TrackerControl | Hacker News Reader

TrackerControl

trackercontrol.org

151 pointsduck34 comments

Recommended this yesterday to someone here. It is an Android app that lets you choose per app, which outgoing connections are allowed. Comparable to uMatrix in the browser, but selection is less fine grained. Pretty eye opening. If you value your privacy, give it a try.

I've been using NetGuard (https://netguard.me/) for this purpose for a few years now - works great for blocking apps off from the internet entirely but is/was a huge battery drain filtering all connections (blocklisting). Will definitely give this a go!

Edit: looks very much like this is based on Netguard or borrows some of its code - near identical settings/etc.

You might have known already, But to those who don't; NetGuard is very configurable it can log just network access or do packet level filtering and although it obviously increases the battery usage, android misattributes battery usage of apps which access network to NetGuard.

I've used it for a few weeks. Aside from a single crash it's been great. Some apps you have to disable monitoring if they don't work with it, but I'd rather be able to do that on a per-app basis than having the floodgates open.

Note that only the version on F-Droid actively blocks tracers, the Play Store version can only track them.

But who is tracing the trackers tracking the tracers?

This is a neat concept but worth noting that any app that uses local VPN to analyze network traffic is technically doing a man-in-the-middle on your SSL / TLS data. It's not necessarily a problem but you have to be damn sure you trust the app, so it's great that this is open source.

Not really. From the website:

> Contrary to similar solutions, this application does not intercept SSL connections, minimising privacy risks and allowing for usage on unrooted Android devices. Only the meta data about network communications is logged, and displayed to the users.

If you have root, you can use AdAway to modify the hosts file to use any blocklist you want.

If you do not, you can use a personal DNS server(or a service) to modify the blocklists.

I just simply don't get the VPN based approaches.

Unlike using a DNS or host file, with TrackerControl you can apply rules per host and/or per app, even block an app from using the internet at all. Also, one can log all the traffic and classify it per app, so it gives a lot of insight into which apps are communicating in the background and how often.

Note that the VPN that TrackerControl uses runs fully on the device (and TC itself is opensource) so there is no need to trust any additional third-party servers.

For Android, the VPN API is simply the only official and best-supported way of intercepting app traffic. Everything else requires root to mess with iptables, etc.

Some Apps will use a pinned/hard-coded DNS server to avoid your DNS based blocklists... a VPN sees all.

Can you give en example of how this is implemented?

I would love to test thebvpn blocker with some poc.

WhatsApp sends out DNS probes to 8.8.8.8 unencrypted (TrackerControl does trap and proxy these).

And spyware SDKs like InMobi and Gamooga do DNS over TCP which almost all apps on Android leak (but TrackerControl does not).

Telegram does its own DoH (?). Instagram does hardcode some of its IPs, not all (TrackerControl has no mitigation for these).

Disclosure: I co-develop a similar app to TrackerControl

NextDNS uses the VPN API to route all DNS traffic through it.

Been using this for some time now, after my Blokada became unstable and Netguard wanted money for blocklists. TrackerControl does the job well with a reasonable interface for making exceptions. They could be a bit more fine grained and I don't always agree with the categories but that's acceptable. Every once in a while the app crashes in the background and blocks all traffic, but less often than Blokada.

I use DNS66 to disable das lookups. Quite equal to pi.hole

Combined with energized lists, this is the best options if you don't want to mess your phone with roots.

It's a great app but unfortunately some anti-malware solutions trigger on it because it contains some indicators of other malware (as it tries to block them). They are in plain text so other antimalware scans pick it up and block it. I wish I could use it but my work requires the antimalware.

Setting up NextDNS delivers similar functionality and can be used on all of your devices.

NextDNS won't show you companies behind tracking and where your app sends the data to.

NextDNS (the resolver) is not equivalent to using an app (a client) like TrackerControl.

NextDNS (the resolver) cannot prevent apps from doing their own DNS, or prevent apps from connecting to preset IPs. Only if the queries reach the resolver can NextDNS act upon it / track it / block it.

Also, apps like TrackerControl can do per-app blocking, just like LittleSnitch / LuLu and Glasswire do on macOS and Windows respectively.

For some background on what apps like TrackerControl could potentially protect against, see: https://github.com/celzero/rethink-app/issues/301#issuecomme...

Disclosure: I co-develop a FOSS app similar to TrackerControl and a FOSS alternative to NextDNS.

Thanks for the clarification! I didn’t expect apps would be resolving using their own DNS or connecting to preset IPs, but it makes perfect sense.

I’m curious, what’s the FOSS alternative to NextDNS you’re developing?

> I'm curious, what's the FOSS alternative to NextDNS you’re developing?

Well, NextDNS is the gold-standard. We are merely building as much as we can but our motive is to remain serverless, so as to be zero-maintenance.

https://github.com/serverless-dns/serverless-dns

I had given this a try a week ago. Love the concept, and pretty neatly surprised. But it broke quite a few apps, couldn't get them to load content from the internet many times. Finally had to uninstall out of frustration :/.

That's a pretty reliable indication you're using some of the most horrible applications, privacy-wise.

Hah, completely agree :P. Instagram is included in that list, unfortunately and unsurprisingly.

If you only use it to view, not post, I very much recommend Barinsta [0] - it's a fully-featured FOSS alternative client with every feature of the official client and more.

Edit: god damn it, they got a C&D: [1]

[0] https://f-droid.org/en/packages/me.austinhuang.instagrabber/ [1] https://news.ycombinator.com/item?id=27969379

It wouldn’t have killed them to put “Android app” somewhere on the page.

There are several mentions of Android on the page.

And there are clear indications at the very top of the page this is an Android project.

The GH repo listed at the has android in the name:

    OxfordHCC/tracker-control-android

and the about section subtitle is

    Download directly here, from F-Droid, or a feature-reduced version from Google Play.

It's pretty clear to me that this is an Android app.

Cool, so after a bit of skimming we can be 99% confident it's an app that is exclusively available for Android.

Or it could have just said "Android app".

> full version: download

> full version: f-droid

> lite version: play store

"Is this android or ios?"

I've been using this the last while and it's shocking. Can't help but think a lot of the trackers would have been considered spyware 15 years or so ago.

How does it compare with Blokada?

Reply on news.ycombinator.com