6 ms·

This is great but too big of a hammer for most use cases. What I really want is a per-application firewall. For example, say I would like to install a photo ed

This is great but too big of a hammer for most use cases. What I really want is a per-application firewall. For example, say I would like to install a photo editing application. It would need access to my photos. That is fine, so long as it is not allowed to connect to the Internet (or any other network). There is currently no way to ensure this.

imdsm 4y ago
I use little snitch for this, but I agree, a big hammer, and likely more hoops for regular developers to jump through. Notarisation, signing, forced developer keys...
- post_break 4y ago
  Little Snitch is great. Apple would never allow it on iOS which is ridiculous.
  - CharlesW 4y ago
    It's not the same, but have you used App Privacy Report to monitor what your iOS apps are doing? https://www.wired.com/story/ios-15-app-privacy-report/ https://www.wired.com/story/ios-15-app-privacy-report/
    - mcculley 4y ago
      The App Privacy Report is great, but too late. It shows you what an app did, not what it might do.
    - criddell 4y ago
      Thanks for posting this. I just turned it on and am looking forward to the report. It's under Settings > Privacy > App Privacy Report.
- mcculley 4y ago
  I use Little Snitch on macOS, but it is not available on iOS, so far as I know. Normal apps on iOS do not have enough visibility into the system for that.
  - jeroenhd 4y ago
    Android exposes a soft VPN API that firewall apps can use to block network traffic for certain apps in certain scenarios (say, no Google Play updates when on mobile data) with apps like Netguard [1]. Does iOS not expose such functionality? Surely there's some kind of VPN API? [1]: https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard
    - FireBeyond 4y ago
      Not like that. The idea is antithetical to Apple, who have said during keynotes that they've tried to avoid doing so, because what they really want is a world where the concept of "mobile data" is not limiting.
    - mcculley 4y ago
      iOS has APIs for VPNs and “content blockers”. But as far as I know, such a filter has no access to know which process/application is trying to make a connection. Little Snitch on macOS has to install code into kernel space. (Or at least it used to; I have not reinstalled in a long time.) The Android app you link to seems to have the functionality I think should exist as a built-in. It needs to be built-in so that non-geeks can use it. Just as users are asked the first time an application attempts to use the microphone and are able to prevent it before it starts, they should be able to limit network access and revoke it at any time. (I don’t think users should be necessarily be forced to approve Internet access for every app install. Just make it possible to revoke in the global Settings widget and encourage users to think about personal data and Internet access being mutually exclusive.)
    - mathisonturing 4y ago
      Android has app system level options in the settings to disable WiFi/mobile data. I tend to use that, and use Netguard as a fallback because the latter has an off by default config incase I forget to disable it for new apps. Netguard on its own is insufficient because sometimes you'd need to use an actual VPN (which turns off Netguard)
- radicaldreamer 4y ago
  None of which is particularly effective since it's trivial to setup a legal entities that makes one game but signs a bunch of malware (or steal enterprise keys).
olliej 4y ago
Edit: apparently I was wrong here? Though I'd swear it had the feature?
- mcculley 4y ago
  Where do you see this in iOS? The Settings app has many permissions for applications, but no "Internet" permission.
  - azinman2 4y ago
    You can turn off cellular data access to an app; not quite whole internet as this WiFi will still work. But it’s half the problem.
    - mcculley 4y ago
      I am aware of that option. It is on the screen I just described. That is really just for saving bandwidth where it is expensive. It is in no way intended as a security measure.
- LeoPanthera 4y ago
  It does not ask for internet access, it asks for access to other devices on the LAN. Not the same thing.
- Nextgrid 4y ago
  You can disable app's cellular data access, but that's it, at least on Western phones. Ironically, phones for the Chinese market actually expand that setting and also allow to block Wi-Fi access.
  - netheril96 4y ago
    As a Chinese user, this is the first time I heard that blocking WiFi access on iOS is China only. How confused I was when reading the comment above you, given I'm already capable of blocking network access for any iOS App.
briffle 4y ago
I'd go a step further, and say per-application virtualization. Every single program running its own (ideally encrypted memory) namespace, with its own assigned memory, etc.
- muricula 4y ago
  That's what the ios sandbox provides. Heck, the tools arm64 gives you to isolate VMs are awfully similar to the tools they give you to isolate processes. VM escapes aren't too different than sandbox escapes. Encrypted memory isn't part of arm yet, I was holding out hope with armv9 "realms" but not so.
- jmprspret 4y ago
  I think this is one of the very (very) long term goals of the GrapheneOS project.
- fsflover 4y ago
  So basically Qubes OS on a phone?
lolsal 4y ago
> This is great but too big of a hammer for most use cases. This is not in any way intended for most use-cases, it's very clearly intended for a single, specific, uncommon use-case. The press release says as much more than once.
- mcculley 4y ago
  I guess my point is that instead of making a special mode that is only useful for a minority of users, it would have been really nice to get a feature that everybody should be thinking about and using.
  - Legion 4y ago
    Perhaps that's what it eventually evolves into. Probably easier to get this off the ground by developing it as a separate mode.
  - derefr 4y ago
    Different people who specialize in different aspects of security can be working on different things at the same time; and contrariwise, experts have comparative advantages and would be mostly wasting their time working outside their nich. In other words: there's no "instead" here, any more than there's an "instead" between e.g. UI work and backend server work. Different people, different competencies, concurrent capacity.
    - mcculley 4y ago
      Every time I have allocated labor on a software project, I was mostly playing a zero-sum game. I am surprised to learn that Apple does not have such problems. Regardless, I was just lamenting that we don't (yet) have a feature that should be table stakes at this point.
varenc 4y ago
Agreed. I wish iOS had a "network access" permissions just like Android does. (Though to avoid permission fatigue for the average user, perhaps make it something only users that care can deny) That said, I think this is pretty unrelated to protecting yourself from nation state actors. Mercenary spyware (like NSO) doesn't use a legitimate app store app as their initial infection point. I can think of many reasons for this: difficulty getting target to install it, app store approvals, leaking their 0days, leaving more of a paper trail, and avoiding scrutiny in general, etc. I'd of course love this feature for my own data privacy of course.
- mcculley 4y ago
  > (Though to avoid permission fatigue for the average user, perhaps make it something only users that care can deny) Yeah, I would not want to have to approve every app. What I would like is a machine readable description of the app's capabilities to include Internet access, just as is required for access to the microphone or photos. This would encourage app developers to advertise to users that they don't need such capability and encourage users to realize that privacy and Internet access are mutually exclusive. There are many small apps I simply will not buy/install (e.g., apps for editing photos or contacts or calendars) because they cannot be trusted. Even if you trust the developer, the developers are often embedding third party analytics libraries that cannot be trusted.
  - astrange 4y ago
    This feature exists in Chinese iPhones because it's required by law there.
- derefr 4y ago
  It's not exposed in the UI, but if you really care, you can just create yourself a configuration profile that disables various per-app permissions (including network access, per-domain/per-IP/per-certificate) on a fairly fine-grained basis. MDM yourself.
  - jbverschoor 4y ago
krrrh 4y ago
That would be a pretty interesting VPN service if you could easily deploy it as a docket container. Something simple that could give Little Snitch like whitelisting. The Charles proxy iOS app doesn’t have the ui to support this, it’s clumsy to whitelist domains, but it does provide some visibility into what domains are being accessed.

