Hacker News Reader

Comment by dsissitka | Hacker News Reader

From the developer of FairEmail.

Every once in a while I consider making the switch to KeePassXC. I trust KeePassXC but I don't really trust the mobile apps so last time around I looked into NetGuard. It's really nice but it wasn't a good fit for my use case:

> NetGuard will do its best, but it is limited by the fact it must use the Android VPN service. This is the trade-off required to make a firewall which does not require root access. The firewall can only start when Android "allows" it to start, so it will not offer protection during early boot-up (although you can disable your network before rebooting). Also, the Android VPN service needs to be restarted to apply new rules when connectivity has changed or when the screen is being turned on or off. It will, however, be much better than nothing.

I believe that also means you can't use it with Tailscale or similar.

View on HN

> I trust KeePassXC but I don't really trust the mobile apps

I'm using Keepass2Android Offline. It doesn't have the network permission, which for me adds a ton of trust already.

Of course there are other ways to infiltrate data too, but you can be only so paranoid if you want to get things done.

https://play.google.com/store/apps/details?id=keepass2androi...

> I believe that also means you can't use it with Tailscale or similar.

You sort of can. It can route over a socks5 proxy to the work profile where you can have a second VPN running. Wouldn't be an easy solution, but it can work

Would be curious to hear if anyone actually did (or attempted) this and have results to share.

I know I have experienced VPN leaks on Android (not the one they publically fixed as it was after). A second layer wouldn't fix that properly but it should make it less likely.

Here you go, a fairly detailed blog post about it: https://itsignacioportal.github.io/netguard-pdnsf-any-vpn-co...

Got this from a thread about Tracker Control, a NetGuard fork, and VPN chaining https://github.com/TrackerControl/tracker-control-android/is...

Amazing, thank you!

> I trust KeePassXC but I don't really trust the mobile apps

Even KeePassDX? That's what I use, and it's been rock solid for me.

> better than nothing

Is "nothing" the only Android per-app outbound firewall alternative to NetGuard?

No, if you have a rooted phone you can use AFWall+. And there are other non-root firewalls.

My favorite is another FOSS, but this one is special because it doesn't need network permissions. No root, ofc, so that sticks.

Karma Firewall https://f-droid.org/packages/net.stargw.fok/

I've been using Blockada for many years but that's a firewall against ads and trackers. No ads inside apps.

Ideally I would use NetGuard to block the apps and Blockada to block ads and trackers for the apps that I allowed to perform network traffic in NetGuard. But Android allows only one active VPN and they can't be chained, so it's a hard choice. Actually it's not so hard: I keep blocking ads and trackers.

Blockada is most likely a DNS level blocker, netguard supports that. Alternatively you can configure it to point the DNS servers at NextDNS if you just want a nice UI to configure block lists (though NextDNS might track you).

NextDNS as a manual DNS server on Android is the adblocking solution I've been using for years. Is there any reason to believe they would track you, any more than any other DNS provider?

Unlike most other dns providers, they often have an account or even payment to identify you, not just your outbound IP....

Do they keep logs though?

That's the whole point, you don't know if they keep logs.

NetGuard does ad-blocking with a DNS blacklist, but it's a Pro feature (which I use and works great).

On NetGuard's F-Droid page it lists "Optionally block ads using a hosts file" under its "features" section and not under its "PRO Features" section

Seems like I can get ad blocking for free.

https://f-droid.org/en/packages/eu.faircode.netguard/

https://github.com/M66B/NetGuard/blob/master/ADBLOCKING.md

Oh you're probably right, it's been a while since I was on the free version :)

At the OS level LineageOS offers per-app network permissions, which I've used and functions as expected.

One quirk from what I understand of this ticket[1] is if there's a proxy set up via a separate internet allowed app it can bypass the restriction via that app. GrapheneOS' implementation is said to prevent this.

[1] https://gitlab.com/LineageOS/issues/android/-/issues/3228

There's RethinkDNS [1](not affiliated to them, just like their software). Sometimes it gets killed on my phone, but otherwise it's a great replacement, adds some much-needed features like proxies and wireguard VPNs on top of a DNS and app level control.

[1] - https://f-droid.org/packages/com.celzero.bravedns/

I have used GlassWire (not affiliated) for a few years without issues.

It's also rootless so I assume it has the same restrictions, but it's been very helpful with apps like Uber, which I use seldomly, but prefer not to have their notifications shoved in my face every 30 minutes.

It's also helpful for disabling access to most of the bloatware that comes with e.g. Samsung phones and such.

Probably not blocking everything, but I feel like it's at least something.

Reply on news.ycombinator.com