4 ms·

Get a raspberry pi and setup pihole with wireguard and dnscrypt-proxy. Get a hostname and basically tunnel your DNS requests to that pihole. Use Firefox and si

by kd913 6y ago

Get a raspberry pi and setup pihole with wireguard and dnscrypt-proxy. Get a hostname and basically tunnel your DNS requests to that pihole. Use Firefox and signal instead of say chrome. Disable the assistant and be aware of the privacy controls of your google account. Looking at the DNS requests made so far, it doesn't seem that much worse than an ipad or iphone. I think it depends on what you are also keeping private from who.

arvindamirtaa 6y ago
Honestly, this is the right answer. Apple makes sure iOS apps don't ask for anymore permissions than they need. Google doesn't really care. That is the ONLY major difference. If you're mindful of what apps are asking for what permissions, you aren't gaining much from Apple's garden. If you're going 1:1 on the apps that run on both android and iOS, you'll soon see that there's very little difference. One more area where iOS is better is security. Your iPhone is basically a paperweight if it's stolen and the thief doesn't know your password. But that's another story.
- actuator 6y ago
  What? This is completely false. I don't know what other manufacturers are doing but Google on stock android and on Pixel does mandate asking for permissions. Even Google's own apps ask for them. If your Pixel is stolen you have remote wipe options and newer Pixels contain Titan M chips that disallow tampering to gain access.
Dahoon 6y ago
Why would you tunnel your DNS requests when you can just switch DNS on the phone to a filtering one and also use blocklists, IE. with Blokada? Unless you route everything, not only default DNS, through the VPN, any app can just hardcode its own DNS ip and if you route everything through the VPN Blokada will do exactly the same but without an extra hop. Sounds terribly complicated for something that gives less security and privacy. Mind you that is coming from someone who runs 3 Piholes on a homelab.
- kd913 6y ago
  You make no sense. It's less secure and likely more privacy problems trusting a service with Blokada compared with my own pihole. My own pihole is accessible wherever I want, I know who has the logs for the DNS requests performed by my pihole which is done over DNS over HTTPS. The DNS requests are made securely through wireguard and just those requests. There is no extra hop?
  - Dahoon 6y ago
    There's no extra hop? Do you carry the pihole around with you? Do you have a firewall running on your phone to block or redirect DNS requests? Since hardcoding and bypassing the one in network settings is extremely easy and done by default by even some Google apps. DNS leaking VPN is trivial. What logs are you talking about? Blokada can use the same upstream DNS as your pihole so the logs are exactly the same if any exists. Without a firewall and a VPN (both on the phone) you are not secure. With a VPN and a custom DNS service with blocklists you have an identical setup as one who uses Blokada, but without an external service.
    - kd913 6y ago
      >Do you carry the pihole around with you? No I leave my pihole at home? >Do you have a firewall running on your phone to block or redirect DNS requests? Since hardcoding and bypassing the one in network settings is extremely easy and done by default by even some Google apps. DNS leaking VPN is trivial. I assume wireguard's DNS field sets/redirects all DNS traffic through the VPN. If it ignores that setting, then Android's VPN design itself is broken. Switching to blokada won't fix this problem either. Either way, Android's Firewall/Network aspects don't give me enough control here. But I can see enough hits on my pihole to have some reasonable confidence. >What logs are you talking about? Blokada can use the same upstream DNS as your pihole so the logs are exactly the same if any exists. I don't have to trust the owners of blokada aren't keeping logs? Why would I need to trust them when I can use my pihole which I know doesn't keep logs? You are offering no advantages here compared to using my setup. >Without a firewall and a VPN (both on the phone) you are not secure. Well there is no competent firewall on the phone without root. Yes there is a VPN on both and it seems to work. >With a VPN and a custom DNS service with blocklists you have an identical setup as one who uses Blokada, but without an external service. Yes, I have an identical setup that I run myself without trusting some random owner of blokada. It runs externally just fine using my home network.

by kd913 6y ago

arvindamirtaa 6y ago

Honestly, this is the right answer. Apple makes sure iOS apps don't ask for anymore permissions than they need. Google doesn't really care. That is the ONLY major difference. If you're mindful of what apps are asking for what permissions, you aren't gaining much from Apple's garden. If you're going 1:1 on the apps that run on both android and iOS, you'll soon see that there's very little difference. One more area where iOS is better is security. Your iPhone is basically a paperweight if it's stolen and the thief doesn't know your password. But that's another story.

actuator 6y ago
What? This is completely false. I don't know what other manufacturers are doing but Google on stock android and on Pixel does mandate asking for permissions. Even Google's own apps ask for them. If your Pixel is stolen you have remote wipe options and newer Pixels contain Titan M chips that disallow tampering to gain access.

Dahoon 6y ago

Why would you tunnel your DNS requests when you can just switch DNS on the phone to a filtering one and also use blocklists, IE. with Blokada? Unless you route everything, not only default DNS, through the VPN, any app can just hardcode its own DNS ip and if you route everything through the VPN Blokada will do exactly the same but without an extra hop. Sounds terribly complicated for something that gives less security and privacy. Mind you that is coming from someone who runs 3 Piholes on a homelab.

kd913 6y ago
You make no sense. It's less secure and likely more privacy problems trusting a service with Blokada compared with my own pihole. My own pihole is accessible wherever I want, I know who has the logs for the DNS requests performed by my pihole which is done over DNS over HTTPS. The DNS requests are made securely through wireguard and just those requests. There is no extra hop?
- Dahoon 6y ago
  There's no extra hop? Do you carry the pihole around with you? Do you have a firewall running on your phone to block or redirect DNS requests? Since hardcoding and bypassing the one in network settings is extremely easy and done by default by even some Google apps. DNS leaking VPN is trivial. What logs are you talking about? Blokada can use the same upstream DNS as your pihole so the logs are exactly the same if any exists. Without a firewall and a VPN (both on the phone) you are not secure. With a VPN and a custom DNS service with blocklists you have an identical setup as one who uses Blokada, but without an external service.
  - kd913 6y ago
    >Do you carry the pihole around with you? No I leave my pihole at home? >Do you have a firewall running on your phone to block or redirect DNS requests? Since hardcoding and bypassing the one in network settings is extremely easy and done by default by even some Google apps. DNS leaking VPN is trivial. I assume wireguard's DNS field sets/redirects all DNS traffic through the VPN. If it ignores that setting, then Android's VPN design itself is broken. Switching to blokada won't fix this problem either. Either way, Android's Firewall/Network aspects don't give me enough control here. But I can see enough hits on my pihole to have some reasonable confidence. >What logs are you talking about? Blokada can use the same upstream DNS as your pihole so the logs are exactly the same if any exists. I don't have to trust the owners of blokada aren't keeping logs? Why would I need to trust them when I can use my pihole which I know doesn't keep logs? You are offering no advantages here compared to using my setup. >Without a firewall and a VPN (both on the phone) you are not secure. Well there is no competent firewall on the phone without root. Yes there is a VPN on both and it seems to work. >With a VPN and a custom DNS service with blocklists you have an identical setup as one who uses Blokada, but without an external service. Yes, I have an identical setup that I run myself without trusting some random owner of blokada. It runs externally just fine using my home network.