THE DATA ECONOMY has too often betrayed its customers, whether it’s Facebook sharing data you didn’t even realize it had, or invisible trackers that follow you around the webwithout your knowledge. But a new app launching in the iOS App Store today wants to help you take back some control—without making your life harder.
The Guardian Firewall app runs in the background of an iOS device, and stymies data and location trackers while compiling a list of all the times your apps attempt to deploy them. It does so without breaking functionality in your apps or making them unusable. Plus, the blow by blow list gives you much deeper insight than you would normally have into what your phone is doing behind the scenes. Guardian Firewall also takes pains to avoid becoming another cog in the data machine itself. You don’t need to make an account to run the firewall, and the app is architected to box its developers out of user data completely.
“We don’t log IPs, because that’s toxic,” says Will Strafach, a long-time iOS jailbreaker and founder of Sudo Security Group, which develops Guardian Firewall. “To us, data is a liability, not an asset. But to think that way you’ve got to think outside the box, because it means you can’t just choose the simplest solutions to engineering problems a lot of times. But if you are willing to spend the time and resources, you can find solutions where there isn’t a privacy downside.”
Block Party
The Guardian Firewall development team, which also includes noted jailbreaker Joshua Hill, currently comprises four engineers and two security researchers, and the app translates their collective knowledge about App Store services into automatic blocking for modules within apps that are known to be potentially invasive. The service costs $10 per month, or $100 per year. You pay through an in-app purchase using your AppleID, which means Guardian Firewall doesn’t manage the transaction or the data associated with it. The team doesn’t have immediate plans to expand to Android, because their expertise lies so specifically in iOS.
To start using Guardian Firewall, all you do is tap a big button on the main screen. It turns green and says “Protection is on.” From the user’s perspective, that’s it. Under the hood, the app establishes a virtual private network connection, and creates a random connection identity for it to keep track of people’s data without knowing who they are. If you turn Guardian Firewall protection off and then on again, the app establishes a new connection and new connection identity, meaning that there’s no way to connect the dots between your sessions.
The app uses its VPN connection to filter your data in the cloud, but the stream is fully encrypted. Guardian Firewall has automated machine learning mechanisms that evaluate how an app behaves and, particularly, whether it sends out data to third parties, like marketing analytics firms. The idea is to flag whenever an app tries to communicate beyond its own infrastructure. Guardian Firewall is also able to detect and block other types of potentially invasive behavior, like page hijackers that push mobile pop-ups.
Apple itself has already been working on baking similar protections directly into iOS, particularly when it comes to blocking web trackers in Safari that would otherwise fingerprint users across multiple sites. But Guardian Firewall aims to go a few steps further, and to apply across all apps.
Test Drive
I’ve been testing Guardian Firewall on and off for months, and have found it easy to leave it running in the background. The connection doesn’t seem to slow things down on my phone or eat my battery, and the list of trackers the app has blocked is constantly growing—310 location trackers, seven page hijackers, and 3,200 data trackers so far. It felt a little uncomfortable at first to have something constantly running in the background, but it was fascinating to see all the shenanigans happening on my iPhone all the time. Some beta testers have noted that they wish Guardian Firewall offered a customizable blacklisting feature, instead of only automated blocking. But I didn’t personally feel a desire to put time into customizing the app. To me the whole value is in “set it and forget it.”
Guardian Firewall has already engineered its way around at least one privacy conundrum during its limited prerelease. Someone essentially launched a denial of service attack against the service by rapidly initiating a deluge of connection requests all at once. Guardian Firewall couldn’t check what IP address or addresses the requests came from, though, because it doesn’t record IP addresses. The team could have solved the issue by altering its policy to access IP addresses during the small window when devices are establishing their connection and then delete the data. But “we determined that that would go against our values,” Strafach says.
Instead, the developers devised a workaround that uses a device check offered by Apple, but encrypts the check so Guardian Firewall itself can’t see the data that’s sent to Apple. The only thing Guardian Firewall finds out at the end of the process is whether the device is a legitimate iOS device or not.
As with any VPN, the ultimate test of Guardian Firewall’s privacy protections and approach to minimal data retention would be a subpoena that is later made public through a trial in which the service has nothing to hand over. And Strafach says that while the company will cooperate with investigators if necessary as required by law, the company has taken precautions both internally and in contracts with its infrastructure providers to ensure that it can be transparent with users about any law enforcement requests.
“Looking over their privacy policy it looks really good,” says William Budington, a senior staff technologist at the Electronic Frontier Foundation. “You’re not logging in, and there’s radical data minimization in general. If they don’t have data stored on a server then a breach or buy-out won’t actually have that much of a negative impact. But keeping an eye on the privacy policy and news about the company is a good practice in general with VPNs, because things can slowly change.”
Not Just Another VPN
Of course, many of the same questions about trust apply to Guardian Firewall as they do to other VPNs. You’re still sending all of your data to their server. But at least Guardian Firewall uses the built-in iOS VPN application programming interface instead of trying to reinvent the wheel, and the encryption scheme protecting your data similarly draws on vetted industry standards, rather than anything proprietary. Strafach also says Guardian Firewall’s goal is to be as open and transparent about its actions as possible—and agrees that people should think carefully about whether it suits their specific needs, as they should for any app.
“People should know exactly what Guardian is doing and if it’s just a concept they don’t like, or they think we’re not the right data custodians for them then so be it, that’s cool,” he says. “‘How can we trust you?’ is just such a valid question for users to be asking all app makers.”
One thing Guardian Firewall can’t currently do is identify what specific apps trigger its tracking alerts, a feature that I found myself wishing it had. If anything, though, the absence helps solidify its privacy cred. Strafach and his team hadn’t figured out how to achieve that granularity without inadvertently creating a potentially identifiable data set of all the apps on your phone. An upcoming solution still won’t directly connect warnings to specific apps, but will instead show the apps that were running at that timestamp that could have cased the alert.
“All you’ll be able to see is ‘at this time we saw this tracker and these are the apps which could be causing it,'” Strafach says. “So maybe that’s one app or maybe three, but it’s a compromise that gives more of the answer users want while it respects their privacy.”
“Clearly the biggest risk to the everyday iOS user is apps surreptitiously tracking them, which unfortunately the majority of apps do—rather massively,” says Patrick Wardle, a Mac security specialist. “Guardian generically thwarts such trackers. I love that Will and Josh, who are former jailbreakers, tackled this. I bet it wasn’t easy, but with their unique skills they are probably one of the few teams that could figure it out and make it all seamlessly work in the constrictive iOS environment.”
It’s complicated and resource-intensive to make all of these wild workarounds happen, but if Guardian Firewall can do it and be financially viable, Strafach hopes that the project will become a sort of case study that privacy pays. With so many companies in the marketplace seemingly convinced that that’s not the case, there’s a lot riding on its success.