dns and ip based connection blocking

ignoramous

GrapheneOS very weak form of enumerating badness

Agree.

This is why we implemented the "Isolate" feature, which blocks all but allowlisted domains and IPs per app. For instance, on my Android, I use "Isolate" to restrict Telegram to some 3 static IPs, and to restrict Gmail to a bunch of Google domains, and WhatsApp to a few Meta + Google (backup) domains.

GrapheneOS Apps can also trivially bypass the filtering by doing their own DNS resolution via DNS-over-HTTPS, hard-wiring IPs or a mix of both

If a user turns ON Configure -> Firewall -> Universal firewall rules -> Block when DNS is bypassed setting, Rethink will block connections to IPs it hasn't resolved.

GrapheneOS The approach is incapable of stopping the most privacy invasive behavior of apps which is primarily done through their own services, not client side connections you can filter

From what we have seen, most apps, once they manage a sizeable userbase, are sold to shady companies (ex: SimpleMobileTools / Glasswire) that low effort embed 3p adware / trackerware / spyware SDKs wholesale. Since many folks have Play Store auto updates turned on, they get "infiltrated" real quick with no defense or recourse.

This is not to say network monitoring & filtering is an effective solution here, but it is also one way of keeping such low effort trackerware apps under leash.

GrapheneOS

ignoramous

This is why we implemented the "Isolate" feature, which blocks all but allowlisted domains and IPs per app. For instance, on my Android, I use "Isolate" to restrict Telegram to some 3 static IPs, and to restrict Gmail to a bunch of Google domains, and WhatsApp to a few Meta + Google (backup) domains.

This still permits everything on the server side if a single domain or IP belonging to the app developers is allowed. Most data sharing with third parties is done server side, not client side, and the server side data sharing is usually the much more invasive sharing of sensitive data rather than simply analytics, telemetry, etc.

From what we have seen, most apps, once they manage a sizeable userbase, are sold to shady companies (ex: SimpleMobileTools / Glasswire) that low effort embed 3p adware / trackerware / spyware SDKs wholesale. Since many folks have Play Store auto updates turned on, they get "infiltrated" real quick with no defense or recourse.

Most apps are tied to services and those would be acquired as part of this including all the data that's already there and the ability to send more based on what the app can access if it hasn't already.

It's not the case that most apps have that happen, but many do, and those companies very actively contact app developers with offers.

strife-john-frozen

GrapheneOS compromises VPN privacy through the set of blocked domains and/or IPs being detectable to determine which filter lists are enabled.

in theory, yes. But one couldn't gain additional information other than that the person uses GrapheneOS if default blocklists would exist. Installed applications can find out that the phone runs GrapheneOS anyway.
For websites, this would be additional information, but there could be an option to disable this feature for web browsers.

The approach is incapable of stopping the most privacy invasive behavior of apps which is primarily done through their own services, not client side connections you can filter. You will not stop apps sharing data with third parties through blocking a list of third party domains. Apps can also trivially bypass the filtering by doing their own DNS resolution via DNS-over-HTTPS, hard-wiring IPs or a mix of both. However, that's really not required because they can simply use dual use domains including their own which aren't going to be filtered since it would break the app functioning. They can share data with arbitrary third parties server side which is how it's primarily done in the first place. The stuff that's done client side is generally unimportant telemetry, ads, analytics, etc. while their more privacy invasive behavior happens server side so you can't filter it.

It is true that apps could bypass this by using the same domain as they use for actual data that is necessary to use the app. But most apps have different domains for functionality and analytics anyway, sometimes because it's by a third party sdk.
This feature wouldn't make every app 100% privacy friendly, but it is a compromise that reduces privacy invasive behavior as much as possible.

Also while one can add VPNs manually in RethinkDNS, not all VPNs can be added since some require using their own app. Not everyone uses VPNs to stay anonymous, sometimes it is used to circumvent censorship, to access resources that are not available in the current network or to access remote devices via their private ip.

I do agree that limited resources would be a good reason not to implement this, though.

ignoramous

strife-john-frozen while one can add VPNs manually in RethinkDNS, not all VPNs can be added since some require using their own app

Those public VPNs are not worth the money, if you ask me.

If it is any consolation, we will bring in ability to sign you up and connect to Windscribe (for a discounted fee) from within Rethink. We are also in talks with another popular public VPN provider. We may also run our own relay (hop) in front of Windscribe (today, we do run our relay for free for select individuals in high-risk situations), but this isn't decided yet (it increases costs by 3x), even though it has already been implemented.

GrapheneOS

strife-john-frozen

in theory, yes. But one couldn't gain additional information other than that the person uses GrapheneOS if default blocklists would exist. Installed applications can find out that the phone runs GrapheneOS anyway.

That would still be enabling a lot of fingerprinting vs. other users.

For websites, this would be additional information, but there could be an option to disable this feature for web browsers.

How would that work?

It is true that apps could bypass this by using the same domain as they use for actual data that is necessary to use the app. But most apps have different domains for functionality and analytics anyway, sometimes because it's by a third party sdk.

No, that's wrong. Most apps do not split it. Most apps do everything with the same domains, not separate ones. The most privacy invasive behaviors usually involve the app's own services including sharing sensitive data with third parties. App developers are also very aware of filtering and actively avoid it, including by not doing things on the client side.

