Hacker News Reader

Comment by walterbell | Hacker News Reader

One network mitigation for Apple devices (e.g iPads) without a cellular baseband is to have a router block all connections to 17.0.0.0/8, except a once a week check for OS and app updates. This assumes no use of iCloud, which would siphon much more data than described in this article. It's also necessary to disable Siri on-device search (e.g. "Learn from this app") and Spotlight indexing of in-app content (per-app setting for "Show app in Search"), including E2E encrypted messengers like Signal and Wire.

For phones, the only mitigation is a lifestyle change to switch from always-reachable to scheduled availability windows or the always-async workflows of pre-mobile computing. A faraday bag can deny realtime telemetry, even if it's cached for relay when connectivity returns.

View on HN

There is almost no point in buying an ecosystem-dependant device and then trying to cut off the ecosystem dependency. This goes for iOS and Android alike.

In some ways, even cellular connectivity itself is problematic or any baseband system that requires some form of out-of-band processing to function (even if it doesn't "call home").

Most people won't know (or care) about any of this anyway, and the disruption trade for some invisible gains that are supposed to come out of unplugging like this isn't likely to attract any reasonable mass of users to do it. It would probably be mostly destructive anyway considering the information flow of civilisation depends on so much of this integration now.

Technically we could do without all of this, but practically it would be luddite's errand to try and do any this.

I wonder what we could do instead, but considering the min-maxing for profit sets the stage today, I doubt someone can come up with an alternative that yields the same (perceived) benefit from using Google's or Apple's technologies.

Considering most new people from the past few years are primarily mobile users and a lot of those never even had access to (or a need for) a desktop-like type computing, there is very little mindshare about what else might be possible in the digital realm.

> There is almost no point in buying an ecosystem-dependant device and then trying to cut off the ecosystem dependency.

The point of using an "ecosystem" is positive network effects, in the case of iOS it means a pool of shared-risk protection against common attacks, and a business model which yielded a huge app ecosystem, a.k.a front-end clients for web services. The greater those positive effects, the greater the incentive to mitigate the negative effects. Some are provided by Apple's obscure combinations of on-device Settings, device policy that is only configurable with Apple Configurator, or enterprise MDM policy.

It is unnecessary that such mitigations be employed by "most people", they only need to pass a cost-benefit analysis for those who use them. E.g. many iOS remote attacks can be mitigated by disabling Javascript, yet there has not been an option for per-site whitelisting of JS in Safari. Brave on iOS (reskin of Safari) provides this policy with one-click per site and now Apple allows Brave to be the system-wide default, possibly due to antitrust/EU/legal pressure. iOS 15 has added web extensions, which are already transforming the web experience.

It could be argued that if more people used "surveillance escape valves", there could be pressure to close them. The bigger the ecosystem, the more incentives there are to jump through hoops to gain benefits and mitigate risks. It's an ongoing negotiation, not blind surrender, even if the balance of power begins with asymmetry. E.g. people may start using Brave on iOS because it blocks Youtube interstitial video ads, allowing free access to the network effects of the YT ecosystem without paying a monthly fee. But once they are using Brave, JS security protections are one click away. The pendulum swings back and forth.

From 2012, https://www.zdnet.com/article/president-obamas-top-secret-ip...

> The president is getting his daily intelligence briefing on an iPad. Ten years ago we wouldn't have done that, but that's what the president wants, so that's what he gets. Now, that iPad is neutered-it has no connectivity. It gets plugged into a docking station. We can do that for the president, but can we can't scale that. So the question is, can we use commercial products that are secure?" said Levine.

> It is unnecessary that such mitigations be employed by "most people", they only need to pass a cost-benefit analysis for those who use them.

This can be said for pretty much any technology/software/hardware/mitigation that some people dismiss out of hand…

> It could be argued that if more people used "surveillance escape valves", there could be pressure to close them.

I would even go one step further and argue that our devices should actively send spoofed data (not necessarily random) and poison the data wells these companies like to drink from to amass their power they wield asymmetrically at scale against individuals.

> There is almost no point in buying an ecosystem-dependant device and then trying to cut off the ecosystem dependency.

