4 ms·

I encourage everyone to try routing your own device's traffic through mitmproxy and observing this in real time. It's eye opening. Apps like Deliveroo, which h

I encourage everyone to try routing your own device's traffic through mitmproxy and observing this in real time. It's eye opening. Apps like Deliveroo, which have legtimate reasons for high accuracy location access, send your data to marketing companies on every launch with very high precision. I've written a guide[0] about how to use mitmproxy to look at the data escaping your device. 0: https://hugotunius.se/2019/01/23/going-spelunking-with-mitmproxy.html https://hugotunius.se/2019/01/23/going-spelunking-with-mitmp...

colesdefectum 7y ago
While it may not catch everything, another way I've picked up on various tracking services is simply running pihole and customizing the lists based on permitted dns lookups. It's interesting and troubling just how much of my internet browsing is blocked at the DNS level on a day to day basis with no perceivable impact on what's being viewed. I do wonder how many services might start trying to hardcode IP addresses to get around such things in the future. I'll have to try mitmproxy and see what I might be missing.
- K0nserv 7y ago
  Yup I do this too and I agree with your observations, about one third of my home network's DNS request are rejected with nearly no impact on my internet browsing. I've also observed the same thing when browsing the web with uBlock Origin set to block third party scripts by default. On most sites whitelisting ~20% of scripts is enough to make the site functional, the other ~80% apparently being redundant for the purpose of the site's core functionality.
mobilemidget 7y ago
Am I understanding it correctly that the app on your mobile is directly sending the data to marketing companies? They don't even collect it and hand it to marketing companies through a separate channel?
- K0nserv 7y ago
  No they dont't usually collect the data and forward it to third parties. With most stuff like this apps will embed a binary SDK which is initialized when the app starts. Because the SDK runs in the app's process it has all the same permission and data access that the app itself has. The SDK communicates with the relevant APIs directly. On the web similar models are often used with third party scripts loaded in the main page context. For example here's Braze's developer integration guide https://www.braze.com/docs/developer_guide/platform_integration_guides/ios/initial_sdk_setup/cocoapods/#step-1-install-cocoapods https://www.braze.com/docs/developer_guide/platform_integrat...

colesdefectum 7y ago

While it may not catch everything, another way I've picked up on various tracking services is simply running pihole and customizing the lists based on permitted dns lookups. It's interesting and troubling just how much of my internet browsing is blocked at the DNS level on a day to day basis with no perceivable impact on what's being viewed. I do wonder how many services might start trying to hardcode IP addresses to get around such things in the future. I'll have to try mitmproxy and see what I might be missing.

K0nserv 7y ago
Yup I do this too and I agree with your observations, about one third of my home network's DNS request are rejected with nearly no impact on my internet browsing. I've also observed the same thing when browsing the web with uBlock Origin set to block third party scripts by default. On most sites whitelisting ~20% of scripts is enough to make the site functional, the other ~80% apparently being redundant for the purpose of the site's core functionality.

mobilemidget 7y ago

Am I understanding it correctly that the app on your mobile is directly sending the data to marketing companies? They don't even collect it and hand it to marketing companies through a separate channel?

K0nserv 7y ago
No they dont't usually collect the data and forward it to third parties. With most stuff like this apps will embed a binary SDK which is initialized when the app starts. Because the SDK runs in the app's process it has all the same permission and data access that the app itself has. The SDK communicates with the relevant APIs directly. On the web similar models are often used with third party scripts loaded in the main page context. For example here's Braze's developer integration guide https://www.braze.com/docs/developer_guide/platform_integration_guides/ios/initial_sdk_setup/cocoapods/#step-1-install-cocoapods https://www.braze.com/docs/developer_guide/platform_integrat...