This feature wouldn't make every app 100% privacy friendly, but it is a compromise that reduces privacy invasive behavior as much as possible.

It has very little impact on the most privacy invasive behaviors. It's often marketed as providing much more than it does and that's why people believe the impact is a lot bigger than it is. Apps are very actively avoiding it but they never had to avoid it for most of the highly privacy invasive behaviors which always involved their own servers.

Also while one can add VPNs manually in RethinkDNS, not all VPNs can be added since some require using their own app. Not everyone uses VPNs to stay anonymous, sometimes it is used to circumvent censorship, to access resources that are not available in the current network or to access remote devices via their private ip.

Those VPN apps can support local filtering or filtering as part of their service. Many support filtering as part of their service, which is superior for privacy due to not differentiating you from the other users of their service in a much more unique way.

strife-john-frozen

Maybe my post wasn't clear enough. I am talking about different kind of VPNs, for example the ones used in universities or VPNs that use special technologies to circumvent VPN blocking, like Proton VPN stealth.

23Sha-ger

strife-john-frozen
You already got a reply from the developers.
Blocking anything by default is not a proper way to achieve any goal. You are free to setup custom DNS block lists you wish. This will work for some ads and tracking. But it will not in any way improve security, which is the main goal of GOS.

ignoramous

strife-john-frozen different kind of VPNs, for example the ones used in universities

Gotcha. Not ideal but, if those private VPN providers or the access endpoints themselves support HTTP Connect / SOCKS5 tunnels, then Rethink can forward packets over it.

strife-john-frozen VPNs that use special technologies to circumvent VPN blocking, like Proton VPN stealth.

Most of this "technology" is either rudimentary or borrowed heavily from projects like XRay, V2Ray, SagerNet, Trojan, Shadowsocks etc; Psiphon[.]ca and Lantern[.]io are possibly the two of the most effective anti-censorship public VPNs out there.

That said, I get your point.

ignoramous

Agree that network filtering per se isn't that important a feature to be baked in to GrapheneOS. There's a case to be made for network monitoring (observe what's going on & report to the developer if one spots any anomalies), however; but I digress.

GrapheneOS Most data sharing with third parties is done server side

I'd not say most, but yeah, data brokers do pay a good dime if you can ship clickstream / data out to them, either directly or via your own servers. Cost-wise and tech-wise, not all app developers are equipped to setup a server-side data firehose and so they may opt to bundle in the SDK as-is.

GrapheneOS This still permits everything on the server side if a single domain or IP belonging to the app developers is allowed

True.

I can show you screenshots from my Android, and the number of different services / ASNs some apps hit. It is nice to be able to restrict apps to known ASNs (Meta ASNs for WhatsApp, for example). In the odd chance an app tries to contact a domain / IP it normally wouldn't (WhatsApp loading webpage previews, for instance), it'd be auto-blocked: Just because someone shares a link to a product on Amazon over WhatsApp and WhatsApp decides to auto-preview that link (and now Amazon knows what's up from my IP), I'd rather not get bombarded with ads for similar products on websites that bake in Amazon's ad network.

But you're right, this is akin to blocking telemetry / analytics / etc, while the app may itself forward the more sensitive stuff to its own servers. In that case, I guess, Privacy Policy / EULAs are the only indicators left to gauge the extent of it.

GrapheneOS those companies very actively contact app developers with offers.

Having been subject to some very lucrative offers, I attest to what you're saying.

I wonder if some of these apps minimize data collection if they're on metered networks (ex: Mobile). If so, Android lets a VPN app setup the tunnel so it appears as metered to installed apps.

strife-john-frozen

GrapheneOS No, that's wrong. Most apps do not split it. Most apps do everything with the same domains, not separate ones. The most privacy invasive behaviors usually involve the app's own services including sharing sensitive data with third parties. App developers are also very aware of filtering and actively avoid it, including by not doing things on the client side.

Well I don't know anything about the backend for most apps, but here is an example for an app that cannot do a lot of server side tracking for endpoints that are simply for functionality, but does most of its tracking on different domains:
https://www.kuketz-blog.de/db-navigator-datenschutz-faellt-heute-aus-app-check-teil1/#top
This is an app that many people in germany depend on, and limiting the tracking the app can do would theoretically be possible.

GrouchyGrape

strife-john-frozen I haven't looked into the linked app, but let's say you're right and this app does zero privacy invasive data transfers over the same IPs/domains that it uses for it's regular services. We block everything except for the known "good" servers, give ourselves a hug for being so smart and go about our day. What's to stop the service from changing tactics next week and using your whitelisted servers for everything?

While I appreciate the efforts made by filtering, they ultimately only provide a false sense of privacy. Don't get me wrong, I use filtering (primarily to block ads), but by no means do I fool myself into thinking it increases my privacy any meaningful way.

Unfortunately, the only way to truly protect yourself from gross privacy invasive practices is to avoid the service outright.

strife-john-frozen

GrouchyGrape there's nothing stopping the app from changing tactics. But for most companies developing these apps the goal is not to invade people's privacy as much as possible but simply to get a lot of data for analytics purposes, they don't care enough about users blocking these servers to circumvent it.
If an app is malicious and developers insist on reaching these servers/collecting the data, of course this won't solve the problem.

GrouchyGrape

strife-john-frozen the goal is not to invade people's privacy

I like the optimism. Unfortunately, money is a very powerful motivator.