6 ms·

Regarding iOS: I stopped using iPhones and (edit typo) quot the ecosystem altogether (apart from an app I still sell in apple app store) because with the lack o

Regarding iOS: I stopped using iPhones and (edit typo) quot the ecosystem altogether (apart from an app I still sell in apple app store) because with the lack of an untethered Jailbreak I could no longer install "Firewall IP" and I could not edit the hosts file. Regarding Android: I switched to Android for the "NoRoot Firewall" and since most Android phones are Root-able I can also edit my hosts file. The article gives a very good analysis of what I have been telling friends, and my constant complain towards that Cancer called Facebook: why does my e-banking app or Booking.com or practically every air carrier's app, need to alert FB that I am using this or that app? Anyone with an Android can install that NoRoot Firewall and see in 60seconds what their phones are doing when you are not looking. This in combination with the applications running in the background 24/7 makes privacy a thing of the past.

jabberthemutt 8y ago
I can highly recommend NetGuard on android, it's non-root and free software. I wish there was a system that lets me whitelist specific hosts per app.
- kekebo 8y ago
  You can do that with NetGuard, but it's a pro feature you have to unlock
  - jabberthemutt 8y ago
    Oh oops! I bought it to support the developer and never even noticed that. Thanks!
- propogandist 8y ago
  Netguards pro features will let you block domains from connecting at the app level. Also, downloading netguard from github will give you the option to use hostfile to block providers (not available via Play Store). Separately, if you have root should look into XprivacyLua from the same dev
HenryBemis 8y ago
and as always my favourite source for hosts file: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/
barnabee 8y ago
Apps like AdGuard Pro let you block domains for all apps by intercepting and blocking DNS locally on iOS.
- DavideNL 8y ago
  it's not a proper solution (apps can simply communicate with their servers public ip instead of looking up a domain name.)
  - bostik 8y ago
    If that becomes more widespread, I would expect a future generation of blocking software to start use ASN information.
    - m463 8y ago
      On IOS apple only allows (some) dns based blocking afaik
  - jakejarvis 8y ago
    Wouldn't that loophole work on all DNS-based blockers/black-holes on any platform, namely Pi-hole (and the hosts file for that matter)?
    - LeoPanthera 8y ago
      Yes. I use a DNSBL in my router (pfBlockerNG), and I've been considering writing a small script to resolve every IP in the blocklist and then block outgoing connections to those IPs. Of course this is only useful at home. As soon as my phone leaves the house, everything is open again.
      - jakejarvis 8y ago
        Ooh, good idea. Would probably only have to write ~1 time per day to a separate, parallel list. Or have a small VPS do the work continuously and push changes to a Git repo so others can pull it however often they want. I’d love to take a look if you end up doing that!
hellcow 8y ago
That's exactly why I uninstalled Robinhood, Spotify, Venmo and half the other apps on my phone. Netguard showed me those apps were notifying Facebook every time I opened them. Facebook has no business knowing when I'm making trades, listening to music, sending money or anything else.
- fancyfish 8y ago
  This is what I did as well, and for the services I still needed, I found the mobile sites nearly equivalent in looks and features. Especially for banking, shopping, and reading sites. I added links to my homescreen in lieu of apps, and that way I know they're not using my phone in the background. The downside is getting hounded to install the app when I visit certain mobile sites.
DavideNL 8y ago
Unfortunately, i seriously doubt whether using Android (and thereby supporting Google) will improve your privacy, even when using a firewall. A simple example: https://www.bloomberg.com/news/articles/2018-08-13/google-tracks-location-data-even-when-users-turn-service-off-ap https://www.bloomberg.com/news/articles/2018-08-13/google-tr...
- kop316 8y ago
  That depends. If he isn't using google play at all, then I think it would.
  - api 8y ago
    I tried no root firewall and found that Google groups literally everything under a kitchen sink service that talks to blind IPs with SSL. There is no way to allow Maps without inviting Google to share your bed with you.
    - kop316 8y ago
      I think you misunderstand me. What I mean is you wipe the phone, reinstall either AOSP or LineageOS (or other custom ROM), do NOT install any Google Apps (to include Google Play Services, Google Store, Google Maps, etc.). Use F-Droid (https://f-droid.org/ https://f-droid.org/) as your App Store. I have been using OsmAnd (https://osmand.net/ https://osmand.net/) as my map service.
      - filleduchaos 8y ago
        It's a bit annoying though how much a first-world-only solution this is. OpenStreetMaps was completely useless for my city/country the last five times I tried to use it.
        jlokier 8y ago
        I think you may be in the first world on this one. I saw a very interesting talk last year about how Google Maps is often useless in third world areas, and OpenStreetMaps provides the only useful coverage. It's due to armies of volunteers mapping an area during disasters, while Google has no economic interest in mapping the area. https://media.ccc.de/v/emf2018-157-how-the-internet-has-changed-emergencies https://media.ccc.de/v/emf2018-157-how-the-internet-has-chan...
captn3m0 8y ago
DNSCloak on iOS supports this now.
shostack 8y ago
Serious question--how does one verify the security and privacy of something like NoRoot Firewall? It wants: - have full network access - view network connections - run at startup That's a pretty serious list of permissions to consider giving something that while it would seemingly be beneficial, is also a great vector into my phone activity for a malicious actor (not accusing them of being such btw).
- A2017U1 8y ago
  Netguard is an equivalent Android app, it is open source and available on fdroid / play store. The fdroid version has to match the source. I'm not sure how play store builds work.
marak830 8y ago
Noroot firewall was a bit of an eye opener for me, and I began by not trusting anything! By block list is huge at the moment, and have basically stopped installing any apps, or allowing non-allowed apps to update.

