News for hackers. Stuff that matters.
Re:Tracking my phone's silent connections by HenryBemis on Sunday February 24, 2019 @08:16AM (#19238431)
Regarding iOS: I stopped using iPhones and (edit typo) quot the ecosystem altogether (apart from an app I still sell in apple app store) because with the lack of an untethered Jailbreak I could no longer install "Firewall IP" and I could not edit the hosts file.

Regarding Android: I switched to Android for the "NoRoot Firewall" and since most Android phones are Root-able I can also edit my hosts file.

The article gives a very good analysis of what I have been telling friends, and my constant complain towards that Cancer called Facebook: why does my e-banking app or Booking.com or practically every air carrier's app, need to alert FB that I am using this or that app?

Anyone with an Android can install that NoRoot Firewall and see in 60seconds what their phones are doing when you are not looking. This in combination with the applications running in the background 24/7 makes privacy a thing of the past.

Re:Tracking my phone's silent connections by hellcow on Sunday February 24, 2019 @09:02AM (#19238575)
That's exactly why I uninstalled Robinhood, Spotify, Venmo and half the other apps on my phone. Netguard showed me those apps were notifying Facebook every time I opened them.

Facebook has no business knowing when I'm making trades, listening to music, sending money or anything else.

Re:Tracking my phone's silent connections by fancyfish on Sunday February 24, 2019 @06:54PM (#19241485)
This is what I did as well, and for the services I still needed, I found the mobile sites nearly equivalent in looks and features. Especially for banking, shopping, and reading sites. I added links to my homescreen in lieu of apps, and that way I know they're not using my phone in the background. The downside is getting hounded to install the app when I visit certain mobile sites.
Re:Tracking my phone's silent connections by DavideNL on Sunday February 24, 2019 @09:07AM (#19238595)
Unfortunately, i seriously doubt whether using Android (and thereby supporting Google) will improve your privacy, even when using a firewall.

A simple example: https://www.bloomberg.com/news/articles/2018-08-13/google-tr...

Re:Tracking my phone's silent connections by kop316 on Sunday February 24, 2019 @10:15AM (#19238833)
That depends. If he isn't using google play at all, then I think it would.
Re:Tracking my phone's silent connections by api on Sunday February 24, 2019 @10:23AM (#19238869)
I tried no root firewall and found that Google groups literally everything under a kitchen sink service that talks to blind IPs with SSL. There is no way to allow Maps without inviting Google to share your bed with you.
Re:Tracking my phone's silent connections by kop316 on Sunday February 24, 2019 @10:44AM (#19238975)
I think you misunderstand me.

What I mean is you wipe the phone, reinstall either AOSP or LineageOS (or other custom ROM), do NOT install any Google Apps (to include Google Play Services, Google Store, Google Maps, etc.). Use F-Droid (https://f-droid.org/) as your App Store.

I have been using OsmAnd (https://osmand.net/) as my map service.

Re:Tracking my phone's silent connections by filleduchaos on Sunday February 24, 2019 @01:53PM (#19239951)
It's a bit annoying though how much a first-world-only solution this is. OpenStreetMaps was completely useless for my city/country the last five times I tried to use it.
Re:Tracking my phone's silent connections by jlokier on Sunday February 24, 2019 @02:44PM (#19240195)
I think you may be in the first world on this one.

I saw a very interesting talk last year about how Google Maps is often useless in third world areas, and OpenStreetMaps provides the only useful coverage.

It's due to armies of volunteers mapping an area during disasters, while Google has no economic interest in mapping the area.

https://media.ccc.de/v/emf2018-157-how-the-internet-has-chan...

Re:Tracking my phone's silent connections by mrb on Sunday February 24, 2019 @03:55PM (#19240570)
"Google has no economic interest in mapping the area"

Google has an economic interest in mapping anything as long as it's useful to some people. Google is playing a very long term game: provide free services online (Email, Maps, Search...) to entice more and more people to go online. The more Internet users there are in the world, the higher their ad revenues are. It's that simple.

Re:Tracking my phone's silent connections by filleduchaos on Sunday February 24, 2019 @05:08PM (#19240926)
I live in West Africa, and yeah I think I'll take the difference between the two services that I've experienced for myself for what it is. Those "armies of volunteers" aren't exactly interested in the region either.
Re:Tracking my phone's silent connections by jlokier on Friday March 01, 2019 @11:39AM (#19282410)
> Those "armies of volunteers" aren't exactly interested in the region either.

I don't doubt your experience.

The talk is about disaster response, so it only describes maps in regions where a response is taking place.

Elsewhere, the rest of the time, I'm under the impression there is no serious mapping taking place, neither by Google or OSM.

What I found surprising from the talk I linked was instances where there was a hardly usable Google Map to use for the area (just big expanses on the map and the occasional large feature), and the fact that at times up to 1000 volunteers would work together mapping a region at short notice, down to street and building level, by analysing satellite images, and coordinating with responders on the ground.

In the opinion of those disaster responders, those volunteer created maps were much more useful than the Google ones.

Re:Tracking my phone's silent connections by filleduchaos on Monday March 04, 2019 @03:27PM (#19305031)
> The talk is about disaster response

We haven't exactly had one of those in decades, so yeah. I'd say it's a bit telling that there's only interest/means for volunteers to map the developing world when there has been a disaster, but I digress.

