DivestOS vs. /e/ OS - security and privacy easy

/e/OS Smartphone Operating System
,
33

:point_up_2: This would be a great addition to /e/OS for those of us that would appreciate not needing a connectivity check but would still like to have the option to turn it on. It would be nice to have it turned off by default. The more information leakage we can control the better. This also would be nice given the current fallback from /e/'s servers are Foogle’s which is verified on the "What is the current state of De- googlisation on /e/ ?" document. Note that it admits, “This is a temporary, not ideal, situation because this solution relies on the confidence users can have in our project and infrastructure.”

@Manoj do you know if such has been discussed or considered?

1 Like
34

A lot of options are discussed and where applicable implemented. You can also raise this issue in gitlab where the developers can comment on it.

1 Like
35

Why still the google fall-back? seems to be very easy to create a second connectivity check… /e/ Source here (Pie)

2 Likes
36

Looks like this could be done from an in home, self-hosted NextCloud, no? Add the PHP 204 file or Apache webserver config. (both ate present in self hosted NextCloud, correct? ie can create PHP files in server OS and/or Apache database)

Can the terminal commands to the phone be done via ADB without root?:point_down:

“Then, in a root terminal on the phone I entered the following two commands, from pat_512 in the Fairphone Forum (see links below).”

settings put global captive_portal_http_url "http://198.51.100.24/204"
settings put global captive_portal_https_url "https://example.com/204.php"

This might be easy for you but average user… A bit overwhelming :+1:

Thank you for sharing.

2 Likes
37

Oh i did not mean every user should do this, just wanted to share knowledge ;). By the way i tested this in my custom build and it works ok (the php way). So what i think /e/ should do is fix this, and remove the Google link in the source. I also got annoyed about the private dns calling home thing which i reported a year ago!, and this is also easy fixable…

evil code here

3 Likes
38

Do you know of a published list of hosts to manually block in NextDNS or do you just manually watch the logs?

I just went into the log and found ......dnsotls-ds.metric.gstatic.com getting through so I added metric.gstatic.com to the denylist. Now to see if all sub-domians are blocked as well. I do have a number of blocklists already enforcing…maybe I need to add more?

You sparked me to check this with this👇 so THANK YOU!

Edit. Just found this as well👇

1 Like
39

With NextDNS, connectivitycheck.android is blocked.
I have decided to trust NextDNS even if it is not open source. Before, I used Quad9. But in any way, one have to trust a DNS server, so why Quad9 should be more trustable that NextDNS ? So let’s go for NextDNS.
Any opinion ?

1 Like
40

Hello.

https://www.fdn.fr/actions/dns/

:wink:

4 Likes
41

I like the FDN.
But NextDNS allows to filter and monitor.

Something I have notice in NextDNS : we have to allow “mtalk.google” in order to have Signal notifications work properly.

2 Likes
42

I was thinking this :point_up_2: too but then I read this :point_down: which has started further thought. Any ideas?

43

Or dns fingerprinting :slight_smile: I’m looking at my dns logs a lot, patterns can be found…

1 Like
44

“Privacy Central”, which I believe will do much of this tracker filtering at the system level, can’t get here soon enough!

Please share what you find further :point_down:. Does this make you think of changing DNS? And thank you for your help.

Edit: Only FOSS apps and a few from Aurora can be found on my phone. The host file blocking here is a very nice feature :point_down:. More discussion on /e/'s app store that I am following even though I don’t use it.

The NextDNS privacy policy sound great! But unfortunately one must trust, so once again another subjective choice! Back to original thought :point_down:

Going back to a flip phone looks more and more appealing :smiley:.

45

I think all flip phones in the U.S. run Android now, don’t they? In any case, an old flip phone won’t work without VoLTE, sadly.

1 Like
46

Just no access to apps, correct? To your point I’m sure there is and will increasingly be tracking in “dumber” phones.

1 Like
47

I don’t know. :man_shrugging:

48

Phones generate a certain pattern depending on the apps / os installed. In my case i have some very specific calls to domains because i own them :). I think i have to let go my desire to be anonymous all the time… It is just not possible. Next DNS promises to not log your queries that helps…

1 Like
49

Do you know if this is needed for Silence as well?

50

Nope. I dont know.
For Signal, I noticed notifications where not available as soon as I switched to NextDNS. After checking the log, I saw mtalk.google was very regularly blocked. A quick search in DuckGo made me find that this tracker was needed. Then I whitelist it and Signal notifications came back imediatly.

The fact that Signal need a Google tracker to work puzzle me a bit…

1 Like
51

I am seeing this too. In my log it is blocked and notifications don’t come through till I open the Signal app :frowning: .

52

Whitelist it and Signal will be alive again… But what to think about that ?