3 ms·

Does it mean that network blockers like piHole can now be bypassed by Android devices? Does Android support "canary domains" like Firefox does (https://support.

Does it mean that network blockers like piHole can now be bypassed by Android devices? Does Android support "canary domains" like Firefox does (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) ?

randomperson_24 4y ago
You could already use nextdns.io for ad blocking on android phones via DNS over TLS.
- neodypsis 4y ago
  I doubt that just using nextdns could help in that. Couldn't they just hardcode and make requests to, say 8.8.8.8 or an unknown address, to resolve their DNS-over-HTTP domains?
  - Melatonic 4y ago
    Yes they can. You need to additionally run a firewall on your mobile device (and/or a firewall on your home network) and block all of the common DNS IP. Then only NextDNS or your choice of DNS is available (and encrypted) Google just wants you to use them for DNS so they can still see where you are going :-)
    - SahAssar 4y ago
      Any app that really wants to can just make a request to a plain IP, or have their own DoT/DoH resolver. DNS-based blocking will never block a determined tracker.
topranks 4y ago
They already do with DoT. You can always block UDP 443 to stop this, given it’s over QUIC.
- jeroenhd 4y ago
  The current implementation uses HTTPS (or DoT in some cases, though that's easily blockable just based on port number if you want to). Blocking QUIC will just make it fall back to a slower method that's just as effective.
jeroenhd 4y ago
They already could. DoT and DoH have been part of Android for years now. If you block too many domains, some Android devices might classify your DNS resolver as broken and fall back to Google's (secure) DNS or anything else the manufacturer has specified in their fork. In fact, I've analyzed several apps that used some kind of binary/text monstrosity over HTTP (not even HTTPS) to resolve IP addresses, usually Chinese manufacturer bloatware. They've been doing this crap for years! When I looked at the apps, the resolver IP had seemingly even been hard-coded into the Java code. If you think your network is leak-free just because you've blocked port 53, you've either been missing leaks or hadn't had any kind of software actually try to evade your blocks. DoH doesn't add anything that wasn't already possible. If you want control over your network, block all outgoing traffic and force every device to go through an intercepting HTTPS proxy and apply filtering heuristics like "this looks double encrypted" or "this looks like an IP address". It's practically impossible to do these days because we've lost control over the devices we've bought, though. It should be noted that there's no sign of this feature being enabled across all Android devices automatically. For most devices, it's an opt-in feature you can toggle in the settings and broken DNS servers won't trigger a fallback. In other words: it doesn't change a thing about your situation, though your situation may not be what you expect it to be.

randomperson_24 4y ago

You could already use nextdns.io for ad blocking on android phones via DNS over TLS.

neodypsis 4y ago
I doubt that just using nextdns could help in that. Couldn't they just hardcode and make requests to, say 8.8.8.8 or an unknown address, to resolve their DNS-over-HTTP domains?
- Melatonic 4y ago
  Yes they can. You need to additionally run a firewall on your mobile device (and/or a firewall on your home network) and block all of the common DNS IP. Then only NextDNS or your choice of DNS is available (and encrypted) Google just wants you to use them for DNS so they can still see where you are going :-)
  - SahAssar 4y ago
    Any app that really wants to can just make a request to a plain IP, or have their own DoT/DoH resolver. DNS-based blocking will never block a determined tracker.

topranks 4y ago

They already do with DoT. You can always block UDP 443 to stop this, given it’s over QUIC.

jeroenhd 4y ago
The current implementation uses HTTPS (or DoT in some cases, though that's easily blockable just based on port number if you want to). Blocking QUIC will just make it fall back to a slower method that's just as effective.

jeroenhd 4y ago

They already could. DoT and DoH have been part of Android for years now. If you block too many domains, some Android devices might classify your DNS resolver as broken and fall back to Google's (secure) DNS or anything else the manufacturer has specified in their fork. In fact, I've analyzed several apps that used some kind of binary/text monstrosity over HTTP (not even HTTPS) to resolve IP addresses, usually Chinese manufacturer bloatware. They've been doing this crap for years! When I looked at the apps, the resolver IP had seemingly even been hard-coded into the Java code. If you think your network is leak-free just because you've blocked port 53, you've either been missing leaks or hadn't had any kind of software actually try to evade your blocks. DoH doesn't add anything that wasn't already possible. If you want control over your network, block all outgoing traffic and force every device to go through an intercepting HTTPS proxy and apply filtering heuristics like "this looks double encrypted" or "this looks like an IP address". It's practically impossible to do these days because we've lost control over the devices we've bought, though. It should be noted that there's no sign of this feature being enabled across all Android devices automatically. For most devices, it's an opt-in feature you can toggle in the settings and broken DNS servers won't trigger a fallback. In other words: it doesn't change a thing about your situation, though your situation may not be what you expect it to be.