Hacker News Reader

Comment by calvinmorrison | Hacker News Reader

The #1 thing you can do right now is to add a application based firewall to your android phone. It emulates a VPN so all traffic is routed through it, then implements firewall rules based on application, IP address, etc. You can whitelist, blacklist, etc. Most of my apps have zero network access and don't need it. For those that do - I block them from sending to advertising domains. Imperfect but better than nothing.

Android conspicuously doesn't include 'network access' as a permission, for what I can only assume is nefarious reasons. There's no reason my Calculator app needs to phone home anywhere.

The problem though really lies in the network. LTE is GPS trackable inherently. If you want to eliminate that problem, a Pager can work quite well if you are interested in receive only.

View on HN

GrapheneOS has a network permission that you can toggle.

I'm still hoping for an application firewall that will also let me use my real VPN, or hoping that my VPN provider will integrate this functionality directly so I don't have to choose between one or the other. I find trying to do everything over Tor quite limiting due to the number of web admins blocking it entirely. Even VPNs are starting to get frequently blocked, unfortunately.

Apps can circumvent these ”firewalls” quite easily via IPC/Intents.

For example, if you block facebook with a firewall, it can still send an intent to the download manager to make network connections.

(see https://madaidans-insecurities.github.io/android.html#firewa...)

GrapheneOS is working on a permission to block that too

GrapheneOS alreasy has such a permission. I use it for Apps that shouldn't require internet access, like my keyboard.

The current network permission does not block IPC

LineageOS, GrapheneOS and CalyxOS all have network and firewall restrictions on applications. You can even limit by certain networks (5G, Wifi, etc..)

It's nice to be able to sandbox an app so it can't do anything, especially call home.

> Android conspicuously doesn't include 'network access' as a permission, for what I can only assume is nefarious reasons. There's no reason my Calculator app needs to phone home anywhere.

I know that some Android ROM's don't allow blocking all network access (only mobile data). But LineageOS, CalyxOS and GrapheneOS all allow blocking all/VPN/mobile network access.

Unless you can confirm the keyboard is not compromised, no amount of security matters.

Well that's silly, since we know the entire baseband is compromised anyway. In reality it's all about your threat model.

I refuse put the NSA in my threat model. If we get to that point as a business, we're going to have warrants blowing us up, secret fisa courts threatening our livelyhoods, and so forth.

However - there's no reason we should allow all advertisers to track us just because we are worried about the NSA

You may be interested in Precursor, for which you indeed can confirm that manually: https://www.crowdsupply.com/sutajio-kosagi/precursor. (But it has no modem.)

GrapheneOS has a network access permission.

InviZible Pro mentioned here provides such firewall in case your OS does not have one built in.

Reply on news.ycombinator.com