• @Pantherina@feddit.de
    link
    fedilink
    51 year ago

    Any system app on Android, the captive portal login and more CAN all bypass a VPN in “block all other connections” mode.

    Android is really problematic and having as little system apps as possible is the only fix.

  • Mullvad is awesome. i think this is the second android bug/incident they brought to light?

    Anyway, really really hope this gets fixed upstream, maybe by Graphene

    How much you wanna bet this was intentional by Google? 😏

  • @Tundra@lemmy.ml
    link
    fedilink
    111 year ago

    What I don’t understand though, doesn’t using mullvad automatically set their own DNS?

    • youmaynotknow
      link
      fedilink
      51 year ago

      Only if your Android connection is set to automatic DNS. Additionally, they are assuming it is an OS bug. However, they also acknowledge that they had to fix something on their app to mitigate. I tried myself with Wireguard instead, killed the network access to it, and nothing ever left my phone, as Android immediately killed all connections due to the VPN always on feature.

      So, I’m going to take their claim with a grain of salt until AOSP says something about this and denies or confirms the alleged bug.

    • lemmyreaderOP
      link
      fedilink
      English
      61 year ago

      On the desktop it does. But on Android things are maybe different ? Not directly related but I remember (long time ago) wanting to tether from an Android phone with Mullvad VPN app in use, to a computer, only to find out that the Android defaults (In Android not in the Mullvad app) needed a button swiped to make it work correctly on the other device.

  • @TheAnonymouseJoker@lemmy.ml
    link
    fedilink
    13
    edit-2
    1 year ago

    I think the problem is Reddit user (who Mullvad cites) not knowing that the Private DNS feature in AOSP/Android defaults to Google or Cloudflare DNS, and that you need to set a custom DNS of your choice to prevent this.

    AdGuard provides a whole list of DNS providers to pick from. Pick a hostname from DNS-over-tls row for any provider, remove the “tls://” part and enter the rest in Private DNS custom option.

    https://adguard-dns.io/kb/general/dns-providers/

    • youmaynotknow
      link
      fedilink
      41 year ago

      If you do this, you’ll be using the DNS you assign instead of using the VPN’s DNS, as intended. That will make you stand out from the rest of the same VPN users, effectively affecting privacy.

      • Either stand out or let your ISP or Google/Cloudflare or VPN read all your domain visit queries. It is better to not let ISP or Big Tech decipher your internet history for obvious reasons.

    • mine gives me three choices. Off, Automatic, and Private DNS (type in your own). should i set mine to off then? will that prevent the leak?

      • @TheAnonymouseJoker@lemmy.ml
        link
        fedilink
        2
        edit-2
        1 year ago

        I am not sure what off does. Might need to recheck Android documentation. But I remember the custom one definitely uses whatever you set, and nothing else. No Google/Cloudflare DNS.

        For example, if you like AdGuard, you can just enter dns.adguard.com there.

          • @TheAnonymouseJoker@lemmy.ml
            link
            fedilink
            2
            edit-2
            1 year ago

            Automatic on Android always falls back to Google or Cloudflare DNS in the same way systemd DNS resolving works. Or if that does not work, ISP is being sent whatever domain queries user is requesting directly. I am going off from connecting the dots between what I know about Private DNS from Android documentation, and what the Reddit poster did not mention who Mullvad cited in their blog post. I am assuming that the time gap between Android’s killswitch turning off and on with always-on settings is giving time for DNS queries to go through (detected by Wireshark), and since the default DNS provider is almost never set by people on Android, this may be happening.

  • @darcmage@lemmy.dbzer0.com
    link
    fedilink
    English
    581 year ago

    “The report detailed how the user managed to leak DNS queries when disabling and enabling VPN while having “Block connections without VPN” on.”

    Not to diminish the severity of the issue but I can’t imagine this being the factor that pushes the average person to ios over android.

    • @TheAnonymouseJoker@lemmy.ml
      link
      fedilink
      321 year ago

      The amount of leaks iOS intentionally does, let alone the part where they tell you to use their own (not so) Private Relay feature, is enough to stick around on Android.

      • meseek #2982
        link
        fedilink
        41 year ago

        Uhhhh, source? Those are pretty bold claims to just casually toss out

          • meseek #2982
            link
            fedilink
            41 year ago

            The one that irks me is how some apps that have already established a connection can ignore the VPN. I always wondered about that, like if I enabled my VPN, what happens to existing connections. One thing I couldn’t find is what apps can do this? If it’s third party apps, that’s pretty serious. But if it’s just Apple apps or default ones, that’s a far less of a concern seeing as Apple seems to bypass VPN anyway for its in-house wares.

