4 ms·

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions So a VPN isn't a VPN on Android? Regardless of

by nottorp 6mo ago

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?

Paradigm2020 6mo ago
Ios does the same, only way around it is if you have an ?enterprise? licence (250+ devices) Mullvad and others reported on that one ages ago
- kqp 6mo ago
  Is this really true? The Mullvad report a year or so ago was that they didn’t want to turn on no exceptions mode because it breaks network connectivity until reboot if you don’t pause it when updating the app, not that the feature doesn’t exist. They also recently shipped it anyway, opt in and behind a warning.
  - Paradigm2020 6mo ago
    As a quick chatgpt check and following the links to apple's own site that still seems to be the case... Force “most” traffic through VPN using includeAllNetworks Yes, but imperfect (normal) Yes (supervision) stronger controls are tied to device management / supervision, usually for organization-owned devices. https://developer.apple.com/documentation/NetworkExtension/NEVPNProtocol/includeAllNetworks https://developer.apple.com/documentation/NetworkExtension/N...
- pyaamb 6mo ago
  a VPN enabled wifi router would suffice as a fallback tho right?
  - ranguna 6mo ago
    For the very specific case where you are connected to that router, yes.
  - Paradigm2020 6mo ago
    You could get one of those hotspots https://www.gl-inet.com/products/gl-mifi/ https://www.gl-inet.com/products/gl-mifi/ Haven't bought one (yet - but did quite a bit of research but again outdated by 2 years...)
unethical_ban 6mo ago
MacOS has had instances where their own apps could bypass always-on VPN. I'm not sure if there have been exploits or gaps where traffic could go to arbitrary destinations directly.
- spr-alex 6mo ago
  this is not an ocassional bug this is still the system design today. privacy gateways upstream of big tech are the way to go on this because privacy isn't their profit center
mmooss 6mo ago
How hard would it be to fix the system_server (and any other) bypass?
ncr100 6mo ago
Terminology like "private" and "trust" differ in meaning from computer land to human convention. It's a concern to me, because humans often extend their trust to computer trust based upon misunderstanding of the identically spelled words and lack of recognition of differing context.

by nottorp 6mo ago

Paradigm2020 6mo ago

Ios does the same, only way around it is if you have an ?enterprise? licence (250+ devices) Mullvad and others reported on that one ages ago

kqp 6mo ago
Is this really true? The Mullvad report a year or so ago was that they didn’t want to turn on no exceptions mode because it breaks network connectivity until reboot if you don’t pause it when updating the app, not that the feature doesn’t exist. They also recently shipped it anyway, opt in and behind a warning.
- Paradigm2020 6mo ago
  As a quick chatgpt check and following the links to apple's own site that still seems to be the case... Force “most” traffic through VPN using includeAllNetworks Yes, but imperfect (normal) Yes (supervision) stronger controls are tied to device management / supervision, usually for organization-owned devices. https://developer.apple.com/documentation/NetworkExtension/NEVPNProtocol/includeAllNetworks https://developer.apple.com/documentation/NetworkExtension/N...
pyaamb 6mo ago
a VPN enabled wifi router would suffice as a fallback tho right?
- ranguna 6mo ago
  For the very specific case where you are connected to that router, yes.
- Paradigm2020 6mo ago
  You could get one of those hotspots https://www.gl-inet.com/products/gl-mifi/ https://www.gl-inet.com/products/gl-mifi/ Haven't bought one (yet - but did quite a bit of research but again outdated by 2 years...)

unethical_ban 6mo ago

MacOS has had instances where their own apps could bypass always-on VPN. I'm not sure if there have been exploits or gaps where traffic could go to arbitrary destinations directly.

spr-alex 6mo ago
this is not an ocassional bug this is still the system design today. privacy gateways upstream of big tech are the way to go on this because privacy isn't their profit center

mmooss 6mo ago

How hard would it be to fix the system_server (and any other) bypass?

ncr100 6mo ago

Terminology like "private" and "trust" differ in meaning from computer land to human convention. It's a concern to me, because humans often extend their trust to computer trust based upon misunderstanding of the identically spelled words and lack of recognition of differing context.