4 ms·

Operating systems need to make Internet access a permission that users can grant or revoke. (Pretty sure that used to be a thing in Android, but never in iOS ex

by kccqzy 3y ago

Operating systems need to make Internet access a permission that users can grant or revoke. (Pretty sure that used to be a thing in Android, but never in iOS except mobile data.) If I get a device that claims to use Bluetooth, I would return it if it actually needs access to the internet.

notjulianjaynes 3y ago
I have used NetGuard on Android to block internet access to certain apps. https://netguard.me/ https://netguard.me/
- VcZar 3y ago
  Thanks for this. How do I trust their VPN is not just harvesting my data?
  - notjulianjaynes 3y ago
    It's not a VPN service like the type you'd use for privacy. The VPN part all happens on your device so there's no data being sent to a third party for them to harvest to begin with. Not sure if that is what you meant. If your concern is more generally about the app being malicious, I suppose you could audit the source code. But this is not something I have done or even am qualified to do, so I don't know.
    - VcZar 3y ago
      Thanks.
- autoexec 3y ago
  Does it stop data from leaving your device or just collect it all as a proxy and refuse to forward some of it. I'd much prefer to not have to hand all my traffic over to anyone offering a free app and just trust them not to use/abuse it.
  - kevincox 3y ago
    How these apps "should" work (IDK how this one does) is use the VPN API to capture traffic then filter it locally. The traffic should then leave the device as regular internet traffic, no VPN tunnel.
    - notjulianjaynes 3y ago
      This is how it works. Downside is that you can't also use a VPN alongside this. (Maybe that's changed haven't used it recently.)
jeroenhd 3y ago
Edit: this seems to be part of my custom ROM, I can't replicate this in Google's Android emulator. That said, almost every non-Google Android distro seems to ship with some kind of switch to disable internet access for apps, though. You can disable internet for apps on Android. Open the app details in the settings (or by tap+holding the icon in the home screen), tap the data usage, and disable network access (cell access, wifi access, neither, or both). Making internet access opt-in would be a massive pain for most apps, because almost every app has some online component these days.
- autoexec 3y ago
  > You can disable internet for apps on Android. Open the app details in the settings (or by tap+holding the icon in the home screen), tap the data usage, and disable network access (cell access, wifi access, neither, or both). I don't have these options on Android 9. All I can do is disable background access or allow access in data saver mode. The only way I can keep active apps offline on this phone is to put the phone in airplane mode when launching them which is a much bigger pain than having an opt in.
  - dotancohen 3y ago
    I have the same results as you describe. Samsung Note 10 Lite, Android 12.
  - jeroenhd 3y ago
    Yeah, I thought it was a generic Android feature because both MIUI and my current ROM has it, but I'm not so sure anymore. I can't reproduce it in the stock emulator so I guess the feature either hasn't made it to upstream Android yet or it has been removed at some point
- VcZar 3y ago
  Samsung removed this feature.
shepherdjerred 3y ago
Didn't operating systems like macOS and Windows 8 _try_ to push native app paradigms where there were stricter permissions, but everyone hated it? How many people install software from the macOS/Windows stores where those checks could happen vs installing it the traditional way?
- sixothree 3y ago
  Ballmer really messed that one up.
- Dalewyn 3y ago
  You can just blacklist the offending executables, ports, and/or addresses in your firewall, you know.
  - shepherdjerred 3y ago
    That's obviously a lot more work than having the OS do it for you.
calvinmorrison 3y ago
Thats the silliest thing. Of all permissions, the really only 2 important permissions are: universal file access and network access. Who cares if it has bluetooth if it can't read or write data (outside of it's own app storage?)
- autoexec 3y ago
  I leave bluetooth off 100% of the time on my phones. It doesn't need file or network access to be used to track you. bluetooth beacons can be still log your device just by being in range, and that range can be anything from ~1 foot to tens of miles. Bluetooth is a privacy nightmare.
- jjav 3y ago
  > Who cares if it has bluetooth if it can't read or write data (outside of it's own app storage?) Bluetooth can allow external parties to detect it for tracking. I always keep bluetooth off unless I specifically need it and then turn it back off. Same for location.
- alias_neo 3y ago
  Just having the ability to control Bluetooth allows your device to become a beacon, it/you/anyone around you can be tracked anywhere it/you/they go(es).
stuff4ben 3y ago
iOS allows setting Location Services per app which is pretty good IMO.
- ajsnigrutin 3y ago
  So does android, but a bluetooth scan requires location permission, and gives you the option for "this time", "while app is running" and "always" ... users probably just click "always" and forget
moomoo11 3y ago
I wouldn’t mind seeing the network requests made and received by apps. For noobs it could show the domain, and if it’s whitelisted by apple somehow it is green (server certs?). Yellow if it’s not whitelisted and not on a banlist. Or maybe skip the colors if it’s too confusing for people, annd just show the names. Apps that request to banlist are blocked from App Store until further review. and for pros we can tap to see more details, like the payloads and headers. Etc. What do you think? I really want this feature. It’s not that hard to add. Come on apple. Wish I worked at apple then I would try and do it. Lol.
toast0 3y ago
> Pretty sure that used to be a thing in Android. Android grant/revoke style permissions are a retrofit. You used to have to accept all permissions before installing through the store, and internet access was one of those. But if you didn't accept, you don't get the app. That's still how it works for some permissions, but many have a grant/revoke instead. Internet access is still a permission, but google play doesn't prompt you for it anymore. All apps get to have it. (But if they don't ask for it in their manifest, it doesn't work)
woadwarrior01 3y ago
Although, not a user granted permission, sandboxed macOS apps have an entitlement[1] for network access. And Apple mandates sandboxing for all apps sold on the Mac App Store. [1]: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_network_client https://developer.apple.com/documentation/bundleresources/en...

