4 ms·
I guess the safest setup is to have mobile data off on your phone and carry an OpenWRT hotspot to do the VPN bit upstream from the phone.
by tiagod 2y ago
I guess the safest setup is to have mobile data off on your phone and carry an OpenWRT hotspot to do the VPN bit upstream from the phone.
- nickburns 2y agoit's true. even bigger nightmare on iOS where 'always-on VPN' can only be configured on devices 'supervised' by an Apple-approved (documented application and telephone call with current employee required) organization's MDM solution—or you otherwise need a Mac to use the Apple Configurator app to even create a Configuration Profile containing the 'always-on VPN' key.
- fullspectrumdev 2y agoMaking a simple OSS tool to generate valid configuration profile files seems like a potentially useful way to spend a weekend sometime. The format cannot be that complex, right?
- nickburns 2y agolol, hit me up with your rate. my only term is that i get to be watching over your shoulder the whole time.
- jasomill 2y agoLooks like it’s just XML .plist format, and (at least partially) publicly documented: https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf https://developer.apple.com/business/documentation/Configura...
- yonatan8070 2y agoUntil you get to the bit where I'm guessing you need Apples private keys to sign it or whatever
- walterbell 2y agoWeb page for offline generation of iOS VPN configuration profile: https://mobileconfig.app https://mobileconfig.app
- brobinson 2y agoI _think_ iMazing can do what you want: https://imazing.com/configurator https://imazing.com/configurator Disclaimer: I've never used this feature. I only use it for backups and copying files to my iPhone.
- nickburns 2y agonever even thought to check if iMazing had any of this functionality. disclaimer noted, great tip regardless. thank you.
- mise_en_place 2y agoYeah it's the best solution if you use any public wifi or even mobile telephony. Somebody can just run their own base station and then your phone would connect to that. If it's not your network don't directly connect without a mobile router.
- hackermatic 2y agoEdit: Other commenters report that Android will silently re-enable cell data under various conditions, so this isn't a surefire solution, either. The Grugq created a tool for this a decade ago (sadly unmaintained): https://github.com/grugq/portal https://github.com/grugq/portal as part of a presentation about operational security for hackers. It's a great watch if you're interested in how various (in)famous hackers thought they were secure and got busted anyway. https://www.youtube.com/watch?v=9XaYdCdwiWU https://www.youtube.com/watch?v=9XaYdCdwiWU
- mise_en_place 2y ago> Other commenters report that Android will silently re-enable cell data under various conditions This is terrifying.
- autoexec 2y agoIt's expected. The people who own the phones aren't in control of the OS and the wireless chipsets are closed/proprietary. Cellphones really shouldn't be trusted by anyone.
- mise_en_place 2y agoCorrect, the baseband usually has binary blobs. Although I am curious why Google/Apple decided not to make their own baseband, given their new silicon manufacturing expertise.
- Too 2y agoArmchair speculation: Patents?
- adamomada 2y agoIIRC Apple has tried/is trying, but it is ridiculously complex to the point that they had to go back to Qualcomm as there really is no other option. Read: The biggest tech co on the planet stumbles with this, it should be considered a magic box as this point.
- sneak 2y agoI've done this before for months at a time (the GL.inet E750 with an iPhone with no SIM) but oftentimes US GSM providers throttle the hell out of UDP traffic on weird ports (like to 64-128kbps, a tenth of a megabit), and also notifications are frequently delayed.