WireGuard 上 macOS 了...

在「WireGuard for macOS」這邊看到 WireGuard 進到 Apple 家的 Mac App Store 了。

除了是透過 app store 下載外,另外的重點在於整合了 NetworkExtension API

This is built from the same code base as our existing iOS app and makes use of Apple's Network Extension API to provide native integration into the operating system's networking stack.

這樣可以確保相容性,而且可以用內建的 VPN 機制管理。另外也給了一些 screenshot 可以看,可以看出來就是走 Mac 上的管理方式:

用關鍵字搜尋 Apple 的 App Store 對不同地區的上架情況

The Intercept 提到了 Apple Censorship 這個站,可以丟關鍵字進去看 app 在不同地區的上架情況:「New Site Exposes How Apple Censors Apps in China」。

預設有美國 (United States) 與中國大陸 (China (mainland)) 當作比較,也可以自己增加地區。除了拿來看 censorship 外 (像是搜尋 vpn 或是 tor),也可以看其他的 app 上架的情況...

整個站其實頗簡單的,是個簡單的 PHP 站台,可以參考 GitHub 上的 greatfire/applecensorship 專案。

Facebook 花錢向使用者購買他們的行為記錄

這則從 Nuzzel 上看到的,國外討論得很凶:「Facebook pays teens to install VPN that spies on them」。

Facebook 付錢給使用者,要他們安裝 VPN (以及 Root CA,看起來是為了聽 HTTPS 內容),然後從上面蒐集資料,這本身就不是什麼好聽的行為了,但更嚴重的問題在於包括了未成年人:

Since 2016, Facebook has been paying users ages 13 to 35 up to $20 per month plus referral fees to sell their privacy by installing the iOS or Android “Facebook Research” app. Facebook even asked users to screenshot their Amazon order history page. The program is administered through beta testing services Applause, BetaBound and uTest to cloak Facebook’s involvement, and is referred to in some documentation as “Project Atlas” — a fitting name for Facebook’s effort to map new trends and rivals around the globe.

這個計畫在 iOS 平台下架了,但 Android 平台看起來還是會繼續:

[Update 11:20pm PT: Facebook now tells TechCrunch it will shut down the iOS version of its Research app in the wake of our report. The rest of this article has been updated to reflect this development.]

Facebook’s Research program will continue to run on Android. We’re still awaiting comment from Apple on whether Facebook officially violated its policy and if it asked Facebook to stop the program. As was the case with Facebook removing Onavo Protect from the App Store last year, Facebook may have been privately told by Apple to voluntarily remove it.

未成年人部份應該會是重點,拉板凳出來看...

在 Android 上支援 DNS over HTTPS 的 Intra

IntraAlphabet (Google 母公司) 旗下 Jigsaw 所開發的 app (目前只有 Android 的,依照說明需要 4.0+),透過 VPN 的架構換掉 DNS 設定,透過本機的 DNS Proxy 改走到外部的 DNS over HTTPS 服務上。

走 DNS over HTTPS 可以降低 DNS 被干擾 (security issue) 或是被監控 (privacy issue) 的風險。

在軟體內已經先內建了兩個 DNS over HTTPS 清單,一個是 Google 的 Google Public DNS,另外一個是 Cloudflare1.1.1.1,除此之外也可以自己輸入。

由於是 Alphabet 家的軟體,預設是用 Google 的服務。

軟體本身是 open source 專案 (Apache-2.0),程式碼在 Jigsaw-Code/intra 這邊可以取得。

蘋果以隱私為由,下掉 Facebook 在 App Store 上的 Onavo App

Onavo 是個提供 VPN 服務的公司,跟一般的 VPN 服務一樣,以隱私為主打,後來在 2013 年被 Facebook 買下,但在今年三月的時候就有媒體有報導 Facebook 打算蒐集 Onavo 上的資料:「Facebook-owned Onavo quietly launches Bolt App Lock, a data-tracking app that locks other apps」,當時 Facebook 不怎麼鳥各家媒體的看法,就放著...

不過直到八月的時候才被 Apple 下架:「Apple removed Facebook’s Onavo from the App Store for gathering app data」,引用 Apple 發言人給 TechCrunch 的句子:

We work hard to protect user privacy and data security throughout the Apple ecosystem. With the latest update to our guidelines, we made it explicitly clear that apps should not collect information about which other apps are installed on a user’s device for the purposes of analytics or advertising/marketing and must make it clear what user data will be collected and how it will be used.

看起來是直接改遊戲規則後強迫下架...

非 Google 的 Android 手機環境

主要是記錄下來,完全不靠 Google 目前還是有點難度:「De-Googling my phone」。

主要是刷機成 LineageOS (還是 Android),然後上面不裝 OpenGApps,而是靠其他軟體來補足... 在英文版維基百科的「List of free and open-source Android applications」也有不少資訊可以看。

另外一個蠻重要的應該是 microG Project,不過在文章裡沒提到...

Google 開放 .app 註冊,是個 HSTS Preload TLD

Google 宣佈了 .app 的網域將開放註冊:「Introducing .app, a more secure home for apps on the web」。

整個 .app 網域都已經被 Google 設定 HSTS Preload 了:

A key benefit of the .app domain is that security is built in—for you and your users. The big difference is that HTTPS is required to connect to all .app websites, helping protect against ad malware and tracking injection by ISPs, in addition to safeguarding against spying on open WiFi networks. Because .app will be the first TLD with enforced security made available for general registration, it’s helping move the web to an HTTPS-everywhere future in a big way.

如果要註冊下來,開發的時候得注意...

拿來分析 Android APK 檔的 Droidefence

忘記在哪邊看到的,分析 Android APK 檔的軟體:「Droidefense: Advance Android Malware Analysis Framework」。

Droidefense (originally named atom: analysis through observation machine)* is the codename for android apps/malware analysis/reversing tool. It was built focused on security issues and tricks that malware researcher have on they every day work. For those situations on where the malware has anti-analysis routines, Droidefense attemps to bypass them in order to get to the code and 'bad boy' routine. Sometimes those techniques can be virtual machine detection, emulator detection, self certificate checking, pipes detection. tracer pid check, and so on.

Droidefense uses an innovative idea in where the code is not decompiled rather than viewed. This allow us to get the global view of the execution workflow of the code with a 100% accuracy on gathered information. With this situation, Droidefense generates a fancy html report with the results for an easy understanding.

看起來是輔助用的工具... 先記錄下來 XD