Google Maps is perfectly usable where I live (apart from its continued if understandable confusion about how...irregular roads and road access can be here), and in my experience has been at least useful in all the cities in my home country I've visited. OpenStreetMaps is...not.

Re:Tracking my phone's silent connections by tkjef on Sunday February 24, 2019 @04:04PM (#19240601)
also using OsmAnd but just on android with Tor & NoRoot Firewall. takes a second to load the route. but allows you to download the maps and use offline. always have Play Store disabled unless there's an app i have to download briefly. once done, i uninstall the app and disable the Play Store.
Re:Tracking my phone's silent connections by SubiculumCode on Sunday February 24, 2019 @02:41PM (#19240166)
Im annoyed how much cheaper phones cant be rooted
Re:Tracking my phone's silent connections by kop316 on Monday February 25, 2019 @07:48AM (#19245217)
How cheap are you looking for? When my Nexus 5x broke, I simply looked through the lineageOS site to look for phones. I ended up with a Sony Xperia XA2. I found it new for $220, but I found an open box for $150.
Re:Tracking my phone's silent connections by jabberthemutt on Sunday February 24, 2019 @08:26AM (#19238455)
I can highly recommend NetGuard on android, it's non-root and free software.

I wish there was a system that lets me whitelist specific hosts per app.

Re:Tracking my phone's silent connections by kekebo on Sunday February 24, 2019 @08:36AM (#19238485)
You can do that with NetGuard, but it's a pro feature you have to unlock
Re:Tracking my phone's silent connections by jabberthemutt on Monday February 25, 2019 @11:07AM (#19246576)
Oh oops! I bought it to support the developer and never even noticed that. Thanks!
Re:Tracking my phone's silent connections by propogandist on Sunday February 24, 2019 @10:00AM (#19238768)
Netguards pro features will let you block domains from connecting at the app level.

Also, downloading netguard from github will give you the option to use hostfile to block providers (not available via Play Store).

Separately, if you have root should look into XprivacyLua from the same dev

Re:Tracking my phone's silent connections by HenryBemis on Sunday February 24, 2019 @08:26AM (#19238457)
and as always my favourite source for hosts file:

https://someonewhocares.org/hosts/

Re:Tracking my phone's silent connections by barnabee on Sunday February 24, 2019 @08:42AM (#19238516)
Apps like AdGuard Pro let you block domains for all apps by intercepting and blocking DNS locally on iOS.
Re:Tracking my phone's silent connections by jakejarvis on Sunday February 24, 2019 @10:59AM (#19239043)
Disconnect Pro for iOS is also a great tool. Hasn't failed me yet and makes adding custom trackers super easy via the list of recent connections. I blocked 30.8k trackers and saved 3 GB of data last month. :)
Re:Tracking my phone's silent connections by DavideNL on Sunday February 24, 2019 @09:02AM (#19238574)
it's not a proper solution (apps can simply communicate with their servers public ip instead of looking up a domain name.)
Re:Tracking my phone's silent connections by bostik on Sunday February 24, 2019 @09:22AM (#19238642)
If that becomes more widespread, I would expect a future generation of blocking software to start use ASN information.
Re:Tracking my phone's silent connections by m463 on Tuesday February 26, 2019 @10:40PM (#19260665)
On IOS apple only allows (some) dns based blocking afaik
Re:Tracking my phone's silent connections by jakejarvis on Sunday February 24, 2019 @11:03AM (#19239057)
Wouldn't that loophole work on all DNS-based blockers/black-holes on any platform, namely Pi-hole (and the hosts file for that matter)?
Re:Tracking my phone's silent connections by LeoPanthera on Sunday February 24, 2019 @05:28PM (#19241040)
Yes. I use a DNSBL in my router (pfBlockerNG), and I've been considering writing a small script to resolve every IP in the blocklist and then block outgoing connections to those IPs.

Of course this is only useful at home. As soon as my phone leaves the house, everything is open again.

Re:Tracking my phone's silent connections by jakejarvis on Sunday February 24, 2019 @06:20PM (#19241305)
Ooh, good idea. Would probably only have to write ~1 time per day to a separate, parallel list. Or have a small VPS do the work continuously and push changes to a Git repo so others can pull it however often they want.

I’d love to take a look if you end up doing that!

Re:Tracking my phone's silent connections by shostack on Sunday February 24, 2019 @05:14PM (#19240970)
Serious question--how does one verify the security and privacy of something like NoRoot Firewall?

It wants: - have full network access - view network connections - run at startup

That's a pretty serious list of permissions to consider giving something that while it would seemingly be beneficial, is also a great vector into my phone activity for a malicious actor (not accusing them of being such btw).

Re:Tracking my phone's silent connections by A2017U1 on Sunday February 24, 2019 @05:45PM (#19241129)
Netguard is an equivalent Android app, it is open source and available on fdroid / play store. The fdroid version has to match the source. I'm not sure how play store builds work.
Re:Tracking my phone's silent connections by marak830 on Monday February 25, 2019 @07:28PM (#19250910)
Noroot firewall was a bit of an eye opener for me, and I began by not trusting anything!

By block list is huge at the moment, and have basically stopped installing any apps, or allowing non-allowed apps to update.

Re:Tracking my phone's silent connections by captn3m0 on Sunday February 24, 2019 @04:39PM (#19240775)
DNSCloak on iOS supports this now.