall IP", and w

One of the reasons why I switched from iPhone to Android is the firewall. On my jailbroken i-devices (all of them) I was always installing "Firewall IP", and when an app was running, for any connection not previously (or globally - meaning rule applies for all apps) approved I would get a pop-up message (screenshot of an earlier iOS Firewall IP)[1]. Now with the jailbreaks being less efficient, and the Firewall IP app not been updated for a few years, I switched to Android and I am using "NoRoot Firewall" [2] for the same exactly purpose. I globally block all FB, ads, trackers There is always the extra option for rooter/jailbroken phones to block things on the hosts file using host file selections from someonewhocares.org [3]. [1]: https://rdsbc.files.wordpress.com/2011/03/wall1.png https://rdsbc.files.wordpress.com/2011/03/wall1.png [2]: https://lh3.ggpht.com/fXRZfgSmArBemdjABjUDu0ibP9Gis3GV5YXTVj_Ix5-967CtoSvZFXxAx0mQdOj0Klc=w1000-h800 https://lh3.ggpht.com/fXRZfgSmArBemdjABjUDu0ibP9Gis3GV5YXTVj... [3]: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/

mangix 8y ago
One annoyance is that SafetyNet pretty much prevents using Google Pay on a rooted or modified device.
- 0x38B 8y ago
  Quoting https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 https://forum.xda-developers.com/apps/magisk/official-magisk...: "Installing Magisk will give you ROOT, a super powerful Systemless Interface, Magisk Modules support, and hide from tons of integrity tests like SafetyNet!" My Pixel 2 is rooted with Magisk, and passes Safetynet. I use Google Pay all the time.
simonh 8y ago
I think for most users Apple does a good job protecting them, but this is definitely one significant area of weakness for the platform. There are ways to implement similar controls using a VPN service[0], but of course then you need to trust the VPN operator. [0]https://techcrunch.com/2018/10/24/smart-firewall-guardian-iphone-app-privacy-before-profits/ https://techcrunch.com/2018/10/24/smart-firewall-guardian-ip...
- epanchin 8y ago
  One could easily host their own VPN and trust only themselves. You could further connect to a vpn service if you wanted anonymity, although that would of course require trusting them.
  - DavideNL 8y ago
    > easily it's a lot more difficult/leaky, for example it's not possible to block a certain app from accessing the internet; Sure, you can gather all the domains it connects to and block those, but those domains and/or ip addresses can change over time. And when they do, you will not notice, and the app will be able to access the internet until maybe one day you notice and start blocking the new domains/ip addresses.
- writepub 8y ago
  Apple projects an aura of protection, and most of the protection it does really well, is of the bottom line, by crippling W3C compliance on Safari, and pushing devs and users to it's app store
throwaway9d0291 8y ago
My favourites are: - Blokada (https://blokada.org/ https://blokada.org/): Does DNS-based blocking, good for blocking ads/trackers generally - NetGuard (https://www.netguard.me/ https://www.netguard.me/): With Pro, has traffic logging and the ability to filter by address or app. My approach for most apps is to disable all access then selectively whitelist as necessary to make it functional again.
jsmith99 8y ago
For Samsung, there are Knox based options (I recommend adhell3) for host file style blocking that don't require root or vpn.
JustSomeNobody 8y ago
The firewall would block the Glassbox IPs, but I can't see this doing any good for the apps that use this technique and don't use a third party like Glassbox to collect the data.

mangix 8y ago

One annoyance is that SafetyNet pretty much prevents using Google Pay on a rooted or modified device.

0x38B 8y ago
Quoting https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 https://forum.xda-developers.com/apps/magisk/official-magisk...: "Installing Magisk will give you ROOT, a super powerful Systemless Interface, Magisk Modules support, and hide from tons of integrity tests like SafetyNet!" My Pixel 2 is rooted with Magisk, and passes Safetynet. I use Google Pay all the time.

simonh 8y ago

I think for most users Apple does a good job protecting them, but this is definitely one significant area of weakness for the platform. There are ways to implement similar controls using a VPN service[0], but of course then you need to trust the VPN operator. [0]https://techcrunch.com/2018/10/24/smart-firewall-guardian-iphone-app-privacy-before-profits/ https://techcrunch.com/2018/10/24/smart-firewall-guardian-ip...

epanchin 8y ago
One could easily host their own VPN and trust only themselves. You could further connect to a vpn service if you wanted anonymity, although that would of course require trusting them.
- DavideNL 8y ago
  > easily it's a lot more difficult/leaky, for example it's not possible to block a certain app from accessing the internet; Sure, you can gather all the domains it connects to and block those, but those domains and/or ip addresses can change over time. And when they do, you will not notice, and the app will be able to access the internet until maybe one day you notice and start blocking the new domains/ip addresses.
writepub 8y ago
Apple projects an aura of protection, and most of the protection it does really well, is of the bottom line, by crippling W3C compliance on Safari, and pushing devs and users to it's app store

throwaway9d0291 8y ago

My favourites are: - Blokada (https://blokada.org/ https://blokada.org/): Does DNS-based blocking, good for blocking ads/trackers generally - NetGuard (https://www.netguard.me/ https://www.netguard.me/): With Pro, has traffic logging and the ability to filter by address or app. My approach for most apps is to disable all access then selectively whitelist as necessary to make it functional again.

jsmith99 8y ago

For Samsung, there are Knox based options (I recommend adhell3) for host file style blocking that don't require root or vpn.

JustSomeNobody 8y ago

The firewall would block the Glassbox IPs, but I can't see this doing any good for the apps that use this technique and don't use a third party like Glassbox to collect the data.