4 ms·

This was a wake-up call for me. On my desktop browser, I can use SSL, NoScript, etc. to control what's exposed. But on my phone I'm powerless. How do I know wh

by panarky 12y ago

This was a wake-up call for me. On my desktop browser, I can use SSL, NoScript, etc. to control what's exposed. But on my phone I'm powerless. How do I know what each app is capturing and transmitting in the clear? If even Google searches don't use SSL, what hope is there for other apps?

Terr_ 12y ago
You can put on an firewall to block certain apps (requires rooting) but it's true that the measure won't help with "mostly respectable" ones that aren't using https.
gatehouse 12y ago
I haven't done this personally but you can minimize the risk of interception without really changing anything by going through a VPN. This way all unencrypted traffic is strictly on wired networks.
- panarky 12y ago
  The VPN secures my data up to the VPN, but it's unencrypted from the VPN to the host. That might help with the casual Wi-Fi snoop in the coffeeshop, but it's still hoovered up once it leaves the VPN.
  - gatehouse 12y ago
    Yes, that's true. That's what the situation in the article was, a hostile WiFi access point. I'd say that running a modern platform countermeasures are only useful up to the point that you trust your OS maker and telco. So if you can get your data encrypted until it reaches a major telco's network, then you are almost as safe as if it were all encrypted.
    - panarky 12y ago
      > That's what the situation in the article was, a hostile WiFi access point. The point of the article was not the hostile AP, but to simulate a pervasive threat: we would create a pint-sized version of the Internet surveillance infrastructure used by the National Security Agency... Porcello would become our one-man equivalent of the NSA’s Special Source Operations department
      - XorNot 12y ago
        Which misses the point of NSA surveillance. Ars knew who they were looking at, and could have multiple people look at that one person's history for whatever they wanted. The broad surveillance of any practical intelligence apparatus only bothers to do that to target actual subjects of interest, and don't have infinite leeway to not produce results while doing it - i.e. if the NSA produces no useful intelligence on Al Qaeda for a few months, they're looking at budget cuts. Or to put it another way: how many man hours did they expend on this effort, and how many people do they actually think work for the NSA? It's certainly not "millions".
        throwaway6637 12y ago
        The NSA does this full-time, with a large staff. They have very elaborate systems designed to automatically pull all this information and organise it into databases for easy lookup. These guys were manually viewing wireshark dumps. Obviously they're going to spend a lot more time to get the same info when working at such a low level, with no access to any of the automation tools the NSA uses.
benologist 12y ago
In your mobile browser at least Firefox Nightly supports extensions - I have adblock, ghostery, etc. Aside from the privacy benefits it also makes a significant performance difference on my kindle. https://nightly.mozilla.org/ https://nightly.mozilla.org/
- yaantc 12y ago
  You can use the stable version too, at least ABP, Ghostery and Self Destructing Cookies works fine on it.
ars 12y ago
If you have root then install https://play.google.com/store/apps/details?id=com.googlecode.droidwall.free https://play.google.com/store/apps/details?id=com.googlecode... - at least that way only apps you allow can communicate online.
A_COMPUTER 12y ago
If only it were even just the apps. Check out this blog post by the Tor project and look at what it takes simply securing the OS: https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy https://blog.torproject.org/blog/mission-impossible-hardenin... Of particular interest to me was how the captive portal detection reports back to Google everywhere you connect even if everything else is disabled.
tikums 12y ago
On Android, iptables packet filter can be used to control what network connections apps are allowed to make. It is, however, an increased maintenance burden. Recent versions of CyanogenMod also have Privacy Guard pre-installed, which can be used to set granular permissions for apps, such as restricting access to geolocation data.

by panarky 12y ago

Terr_ 12y ago

You can put on an firewall to block certain apps (requires rooting) but it's true that the measure won't help with "mostly respectable" ones that aren't using https.

gatehouse 12y ago

I haven't done this personally but you can minimize the risk of interception without really changing anything by going through a VPN. This way all unencrypted traffic is strictly on wired networks.

panarky 12y ago
The VPN secures my data up to the VPN, but it's unencrypted from the VPN to the host. That might help with the casual Wi-Fi snoop in the coffeeshop, but it's still hoovered up once it leaves the VPN.
- gatehouse 12y ago
  Yes, that's true. That's what the situation in the article was, a hostile WiFi access point. I'd say that running a modern platform countermeasures are only useful up to the point that you trust your OS maker and telco. So if you can get your data encrypted until it reaches a major telco's network, then you are almost as safe as if it were all encrypted.
  - panarky 12y ago
    > That's what the situation in the article was, a hostile WiFi access point. The point of the article was not the hostile AP, but to simulate a pervasive threat: we would create a pint-sized version of the Internet surveillance infrastructure used by the National Security Agency... Porcello would become our one-man equivalent of the NSA’s Special Source Operations department
    - XorNot 12y ago
      Which misses the point of NSA surveillance. Ars knew who they were looking at, and could have multiple people look at that one person's history for whatever they wanted. The broad surveillance of any practical intelligence apparatus only bothers to do that to target actual subjects of interest, and don't have infinite leeway to not produce results while doing it - i.e. if the NSA produces no useful intelligence on Al Qaeda for a few months, they're looking at budget cuts. Or to put it another way: how many man hours did they expend on this effort, and how many people do they actually think work for the NSA? It's certainly not "millions".
      - throwaway6637 12y ago
        The NSA does this full-time, with a large staff. They have very elaborate systems designed to automatically pull all this information and organise it into databases for easy lookup. These guys were manually viewing wireshark dumps. Obviously they're going to spend a lot more time to get the same info when working at such a low level, with no access to any of the automation tools the NSA uses.

benologist 12y ago

In your mobile browser at least Firefox Nightly supports extensions - I have adblock, ghostery, etc. Aside from the privacy benefits it also makes a significant performance difference on my kindle. https://nightly.mozilla.org/ https://nightly.mozilla.org/

yaantc 12y ago
You can use the stable version too, at least ABP, Ghostery and Self Destructing Cookies works fine on it.

ars 12y ago

If you have root then install https://play.google.com/store/apps/details?id=com.googlecode.droidwall.free https://play.google.com/store/apps/details?id=com.googlecode... - at least that way only apps you allow can communicate online.

A_COMPUTER 12y ago

If only it were even just the apps. Check out this blog post by the Tor project and look at what it takes simply securing the OS: https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy https://blog.torproject.org/blog/mission-impossible-hardenin... Of particular interest to me was how the captive portal detection reports back to Google everywhere you connect even if everything else is disabled.

tikums 12y ago

On Android, iptables packet filter can be used to control what network connections apps are allowed to make. It is, however, an increased maintenance burden. Recent versions of CyanogenMod also have Privacy Guard pre-installed, which can be used to set granular permissions for apps, such as restricting access to geolocation data.