jabberthemutt 8y ago

I can highly recommend NetGuard on android, it's non-root and free software. I wish there was a system that lets me whitelist specific hosts per app.

kekebo 8y ago
You can do that with NetGuard, but it's a pro feature you have to unlock
- jabberthemutt 8y ago
  Oh oops! I bought it to support the developer and never even noticed that. Thanks!
propogandist 8y ago
Netguards pro features will let you block domains from connecting at the app level. Also, downloading netguard from github will give you the option to use hostfile to block providers (not available via Play Store). Separately, if you have root should look into XprivacyLua from the same dev

HenryBemis 8y ago

and as always my favourite source for hosts file: https://someonewhocares.org/hosts/ https://someonewhocares.org/hosts/

barnabee 8y ago

Apps like AdGuard Pro let you block domains for all apps by intercepting and blocking DNS locally on iOS.

DavideNL 8y ago
it's not a proper solution (apps can simply communicate with their servers public ip instead of looking up a domain name.)
- bostik 8y ago
  If that becomes more widespread, I would expect a future generation of blocking software to start use ASN information.
  - m463 8y ago
    On IOS apple only allows (some) dns based blocking afaik
- jakejarvis 8y ago
  Wouldn't that loophole work on all DNS-based blockers/black-holes on any platform, namely Pi-hole (and the hosts file for that matter)?
  - LeoPanthera 8y ago
    Yes. I use a DNSBL in my router (pfBlockerNG), and I've been considering writing a small script to resolve every IP in the blocklist and then block outgoing connections to those IPs. Of course this is only useful at home. As soon as my phone leaves the house, everything is open again.
    - jakejarvis 8y ago
      Ooh, good idea. Would probably only have to write ~1 time per day to a separate, parallel list. Or have a small VPS do the work continuously and push changes to a Git repo so others can pull it however often they want. I’d love to take a look if you end up doing that!

hellcow 8y ago

That's exactly why I uninstalled Robinhood, Spotify, Venmo and half the other apps on my phone. Netguard showed me those apps were notifying Facebook every time I opened them. Facebook has no business knowing when I'm making trades, listening to music, sending money or anything else.

fancyfish 8y ago
This is what I did as well, and for the services I still needed, I found the mobile sites nearly equivalent in looks and features. Especially for banking, shopping, and reading sites. I added links to my homescreen in lieu of apps, and that way I know they're not using my phone in the background. The downside is getting hounded to install the app when I visit certain mobile sites.

DavideNL 8y ago

Unfortunately, i seriously doubt whether using Android (and thereby supporting Google) will improve your privacy, even when using a firewall. A simple example: https://www.bloomberg.com/news/articles/2018-08-13/google-tracks-location-data-even-when-users-turn-service-off-ap https://www.bloomberg.com/news/articles/2018-08-13/google-tr...

kop316 8y ago
That depends. If he isn't using google play at all, then I think it would.
- api 8y ago
  I tried no root firewall and found that Google groups literally everything under a kitchen sink service that talks to blind IPs with SSL. There is no way to allow Maps without inviting Google to share your bed with you.
  - kop316 8y ago
    I think you misunderstand me. What I mean is you wipe the phone, reinstall either AOSP or LineageOS (or other custom ROM), do NOT install any Google Apps (to include Google Play Services, Google Store, Google Maps, etc.). Use F-Droid (https://f-droid.org/ https://f-droid.org/) as your App Store. I have been using OsmAnd (https://osmand.net/ https://osmand.net/) as my map service.
    - filleduchaos 8y ago
      It's a bit annoying though how much a first-world-only solution this is. OpenStreetMaps was completely useless for my city/country the last five times I tried to use it.
      - jlokier 8y ago
        I think you may be in the first world on this one. I saw a very interesting talk last year about how Google Maps is often useless in third world areas, and OpenStreetMaps provides the only useful coverage. It's due to armies of volunteers mapping an area during disasters, while Google has no economic interest in mapping the area. https://media.ccc.de/v/emf2018-157-how-the-internet-has-changed-emergencies https://media.ccc.de/v/emf2018-157-how-the-internet-has-chan...

captn3m0 8y ago

DNSCloak on iOS supports this now.

shostack 8y ago

Serious question--how does one verify the security and privacy of something like NoRoot Firewall? It wants: - have full network access - view network connections - run at startup That's a pretty serious list of permissions to consider giving something that while it would seemingly be beneficial, is also a great vector into my phone activity for a malicious actor (not accusing them of being such btw).

A2017U1 8y ago
Netguard is an equivalent Android app, it is open source and available on fdroid / play store. The fdroid version has to match the source. I'm not sure how play store builds work.

marak830 8y ago

Noroot firewall was a bit of an eye opener for me, and I began by not trusting anything! By block list is huge at the moment, and have basically stopped installing any apps, or allowing non-allowed apps to update.