3 ms·

What if there is a little device that acts like network firewall and router appliances but somehow the phone proxies all connectivity via it. Something to carry

What if there is a little device that acts like network firewall and router appliances but somehow the phone proxies all connectivity via it. Something to carry around that shows ingress and egress connections, calls and anything in between. You can either set an allowed or blocked list, detects cell connection mitm attacks and spikes in traffic (to detect leaks). Mobile phones are like desktop computers and will always have security issues. It only makes sense to firewall them.

Nextgrid 4y ago
TLS and certificate pinning makes this a problem. Technically certificates don't have to be pinned, but if they weren't then people would use this to defeat "growth & engagement" and block analytics, ads, etc (or worse, reverse-engineer the API to make a third-party client) and we obviously can't have that.
- deleted 4y ago
  [deleted]
jiveturkey 4y ago
Like your own personal stingray
- yrgulation 4y ago
  Had to look it up. I guess the question is how to make sure it cant be abused by capturing data from random nearby phones. In that case we’d end up worse off.
bistable 4y ago
Why not on the same device? Have a separate small simple SoC completely segregated from everything else, except shared battery, with 2 NICs and a physical switch to swap between using the firewall interface and the regular phone. Although this may make more sense for a regular computer plus router, with a cell phone there's multiple radios, not just a single simple IP connection...
- yrgulation 4y ago
  Issue is that we would have to get device makers to buy into it, and also trust them that they show us everything. Also we wouldn't be able to retrofit existing devices. Most people dont like tinkering with things. A universal device small enough to fit in your pocket, with a nice little display or a usb connector to download data to a laptop and configure rules, is more desirable imo.

Nextgrid 4y ago

TLS and certificate pinning makes this a problem. Technically certificates don't have to be pinned, but if they weren't then people would use this to defeat "growth & engagement" and block analytics, ads, etc (or worse, reverse-engineer the API to make a third-party client) and we obviously can't have that.

deleted 4y ago
[deleted]

jiveturkey 4y ago

Like your own personal stingray

yrgulation 4y ago
Had to look it up. I guess the question is how to make sure it cant be abused by capturing data from random nearby phones. In that case we’d end up worse off.

bistable 4y ago

Why not on the same device? Have a separate small simple SoC completely segregated from everything else, except shared battery, with 2 NICs and a physical switch to swap between using the firewall interface and the regular phone. Although this may make more sense for a regular computer plus router, with a cell phone there's multiple radios, not just a single simple IP connection...

yrgulation 4y ago
Issue is that we would have to get device makers to buy into it, and also trust them that they show us everything. Also we wouldn't be able to retrofit existing devices. Most people dont like tinkering with things. A universal device small enough to fit in your pocket, with a nice little display or a usb connector to download data to a laptop and configure rules, is more desirable imo.