Comment by matthewmacleod | Hacker News Reader

Comment by matthewmacleod | Hacker News Reader

Parent Full thread

I believe Apple purposely makes this difficult/impossible on iPhones due to the constant metrics/analytics sent to Apple servers.

I don't think that follows. Allowing applications to intercept and mess with other application's network traffic would be an obvious security issue; that's far more likely to be the reason than some kind of vague "we want to track your data" thing.

It's certainly possible that Apple could construct an appropriate API for allowing users to configure apps in such a fashion that they could monitor network traffic, much the same way as similar APIs exist for accessing e.g. photos. But since it's a niche application at best, I'm hardly surprised they haven't done so.

Such an API already exists: the NetworkExtension APIs, specifically NEPacketTunnelProvider and NEAppProxyProvider. They're meant for VPNs, but it should be possible to use the same APIs to monitor traffic and send it on, rather than tunneling it through a VPN. (There is also NEFilterProvider, but that API is designed to run the filter in a tight sandbox that doesn't allow it any outbound communication, so that it can filter packets but not exfiltrate them.)

…though if you're concerned about privacy, perhaps you should be using a real VPN anyway, in which case you could handle traffic monitoring and filtering on the server side.

Edit: I guess the server-side approach wouldn't allow identifying on which app is making the connection. The NetworkExtension APIs, however, should allow that: you get a flow of NEPackets, each of which has a 'metadata' property containing a 'sourceAppUniqueIdentifier' and 'sourceAppSigningIdentifier'. I don't have personal experience using these APIs though.

  Allowing applications to intercept and mess with other application's network traffic

Look at your cellular data usage in "system services" .. Apple is already intercepting and sending home a lot of your information without your ability to stop it.

Reply on news.ycombinator.com