            • @TheAnonymouseJoker@lemmy.ml
              link
              fedilink
              6
              edit-2
              1 year ago

              You should treat Apple as a third party to your data. Apple is not your friend. No corporation is your friend. Apple is even worse than the average corporation.

              • meseek #2982
                link
                fedilink
                21 year ago

                LOL. They built the entire fucking OS. If they want to siphon my data, they can. Without anyone knowing. Also everything is linked to my Apple ID. So what’s the point? They already know everything and have tied it all together with my unique IDs, device serial numbers and the payment data associated. What’s the point the of running FaceTime over a VPN? They already know everything…

                At some point you have to stay calm and think rationally.

                Now if Twitter or some random app I downloaded from GitHub can bypass my VPN, then yeah, that’s a pretty big concern as they currently have nothing on me.

                I’m going to ignore the “corpos aren’t your friend” because FUCKING DUUUHHHHHH

                • @TheAnonymouseJoker@lemmy.ml
                  link
                  fedilink
                  5
                  edit-2
                  1 year ago

                  If you have sold your soul to Apple already, then that is not a problem. You may take this as offensive or factual, I do not care. Why? Because I use Android phones without a Google account. You may think, this person does not have a life, I do. But I also have a life. I use online groceries and use shopping sites through Firefox web browser. I have WhatsApp and Discord with lots of restrictions and a firewall with 400k+ domains blocked all the time.

                  How much data you consider okay to give away to corpos is up to you. However, understand that once you give away this or that data about you, there is no way to return back to an option or time where nobody had that data about you.

                  Yes, I am pretty anal about my privacy, security, anonymity and freedom. And I am shameless about it.

    • Possibly linux
      link
      fedilink
      English
      131 year ago

      I’m not sure of anyone who switches from iOS. Once you are in the ecosystem they won’t let you leave.

      • @dubyakay@lemmy.ca
        link
        fedilink
        23
        edit-2
        1 year ago

        Why is this stupidity repeated ad nauseum? I’ve successfully switched from iOS to Android and back to iOS again without any hindrance.

        It’s not any different from switching from windows to Linux.

        • Possibly linux
          link
          fedilink
          English
          141 year ago

          Then why can’t I use an Apple watch with anything but Apple products? Why do I need a Mac to create iOS apps?

          • meseek #2982
            link
            fedilink
            41 year ago

            Lmao. People really are just out there on the raggedy edge. The watch communicates with a shit ton of sensors and other tech only found on Apple devices. Also, last I checked, I can’t run an Android Watch on iPhone fully, there is always a slew of things that don’t work or kinda work. Maybe Apple didn’t want that experience for its users.

            You need a Mac to build Apple apps because why in the actual fuck would you use a PC to do that!? What’s the point?

            I’m not defending Apple as they clearly gate a lot of shit but the complaining about the dumbest shit ever doesn’t make them Nazis. Also, Google, Samsung, Microsoft, all of them are the same level of asshole. Big Tech is trash. This is not new news.

            • Possibly linux
              link
              fedilink
              English
              51 year ago

              You could use an Android watch with iOS but Apple will not let you. I don’t get why you are defending Apple

              • meseek #2982
                link
                fedilink
                41 year ago

                What do you mean don’t let you? https://screenrant.com/samsung-galaxy-watch-4-use-with-iphone-compatible-explained/

                Same shit as with Apple on Android, basic functionality, nothing more.

                So you blame Apple for Android having basic functionality with an aWatch but then blame Apple for a Samsung Watch having basic functionality on iOS? So it’s just Apple’s fault all the way around then?

                I guess you also missed the part where I say all big tech is the same? And are all basically shit? Or you just didn’t read that far…

          • @kugmo@sh.itjust.works
            link
            fedilink
            English
            111 year ago

            If you just have an iPhone and nothing else and treat it like a smart phone it is very easy to migrate over to android and vice versa. If you get invested in the apple ecosystem it might be hard to leave or use some other products that are gimped without an iPhone

            • Possibly linux
              link
              fedilink
              English
              81 year ago

              Third party products will not work well with an iPhone as Apple makes sure that there products work best. Additionally, iphones have very bad SMS and MMS support.