I mean, your work could be dependent on an embedded appliance from an enterprise vendor, where that 'appliance' just consists of an app running on an iPad in kiosk mode sealed into an ugly case, with its lightning port hard-wired to a particular accessory.

If you're an IT admin of an organization and you have to support an appliance like this within your Intranet, it's in your best interests to lock it down from doing anything other than "its job as an appliance." For the same reason you wouldn't leave any ports open on a machine/VM other than the ones it needs to perform its function.

Apple MDM almost certainly requires some connection to 17/8 (or 2620:149::/32 ) to function, even with a 3p mdm server, at least for the CRL download.

So what?

$appliance does not require mdm

So how are you locking it down? Are you going to sit there and put the iPad in supervised mode by hand? Maybe sideload your specialised kiosk software onto it by hand? Periodically check in on it to make sure it’s up to date and all of its configuration is as you left it?

This is a solution that doesn’t scale, and any IT admin supporting more than a handful of Apple devices in their network should look at MDM.

> Maybe sideload your specialised kiosk software onto it by hand?

In this case I was suggesting that you have a vendor upstream of you doing this, where you then take receipt of a system (e.g. a POS system) of which an "embedded" iPad is a one component, and is a black box, perhaps even epoxied into an enclosure.

In such a case, you literally cannot do anything to the iPad. It's locked down into its kiosk application, and getting admin access to it would require taking the system it's a part of apart to a degree that would void your warranty with the vendor.

Instead, the only thing you can alter, is the network the iPad connects to.

> There is almost no point in buying an ecosystem-dependant device and then trying to cut off the ecosystem dependency.

...the only alternative right now is throwing cash at a librem5 and there's still plenty of work until it's feasible for a linux phone as a daily driver.

There's also Jolla Sailfish (descendant of Nokia Maemo/Meego, funded by Russia) which works on Sony Xperia 10 II. The free version doesn't support Android apps. The paid version does, but is technically only sold to EU customers.

Looking further ahead, Pinephone development is active.

To clarify you should say: Nowadays funded by Russia, it hasn't been always like that.

The question of course is whether they do anything equally bad as either Google/Apple or the NSA. It looks obvious to me that Russia funds this because they don't want the former inside their devices.

Trying to run their own mass surveillance using Sailfish wou be pretty much a waste of resources. There are no masses that use it and the Russian opposition could easily avoid touching such device. However, in typical Stalin/KGB/Putin-style paranoia you would want to eavesdrop your friends to make sure they don't work against you. So that is somewhat worrying.

Disclaimer: Typed on a Sailfish device.

Open bootloaders and proper open-source projects.

I think GrapheneOS provides a maximally usable experience with maximal control over your device.

Unfortunately linux phones are nowhere near the polish of Android forks, and let’s be honest - hardware-wise a 3-4 years old phone mid-level android hardware is a minimum.

> There is almost no point in buying an ecosystem-dependant device and then trying to cut off the ecosystem dependency

Android works fine without the Google bits. Make sure to get a device which is supported by an AOSP-derived distribution like LineageOS and you're almost there. Install the alternative distribution, do not install any Google services (i.e. skip the 'gapps' or Google apps), install F-droid or Aurora Droid, done - you'll end up with a device running free software (apart from the radio firmware and any driver blobs used in building the distribution). If you need software from the play store there is Aurora Store, an alternative front-end which can be used without a Google account. If some of that software needs access to the Google Services Framework (indicated in the listing as 'gsf-dependent' or something along those lines) you can install microG, an in-progress but remarkably functional free software implementation of such.

I've been doing this for about 10 years now and never had the impression I missed out on anything by not using a stock distribution with a Google account - the opposite is true. Batteries last longer since there is less background activity, devices have a far longer useable life span by virtue of the distribution being kept up to date.

I bought a Pixel 2 XL brand new from Amazon for $140 two weeks ago and installed LineageOS 18.1 (Android 11) and using F-Droid and Aurora Store. I ended up reflashing to LineageOS with MicroG to get one stubborn app to function properly but it is a fast, functional, and a significantly more private experience for a budget price and about an hour or two of work.

