topic Re: Controlling MOBILE APPS rather than websites and browsers. in OpenDNS

Controlling MOBILE APPS rather than websites and browsers.

dns_tester — Mon, 23 Feb 2015 02:07:23 GMT

Folks, I've seen some posts covering a specific app (e.g. the Facebook or Youtube app), but I have a more general question. I'm coming across a growing need to be able to block / filter mobile devices which are connected wirelessly to our network. I understand that mobile phones and some tablets have their 3/4g connections, and when they're using that for access, it's a non-issue. However, this question concerns those devices when connected to the wifi access points on our network. When those devices use their web browsers, our OpenDNS router-based filtering generally works just fine. However, more and more mobile device users are beginning to use apps much / most of the time, rather than the browser....and more and more common / popular websites (even some not-so-common sites) are beginning to offer their own custom apps for accessing their content as an alternative to the browser. The QUESTION: Is there a method/setting which will block adult themed apps as well as such websites reliably (or any app which may fall within any of the categories which we currently filter) ? REASON for the question: The discussions I've read covering, for example, the Youtube app instruct the admin to add a specific list of URLs used by that particular app to their custom block list. After taking those specific steps to address that specific app, the Youtube mobile app would be blocked when using wifi. Well, there are a lot of apps out there. In order to control / block the ones falling within certain categories....will we need to go through the same type process (identify the specific app by name, post in the forum and hope someone knows or is able to find out the specific domains which that app uses to access its content....then log in to the Dashboard and add those specific domains to our blacklist) ? I'm hoping there is some other method for obvious reasons. The value of OpenDNS is its centralized, categorized point of control. If the app-by-app / domain-by-domain method is the only option for filtering / blocking app content....one can begin to see the dilemma...since more and more people are starting to use mobile devices for much/most of their Internet access, coupled with the fact that there are 1000's of apps out there (and 100's or maybe 1000's being added every day). One's day could easily begin to be filled with scouring the app stores for the newly added apps that day, determining which ones fall within the categories we filter, digging/researching/posting to try to discover the domain(s) used by each....then manually adding those to the blocked list in our OpenDNS control panel. Thanks for any advice / assistance. -KEV

Re: Controlling MOBILE APPS rather than websites and browsers.

mattwilson9090 — Mon, 23 Feb 2015 02:20:59 GMT

Manually adding them to the blacklist is an intermediate step. If an app, just like a website accesses multiple domains someone will need to identify those domains. After that they can be manually and individually added to a blacklist, or more appropriately they can be categorized and volted upon here https://community.opendns.com/domaintagging/

The domain tagging is a community process that relies upon people identifying and properly tagging domains. OpenDNS simply cannot hire enough people to accurately tag every single domain that is used by various websites and apps. They oversee it and do get quite involved, but especially for the smaller ones the only way to get things categorized is via user submissions and voting.

Re: Controlling MOBILE APPS rather than websites and browsers.

rotblitz — Mon, 23 Feb 2015 11:21:39 GMT

With a DNS service like OpenDNS you cannot block apps, particular devices, websites, browsers or URLs, just domain names.

Many routers allow restricting WLAN access for devices by their MAC address, i.e. you had to allow connecting certain devices based on their MAC addresses.

"Is there a method/setting which will block adult themed apps as well as such websites reliably"

That asked, are you attempting to prevent minors from accessing adult content? So, you're probably representing an educational institution or organization? Else you would not really be worried, would you?

Re: Controlling MOBILE APPS rather than websites and browsers.

dns_tester — Mon, 23 Feb 2015 13:50:04 GMT

Is there a method/setting which will block adult themed apps as well as such websites reliably (or any app which may fall within any of the categories which we currently filter) ? Entire sentence re-posted above....adult specification used simply as an example of a commonly blocked category. Basis of question is that the category settings which filter websites are usually fairly comprehensive. Sure, you'll occasionally come across one that has slipped through detection and isn't on the list.....and the submission area can be used to submit it for review....but such is generally the exception. With apps, it seems that it may be the other way around....only a few are affected....with most working. And since more and more users are replacing a significant amount of their online access with apps via mobile devices, one can begin to see the time-dilemma, if, indeed, the standard method of controlling app content filtering requires first learning of which app was installed by someone (that day)....then researching that specific app...then making blocked-list entries...for each specific app. Not sure how to restate the question. Was just checking to see if there were any other filter settings / menu areas in the OpenDNS dashboard that applied to mobile apps (vs browsers) based on any possible technical differences between the two. I'm not aware of what those may be, so figured I'd reference the support community forums. -Thanks

Re: Controlling MOBILE APPS rather than websites and browsers.

rotblitz — Mon, 23 Feb 2015 16:32:38 GMT

"Is there a method/setting which will block adult themed apps as well as such websites reliably (or any app which may fall within any of the categories which we currently filter) ?"

Yes, there are many options. Just search the internet for them. And if these apps work with DNS, you can even use OpenDNS to block them from accessing domains in categories or individual domains. Again, you do not block apps, but domains with OpenDNS.

"With apps, it seems that it may be the other way around....only a few are affected....with most working."

This would to be proved. There are apps not making use of DNS at all, but they may use IP addressing only, so you're totally out of luck with controlling domain access by a DNS service like OpenDNS, because nothing ever reaches the OpenDNS service.

"the standard method of controlling app content filtering requires first learning of which app was installed by someone (that day)....then researching that specific app...then making blocked-list entries"

Domain tagging at OpenDNS is community effort. Users (like you) have to find out if the app uses DNS at all, and if so, what domains are being accessed.
Looking at the domain stats is a good starting point: https://dashboard.opendns.com/stats/all/topdomains
Then users can submit these domains for certain categories: https://community.opendns.com/domaintagging/submit/

"...for each specific app."

