If an app has the ability to perform arbitrary DNS queries via the OS, it can exfiltrate data to any party.
It can query encrypted-data.domain.tld to send data to an authoritative DNS server. No direct connection is ever required. It's being used in practice. Keep that in mind.
It can query encrypted-data.domain.tld to send data to an authoritative DNS server. No direct connection is ever required. It's being used in practice. Keep that in mind.
In general, granting network access provides the ability to exfiltrate data anywhere via the network. Fine-grained filtering is useful for harm reduction but doesn't provide what users expect from it. That includes using it in a stricter way than enumerating + blocking badness.
GrapheneOS has a coarse Network toggle blocking all direct access to the network and also preventing indirect access via APIs requiring the INTERNET permission.
Fine-grained filtering only filters direct access and there are a lot of issues like that DNS one. Doesn't work well.
Fine-grained filtering only filters direct access and there are a lot of issues like that DNS one. Doesn't work well.
Fingerprinting is also an issue. Web sites can enumerate what gets blocked.
If you're going to do DNS-based blocking, stick to a widely used filter set.
If you use a VPN, use their take or you'll stand out from others.
Sites can check your DNS server and enumerate filtering.
If you're going to do DNS-based blocking, stick to a widely used filter set.
If you use a VPN, use their take or you'll stand out from others.
Sites can check your DNS server and enumerate filtering.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
