2 ms·

> In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me? I could be mistaken here, but I believe it's

> In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me? I could be mistaken here, but I believe it's only dangerous if you're using an insecure connection (ie, http (no https) which is already dangerous). Or if you install a custom CA certificate--then the VPN could perform man in the middle attacks on your connection.

jeroenhd 4y ago
Android apps need to opt in before they load user-installed certificates. Browsers commonly do that, but almost all other apps don't bother. If you, as a smartphone owner, install your own certificate and set up a proxy to watch what your phone is doing, everything breaks and even Google will report that there is no internet connection at all (killing all kinds of apps using Google Play Services in the process). You need root access to remount the system partition or overlay an image on top of it containing your certificate. This assumes apps don't use cert pinning. Many chat apps, social media, some games, and all kinds of external libraries employ certificate pinning so that even when a malicious CA generates a certificate for their domain, their clients will not send secrets to that server. In this scenario that means that Facebook won't work even if you manage to get Symantec's private CA keys loaded onto your VPN because Facebook trusts specific Facebook certificates and nothing else. For unencrypted connections the MitM risk is there and SNI sniffing can be used to log tons of sensitive information in all other cases. However, I wouldn't portray it as risky as this solution may sound on the desktop where there is a proper firewall API. That's also the core issue, there is no firewall API on Android. The VPN system is the only API that can filter packets (though Google's and the manufacturer's apps can choose to bypass it) so most ad blocking VPNs are actually just user mode firewalls that need to appear as a VPN to work. Alternative solutions include changing your DNS server (to localhost or their cloud servers, depending on if DoH/DoT needs to be enforced) which works less reliably and has very similar risks. The risk is definitely there, but in practice the risk is lower.

jeroenhd 4y ago

Android apps need to opt in before they load user-installed certificates. Browsers commonly do that, but almost all other apps don't bother. If you, as a smartphone owner, install your own certificate and set up a proxy to watch what your phone is doing, everything breaks and even Google will report that there is no internet connection at all (killing all kinds of apps using Google Play Services in the process). You need root access to remount the system partition or overlay an image on top of it containing your certificate. This assumes apps don't use cert pinning. Many chat apps, social media, some games, and all kinds of external libraries employ certificate pinning so that even when a malicious CA generates a certificate for their domain, their clients will not send secrets to that server. In this scenario that means that Facebook won't work even if you manage to get Symantec's private CA keys loaded onto your VPN because Facebook trusts specific Facebook certificates and nothing else. For unencrypted connections the MitM risk is there and SNI sniffing can be used to log tons of sensitive information in all other cases. However, I wouldn't portray it as risky as this solution may sound on the desktop where there is a proper firewall API. That's also the core issue, there is no firewall API on Android. The VPN system is the only API that can filter packets (though Google's and the manufacturer's apps can choose to bypass it) so most ad blocking VPNs are actually just user mode firewalls that need to appear as a VPN to work. Alternative solutions include changing your DNS server (to localhost or their cloud servers, depending on if DoH/DoT needs to be enforced) which works less reliably and has very similar risks. The risk is definitely there, but in practice the risk is lower.