Slashdot Mirror
Ask Slashdot: How Do I Reduce Information Leakage From My Personal Devices?
Mattcelt writes: I find that using an ad-blocking hosts file has been one of the most effective way to secure my devices against malware for the past few years. But the sheer number of constantly-shifting server DNs to block means I couldn't possibly manage such a list on my own. And finding out today that Microsoft is, once again, bollocks at privacy (no surprise there) made me think I need to add a new strategic purpose to my hosts solution — specifically, preventing my devices from 'phoning home'. Knowing that my very Operating Systems are working against me in this regard incenses me, and I want more control over who collects my data and how. Does anyone here know of a place that maintains a list of the servers to block if I don't want Google/Apple/Microsoft to receive information about my usage and habits? It likely needs to be documented so certain services can be enabled or disabled on an as-needed basis, but as a starting point, I'll gladly take a raw list for now.
Never use an internet connected device
Is there a way to use some things (E.g. Google Maps) with known leaks, without exposing every activity to Google all the time on unrelated sites. It seems like limiting some domains make sense, but I'm thinking of things like cloudfront.net
Also, is there some way to prevent the CDN-style spying/extra downloads?
Your ad here. Ask me how!
Right - then you just leak information to the VPN host.
You haven't been given the same tools on your mobile device as we have on desktops, because the ad revenue from mobile devices is what everybody most wants.
The OS, and every app largely exist to track you and serve you ads.
I'd be surprised if there was an easy mechanism, which worked on multiple devices, and didn't require a rooted device. Because this is precisely the kind of thing which isn't nearly as available as it should be.
Me, I'm betting the OS makers have pretty much decided no way in hell you're getting that kind of control, and if they gave it to you malicious apps would use it to take over where your device really goes.
Being able to control that is a two way street, and the potable devices don't surrender as much control.
Lost at C:>. Found at C.
I've gone the route of using VPN to my home network, and using a DNS Server with the Hosts file installed, effectively destroying many advertising links on my mobile devices. Unfortunately, it's not perfect, but I have ad-block in nearly ever application on my iDevice now.
Fundamentalism stops a thinking mind.
If you don't want to root your device and don't want to tunnel all your traffic to a VPN server (adds latency) , you can use one of the Android "NoRoot" firewalls that routes app traffic through a local VPN for inspection and filtering. This uses more CPU and battery, but all protection is done within your mobile device. It takes a lot of manual effort to build a policy that blocks undesirable traffic and still lets apps work.
You can tunnel your traffic to a commercial VPN provider, but now you are trusting them to maintain performance and not invade your privacy, and they won't have any visibility to the contents of traffic that is inside SSL/TLS encryption, for better or for worse (e.g. cannot inspect Android apps downloaded as APKs from SSL websites).
Better yet, you can root the device and add your own Certificate Authority and firewall settings. Now you can use your own VPN to ensure all traffic from all applications goes to a remote VPN headend for inspection/modification, even traffic the device thinks is encrypted with SSL. If you have many users going through the same VPN, you can do things with packets and headers to make it difficult for CDNs and ad networks to identify individual users who are all behind the same gateway.
If you have more time than money, you can build up a VPN headend with open source tools (e.g. Squid+SSLbump)., and write policy to block traffic that doesn't meet your security policy, and to log what your device tries to send. You can use header modification to strip out identifying information and cookies.
If you are a business or otherwise have more money than time, the expensive approach is to use a commercial firewall appliance that has a client VPN and URL filtering service (e.g. Checkpoint, Palo Alto, Juniper, F5, etc). You set up the VPN to send all your mobile device traffic through the firewall, and use firewall policy to decrypt SSL, inspect APKs, and block ads. This solution is very effective at blocking ads and undesirable network traffic, and can often detect or block malicious APKs and other attacks.
I do not deploy Linux. Ever.
you've been to my house, clearly. Please turn off the light next time, hm?
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
You can't install it as an APK on your Android device because only root can write to the hosts file, and by default, only an Android device's manufacturer (not its owner) is root.
1) Root your phone. If you don't have full control over your device, you have no chance.
2) Install Xposed Framework (http://repo.xposed.info/)
3) Install Xprivacy (http://repo.xposed.info/module/biz.bokhorst.xprivacy)
Xprivacy doesn't block your programs from sending whatever they want to send - if you try to do that, most programs will crash. Instead, it feeds your programs completely false information. Boom, you win.
You know as well as I do that his software would be better received if he maintained a web site for it and didn't treat Slashdot as his personal advertising site. When he posts 30+ wall-of-text advertisements in certain threads then his reputation gets diminished a bit. He is, by definition, a spammer, so people can be excused if they don't want to use a piece of "security software" advertised by a spammer, regardless of who else hosts or recommends it.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Just install FC23 or whatever and be done with it.
That's fine if you either A. own hardware compatible with Fedora (or whatever X11/Linux distribution for PCs) or B. were planning on replacing your PC anyway. Desktop compatibility is pretty good, I'm told, but laptop compatibility is not guaranteed unless it's from an explicitly Linux-friendly manufacturer such as System76.
Here's my old comment verbatim:
First of all there are immortal cookies (infinite cache entries created specifically for your unique PC). Secondly, there's a unique combination of your web browser + OS + fonts + plug ins: https://panopticlick.eff.org/ Thirdly, there are unique patterns in your behaviour (websites that you visit and how frequently you do that) and other wonderful metrics to trace you.
If you want to avoid being traced and tracked there's just one way:
This is actually a recipe for browsing the web anonymously however this is the reality of the modern web - not to be traced means to be anonymous as much as possible.
All other ways are only half measures. Or, like people have suggested, you may stop using the Internet completely. It should have long been renamed to a "Trackingnetwork".
Brave beta is just out. A project from the former CEO of Mozilla.
AFAICT out of the box one of the safest and most private browsers around.
Definitely a leg up from the usual suspects.
We suffer more in our imagination than in reality. - Seneca
I have no idea what you are saying.
The last I read, Brave will inject it's own ads. No thanks.
You should have put the warning before the link. His finger got cramp before he reached it.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Best bet is for a fire wall router to block all undesirable IPs out and in and this updated from the internet, with user interaction required. Trying to secure an OS from perv http://www.urbandictionary.com... OS manufacturer, is impossible, the can straight up go around any software blocks you put in and redo them every single update. So either drop the OS or upgrade to a secure modem router designed with the express purpose of blocking pervert corporations. Windows anal probe 10, specifically requires a redesign of the firewall router to keep M$'s prying eyse out of you system. You might very need to check and approve of disapprove every single IP address the router firewall attempts to access. So the firewall reports back with a delivered page for each new IP access with a request for temporarily approve, allow or block, with details gathered about the site and presented, before access to the site is allowed.
Chaos - everything, everywhere, everywhen