Comment by forapurpose | Hacker News Reader

Comment by forapurpose | Hacker News Reader

Parent Full thread

Last time I looked at it, maybe a couple of years ago, the parent's approach was not nearly sufficient if you don't want your phone communicating with Google. There was so much, including things baked into Android, that it would have been a full time job to identify and find solutions to everything. The only hope was another OS (including Android forks/ROMs), and none of those available at the time seemed sufficient secure - many didn't focus on security, didn't know what they were doing, or lacked resources to complete the job - or capabilities.

As one simple issue, I'm pretty sure Android uses Google's DNS and that is hard to change.

Sorry to be vague; I wish I had more details but don't have time to look them up right now. The basic message is: It's not sufficient, depending on your goals. to rely on settings in the GUI and to avoid Google applications.

I agree with the general feeling, but for the DNS issue specifically you can use iptables' DNAT if you're root. It is unlikely that Google went as far as bypassing iptables just to use their DNS.

Example usage:

    iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to-destination 1.2.3.4
    iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination 1.2.3.4

> As one simple issue, I'm pretty sure Android uses Google's DNS and that is hard to change.

I'm pretty sure it runs the DNS you specify though your ISP might mangle the packets to their own DNS (Vodafone NL used to do this and also tunnel HTTP traffic into their transparent proxy; not sure if they still do).

However this is a non-issue if you're OK running a VPN server. I use WireGuard to use my home network's Pi-Hole which applies filtering. I also get insight on data traffic from the device via DPI feature on my router. Though the WireGuard Android package isn't complete yet the good part of the story is WireGuard doesn't take many resources. When I did this with OpenVPN in the past my phone would get so hot it hurted to touch it at some spots (granted though it was in summer but still not good for battery).

>I'm pretty sure Android uses Google's DNS and that is hard to change.

DNS66 from the fdroid store. Doesn't require root either.

Reply on news.ycombinator.com