3

HTTPS and other encryption methods help prevent targeted advertising, tracking, and information theft. Tools like HTTPS Everywhere can attempt or require HTTPS in web browser connections. Are there any tools to similarly attempt or require encrypted connections throughout device internet connectivity on smart phones? If so, what are some examples, and in either case, what are some of the notable issues / limitations faced when trying to secure mobile devices from tracking, targeted advertising, and information/identity theft?

Disconnect.me, or Tor's Orbot with root mode, may be examples but I'm not sure yet if they handle the many potentially-leaky holes that come with smart phone apps. I'm also not sure how practical (using Orbot in root mode) or secure (relying on Disconnect.me's VPN) those options are, but that set of trade-offs is a whole conversation in itself.

  • 2
    I see answers promoting VPNs. It is important to mention that some of mobile applications playing VPN role do not assure that all traffic go through desired VPN server. Even: > 67% of the VPN apps (300 tested) embed at least one third-party tracking library in their source code. Reference: An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps So, it's wise to properly choose VPN client app or use OS level connection management. – Dave Yarsky Apr 19 '17 at 11:52
  • 1
    The analysis mentioned by @DaveYarsky only covers free VPN providers - still worth checking for paid ones, but they have slightly less incentive to including tracking code. If you're using an audited open source client (merely being open source doesn't mean safe, if no-one has looked at the code!), connecting to a trusted VPN server (perhaps which you run), the risk is reduced. Personally, I'd avoid the free ones, since they need to make money somehow, and the easiest thing to sell is your data... – Matthew Apr 19 '17 at 12:18
  • 1
    A VPN would be the typical method for device-wide encryption (or Tor if you can route all connections through it). It may still be possible or some low-level traffic to bypass the tunnel. For example, I've noticed on iOS that tethered traffic bypases the VPN. Also, your question focuses on HTTPS, but targeting and tracking can also use other characteristics of your device (device fingerprinting) to correlate your activities. Blocking offending servers at OS-level or via VPN or DNS can reduce this threat. – pseudon Apr 19 '17 at 13:53
  • @pseudon that looks like a solid answer, especially if you provide more detail (about traffic bypassing the tunnel, other characteristics than HTTP/HTTPS traffic that can be used in tracking, and/or how to use VPN or DNS configurations to block offending servers which track via HTTP traffic or other device characteristics). – cr0 Apr 19 '17 at 14:32
  • 2
    These are broader issues than encrypted traffic that also involve device and procedural privacy hygiene, so I'd suggest editing the question (or making a new one) and get to the heart of your threat model: are you concerned about your ISP? Wi-Fi hotspots? 3rd-party ads and the associated tracking? ID or information theft by websites or network intermediaries? State actors? Correlation across web sites? Correlation across devices? Correlation to your real-world identity? How do you prioritize the threats with respect to risk of occurrence and potential harm? – pseudon Apr 19 '17 at 15:32
4

Using a VPN to tunnel all internet traffic will encrypt the traffic until it gets to the VPN servers, after that it goes over the internet as protected as it would be without a VPN (possibly unprotected). This means that it will help secure you against local tracking (for example people listening in on the hotspot you are connected to). But it will not help against tracking on websites with banners or scripts (which is also a whole other conversation).

In order to choose which VPN to use for encrypting all data coming from your phone I would recommend having a look at this site, which compares a whole lot of VPN providers.

Tor is also an option to encrypt outgoing traffic but it is probably slower than a VPN. The data gets decrypted at the exit node and travels on from there (possibly unprotected).
This means you entrust the exit node with your internet traffic.

  • Tor and VPNs work alike in the way that it encrypts data at the start of the tunnel (the user device) en gets decrypted at the end of the tunnel (being the VPN-server or exit node respectifly). After that the data goes on like it normally would have. I will try and reflect that more in my answer. – Eelke Apr 19 '17 at 10:37
  • Using a VPN or Tor means you trust the VPN to be benign and secure and the TOR guard and exit nodes to not collaborate and the latter to not use or log your data, which are bold assumptions given the worth associated with it. If I were an intelligence agency, I'd invest heavily in TOR and VPNs because intercepting people with something to hide is much cheaper there than to collect and analyze all traffic of all ISPs. – Archimedix Apr 22 '17 at 5:05
1

I'd use a VPN for this, browser bundles or extensions such as 'https anywhere' are browser only, meaning that traffic from your phone via apps other than the browser will not be encrypted unless the app itself encrypts it (many don't).

You can either use a VPN provider app or native support in your mobile OS such as Android or iOS (both have settings to set up a vpn without installing an app).

-2

All WiFi traffic can be encrypted by using Tunnelbear, which can be found in the Android play store.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.