Did the same with my old Pixel 2, just put CalxyOS on it. Personally, while ecosystems are quite convenient, I am really fed up with what they became. All I want is an OS that gets critical updates, but other wise just runs without any strings attached on hardware I own. Give my good mobile websites and a privacy-oriented browser for everything else. I guess big-tech just won't be able to make a living in such a world...

Yes. This is the best story now for a somewhat feature packed privacy respecting phone. The other options like Purism's Librem are not there yet.

Want to go one step further: use a laptop which you connect to the internet over burner phone's tethered internet connection, using a self-hosted VPN or Tor.

According to the article, you can also reduce the vast majority of Google communication by disabling all Google apps and services. You need a phone that allows that (I have a Fairphone 2). Not as watertight as LineageOS, but easier for most people, at least for me. Then indeed use F-Droid and the occasional app from sources you trust via Aurora Store. Very usable as a main phone.

You can't add an IMAP email account (or a gmail email account) to the device's local mail app with 17./8 blocked on iOS.

And, of course, you can't install or update any apps.

The iPhone depends on Apple services to function even outside of iCloud and updates. I've tried.

I've added IMAP email accounts with 17./8 unblocked and then accessed those email accounts later with 17./8 blocked.

Most apps aren't updated more than once a week, some are not updated for months.

There are a few high-quality iOS apps which support NAS (e.g. WebDAV) for local, surveillance-free, cross-device sync.

Maybe not through the device's local Settings UI, but presumably you could insert the mail account binding through an MDM profile, no?

Yes, Apple Configurator can be used to install IMAP accounts, including password.

Gmail accounts require password entry on the device, even if the account is installed via Apple Configurator.

> Gmail accounts require password entry on the device, even if the account is installed via Apple Configurator.

Is that still true, if the password provided in the profile is an App Password for the account? IIRC those can be used for direct IMAP access to Gmail's servers without those servers complaining; so I would expect them to also work fine for creating a Gmail web-API binding.

Wouldn't this kill the phone's ability to receive notifications? I don't think apps can just poll their servers like it's 2010 anymore.

Yes, battery-conserving notification interrupts are part of an always-reachable lifestyle, which requires surrender to behavioral telemetry with the potential long-term consequence of influencing the human's behavior (e.g. via advertising).

Regardless of an app's implementation of polling/notifications, most apps will poll servers when first started or network service is restored.

Apple provides a list of IPs used by APNS if you need it but want to block the rest of 17 or 2620:149:: (I believe the other IPv6 prefixes are for non-US use).

https://support.apple.com/en-us/HT203609

Super useful, thanks.

Good that Apple provides this "stable firewall interface".

> For phones, the only mitigation is a lifestyle change

I've been considering buying a Linux phone. Does anyone here own one?

My PinePhone turned up this week.

It, ummmm, very rough around the edges, software wise.

So far I have only used the default Manjaro distribution it came with. Im both looking forward to, and dreading, working my way through a dozen or so alternative distros to find the least worst collection of brokenness and bugs.

But I 100% knew what I was buying into when I paid for it, and am very happy I have it.

I found the pinephone in my research. It seemed nice but the hardware specifications were really underwhelming. I'm used to buying flagship phones with the best hardware available and using them for years and years.

> It, ummmm, very rough around the edges, software wise.

I can imagine. How's the driver situation? Lots of proprietary blobs?

What about the device itself? Build quality? I see it has hardware switches for RF and sensors, I really like that.

> So far I have only used the default Manjaro distribution it came with.

I wonder why Manjaro and not stock Arch Linux.

> How's the driver situation? Lots of proprietary blobs?

Even if this is the case, what are you going to do? Buy a normal phone? That will just get you even more proprietary blobs.

You shouldn't let aversion to proprietary blobs put you off getting a PinePhone if all the other options you'd consider contain more proprietary blobs.

> Buy a normal phone? That will just get you even more proprietary blobs.

Google's apparently trying to get all these manufacturers to contribute their drivers to the kernel. Not sure how successful they've been.

I was hoping the situation would be better here. Proprietary Linux drivers suck. Even nvidia drivers have caused instability in my system before, switching to nouveau fixed it. I hate those things so much.

> How's the driver situation? Lots of proprietary blobs?

