<story><title>DNS traffic can leak outside the VPN tunnel on Android</title><url>https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the-vpn-tunnel-on-android</url></story><parent_chain><item><author>cma</author><text>They don&amp;#x27;t even allow disabling internet permissions on a flashlight app, the OS is run by an internet ad company so it makes sense.</text></item><item><author>ignoramous</author><text>&lt;i&gt;rethinkdns dev here&lt;/i&gt;&lt;p&gt;&amp;gt; &lt;i&gt;these issues should be addressed in the OS in order to protect all Android users regardless of which apps they use.&lt;/i&gt;&lt;p&gt;Android&amp;#x27;s &lt;i&gt;paranoid networking&lt;/i&gt; has always had an exception for &lt;i&gt;System&lt;/i&gt; and &lt;i&gt;OEM&lt;/i&gt; apps (which include Google apps). Most such bugs fixes are unlikely to fix that core assumption. Some code refs: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;celzero&amp;#x2F;rethink-app&amp;#x2F;issues&amp;#x2F;224&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;celzero&amp;#x2F;rethink-app&amp;#x2F;issues&amp;#x2F;224&lt;/a&gt;&lt;p&gt;&amp;gt; &lt;i&gt;The leak during tunnel reconnects is harder for us to mitigate in our app. We are still looking for solutions.&lt;/i&gt;&lt;p&gt;Android supports &lt;i&gt;seamless handover&lt;/i&gt; between two TUN devices (on reconfiguration). It is tricky to get it right, but implementable.</text></item></parent_chain><comment><author>adamomada</author><text>To be fair, it’s the application developer who requests the application’s permissions and it is possible to release an app without internet permission.&lt;p&gt;I agree that the OS should have a way to override the permission, but it’s not Android itself just giving out internet access by default. It’s more that it’s almost every developer’s default setting when building the app.&lt;p&gt;The best example of no internet permission in an app off the top of my head is Hacker’s Keyboard – and you can understand why the developer chose to avoid it.</text></comment>
<story><title>DNS traffic can leak outside the VPN tunnel on Android</title><url>https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the-vpn-tunnel-on-android</url></story><parent_chain><item><author>cma</author><text>They don&amp;#x27;t even allow disabling internet permissions on a flashlight app, the OS is run by an internet ad company so it makes sense.</text></item><item><author>ignoramous</author><text>&lt;i&gt;rethinkdns dev here&lt;/i&gt;&lt;p&gt;&amp;gt; &lt;i&gt;these issues should be addressed in the OS in order to protect all Android users regardless of which apps they use.&lt;/i&gt;&lt;p&gt;Android&amp;#x27;s &lt;i&gt;paranoid networking&lt;/i&gt; has always had an exception for &lt;i&gt;System&lt;/i&gt; and &lt;i&gt;OEM&lt;/i&gt; apps (which include Google apps). Most such bugs fixes are unlikely to fix that core assumption. Some code refs: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;celzero&amp;#x2F;rethink-app&amp;#x2F;issues&amp;#x2F;224&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;celzero&amp;#x2F;rethink-app&amp;#x2F;issues&amp;#x2F;224&lt;/a&gt;&lt;p&gt;&amp;gt; &lt;i&gt;The leak during tunnel reconnects is harder for us to mitigate in our app. We are still looking for solutions.&lt;/i&gt;&lt;p&gt;Android supports &lt;i&gt;seamless handover&lt;/i&gt; between two TUN devices (on reconfiguration). It is tricky to get it right, but implementable.</text></item></parent_chain><comment><author>infthi</author><text>This depends on the firmware used. I am writing this comment from an Oneplus device which allows blocking internet access on a per-app basis - on a stock firmware.</text></comment>