No, this does not make sense. OpenDNS does not see what networking program is being used, whether it's an app, a browser, a mail program, a usenet program or anything else. OpenDNS just sees a public source IP address.

"Was just checking to see if there were any other filter settings / menu areas in the OpenDNS dashboard that applied to mobile apps (vs browsers) based on any possible technical differences between the two."

No, again, this does not make sense, because this is not information OpenDNS can see from you, so they can't do anything based on what program/app is being used.

Re: Controlling MOBILE APPS rather than websites and browsers.

dns_tester — Tue, 24 Feb 2015 00:52:59 GMT

Thanks for the info.----- This raises a question about apps. I've done some research to try to find the answer, but to no avail.--- Does anyone know what method apps typically use to access their online data? Is it typically via a domain or via an IP ?----- In the case of the Youtube app for example, according to another post I read earlier, there are like 4 specific domains that when entered into the block-list, OpenDNS will begin to block that app, so it's apparently is "domain based" ---- But does anyone know if this the typical online-access method for most apps ?

Re: Controlling MOBILE APPS rather than websites and browsers.

pcolford — Tue, 24 Feb 2015 01:06:41 GMT

Most apps will use domains rather than hard-coded IP addresses. This is principally because new servers may come online that use different IP addresses than previous servers, or because of CDN technology that is based on getting you the fastest response possible, anywhere in the world.

Re: Controlling MOBILE APPS rather than websites and browsers.

dns_tester — Tue, 24 Feb 2015 02:40:50 GMT

Patrick,

Thanks very much for the reply. I've been really impressed with how OpenDNS is able to keep a pretty comprehensive blacklist for the predefined categories. Since this does seem to be such a comprehensive list, I'm assuming that there is OpenDNS staff who will review and update domains that are continually coming online (as much as is reasonably possible)....as well as evaluating those that users discover and send in via domain-tagging submission.

While many users out there, I'm sure, contribute via domain-tagging as they discover a website that is either brand new., or has otherwise remained unnoticed to that point.....I'm guessing that most users who discover a mobile app that may clearly fall in a particular category (but is at that time unaffected by the filter)....would not really know how to find out which domains it is using to access it's content (since, unlike a standard website, the domain is not being clearly displayed in an address bar at the top of the screen). This would preclude most users from either submitting them via domain tagging....or adding them to their own block-list.

Is OpenDNS' monitoring and maintence procedures beginning to include reviewing the known / more common apps whose content falls within those predefined categories...in order to determine if they are indeed using domains to access their content and then adding those domains to categories' blacklists ? And, does the domain-tagging submission area allow submitting the name of a mobile app that an contributor believes should fall within a category (again, since the average contributor would simply know know how to determine which url(s) a given app may be using) ?

Thanks

Re: Controlling MOBILE APPS rather than websites and browsers.

dns_tester — Tue, 24 Feb 2015 02:45:21 GMT

[[ CORRECTION ]]

The last part of that last sentence should read: "....(again, since the average contributor would simply *not* know how to determine which url(s) a given app may be using) ? "

Re: Controlling MOBILE APPS rather than websites and browsers.

mattwilson9090 — Tue, 24 Feb 2015 02:55:32 GMT

No, the domain tagging area includes nothing about submitting mobile apps. OpenDNS is a *DNS* which concerns itself only with domain names, not web pages, URL's, apps, applications, or anything else. There is absolutely no way for OpenDNS (or any other DNS service) to know if a webpage, app, or anything else initiated a domain lookup, only that something needed a lookup.

Asking specifically about apps is the same as asking about OpenDNS filtering specific images on a website. Since DNS doesn't deal with content, or what generated that content, it has no way to allow or block anything based on those criteria. It ONLY blocks or allows traffic based on domain name.

Re: Controlling MOBILE APPS rather than websites and browsers.

pcolford — Tue, 24 Feb 2015 18:28:40 GMT

dns_tester:

The domains which apps require are somewhat harder to pin down than the domains which sites need. For websites, you can use a variety of tools, my favorite of which are baked into browsers (Firefox' Firebug and Chrome's Developer Tools) that will show you what domains have DNS requests made to them when the website is requested. Conversely, apps have no such tools to define what domains they use, nor are there great tools on the mobile device itself to identify those domains. Generally, you have to look at either DNS logs or traffic records from your router to pick up on which domains are being called by the app.

That being said, we internally have a list of services (and a smaller list for applications) which we curate, containing the names of domains for that service or app. There aren't any plans at this time of which I am aware to change the domain tagging system to create a new category for "mobile" or "app domain", but that sounds like an interesting idea and you may want to submit it as a new category.

Re: Controlling MOBILE APPS rather than websites and browsers.

dns_tester — Wed, 25 Feb 2015 01:33:29 GMT

Patrick, Thanks very much for that information. These "app-questions" have resulted from observing how more and more users seem to be reaching for that mobile device as much or more often than the mouse, when accessing something online. And when doing so, they're usually tapping an app rather than the device's browser. To be honest, I suspect that (these days), for much of the residential side (families)...a majority of their online access may be via mobile. There are an enormous number of mobile/tablet devices out there now. A tablet has been one of the most popular family gifts over the last 5 years. Hopefully most of these apps are depend on the same xxxxxxx.com /xxxxxx name variations as known websites...and are largely being covered in the current categories. But if not, an enormous amount of content may be getting through home networks....unbeknownst to the unsuspecting parent who may be assuming that the Family Shield or regular OpenDNS account they set up in their router (and which they observe working on their own desktop or laptop)....is covering the wifi-connected tablets they got their kids as well. I will submit that as a request / suggestion. And thanks again for the detailed response.