Interestingly enough, no, the drivers are all open source and mainlined. There is even a work-in-progress driver for hardware video decoding.

There are a couple proprietary firmware blobs that have to be loaded at boot time but that is just like on a laptop.

> Interestingly enough, no, the drivers are all open source and mainlined. There is even a work-in-progress driver for hardware video decoding.

That's amazing. So unlike Android phones I can actually use a stock kernel. I think I'm gonna buy one.

> There are a couple proprietary firmware blobs that have to be loaded at boot time but that is just like on a laptop.

So the kernel itself is not tainted? I'm fine with that.

It’s got closed source blobs for at least it’s Realtek wifi chipset. Probably more as well. :shrug:

Hardware and build quality wise, I’m quite happily surprised at how good it feels. It’s certainly not at iPhone13 Pro levels of industrial design, but it feels like it compares favourably to, say Galaxy S4 vintage “flagship phones”.

And yeah, that row of hardware switches was a very powerful deciding feature for my purchase.

Use Mobian

I own a Pinephone. I use jmp.chat so messing around with the phone doesn't effect my ability to use the phone network. It's gotten a lot better, I would recommend running a lightweight X11 WM (I like fluxbox and fvwm) rather than a fat DE like phosh or kde.

> I would recommend running a lightweight X11 WM

I'm not used to the notion that X11 even supports touch events. I wonder what the experience is like. Will I need mobile versions of Linux software or can I expect existing desktop software to work?

Honestly I'd be satisfied if I could have a fully featured terminal and browser. Looks like the pinephone even supports physical keyboards!

The only thing you really miss is right clicks. The Gnome (not phosh) keyboard supports some of that but I prefer xvkbd.

I ordered the pinephone when it was first announced. I think it’s a really good first step. The hardware is extremely lacking though. It’s not nearly powerful enough to make this a daily driver for me. Way too much lag and stuttering. Every couple months I will flash a new or updated distro and play around with it for a day or two, and the software side has definitely improved a lot in the last year. I’m hoping that the next generation comes with better, more usable hardware. Super excited to see the progress that comes for this product

The hardware specifications are really disapointing. I'm used to buying top end hardware, desktop and mobile. The Librem 5 isn't any better and it's a $900 phone!

I suppose this market is still too new. I'm hopeful things will get better in the future as well. I'm very impressed by the fact the pinephone can run the upstream Linux kernel. Maybe that wouldn't have been possible with higher end hardware. I'm not sure.

Would a transparent HTTPS proxy be able to intercept traffic (once you install the certificate on the phone), or are the certificates pinned?

Not traffic that is being sent via other protocols or on different ports. One way of doing this would be setting up a computer to pass its internet connection via NAT firewall rules to the apple device and behave like an access point. From there you could dump the raw traffic to/from the apple device. Regarding encrypted content, it’s probable that the telemetry and other info being sent is signed with a key that is not available in user space so you wouldn’t be able to add a key to view it. However you would definitey be able to see it being sent and the packet size/frequency ect

"The only mitigation is a lifestyle change to switch from always-reachable to scheduled availability windows or the always-async workflows of pre-mobile computing."

I always had a call recorder installed on my mobile, it saved my bacon a few times when dealing with scammy companies and various wankers.

Then a wakeup call arrives for me - my phone updates to the new version of android, on which google blocked call recording.

I installed a landline, and stopped spending money on fancy phones. I can't eacape them, but they will never see me spend more than a bare minimum.

Since recording laws are illegal in most places without mutual consent..

I don't know about most places, it's perfectly legal in UK and Czech republic.

Every time you call a firm, they record you, and will use it against you.

But afaik they have to notify you of the recording.

Okay, I will tell them I am recording, now can I have my record button back Google? What do you mean no?

Secondly, its still legal to record without notifying in Uk, you just arent allowed to use it in court

I don't find that reason convincing.

Recording videos in public is also often illegal in many places, yet all smartphones come with 2-7(?) cameras. The web browser lets you download pirated content from shady sources. You can post illegal text-based content (defamation etc.) in various apps. You could probably even cause some noise complaints with the alarm app.

And that's just preinstalled software.

Reply on news.ycombinator.com