imdsm 4y ago

I use little snitch for this, but I agree, a big hammer, and likely more hoops for regular developers to jump through. Notarisation, signing, forced developer keys...

post_break 4y ago
Little Snitch is great. Apple would never allow it on iOS which is ridiculous.
- CharlesW 4y ago
  It's not the same, but have you used App Privacy Report to monitor what your iOS apps are doing? https://www.wired.com/story/ios-15-app-privacy-report/ https://www.wired.com/story/ios-15-app-privacy-report/
  - mcculley 4y ago
    The App Privacy Report is great, but too late. It shows you what an app did, not what it might do.
  - criddell 4y ago
    Thanks for posting this. I just turned it on and am looking forward to the report. It's under Settings > Privacy > App Privacy Report.
mcculley 4y ago
I use Little Snitch on macOS, but it is not available on iOS, so far as I know. Normal apps on iOS do not have enough visibility into the system for that.
- jeroenhd 4y ago
  Android exposes a soft VPN API that firewall apps can use to block network traffic for certain apps in certain scenarios (say, no Google Play updates when on mobile data) with apps like Netguard [1]. Does iOS not expose such functionality? Surely there's some kind of VPN API? [1]: https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard
  - FireBeyond 4y ago
    Not like that. The idea is antithetical to Apple, who have said during keynotes that they've tried to avoid doing so, because what they really want is a world where the concept of "mobile data" is not limiting.
  - mcculley 4y ago
    iOS has APIs for VPNs and “content blockers”. But as far as I know, such a filter has no access to know which process/application is trying to make a connection. Little Snitch on macOS has to install code into kernel space. (Or at least it used to; I have not reinstalled in a long time.) The Android app you link to seems to have the functionality I think should exist as a built-in. It needs to be built-in so that non-geeks can use it. Just as users are asked the first time an application attempts to use the microphone and are able to prevent it before it starts, they should be able to limit network access and revoke it at any time. (I don’t think users should be necessarily be forced to approve Internet access for every app install. Just make it possible to revoke in the global Settings widget and encourage users to think about personal data and Internet access being mutually exclusive.)
  - mathisonturing 4y ago
    Android has app system level options in the settings to disable WiFi/mobile data. I tend to use that, and use Netguard as a fallback because the latter has an off by default config incase I forget to disable it for new apps. Netguard on its own is insufficient because sometimes you'd need to use an actual VPN (which turns off Netguard)
radicaldreamer 4y ago
None of which is particularly effective since it's trivial to setup a legal entities that makes one game but signs a bunch of malware (or steal enterprise keys).

