re: opening up Safari on the iPhone 'any website you have in your bookmarks can track that' I assume that's because it's checking/refreshing favicons? If that's all it is there's nothing nefarious about it but he sure is opaque in his statement.
"Safari" is the app that does the browsing.
"com.apple.Webkit.networking" is the app that works in the background doing things like the icons refresh. Some other applications also use this "channel" (app) to reach out, and I usually have it on "Deny all". I like it better when apps do their own connections and don't hijack the "backroards".
The only two reasons I jailbreak ALL my idevices(s):
a. Firewall IP
b. Protect My Privacy (PMP)
You literally have no idea what goes in the background when you install and run an app if you don't spy on your phone.
The disgusting part is that even my bank's (NatWest) app, as well as LastPass talk to irrelevant companies when I fire them up, with (my) most hated being Facebook (which is of course blacklisted and added on my hosts file).
For my Android devices I always run "NoRootFirewall" which is a pretty good firewall.
Edit: Both FirewallIP (iOS) and NoRootFirewall (Android) have logging mechanisms so you can track what goes in/out and what is rejected. I am really looking forward to a NoRootFirewall-app for iOS. Something that creates an internal VPN allowing you to manage it.
Thank you
Please, do tell us more. Or write a post about it!
Also on my deny list I seek the following which do not appear in the logs right now: segment.com, fiksu.com, youtube.com, redirector.gvt1.com
Other notes:
1) I never use the LastPass browser.
2) When a service has a "lastpass.com" AND amazon/cloudfront/azure, I prefer the "lastpass.com" over the alternatives/load balancers.
Edit: if you see, these are the logs for only 10 seconds. I know that there are multiple "Denied" since the poor thing keeps trying. It is amazing to see it on many other apps (e.g. games) that talk to apjust, appsflyer, doubleclick, duaps, feeldallapps, glispa, mobileapptracking, segment, startappservice, taprica, app-measuremenet, and HUNDREDS more.
A carefully managed firewall and an extensive hosts file is a must.
The Business/Product side of the app business considers it really important to gather in-app usage information, and they like to use off-the-shelf third-party services to do it. Depending on the service, the SDK enabling use of the service is not necessarily well-behaved. This is to say nothing of SDKs for advertising.
As a developer, it grosses me out.
It is an eye opener to see how most apps behave (including the system apps).
In F-Droid there appears to be AFWall+[1] and NetGuard[2].
Does anyone have a comparison of these two apps, compared to NoRootFirewall, or indeed others (Blokada mentioned in other threads)?
AFWall+ appears to required a rooted device for iptables, but NetGuard says no root is required.
The solution I've settling on has been AFWall+ to ensure that only a limited set of apps can talk at all, and Netguard to control where those apps can talk. The interface is not as elegant as FirewallIP, but it does allow an easier ability to interactively allow and block specific destinations without firing up a text editor.
People introducing new functionality need to be incentivized to focus on sand-boxing it in some way before we accept it as a web-standard tech. Barring that, limiting functionality is preferable. But business is business, so adequate measures are generally not taken, either out of cost-saving, or deliberately.
Also, these types of irresponsible practices now constitute an indispensable core of how large modern web-apps work. They exist in a moral gray area, where it can be argued that problematic practices are outweighed by their net benefit to user experience, and misuses of the technology can be blamed on malicious outside actors who have found a loophole. If you build a giant information weapon, you are also culpable for any of its misuses, no matter how unintended they might be.
I currently don't see a way of changing things without some kind of regulation, as problematic government interference can be. The incentives here are possibly too strong for the market to sort it out, at the current state of public awareness. Current efforts in the US seem to be focusing on pressuring companies to self-regulate, but they have still have little real incentive to do so.
Another complicating factor may be the rate in which innovation arises in the tech sector - most burgeoning industries spend some time in a regulatory wild-west, but as the issues become known, laws gradually catch up and a status-quo is reached. Now, its possible that by the time any technology has matured enough to have a widespread regulatory harness applied to it, another technology has already superseded it, and the regulatory void is renewed.
As RawTruthHurts stated: "Call me crazy, but I expect an icon to behave as an icon.."
I too am one of those people that draw lines in the sand, and when these lines are crossed I make it my business to kick them out (adblockers, hosts file, VPN, firewall). I do this to keep my headspace intact, or with the minimum noise.
Market (aka profit) drives things, and it is a greedy monster with infinite appetite. There are many willing to "innovate" (flash ads were considered as innovation once)(so was medicine).
Since it is a cat-mouse/bigger mousetrap game, regulation will always be 10 steps behind, meanwhile we need to maintain our sanity and find ways to keep these distractions at bay.
My time is my time, I don't want to see a movie in an icon. Glad to know the technology is there (perhaps focus on curing cancer instead???), and not everything needs to be redefined, so that <insert-ad-company-name> can display more ads.
I use a custon hodgepodge of SVG, XMLSerializer, image elements, and canvas to do a lo-fi animation for a badge in the favicon. Works for desktop browsers (including IE11, although I haven't tested Safari. B2B web app so covers what we need). A few gotchas, but wasn't too hard.