4 ms·

Realistically you want it at the router level. Force all traffic through a transparent proxy like mitmproxy with some custom code to strip out the sends you do

Realistically you want it at the router level. Force all traffic through a transparent proxy like mitmproxy with some custom code to strip out the sends you don't like. Stop all those IoT devices. Its on my plate to make a go at it, with some inspiration from pihole. But really it'd be about enabling myself to use some of this great data without sharing it with a third party. For example, I'd wear my fitbit if it wasn't reporting in to their servers. But if I force my phone through a VPN, which routes through my transparent proxy, I could feed fitbit junk data while scraping the pieces I want to my own system. We need apps that take control of these devices and their telemetry away from the third parties.

mindslight 7y ago
Philosophically, I completely agree with you. The problem is that this isn't inherently possible because the whole thing could be E2E encrypted. I know there is a Linux (python?) client that will sync (at least some models of fitbit) to their cloud service. But I've no idea if there is one that will dump the data locally. It's entirely possible that the cloud client is merely passing along an opaque blob.
- Freak_NL 7y ago
  Why not just block everything the printer sends? When does a printer actually need internet?
  - mindslight 7y ago
    Yes, removing Internet access is always an option (although eventually we might have to physically disconnect wifi antennas or use a Faraday cage...). I was responding to a comment that was talking about creating Free Software to communicate with the device, specifically the idea of proxying access to the corporate server and modifying the communication, rather than implementing the whole protocol from scratch. I'd guess the Fitbit protocol is encrypted, from a desire to keep people from cheating their activity reports. If a company wants to spend the development time, there is basically nothing that can be done to prevent a device requiring Internet access on a dumb-pipe all-or-nothing basis.
    - c0d3rX 7y ago
      Faraday cage for the win. My printer stays offline - period. If something needs printing, I have to sneakerware it. If I'm unable to do that, I rethink whether it really needs printing in the first place :D
    - cmroanirgo 7y ago
      Although this comment may seem a bit extreme: I looked at the rubbish that Fitbit installed on my laptop several years ago. I decided to throw my Fitbit out after scrubbing my hard drive of their software. So, although it's fair to assume their software's probably improved since then, I'm not buying.
  - pdimitar 7y ago
    That's exactly what I do on my Mikrotik router. I assign a static address to my printer and then disallow any outgoing internet traffic coming from its internal IP.
JohnFen 7y ago
> Realistically you want it at the router level. I do both. I run a firewall on my phone mostly to prevent applications from communicating out without my express permission. I also don't turn on my phone's radios without connecting to a VPN that I run at home, so that all of my phone's traffic gets routed through the defenses I've set up for my home network. On top of that, I avoid using the web on mobile devices to the greatest degree possible.
cmroanirgo 7y ago
Router solutions tend to work only for static/controlled lans. Nearly 100% of my time connected to a network is not under my control (someone else's wifi or telco). Another problem with router and other solutions such as pi hole / hosts is that they apply rules in a generic manner without regard to context. eg. On my Mac I use Little Snitch to disallow any comms with apple, except when it's App Store. Appalled at the telemetry that vscode allows, I've gone back to sublime text 2. On my Android, (sadly without root) I use NetGuard for similar purposes. I blanket disallow google for many apps. I allow carte blanch to my personal servers for apps that I use, but any telemetry of theirs is stonewalled. In Firefox I use containers to separate FB/Twitter to their own hole, while I blacklist them in uMatrix for every other circumstance. That said, things like doubleclick and crashlytics are fine to be black listed throughout a network. My thoughts were more targeted toward a properly sandboxed os that gives users the chance to control on a port/ hostname level what is being connected to.

mindslight 7y ago

Philosophically, I completely agree with you. The problem is that this isn't inherently possible because the whole thing could be E2E encrypted. I know there is a Linux (python?) client that will sync (at least some models of fitbit) to their cloud service. But I've no idea if there is one that will dump the data locally. It's entirely possible that the cloud client is merely passing along an opaque blob.

Freak_NL 7y ago
Why not just block everything the printer sends? When does a printer actually need internet?
- mindslight 7y ago
  Yes, removing Internet access is always an option (although eventually we might have to physically disconnect wifi antennas or use a Faraday cage...). I was responding to a comment that was talking about creating Free Software to communicate with the device, specifically the idea of proxying access to the corporate server and modifying the communication, rather than implementing the whole protocol from scratch. I'd guess the Fitbit protocol is encrypted, from a desire to keep people from cheating their activity reports. If a company wants to spend the development time, there is basically nothing that can be done to prevent a device requiring Internet access on a dumb-pipe all-or-nothing basis.
  - c0d3rX 7y ago
    Faraday cage for the win. My printer stays offline - period. If something needs printing, I have to sneakerware it. If I'm unable to do that, I rethink whether it really needs printing in the first place :D
  - cmroanirgo 7y ago
    Although this comment may seem a bit extreme: I looked at the rubbish that Fitbit installed on my laptop several years ago. I decided to throw my Fitbit out after scrubbing my hard drive of their software. So, although it's fair to assume their software's probably improved since then, I'm not buying.
- pdimitar 7y ago
  That's exactly what I do on my Mikrotik router. I assign a static address to my printer and then disallow any outgoing internet traffic coming from its internal IP.

JohnFen 7y ago

> Realistically you want it at the router level. I do both. I run a firewall on my phone mostly to prevent applications from communicating out without my express permission. I also don't turn on my phone's radios without connecting to a VPN that I run at home, so that all of my phone's traffic gets routed through the defenses I've set up for my home network. On top of that, I avoid using the web on mobile devices to the greatest degree possible.

cmroanirgo 7y ago

Router solutions tend to work only for static/controlled lans. Nearly 100% of my time connected to a network is not under my control (someone else's wifi or telco). Another problem with router and other solutions such as pi hole / hosts is that they apply rules in a generic manner without regard to context. eg. On my Mac I use Little Snitch to disallow any comms with apple, except when it's App Store. Appalled at the telemetry that vscode allows, I've gone back to sublime text 2. On my Android, (sadly without root) I use NetGuard for similar purposes. I blanket disallow google for many apps. I allow carte blanch to my personal servers for apps that I use, but any telemetry of theirs is stonewalled. In Firefox I use containers to separate FB/Twitter to their own hole, while I blacklist them in uMatrix for every other circumstance. That said, things like doubleclick and crashlytics are fine to be black listed throughout a network. My thoughts were more targeted toward a properly sandboxed os that gives users the chance to control on a port/ hostname level what is being connected to.