3 ms·

This is false. Blokada uses the Private DNS feature of the phone to block ads. That feature is only available as of Android 9. Any device running Android 8 o

This is false. Blokada uses the Private DNS feature of the phone to block ads. That feature is only available as of Android 9. Any device running Android 8 or lower doesn't have access to it. I don't believe there is a "content-blocking api". Correct me if I'm wrong. Using a VPN could technically allow an ad blocker to block based on the full http path instead of blocking based on domain name. It should also be noted that you can use the VPNService in android to only set a DNS server to use, without actually sending any traffic through a VPN. Using the VPNService in this way is not going to be allowed with the new Developer Policy update. When used this way, the privacy issues aren't there--though there is the potential misunderstanding of end users who might think they are using a full VPN when in reality they aren't.

danpalmer 4y ago
> Blokada uses the Private DNS feature of the phone to block ads Oh, good, I had interpreted "Cloud filtering" as some sort of content blocking API. DNS makes sense. > It should also be noted that you can use the VPNService in android to only set a DNS server to use, without actually sending any traffic through a VPN. Using the VPNService in this way is not going to be allowed with the new Developer Policy update. When used this way, the privacy issues aren't there--though there is the potential misunderstanding of end users who might think they are using a full VPN when in reality they aren't. That's good if VPN apps aren't always actually implementing a VPN, and it likely eliminates the battery life issue, but the confusion is a problem as users can't tell the difference between an actual VPN and one that is only doing DNS stuff. In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me?
- camhart 4y ago
  > In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me? I could be mistaken here, but I believe it's only dangerous if you're using an insecure connection (ie, http (no https) which is already dangerous). Or if you install a custom CA certificate--then the VPN could perform man in the middle attacks on your connection.
  - jeroenhd 4y ago
    Android apps need to opt in before they load user-installed certificates. Browsers commonly do that, but almost all other apps don't bother. If you, as a smartphone owner, install your own certificate and set up a proxy to watch what your phone is doing, everything breaks and even Google will report that there is no internet connection at all (killing all kinds of apps using Google Play Services in the process). You need root access to remount the system partition or overlay an image on top of it containing your certificate. This assumes apps don't use cert pinning. Many chat apps, social media, some games, and all kinds of external libraries employ certificate pinning so that even when a malicious CA generates a certificate for their domain, their clients will not send secrets to that server. In this scenario that means that Facebook won't work even if you manage to get Symantec's private CA keys loaded onto your VPN because Facebook trusts specific Facebook certificates and nothing else. For unencrypted connections the MitM risk is there and SNI sniffing can be used to log tons of sensitive information in all other cases. However, I wouldn't portray it as risky as this solution may sound on the desktop where there is a proper firewall API. That's also the core issue, there is no firewall API on Android. The VPN system is the only API that can filter packets (though Google's and the manufacturer's apps can choose to bypass it) so most ad blocking VPNs are actually just user mode firewalls that need to appear as a VPN to work. Alternative solutions include changing your DNS server (to localhost or their cloud servers, depending on if DoH/DoT needs to be enforced) which works less reliably and has very similar risks. The risk is definitely there, but in practice the risk is lower.

danpalmer 4y ago

> Blokada uses the Private DNS feature of the phone to block ads Oh, good, I had interpreted "Cloud filtering" as some sort of content blocking API. DNS makes sense. > It should also be noted that you can use the VPNService in android to only set a DNS server to use, without actually sending any traffic through a VPN. Using the VPNService in this way is not going to be allowed with the new Developer Policy update. When used this way, the privacy issues aren't there--though there is the potential misunderstanding of end users who might think they are using a full VPN when in reality they aren't. That's good if VPN apps aren't always actually implementing a VPN, and it likely eliminates the battery life issue, but the confusion is a problem as users can't tell the difference between an actual VPN and one that is only doing DNS stuff. In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me?

camhart 4y ago
> In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me? I could be mistaken here, but I believe it's only dangerous if you're using an insecure connection (ie, http (no https) which is already dangerous). Or if you install a custom CA certificate--then the VPN could perform man in the middle attacks on your connection.
- jeroenhd 4y ago
  Android apps need to opt in before they load user-installed certificates. Browsers commonly do that, but almost all other apps don't bother. If you, as a smartphone owner, install your own certificate and set up a proxy to watch what your phone is doing, everything breaks and even Google will report that there is no internet connection at all (killing all kinds of apps using Google Play Services in the process). You need root access to remount the system partition or overlay an image on top of it containing your certificate. This assumes apps don't use cert pinning. Many chat apps, social media, some games, and all kinds of external libraries employ certificate pinning so that even when a malicious CA generates a certificate for their domain, their clients will not send secrets to that server. In this scenario that means that Facebook won't work even if you manage to get Symantec's private CA keys loaded onto your VPN because Facebook trusts specific Facebook certificates and nothing else. For unencrypted connections the MitM risk is there and SNI sniffing can be used to log tons of sensitive information in all other cases. However, I wouldn't portray it as risky as this solution may sound on the desktop where there is a proper firewall API. That's also the core issue, there is no firewall API on Android. The VPN system is the only API that can filter packets (though Google's and the manufacturer's apps can choose to bypass it) so most ad blocking VPNs are actually just user mode firewalls that need to appear as a VPN to work. Alternative solutions include changing your DNS server (to localhost or their cloud servers, depending on if DoH/DoT needs to be enforced) which works less reliably and has very similar risks. The risk is definitely there, but in practice the risk is lower.