4 ms·

Are there any firewall style apps to block this type of behavior? Something like uBlock or uMatrix but for apps. I'm not inclined to trust any apps and would pr

Are there any firewall style apps to block this type of behavior? Something like uBlock or uMatrix but for apps. I'm not inclined to trust any apps and would prefer explicit control over what they do. Also, it's a bit strange to me that we didn't/don't seem to have this explosion of data leakage for desktop apps despite them having unique ids just like on mobile (idfa/google ad id).

Despegar 7y ago
You can use Will Strafach's new app Guardian that blocks trackers in apps. I think Apple is going to purge them from iOS apps over time, they've already started with kids apps. https://guardianapp.com/ https://guardianapp.com/
- sascha_sl 7y ago
  it's a vpn from all i see cloud firewalls are their own brand of yikes, unless you run them yourself
  - chatmasta 7y ago
    It could be implemented as a local VPN server using the NetworkExtension API.
    - sascha_sl 7y ago
      It's not though, typical VPN provider claims. Network Traffic Encryption Protect all passwords, communications, and other sensitive network data with AES-256 encryption, mitigating any attempts to monitor your electronic activity.
- wool_gather 7y ago
  Very interesting technique: the firewall is remote. > The Guardian Firewall app has been designed to simply act as a client for remotely hosted VPN servers running custom fully-featured firewall software... (From https://guardianapp.com/blog/2019/06/introducing-guardian-firewall-for-ios/ https://guardianapp.com/blog/2019/06/introducing-guardian-fi...) I wondered at first why the VPN was free but you had to pay for the firewall.
- reaperducer 7y ago
  I think Apple is going to purge them from iOS apps over time, they've already started with kids apps. To be clear, Apple isn't purging apps that protect kids in favor of its own apps. Its my understanding that Apple is purging apps that take over the phone entirely (including the ability to remotely control the camera and microphone) by misusing enterprise certificates. There are plenty of kid protection apps out there that play by the rules and will continue to work.
  - graeme 7y ago
    I think OP meant purging trackers from kids apps. https://www.macrumors.com/2019/05/31/apple-to-limit-third-party-tracking-in-kids-apps/ https://www.macrumors.com/2019/05/31/apple-to-limit-third-pa...
  - Clent 7y ago
    I believe the parent was referring to a change in Apple's guidelines that was making the rounds a couple of weeks ago, “Apps intended for kids may not include third-party advertising or analytics” This was previously discussed here https://news.ycombinator.com/item?id=20108096 https://news.ycombinator.com/item?id=20108096
  - Despegar 7y ago
    As the other comments mentioned, I meant purging trackers from iOS apps. There's a privacy reason to do it but also a business reason. Apple shouldn't have apps on their platform with dependencies to major competitors like Google and Facebook. And it's probably going to be ruled illegal anyway after the GDPR cases get litigated, so it's better to get ahead of it.
- wtmt 7y ago
  This app does not work in all countries and regions as yet. The pricing for the firewall capability also seems to be on the higher side: "The cost is $9.99/month (or $99.99 per year) for VPN + Firewall capabilities. VPN-only service will be available at no cost." [1] [1]: https://guardianapp.com/blog/2019/06/introducing-guardian-firewall-for-ios/ https://guardianapp.com/blog/2019/06/introducing-guardian-fi...
  - stefan_ 7y ago
    And the VPN-only part is free, but it's not a locally emulated VPN. I'm gonna take a wild guess of how that particular service is financed.
bonjurkes 7y ago
You can use Pi Hole both on your local network and on cloud as VPN on your iPhone (only DNS or for full traffic)
- close04 7y ago
  DNS filtering can only do so much. For apps that hardcode addresses you'd have to set up your own firewall. And then to protect yourself when you are "in the wild" you'd have to use an always on VPN to your own network. There might be commercial products that do this for you. Setting this up is definitely outside of the comfort zone for the overwhelming majority of phone users.
  - benologist 7y ago
    One of the main things Pi-hole does is give you transparency into what domains are being contacted and with what frequency, so you can identify and block relevant domains manually. https://discourse-cdn.pi-hole.net/uploads/default/original/2X/7/76219b47f24ad298d3dd9f0e3361ca6eee73d59b.jpeg https://discourse-cdn.pi-hole.net/uploads/default/original/2... https://discourse.pi-hole.net/uploads/default/original/2X/5/550320e5b8541985335a9cd6a31ea6e3ccea24df.jpg https://discourse.pi-hole.net/uploads/default/original/2X/5/...
    - stordoff 7y ago
      Not if the analytics companies start being contacted by hardcoded IP address, or the apps otherwise avoid DNS. May not by a common technique now, but it could become one.
      - lostlogin 7y ago
        All of this describes my Chromecast nicely. There are others that do it too. Forcing this traffic through the Pihole isn’t always helpful though, as blocking it entirely breaks the Chromecast (which is used mainly for playing local media).
    - close04 7y ago
Blackstone4 7y ago
A while back I used NoRoot Firewall on Android which works as a “local VPN” funnelling all web tragic through the app and you whitelist every outbound connection. Only thing is that you don’t always have enough context on each IP address for each app to make an informed decision.
duhi88 7y ago
The article mentions one.