olliej 4y ago

Edit: apparently I was wrong here? Though I'd swear it had the feature?

mcculley 4y ago
Where do you see this in iOS? The Settings app has many permissions for applications, but no "Internet" permission.
- azinman2 4y ago
  You can turn off cellular data access to an app; not quite whole internet as this WiFi will still work. But it’s half the problem.
  - mcculley 4y ago
    I am aware of that option. It is on the screen I just described. That is really just for saving bandwidth where it is expensive. It is in no way intended as a security measure.
LeoPanthera 4y ago
It does not ask for internet access, it asks for access to other devices on the LAN. Not the same thing.
Nextgrid 4y ago
You can disable app's cellular data access, but that's it, at least on Western phones. Ironically, phones for the Chinese market actually expand that setting and also allow to block Wi-Fi access.
- netheril96 4y ago
  As a Chinese user, this is the first time I heard that blocking WiFi access on iOS is China only. How confused I was when reading the comment above you, given I'm already capable of blocking network access for any iOS App.

briffle 4y ago

I'd go a step further, and say per-application virtualization. Every single program running its own (ideally encrypted memory) namespace, with its own assigned memory, etc.

muricula 4y ago
That's what the ios sandbox provides. Heck, the tools arm64 gives you to isolate VMs are awfully similar to the tools they give you to isolate processes. VM escapes aren't too different than sandbox escapes. Encrypted memory isn't part of arm yet, I was holding out hope with armv9 "realms" but not so.
jmprspret 4y ago
I think this is one of the very (very) long term goals of the GrapheneOS project.
fsflover 4y ago
So basically Qubes OS on a phone?

lolsal 4y ago

> This is great but too big of a hammer for most use cases. This is not in any way intended for most use-cases, it's very clearly intended for a single, specific, uncommon use-case. The press release says as much more than once.

mcculley 4y ago
I guess my point is that instead of making a special mode that is only useful for a minority of users, it would have been really nice to get a feature that everybody should be thinking about and using.
- Legion 4y ago
  Perhaps that's what it eventually evolves into. Probably easier to get this off the ground by developing it as a separate mode.
- derefr 4y ago
  Different people who specialize in different aspects of security can be working on different things at the same time; and contrariwise, experts have comparative advantages and would be mostly wasting their time working outside their nich. In other words: there's no "instead" here, any more than there's an "instead" between e.g. UI work and backend server work. Different people, different competencies, concurrent capacity.
  - mcculley 4y ago
    Every time I have allocated labor on a software project, I was mostly playing a zero-sum game. I am surprised to learn that Apple does not have such problems. Regardless, I was just lamenting that we don't (yet) have a feature that should be table stakes at this point.

varenc 4y ago

Agreed. I wish iOS had a "network access" permissions just like Android does. (Though to avoid permission fatigue for the average user, perhaps make it something only users that care can deny) That said, I think this is pretty unrelated to protecting yourself from nation state actors. Mercenary spyware (like NSO) doesn't use a legitimate app store app as their initial infection point. I can think of many reasons for this: difficulty getting target to install it, app store approvals, leaking their 0days, leaving more of a paper trail, and avoiding scrutiny in general, etc. I'd of course love this feature for my own data privacy of course.

mcculley 4y ago
> (Though to avoid permission fatigue for the average user, perhaps make it something only users that care can deny) Yeah, I would not want to have to approve every app. What I would like is a machine readable description of the app's capabilities to include Internet access, just as is required for access to the microphone or photos. This would encourage app developers to advertise to users that they don't need such capability and encourage users to realize that privacy and Internet access are mutually exclusive. There are many small apps I simply will not buy/install (e.g., apps for editing photos or contacts or calendars) because they cannot be trusted. Even if you trust the developer, the developers are often embedding third party analytics libraries that cannot be trusted.
- astrange 4y ago
  This feature exists in Chinese iPhones because it's required by law there.
derefr 4y ago
It's not exposed in the UI, but if you really care, you can just create yourself a configuration profile that disables various per-app permissions (including network access, per-domain/per-IP/per-certificate) on a fairly fine-grained basis. MDM yourself.
- jbverschoor 4y ago

krrrh 4y ago

That would be a pretty interesting VPN service if you could easily deploy it as a docket container. Something simple that could give Little Snitch like whitelisting. The Charles proxy iOS app doesn’t have the ui to support this, it’s clumsy to whitelist domains, but it does provide some visibility into what domains are being accessed.