Hacker News Reader

Comment by Nursie | Hacker News Reader

Even more egregious IMHO, is that they set up shadow APNs on android devices, at the behest of the carriers, and route all tethered traffic via them.

This is so the carriers can measure and limit tethering separately.

The security issue here is that if you have a VPN client running on your phone, tethered traffic still goes in plaintext to the public internet via the hidden APN.

Not cool.

View on HN

Since you wrote this a bit misleadingly - this happens with Apple's carrier profiles as well.

I didn't mean to be misleading, and I've never used an iPhone so I have no idea what Apple does.

Interesting though, thanks.

Mostly correct. Most major phone OS has had this situation. iOS, Android, and BB10. It's a billing/terms of service issue.

That being said, the most straightforward non-root way around it is to install LineageOS on a supported device. There's an option in hotspot settings to share VPN connection. There may be other (non-Google) manufacturers that carry a similar feature.

If you want to talk real nasty shit: Lets say you do the above and unlock device bootloader to install LineageOS. However, you decide not to root because you'd like to maintain security on the device. Additionally, you're on the latest monthly patch level while your vendor's latest build is 8+ months back...

Guess what? Now you can't use Netflix or your banking app!

Why? Because Google play services uses your device's 'hardware-backed attestation' to know bootloader is unlocked and app developers can block install of their apps based on this certification status. See: https://www.lineageos.org/Google-Play-Certification/

What!? is that documented, shown somewhere? Any source you can provide that speaks about it?

Just trial and error on a couple of devices now, then found a few more people suffering from it on a reddit thread.

I discovered the issue by connecting my phone to my home VPN and then trying to access services that are only accessible from my home.

Your post is very confused. Android doesn't send tethered traffic through VpnService whether or not tethered traffic goes to the same APN. Tethering just sets up a dumb router.

That's actually worse, IMHO. The VPN should apply to all outbound traffic.

The current behavior matches iOS.

Do you have any source with more info? For "shadow APN android" Google first result was your comment with same assertion on HN from 5 months ago.

LOL, that's probably when I found it! There was a reddit thread of other people seeing similar issues, will see.if I can dig it out later/tomorrow.

That _is_ grotesque.

I wish I had something to add; particularly like "here's a reasonable alternative", but there really isn't.

> I wish I had something to add; particularly like "here's a reasonable alternative", but there really isn't.

Yes, there are: https://en.wikipedia.org/wiki/Pinephone and https://en.wikipedia.org/wiki/Librem_5.

Why are they so under specced ?

They're first-generation devices, so the focus is on getting the device experience right, not on having flagship specifications. If they get the experience right, they'll likely come out with higher-spec devices in the future.

Economies of scale.

If I want to buy 20 million of something the wholesale will give me a better price than if I want 2000.

The marginal cost goes down with the number produced as well.

What are you going to do with them?

3D-gaming? Yes: https://www.youtube.com/watch?v=S_HXQJkWjUQ.

Using an external screen? Yes: https://www.youtube.com/watch?v=bH3RbrwhNd8.

I could live with small ram or processor but not with 16 or even 32gb storage.

Both phones have slots for microSD cards up to 2 TB.

I’ve had phones with card expansion. Never worked seamlessly to the point where I gave up on them. Does anyone have experience with using cards on these phones? Can you for example store all images and media there as if it was the main storage without ever needing to think about it again?

I have a Pinephone. It boots from the microSD by default, if it's bootable. Works flawlessly.

That’s good to hear. Might give it a go next time I need a phone

Have you bought cheap and slow cards or expensive and fast ones? Faster cards are more expensive but for phones it's absolutely worth it.

A phone with a non-existent app ecosystem is not a reasonable alternative for most people.

GNU/Linux has thousands of apps. They do not all fit the screen, but it's much easier to fix than create new ones. Purism created libhandy library for that.

It should be noted that the libhandy features are now part of the stock gtk3+ framework, so every app following standard UI guidelines benefits from the new "responsive" look.

What are you talking about? GNU/Linux has a much more healthy app ecosystem than any mobile OS.

I own one of these (the pinephone) and it's really very much like a laptop running alpine. All of my desktop apps just work (although I have to use fluxbox because CWM isn't nice on a touchscreen.)

Neither of which are in stock now.

I have a Pinebook Pro and love it, but the Pinephone's camera is woefully underspec'd. Put a better camera on it and let me pre-order ffs and I'll buy one in a heart beat.

Preorders for Pinephone will open in about a week. You can preorder Librem 5 with a better camera now (but you won't get it very soon due to a large queue).

> Preorders for Pinephone will open in about a week

That's great! Now if only I could get some kind of email notification about that. Oh. I can't.

https://www.pine64.org/, see "Subscribe to the PINE64 Blog" below.

Yes, I have subscribed to both the blog and the Telegram; on the Discord I'm given the impression this may be unreliable.

I don't get why I can't pre-order now; if I'm willing to spend money on a promise, like with Kickstarter, then I should be able to do so here.

This is a big issue for privacy, yes, but also for businesses leveraging tethering capabilities with company issued phones.

If you have some sources on this, it I'd upvote it as a submission.

Anyone security conscious would run a VPN client on the client device, not the tether.

Good point.

It's not just the security issue - the ability to differentiate between tethered and non-tethered traffic means they're not treating them equally.

I'll see if I can find anything. So far I have my own tinkering and a reddit thread or two that I seem to have lost...

I've been using PdaNet+ to get around the hidden APN hotspot traffic routing. It makes AT&T think I am using 100GB on my phone when most is from my PC.

Is it possible to inspect those shadow APNs without rooting?

I’ll never buy another android phone for personal use. I’d made my mind up before today but this really drives home why.

It can be done properly though. Take GrapheneOS. Or lineage with MicroG if you want to have a bit more mainstream capability.

> Or lineage with MicroG

One major thing to note: Don't expect support from LineageOS devs for MicroG stuff. They explicitly do not support it and are slightly rustled at people using unofficial builds with MicroG and then complaining in their support channels.

Reply on news.ycombinator.com