• GeneralSolved

  • Notifications (FCM) bypass misconfigured VPN on rooted phones with bad config

horde If the reports are from Google's stock OS it might be because the Play apps are privileged on the stock OS, in which case presumably the experiment would yield different results on GrapheneOS.

    This happens when I use the kernel module backend for wireguard.
    […]
    This doesn’t happen when I use the userspace backend of wireguard.

    And how exactly are we supposed to reproduce this, then?

    other8026 changed the title to Notifications (FCM) bypass misconfigured VPN? .

    First, it would be nice if someone can see if they can reproduce this on GrapheneOS. I will later if I have time.

    It's important to note that the "proof" for VPN "leaks" is setting up a dummy VPN on Wireguard. This could be a problem with their app, not with Android (and therefore not GrapheneOS).

    It's also important to remember that computers are stupid and programmers sometimes fail to plan ahead for odd things to happen. In this case, misconfiguration can very well lead to unexpected behavior. So far, there is no evidence that Google apps can bypass the VPN on the stock OS or GrapheneOS when a VPN is properly configured.

    Edit: I just tried on my phone with multiple dummy configs. I even copied a config from screenshots I found in the forum linked in the OP. I am NOT able to reproduce this. Notifications only come through when I connect to a correctly configured WireGuard server via the WireGuard app.

      other8026 changed the title to Notifications (FCM) bypass misconfigured VPN? (not reproducible on GrapheneOS) .

      other8026 did you try with the kernel module backend on wireguard ? You can enable it in the settings but it requires root AFAIK

          Fibonacci I'm not familiar with this, though if it requires root (or changing things in developer tools) then it's not supported.

          I did see the official project account mention some sort of WireGuard support in the kernel. Here's what they said:

          There is kernel WireGuard support in Android which doesn't do any good yet because it hasn't been integrated into the network management infrastructure. Having support for it in the kernel doesn't accomplish anything without having the infrastructure developed to make use of it.

          Also, my phone isn't rooted so I couldn't test it even if I wanted to.

              other8026 changed the title to Notifications (FCM) bypass misconfigured VPN on rooted phones with bad config .
              5 days later