DNS Blocklist for Sandboxed Play Services?

AloofChocolate

gristle-cause "Fuck you Google. Don't be evil" There motto years ago Don't be evil, how times have changed.

gta3

Might be easier to start using nonproprietary apps like mollyFOSS, fdroid, etc

If alternativrs don't exist, maybe crowd fund development.

Seems more straightforward and less cumbersome than checking new domains and IPS etc

AloofChocolate

gta3 1/4 of all apps are opensoruces, Google is becoming worse than Apple, and GOS will have to leave pixel in time due to Google policies and hardware changes.

Why GrapheneOS is Almost Impossible to Crack (Forensic Teams Have Tried)

https://www.youtube.com/watch?v=eUEtc6gblK0

gristle-cause

gta3 ideally, yes. But many are unable or unwilling to do so.

For example, I'm active in a large professional network that only exists on a Play-only communication app. This network has & does provide tremendous value to my career. I can't switch to a FOSS alternative without entirely cutting this network off

The broad, diverse needs of the potential GOS user base is precisely why sandboxed play services are provided in the GOS store. This thought experiment is focused towards those GOS users who, for whatever reason, can't go pure FOSS

gristle-cause

gristle-cause update2: If Play Protect scanning is on, PStore will also need to reach 'android.apis.google.com'

hemingway

gristle-cause I have successfully limited outbound connections from GOS sandboxed Google to the bare minimum for my needs

Glad you got results!. Ima steal your setup and try to improve upon it when I have time.

gristle-cause

hemingway hell yeah, keep me posted. Especially if you identify servers associated with particular services - a part of me debates building lists tied to each service, i.e. "core functionality", "maps", "notifications" etc

Sindbad

gristle-cause
Thanks for that list! I also started whitelisting single Google domains based on your findings.
Could you make an example "GMessages domains" for RCS and general messaging? I'm not finding them in my DNS logs.

Also do you think following domains are required for Play Store?

playstoregatewayadapter-pa.googleapis.com
prod-lt-playstoregatewayadapter-pa.googleapis.com

gristle-cause

Sindbad playstoregatewayadapter-pa.googleapis.com
prod-lt-playstoregatewayadapter-pa.googleapis.com

I explicitly blocked both these domains w/o issue. Not sure what they do, calls aren't correlated with any specific action or data. I've got a consistent 3 & 7 logs/day for each, respectively.

The main RCS domains seem to follow this format:

rcs-copper-{region}.googleapis.com
rcs-copper-optimized-{region}.googleapis.com

where {region} is a country code - I've found both 'eu' & 'us'.

There are additional RCS domain(s) that each contain 'RCS', but follow an unpredictable random character format, I believe these are a CDN. You will have to identify these in your logs

The standard messaging domain appears to follow the same regional format:

instantmessaging-pa-jms-{region}.googleapis.com

where {region} is either us or EU. I have not identified any additional CDN domains

I make no promises or guarentees, and bear no responsibility for issues. The right way to do it is to monitor your local firewall & watch which domains are contacted as you send & receive SMS, MMS, & RCS messages

Do please report back with your findings :)

« Previous Page