Despegar 7y ago

You can use Will Strafach's new app Guardian that blocks trackers in apps. I think Apple is going to purge them from iOS apps over time, they've already started with kids apps. https://guardianapp.com/ https://guardianapp.com/

sascha_sl 7y ago
it's a vpn from all i see cloud firewalls are their own brand of yikes, unless you run them yourself
- chatmasta 7y ago
  It could be implemented as a local VPN server using the NetworkExtension API.
  - sascha_sl 7y ago
    It's not though, typical VPN provider claims. Network Traffic Encryption Protect all passwords, communications, and other sensitive network data with AES-256 encryption, mitigating any attempts to monitor your electronic activity.
wool_gather 7y ago
Very interesting technique: the firewall is remote. > The Guardian Firewall app has been designed to simply act as a client for remotely hosted VPN servers running custom fully-featured firewall software... (From https://guardianapp.com/blog/2019/06/introducing-guardian-firewall-for-ios/ https://guardianapp.com/blog/2019/06/introducing-guardian-fi...) I wondered at first why the VPN was free but you had to pay for the firewall.
reaperducer 7y ago
I think Apple is going to purge them from iOS apps over time, they've already started with kids apps. To be clear, Apple isn't purging apps that protect kids in favor of its own apps. Its my understanding that Apple is purging apps that take over the phone entirely (including the ability to remotely control the camera and microphone) by misusing enterprise certificates. There are plenty of kid protection apps out there that play by the rules and will continue to work.
- graeme 7y ago
  I think OP meant purging trackers from kids apps. https://www.macrumors.com/2019/05/31/apple-to-limit-third-party-tracking-in-kids-apps/ https://www.macrumors.com/2019/05/31/apple-to-limit-third-pa...
- Clent 7y ago
  I believe the parent was referring to a change in Apple's guidelines that was making the rounds a couple of weeks ago, “Apps intended for kids may not include third-party advertising or analytics” This was previously discussed here https://news.ycombinator.com/item?id=20108096 https://news.ycombinator.com/item?id=20108096
- Despegar 7y ago
  As the other comments mentioned, I meant purging trackers from iOS apps. There's a privacy reason to do it but also a business reason. Apple shouldn't have apps on their platform with dependencies to major competitors like Google and Facebook. And it's probably going to be ruled illegal anyway after the GDPR cases get litigated, so it's better to get ahead of it.
wtmt 7y ago
This app does not work in all countries and regions as yet. The pricing for the firewall capability also seems to be on the higher side: "The cost is $9.99/month (or $99.99 per year) for VPN + Firewall capabilities. VPN-only service will be available at no cost." [1] [1]: https://guardianapp.com/blog/2019/06/introducing-guardian-firewall-for-ios/ https://guardianapp.com/blog/2019/06/introducing-guardian-fi...
- stefan_ 7y ago
  And the VPN-only part is free, but it's not a locally emulated VPN. I'm gonna take a wild guess of how that particular service is financed.

bonjurkes 7y ago

You can use Pi Hole both on your local network and on cloud as VPN on your iPhone (only DNS or for full traffic)

close04 7y ago
DNS filtering can only do so much. For apps that hardcode addresses you'd have to set up your own firewall. And then to protect yourself when you are "in the wild" you'd have to use an always on VPN to your own network. There might be commercial products that do this for you. Setting this up is definitely outside of the comfort zone for the overwhelming majority of phone users.
- benologist 7y ago
  One of the main things Pi-hole does is give you transparency into what domains are being contacted and with what frequency, so you can identify and block relevant domains manually. https://discourse-cdn.pi-hole.net/uploads/default/original/2X/7/76219b47f24ad298d3dd9f0e3361ca6eee73d59b.jpeg https://discourse-cdn.pi-hole.net/uploads/default/original/2... https://discourse.pi-hole.net/uploads/default/original/2X/5/550320e5b8541985335a9cd6a31ea6e3ccea24df.jpg https://discourse.pi-hole.net/uploads/default/original/2X/5/...
  - stordoff 7y ago
    Not if the analytics companies start being contacted by hardcoded IP address, or the apps otherwise avoid DNS. May not by a common technique now, but it could become one.
    - lostlogin 7y ago
      All of this describes my Chromecast nicely. There are others that do it too. Forcing this traffic through the Pihole isn’t always helpful though, as blocking it entirely breaks the Chromecast (which is used mainly for playing local media).
  - close04 7y ago

Blackstone4 7y ago

A while back I used NoRoot Firewall on Android which works as a “local VPN” funnelling all web tragic through the app and you whitelist every outbound connection. Only thing is that you don’t always have enough context on each IP address for each app to make an informed decision.

duhi88 7y ago

The article mentions one.