4 ms·

Is there anywhere with an in-depth overview of what this does? Does it just fail DNS request and block known IPs? How are the lists maintained and updated? With

Is there anywhere with an in-depth overview of what this does? Does it just fail DNS request and block known IPs? How are the lists maintained and updated? With TLS and it surely not mitm-ing connections, that's all it can do correct?

josteink 7y ago
> With TLS and it surely not mitm-ing connections, that's all it can do correct? Unless it also acts as a web-proxy, yes.
- winternett 7y ago
  It can possibly access all your activity, contacts, microphone, and camera... Hard pass from me at the moment. :/
  - rectang 7y ago
    It's a start. It's good that it's open source, but that's necessary not sufficient to establish trust for something which requires such significant privileges. You also want to be able to know who the authors are, to evaluate them for trustworthiness, and to evaluate their processes to see how well hardened they are against malicious contributions.
  - hosteur 7y ago
    > It can possibly access all your activity, contacts, microphone, and camera... Hard pass from me at the moment. :/ Camera and mic? How does it do this as a vpn? I see no requests for such things in iOS settings for the app.
    - winternett 7y ago
      It's an app you install on your phone. That app can use any service on the device if system permissions allow it, also, tracking and libraries or spyware can be embedded in the app itself which could potentially circumvent device security.
- jangoolie 7y ago
  it uses the `NetworkExtension` framework to intercept all your communications and potentially modify them. https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension
ignoramous 7y ago
The source indicates that they check-in DNS blocklists as JSON files [0] and txt files (one of which has Facebook IPv4s) [1]. So, the updates to those would require app updates, I guess, unless there's OTA for the blocklists somewhere in the code that I missed. My experience with running client-side DNS based blockers are they consume additional battery and need a lot of RAM if you block with aggressive lists that have more than 1M+ domains. Besides, DNS based blockers can be circumvented by apps that do their own resolution over DoH or use clever techniques like CNAME cloaking [2]. Some nameservers such as the one run by Cloudflare flatten the CNAMES [3], effectively rendering even nextdns' solution ineffective [4]. I must also note that, Cloudflare does hide origin-IP if they are setup to reverse-proxy the traffic, which then would render IP based blocklists ineffective, too, unless Cloudflare's IPs are blocked, as well. The folks who build the lockdownhq apps are also the makers of https://confirmedvpn.com https://confirmedvpn.com. u/willstrafach's https://guardianapp.com https://guardianapp.com (VPN and ad-blocking), u/poitrus's https://nextdns.io https://nextdns.io (no VPN but imo the best DNS based content-blocker in the market today), and https://adguard.com https://adguard.com (cross platform all-in-one network security suite) are other comparable alternatives. Disclosure: I run a competing ad-blocking service. --- [0] https://github.com/confirmedcode/lockdown-ios/tree/master/Lockdown%20Blocker https://github.com/confirmedcode/lockdown-ios/tree/master/Lo... [1] https://github.com/confirmedcode/lockdown-ios/tree/master/LockdowniOS https://github.com/confirmedcode/lockdown-ios/tree/master/Lo... [2] https://trackingthetrackers.com/ https://trackingthetrackers.com/ [3] https://blog.cloudflare.com/introducing-cname-flattening-rfc-compliant-cnames-at-a-domains-root/ https://blog.cloudflare.com/introducing-cname-flattening-rfc... [4] https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a https://medium.com/nextdns/cname-cloaking-the-dangerous-disg...
- clairity 7y ago
  > "The folks who build the lockdownhq apps are also the makers of ...[a bunch of other iOS apps]." are you saying the same group of subcontractors built them all? or that it's the same app repackaged multiple times? or something else? i use adguard on iOS and while i don't like the first-party exposure (to adguard itself), it's better than being completely naked in public to all sorts of shady actors (including telecom/wireless providers). or is it?

josteink 7y ago

> With TLS and it surely not mitm-ing connections, that's all it can do correct? Unless it also acts as a web-proxy, yes.

winternett 7y ago
It can possibly access all your activity, contacts, microphone, and camera... Hard pass from me at the moment. :/
- rectang 7y ago
  It's a start. It's good that it's open source, but that's necessary not sufficient to establish trust for something which requires such significant privileges. You also want to be able to know who the authors are, to evaluate them for trustworthiness, and to evaluate their processes to see how well hardened they are against malicious contributions.
- hosteur 7y ago
  > It can possibly access all your activity, contacts, microphone, and camera... Hard pass from me at the moment. :/ Camera and mic? How does it do this as a vpn? I see no requests for such things in iOS settings for the app.
  - winternett 7y ago
    It's an app you install on your phone. That app can use any service on the device if system permissions allow it, also, tracking and libraries or spyware can be embedded in the app itself which could potentially circumvent device security.
jangoolie 7y ago
it uses the `NetworkExtension` framework to intercept all your communications and potentially modify them. https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension

ignoramous 7y ago

The source indicates that they check-in DNS blocklists as JSON files [0] and txt files (one of which has Facebook IPv4s) [1]. So, the updates to those would require app updates, I guess, unless there's OTA for the blocklists somewhere in the code that I missed. My experience with running client-side DNS based blockers are they consume additional battery and need a lot of RAM if you block with aggressive lists that have more than 1M+ domains. Besides, DNS based blockers can be circumvented by apps that do their own resolution over DoH or use clever techniques like CNAME cloaking [2]. Some nameservers such as the one run by Cloudflare flatten the CNAMES [3], effectively rendering even nextdns' solution ineffective [4]. I must also note that, Cloudflare does hide origin-IP if they are setup to reverse-proxy the traffic, which then would render IP based blocklists ineffective, too, unless Cloudflare's IPs are blocked, as well. The folks who build the lockdownhq apps are also the makers of https://confirmedvpn.com https://confirmedvpn.com. u/willstrafach's https://guardianapp.com https://guardianapp.com (VPN and ad-blocking), u/poitrus's https://nextdns.io https://nextdns.io (no VPN but imo the best DNS based content-blocker in the market today), and https://adguard.com https://adguard.com (cross platform all-in-one network security suite) are other comparable alternatives. Disclosure: I run a competing ad-blocking service. --- [0] https://github.com/confirmedcode/lockdown-ios/tree/master/Lockdown%20Blocker https://github.com/confirmedcode/lockdown-ios/tree/master/Lo... [1] https://github.com/confirmedcode/lockdown-ios/tree/master/LockdowniOS https://github.com/confirmedcode/lockdown-ios/tree/master/Lo... [2] https://trackingthetrackers.com/ https://trackingthetrackers.com/ [3] https://blog.cloudflare.com/introducing-cname-flattening-rfc-compliant-cnames-at-a-domains-root/ https://blog.cloudflare.com/introducing-cname-flattening-rfc... [4] https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a https://medium.com/nextdns/cname-cloaking-the-dangerous-disg...

clairity 7y ago
> "The folks who build the lockdownhq apps are also the makers of ...[a bunch of other iOS apps]." are you saying the same group of subcontractors built them all? or that it's the same app repackaged multiple times? or something else? i use adguard on iOS and while i don't like the first-party exposure (to adguard itself), it's better than being completely naked in public to all sorts of shady actors (including telecom/wireless providers). or is it?