Sending cleartext data over an open Wi-Fi network, or an encrypted network controlled by someone you don't trust, is very bad for security. This has been discussed here previously. The usual solution to this is to use a VPN, but that adds latency, and requires you to run it on your own server or buy a third-party VPN service - which is itself someone you have to trust.
Most reputable apps these days use HTTPS or other encrypted protocols to communicate with their servers, and most websites are available via HTTPS too. So in many cases it's safe to let these apps communicate over any network - there's no need for a VPN. But as an end user, I don't know if any given app is secure.
I'd like to block all apps from using cleartext while I'm connected to an untrusted network, but allow HTTPS and other encrypted protocols. I don't mind the block being port-based: I'm not worried about malicious apps "tricking" the filter by sending cleartext over an SSL port. I don't mind if the solution uses Android's "always-on VPN" feature to work, as long as it doesn't require a remote VPN server. I'd like to avoid the need to root the phone. I'd also like to be able to designate some networks as "trusted" and allow cleartext data over those networks.
Is there a way to achieve this?