by kccqzy 3y ago

notjulianjaynes 3y ago

I have used NetGuard on Android to block internet access to certain apps. https://netguard.me/ https://netguard.me/

VcZar 3y ago
Thanks for this. How do I trust their VPN is not just harvesting my data?
- notjulianjaynes 3y ago
  It's not a VPN service like the type you'd use for privacy. The VPN part all happens on your device so there's no data being sent to a third party for them to harvest to begin with. Not sure if that is what you meant. If your concern is more generally about the app being malicious, I suppose you could audit the source code. But this is not something I have done or even am qualified to do, so I don't know.
  - VcZar 3y ago
    Thanks.
autoexec 3y ago
Does it stop data from leaving your device or just collect it all as a proxy and refuse to forward some of it. I'd much prefer to not have to hand all my traffic over to anyone offering a free app and just trust them not to use/abuse it.
- kevincox 3y ago
  How these apps "should" work (IDK how this one does) is use the VPN API to capture traffic then filter it locally. The traffic should then leave the device as regular internet traffic, no VPN tunnel.
  - notjulianjaynes 3y ago
    This is how it works. Downside is that you can't also use a VPN alongside this. (Maybe that's changed haven't used it recently.)

jeroenhd 3y ago

Edit: this seems to be part of my custom ROM, I can't replicate this in Google's Android emulator. That said, almost every non-Google Android distro seems to ship with some kind of switch to disable internet access for apps, though. You can disable internet for apps on Android. Open the app details in the settings (or by tap+holding the icon in the home screen), tap the data usage, and disable network access (cell access, wifi access, neither, or both). Making internet access opt-in would be a massive pain for most apps, because almost every app has some online component these days.

autoexec 3y ago
> You can disable internet for apps on Android. Open the app details in the settings (or by tap+holding the icon in the home screen), tap the data usage, and disable network access (cell access, wifi access, neither, or both). I don't have these options on Android 9. All I can do is disable background access or allow access in data saver mode. The only way I can keep active apps offline on this phone is to put the phone in airplane mode when launching them which is a much bigger pain than having an opt in.
- dotancohen 3y ago
  I have the same results as you describe. Samsung Note 10 Lite, Android 12.
- jeroenhd 3y ago
  Yeah, I thought it was a generic Android feature because both MIUI and my current ROM has it, but I'm not so sure anymore. I can't reproduce it in the stock emulator so I guess the feature either hasn't made it to upstream Android yet or it has been removed at some point
VcZar 3y ago
Samsung removed this feature.

shepherdjerred 3y ago

Didn't operating systems like macOS and Windows 8 _try_ to push native app paradigms where there were stricter permissions, but everyone hated it? How many people install software from the macOS/Windows stores where those checks could happen vs installing it the traditional way?

sixothree 3y ago
Ballmer really messed that one up.
Dalewyn 3y ago
You can just blacklist the offending executables, ports, and/or addresses in your firewall, you know.
- shepherdjerred 3y ago
  That's obviously a lot more work than having the OS do it for you.

calvinmorrison 3y ago

Thats the silliest thing. Of all permissions, the really only 2 important permissions are: universal file access and network access. Who cares if it has bluetooth if it can't read or write data (outside of it's own app storage?)

autoexec 3y ago
I leave bluetooth off 100% of the time on my phones. It doesn't need file or network access to be used to track you. bluetooth beacons can be still log your device just by being in range, and that range can be anything from ~1 foot to tens of miles. Bluetooth is a privacy nightmare.
jjav 3y ago
> Who cares if it has bluetooth if it can't read or write data (outside of it's own app storage?) Bluetooth can allow external parties to detect it for tracking. I always keep bluetooth off unless I specifically need it and then turn it back off. Same for location.
alias_neo 3y ago
Just having the ability to control Bluetooth allows your device to become a beacon, it/you/anyone around you can be tracked anywhere it/you/they go(es).

stuff4ben 3y ago

iOS allows setting Location Services per app which is pretty good IMO.

ajsnigrutin 3y ago
So does android, but a bluetooth scan requires location permission, and gives you the option for "this time", "while app is running" and "always" ... users probably just click "always" and forget

moomoo11 3y ago

I wouldn’t mind seeing the network requests made and received by apps. For noobs it could show the domain, and if it’s whitelisted by apple somehow it is green (server certs?). Yellow if it’s not whitelisted and not on a banlist. Or maybe skip the colors if it’s too confusing for people, annd just show the names. Apps that request to banlist are blocked from App Store until further review. and for pros we can tap to see more details, like the payloads and headers. Etc. What do you think? I really want this feature. It’s not that hard to add. Come on apple. Wish I worked at apple then I would try and do it. Lol.

toast0 3y ago

> Pretty sure that used to be a thing in Android. Android grant/revoke style permissions are a retrofit. You used to have to accept all permissions before installing through the store, and internet access was one of those. But if you didn't accept, you don't get the app. That's still how it works for some permissions, but many have a grant/revoke instead. Internet access is still a permission, but google play doesn't prompt you for it anymore. All apps get to have it. (But if they don't ask for it in their manifest, it doesn't work)

woadwarrior01 3y ago

Although, not a user granted permission, sandboxed macOS apps have an entitlement[1] for network access. And Apple mandates sandboxing for all apps sold on the Mac App Store. [1]: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_network_client https://developer.apple.com/documentation/bundleresources/en...