Hacker News Reader

Comment by mrgreenfur | Hacker News Reader

Are there any firewall style apps to block this type of behavior? Something like uBlock or uMatrix but for apps. I'm not inclined to trust any apps and would prefer explicit control over what they do.

Also, it's a bit strange to me that we didn't/don't seem to have this explosion of data leakage for desktop apps despite them having unique ids just like on mobile (idfa/google ad id).

View on HN

You can use Will Strafach's new app Guardian that blocks trackers in apps. I think Apple is going to purge them from iOS apps over time, they've already started with kids apps.

https://guardianapp.com/

it's a vpn from all i see

cloud firewalls are their own brand of yikes, unless you run them yourself

It could be implemented as a local VPN server using the NetworkExtension API.

It's not though, typical VPN provider claims.

  Network Traffic Encryption
  
  Protect all passwords, communications, and other sensitive
  network data with AES-256 encryption, mitigating any
  attempts to monitor your electronic activity.

Very interesting technique: the firewall is remote.

> The Guardian Firewall app has been designed to simply act as a client for remotely hosted VPN servers running custom fully-featured firewall software...

(From https://guardianapp.com/blog/2019/06/introducing-guardian-fi...)

I wondered at first why the VPN was free but you had to pay for the firewall.

I think Apple is going to purge them from iOS apps over time, they've already started with kids apps.

To be clear, Apple isn't purging apps that protect kids in favor of its own apps.

Its my understanding that Apple is purging apps that take over the phone entirely (including the ability to remotely control the camera and microphone) by misusing enterprise certificates. There are plenty of kid protection apps out there that play by the rules and will continue to work.

I think OP meant purging trackers from kids apps.

https://www.macrumors.com/2019/05/31/apple-to-limit-third-pa...

I believe the parent was referring to a change in Apple's guidelines that was making the rounds a couple of weeks ago, “Apps intended for kids may not include third-party advertising or analytics”

This was previously discussed here https://news.ycombinator.com/item?id=20108096

As the other comments mentioned, I meant purging trackers from iOS apps.

There's a privacy reason to do it but also a business reason. Apple shouldn't have apps on their platform with dependencies to major competitors like Google and Facebook. And it's probably going to be ruled illegal anyway after the GDPR cases get litigated, so it's better to get ahead of it.

This app does not work in all countries and regions as yet.

The pricing for the firewall capability also seems to be on the higher side:

"The cost is $9.99/month (or $99.99 per year) for VPN + Firewall capabilities. VPN-only service will be available at no cost." [1]

[1]: https://guardianapp.com/blog/2019/06/introducing-guardian-fi...

And the VPN-only part is free, but it's not a locally emulated VPN. I'm gonna take a wild guess of how that particular service is financed.

A while back I used NoRoot Firewall on Android which works as a “local VPN” funnelling all web tragic through the app and you whitelist every outbound connection. Only thing is that you don’t always have enough context on each IP address for each app to make an informed decision.

You can use Pi Hole both on your local network and on cloud as VPN on your iPhone (only DNS or for full traffic)

DNS filtering can only do so much. For apps that hardcode addresses you'd have to set up your own firewall. And then to protect yourself when you are "in the wild" you'd have to use an always on VPN to your own network.

There might be commercial products that do this for you. Setting this up is definitely outside of the comfort zone for the overwhelming majority of phone users.

One of the main things Pi-hole does is give you transparency into what domains are being contacted and with what frequency, so you can identify and block relevant domains manually.

https://discourse-cdn.pi-hole.net/uploads/default/original/2...

https://discourse.pi-hole.net/uploads/default/original/2X/5/...

Not if the analytics companies start being contacted by hardcoded IP address, or the apps otherwise avoid DNS. May not by a common technique now, but it could become one.

All of this describes my Chromecast nicely. There are others that do it too. Forcing this traffic through the Pihole isn’t always helpful though, as blocking it entirely breaks the Chromecast (which is used mainly for playing local media).

So and so. I have a PiHole and a firewall. Plenty of stuff bypasses the PiHole and doesn't show up in the dashboard. It's much better than nothing but vendors are also getting sneakier. Also when you go out of your WiFi you're competently exposed unless you VPN back into your network or use some service that provide similar functionality.

Some routers can do something like NAT !<Pihole> and on port 53 —> pihole. Mine is a Uniquiti Edgerouter. It’s not a thing for everyone though, as you say.

The article mentions one.

Reply on news.ycombinator.com