5 ms·
Even more egregious IMHO, is that they set up shadow APNs on android devices, at the behest of the carriers, and route all tethered traffic via them. This is s
by Nursie 6y ago
Even more egregious IMHO, is that they set up shadow APNs on android devices, at the behest of the carriers, and route all tethered traffic via them.
This is so the carriers can measure and limit tethering separately.
The security issue here is that if you have a VPN client running on your phone, tethered traffic still goes in plaintext to the public internet via the hidden APN.
Not cool.
- dleslie 6y agoThat _is_ grotesque. I wish I had something to add; particularly like "here's a reasonable alternative", but there really isn't.
- fsflover 6y ago> I wish I had something to add; particularly like "here's a reasonable alternative", but there really isn't. Yes, there are: https://en.wikipedia.org/wiki/Pinephone https://en.wikipedia.org/wiki/Pinephone and https://en.wikipedia.org/wiki/Librem_5 https://en.wikipedia.org/wiki/Librem_5.
- rorykoehler 6y agoWhy are they so under specced ?
- JoshTriplett 6y agoThey're first-generation devices, so the focus is on getting the device experience right, not on having flagship specifications. If they get the experience right, they'll likely come out with higher-spec devices in the future.
- noir_lord 6y agoEconomies of scale. If I want to buy 20 million of something the wholesale will give me a better price than if I want 2000. The marginal cost goes down with the number produced as well.
- fsflover 6y agoWhat are you going to do with them? 3D-gaming? Yes: https://www.youtube.com/watch?v=S_HXQJkWjUQ https://www.youtube.com/watch?v=S_HXQJkWjUQ. Using an external screen? Yes: https://www.youtube.com/watch?v=bH3RbrwhNd8 https://www.youtube.com/watch?v=bH3RbrwhNd8.
- rorykoehler 6y agoI could live with small ram or processor but not with 16 or even 32gb storage.
- fsflover 6y agoBoth phones have slots for microSD cards up to 2 TB.
- rorykoehler 6y agoI’ve had phones with card expansion. Never worked seamlessly to the point where I gave up on them. Does anyone have experience with using cards on these phones? Can you for example store all images and media there as if it was the main storage without ever needing to think about it again?
- fsflover 6y agoI have a Pinephone. It boots from the microSD by default, if it's bootable. Works flawlessly.
- rorykoehler 6y agoThat’s good to hear. Might give it a go next time I need a phone
- est31 6y agoHave you bought cheap and slow cards or expensive and fast ones? Faster cards are more expensive but for phones it's absolutely worth it.
- jsheard 6y agoA phone with a non-existent app ecosystem is not a reasonable alternative for most people.
- fsflover 6y agoGNU/Linux has thousands of apps. They do not all fit the screen, but it's much easier to fix than create new ones. Purism created libhandy library for that.
- zozbot234 6y agoIt should be noted that the libhandy features are now part of the stock gtk3+ framework, so every app following standard UI guidelines benefits from the new "responsive" look.
- swiley 6y agoWhat are you talking about? GNU/Linux has a much more healthy app ecosystem than any mobile OS. I own one of these (the pinephone) and it's really very much like a laptop running alpine. All of my desktop apps just work (although I have to use fluxbox because CWM isn't nice on a touchscreen.)
- dleslie 6y agoNeither of which are in stock now. I have a Pinebook Pro and love it, but the Pinephone's camera is woefully underspec'd. Put a better camera on it and let me pre-order ffs and I'll buy one in a heart beat.
- fsflover 6y agoPreorders for Pinephone will open in about a week. You can preorder Librem 5 with a better camera now (but you won't get it very soon due to a large queue).
- dleslie 6y ago> Preorders for Pinephone will open in about a week That's great! Now if only I could get some kind of email notification about that. Oh. I can't.
- fsflover 6y agohttps://www.pine64.org/ https://www.pine64.org/, see "Subscribe to the PINE64 Blog" below.
- dleslie 6y agoYes, I have subscribed to both the blog and the Telegram; on the Discord I'm given the impression this may be unreliable. I don't get why I can't pre-order now; if I'm willing to spend money on a promise, like with Kickstarter, then I should be able to do so here.
- Iolaum 6y agoWhat!? is that documented, shown somewhere? Any source you can provide that speaks about it?
- Nursie 6y agoJust trial and error on a couple of devices now, then found a few more people suffering from it on a reddit thread. I discovered the issue by connecting my phone to my home VPN and then trying to access services that are only accessible from my home.
- rorykoehler 6y agoI’ll never buy another android phone for personal use. I’d made my mind up before today but this really drives home why.
- GekkePrutser 6y agoIt can be done properly though. Take GrapheneOS. Or lineage with MicroG if you want to have a bit more mainstream capability.
- joecool1029 6y ago> Or lineage with MicroG One major thing to note: Don't expect support from LineageOS devs for MicroG stuff. They explicitly do not support it and are slightly rustled at people using unofficial builds with MicroG and then complaining in their support channels.
- SubiculumCode 6y agoThis is a big issue for privacy, yes, but also for businesses leveraging tethering capabilities with company issued phones. If you have some sources on this, it I'd upvote it as a submission.
- alisonkisk 6y agoAnyone security conscious would run a VPN client on the client device, not the tether.
- SubiculumCode 6y agoGood point.
- dleslie 6y agoIt's not just the security issue - the ability to differentiate between tethered and non-tethered traffic means they're not treating them equally.
- Nursie 6y agoI'll see if I can find anything. So far I have my own tinkering and a reddit thread or two that I seem to have lost...
- izacus 6y agoSince you wrote this a bit misleadingly - this happens with Apple's carrier profiles as well.
- Nursie 6y agoI didn't mean to be misleading, and I've never used an iPhone so I have no idea what Apple does. Interesting though, thanks.
- lern_too_spel 6y agoYour post is very confused. Android doesn't send tethered traffic through VpnService whether or not tethered traffic goes to the same APN. Tethering just sets up a dumb router.
- Nursie 6y agoThat's actually worse, IMHO. The VPN should apply to all outbound traffic.
- lern_too_spel 6y agoThe current behavior matches iOS.
- inshadows 6y agoDo you have any source with more info? For "shadow APN android" Google first result was your comment with same assertion on HN from 5 months ago.
- Nursie 6y agoLOL, that's probably when I found it! There was a reddit thread of other people seeing similar issues, will see.if I can dig it out later/tomorrow.
- joecool1029 6y agoMostly correct. Most major phone OS has had this situation. iOS, Android, and BB10. It's a billing/terms of service issue. That being said, the most straightforward non-root way around it is to install LineageOS on a supported device. There's an option in hotspot settings to share VPN connection. There may be other (non-Google) manufacturers that carry a similar feature. If you want to talk real nasty shit: Lets say you do the above and unlock device bootloader to install LineageOS. However, you decide not to root because you'd like to maintain security on the device. Additionally, you're on the latest monthly patch level while your vendor's latest build is 8+ months back... Guess what? Now you can't use Netflix or your banking app! Why? Because Google play services uses your device's 'hardware-backed attestation' to know bootloader is unlocked and app developers can block install of their apps based on this certification status. See: https://www.lineageos.org/Google-Play-Certification/ https://www.lineageos.org/Google-Play-Certification/
- mycall 6y agoI've been using PdaNet+ to get around the hidden APN hotspot traffic routing. It makes AT&T think I am using 100GB on my phone when most is from my PC.
- sigsergv 6y agoIs it possible to inspect those shadow APNs without rooting?