7 ms·
Doesn't matter, they have it on their personal phone. App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. Th
by angry_octet 7y ago
Doesn't matter, they have it on their personal phone.
App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. The whole idea of unrestricted network access is stupid.
- kardos 7y agoHow would restricted network access help? If you permit a dodgy app to talk to only one remote endpoint, it can exfiltrate whatever it wants.
- angry_octet 7y agoWhy would a flashlight app need to talk to the internet at all? (Advertising.)
- thaumasiotes 7y ago> The whole idea of unrestricted network access is stupid. I've been coming around to a similar idea. I'd like a setup something like this for my desktop: 1. Some devices representing network connections. One or more are "real"; others may be VPNs. 2. Per-application settings governing which network devices, if any, the application may use. Default to none. For example, the common way to use a VPN is like this: 1. Start your machine. You're connected to the internet, but not yet to the VPN. All of your running software is already using the internet over the unprotected connection. 2. Start the VPN. It will magically do something such that applications wanting to use "the internet" find it instead of the connection they used to find (the one the VPN itself is still using). All of your running software is now using the VPN. Did you want something to use the other connection? Too bad. I'm sick of the idea that Windows perceives an internet connection somehow, hides it from me, and automatically makes it available to everything that asks for "the internet". But I don't actually know how to do this. Someone is working really, really hard to make sure I don't affect who uses what device.
- deleted 7y ago[deleted]
- wrkronmiller 7y agoThis behavior is a function of Berkeley Sockets style APIs and the nature of routing tables/default routes.
- jjhb94 7y agoCan't you configure this with most firewalls by restricting WAN traffic?
- bradgessler 7y agoCheck out https://www.qubes-os.org/ https://www.qubes-os.org/ They secure and compartmentalize at the VM-level so you can setup a VM to work only over Tor or VPN, and others to work directly over your own network. You can also restrict access to hardware per VM.
- fleminra 7y agoYou can have per-application IP routing if you run applications within individual Linux containers. E.g.: sudo pflask --netif=macvlan:enp4s0:net0 tmux Then inside tmux run a VPN client and the sensitive application.
- dahfizz 7y agoReading your comment melts my mind as a Linux user. You can't just set your vpn connection as the default route? What's even the point if it's not the default route? Applications (at least on Linux) have no idea what device they are using. They just request a connection to an IP and it's the kernels job to route that request correctly.
- nl 7y agoOf course Windows can (and does usually) use a VPN as an active route. The poster just doesn't know what they are talking about. In particular this sentence is complete nonsense: I'm sick of the idea that Windows perceives an internet connection somehow, hides it from me, and automatically makes it available to everything that asks for "the internet". But I don't actually know how to do this. Someone is working really, really hard to make sure I don't affect who uses what device. As usual, MS has pretty decent documentation on this: https://docs.microsoft.com/en-us/windows-hardware/drivers/mobilebroadband/understanding-and-configuring-windows-connection-manager https://docs.microsoft.com/en-us/windows-hardware/drivers/mo... I don't particularly like the GUI_centric nature of much of it, but the complaint itself is completely ill-informed.
- apk-d 7y agoInstalling a firewall app and checking the connection log on my Android phone really spooked me. There's a ton of traffic in the background that shouldn't be there. It's absolutely crazy that Android doesn't have a first party firewall or the ability to disable internet access permission per app, but that would impact Google's ad revenue, so of course we can't have that.
- vsviridov 7y agoSettings -> Apps and Notifications -> Data Usage Control
- llampx 7y agoIt depends on the OS. Huawei's EMUI has a built-in firewall which can restrict access over Wi-Fi or cellular data to certain apps.
- Anarch157a 7y agoI don't know if this is a feature of Android or of the alternative ROM I'm using, but I can disable network access on a per app basis. In my Android Pie based ROM, in Settings / Network & Internet / Data Usage / App data usage I can select any app and disable WiFi, Cellular data or both.
- angry_octet 7y agoThat must be the custom OS build. Many official builds allow you to disable cellular, though very time consuming.
- kjaftaedi 7y agoA simple approach is to just ban personal phones while at work. You can forward your number to a work phone while you're on duty, you don't need to carry a personal device with you.
- mattr47 7y agoThat is what all units in USSOCOM do. No personal cell phones, smart watches, etc allowed in the office. Guests have lock boxes outside main entrance to secure their phone. About once a week security folks wander through the offices looking for phones with some type of detector. God help the person who brought their phone in.
- gambiting 7y agoFew years ago I worked at an oil refinery in Scotland, the rules were the same - no personal phones on site, if you were found with one you'd get in deep trouble.
- angry_octet 7y agoYou may have seen people doing the two minute sprint then? That's when you check the TOTP code on your phone, put it back on the stack of phones, and race as fast as you can back to your desk to enter the code before it expires.
- angry_octet 7y agoPlease, downvoter, tell me I'm wrong.
- SpicyLemonZest 7y ago> App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. Yeah, this is really bizarre to me. I was trying to check on volume levels through walls in my apartment, so I wanted to find some random decibel measuring app and lock it down so I don't have to worry too much about trusting it. But somehow Apple's permission model, which provides a whole pile of privilege switches including mobile data, has no way to completely revoke Internet privileges for an app.
- TYPE_FASTER 7y agoI’ve found blocking an iPhone on my WiFi AP effectively cuts it off from the net. It may have cell, but I think iOS prioritizes the WiFi connection because it’s live to the AP, even though all requests stop there.
- Spooky23 7y agoWhy not just turn off cellular data?
- deleted 7y ago[deleted]
- freedomben 7y agoThis is one of my favorite things about Android. It's trivial to restrict access using AFWall+ . You can block all access, mobile data access, WiFi access, it any combination thereof on a per app basis. Highly recommend it.
- rsanek 7y agoUnfortunately requires root though, which means for the vast majority of Android users this is not an option.
- freedomben 7y agoYes very true. I've been rooting for years so don't usually think about that, but yes you have to be rooted. It's sad that for proper security you have to root your device. I'd love if they built that firewall into Android. Anticipating a question, the best phones IMHO for rooting are the OnePlus phones and Pixel. Motorola had been good in the past but you have to get a code to unlock the bootloader (which I don't like).
- ComodoHacker 7y agoGood luck figuring out a sane UI for that for average mobile user.
- ThomPete 7y agobut government issued phones have access to things personal phones don't.
- Spooky23 7y agoNo way. Restricted access to networks is a step back to the Bell System days. Once you open the door, it won’t close. This is a legal and compliance issue. If you made the marketplace share liability for fraudulent apps, and had meaningful law around the ownership of electronic data, this problem would go poof. In the US, a piece of paper in a locked drawer requires a warrant to access. Electronic data requires as little as an administrative subpoena