Similarly, wrapping websites like Discord or Slack in Electron also gives the website owners full telemetry and tracking that they can't get in a tech savvy browser.
Would an always on VPN, a remote pihole be the only way for privacy?
It must be very disheartening to work on reddit's mobile site. Not only is it deliberately made a miserable experience by forcing you through AMP via Google and insisting you "continue in browser" every time, but then you're greeted with a banner that outright says "this page is better in the app".
You can probably cross "mobile" out of this entirely.
Reddit have spent three years now building sites that are worse in every way than the decade old junker it's trying to replace.
So, maybe, they should have improved the old design instead of creating that insanity that is newreddit.
For now I still use it because it's significantly faster and easier to use, but I strongly suspect they want me on their new site.
The amount of times it crashes on mobile platforms is insane.
If they cared that much about whether or not what they were working on made the world better or worse they'd never have taken a job at Reddit.
What I do not know is if it will work also when apps begin using DNS over HTTPS… I suppose not?
What I do and recommend everyone to do is:
1. Run an edge network device using network access controls and filter which devices on your network get outbound network access (in my case just the gateway device). Block all inbound traffic except what you choose to pinhole, block all outbound traffic except ports you choose to add to the allow list.
2. On every client device run a local application firewall (I like Vallum and Little Snitch on MacOS as examples) and filter applications by domain + port on outbound requests, block all inbound requests.
3. On every client device force it through a VPN to a gateway device internal to your network to get internet access, anything that falls off the VPN is then blocked from the internet. The gateway device can forcibly route traffic and perform additional filtering
4. On every client device, configure it to use an internal DNS on your network with a fallback to a trustworthy external provider, have the internal DNS use a trustworthy external provider over DoH. Block outbound DNS at the edge device (blocks all non-encrypted lookups).
It's kind of a pain, and a mess, but it does greatly restrict the damage that rogue IoT / Smart devices can do.
ipset create blist_doh hash:ip hashsize 1024
for ip in `cat /etc/bin/blist_doh.txt`; do ipset add blist_doh "$ip"; done
iptables -A <insert some iptables placement specific to your outgoing/forwarded traffic> -m set --match-set blist_doh dst -j DROP -m comment --comment 'SPY:all ext DoH BLOCKED'
Still, as of 2021, doh rule is around 2% traffic logged compared to my other rule, where I simply block outgoing 53/udp (except my resolver). a LOT of your devices ignore your dhcp dns settings and try to circumvent it going directly to shady 8.8.8.8 etc.
(*) you shall every few months check and update it.
E.g. if I wanted to know where you're hailing from, I'd browbeat you into granting me Location access privileges. If that's too difficult, I'd get you to grant me Files/Photos privileges (this one won't raise too many alarm bells with apps like Discord or Reddit), and then try to read EXIF geotags off your recent photos.
I'm using NextDNS as the system-wide private DNS on my Android phone, it works great and eats less battery than Blokada.
It works very well, I highly recommend it.
That and revenue is much higher on apps than on the web. I made an android apps for a website. And just alone the android apps made more money than the web version. With less ads.
Discord, Slack and other similar webapps can (and maybe do) send telemetry in the same connections used for the app's features. You can't reliably block that.
Maybe for now, but it's just a matter of time until use of DoH to circumvent your attempts at redirecting DNS becomes more widespread as well.
The only approach that I could come up with to do so was to install a proxy to MITM all HTTPS connections to allow me to filter out DoH requests.
Here's an idea that supposes you have some server available: Force all traffic over your network, even when roaming (VPN). Squid+Privoxy as HTTP proxy (your choice if you want to DPI and add own TLS CA as root on devices, in which case you can actually block it, or just do HTTP CONNECT). Optionally also set up a SOCKS5-proxy (microsocks). Configure all applications to go over proxy. Applications that don't support it can usually be "proxified" with tsocks or proxychains4.
Now you have more fine-grained control over your traffic. You can do fun stuff like setting up several incoming ports, several outgoing proxies (including Tor/I2P) and allow/block based on destination, domain, protocol, etc.
Finally disable outgoing traffic on your devices/route to a black hole. Or route it via your VPN at least, where you can do some rudimentary stuff with nftables/iptables. Oh, and something not everyone knows: you can route traffic based on uid/gid on Linux, so on your workstation you can leverage that too selectively control traffic on an application-basis.
On non-rooted Android and iOS, I suspect this is not perfectly achievable but if you have the time you can get pretty far otherwise. It's an arms race and I feel like we can keep up.