Hacker News Reader

Comment by danpalmer | Hacker News Reader

There is no need to implement an ad-blocker as a VPN. It provides a strictly worse experience than implementing one via DNS APIs (as Blokada have done).

The only reason one may wish to implement as a VPN instead is to get a lot of data about users to sell. They otherwise provide less control, use more battery, are less reliable, and have privacy issues.

iOS even provides some good APIs for this that apps can hook into so that they don't need to deal with networking at all. Much faster, and the app receives no data about network usage.

Edit: Misunderstood Blokada's comment, they use DNS to do their filtering now.

View on HN

This is false. Blokada uses the Private DNS feature of the phone to block ads. That feature is only available as of Android 9. Any device running Android 8 or lower doesn't have access to it.

I don't believe there is a "content-blocking api". Correct me if I'm wrong.

Using a VPN could technically allow an ad blocker to block based on the full http path instead of blocking based on domain name.

It should also be noted that you can use the VPNService in android to only set a DNS server to use, without actually sending any traffic through a VPN. Using the VPNService in this way is not going to be allowed with the new Developer Policy update. When used this way, the privacy issues aren't there--though there is the potential misunderstanding of end users who might think they are using a full VPN when in reality they aren't.

> Blokada uses the Private DNS feature of the phone to block ads

Oh, good, I had interpreted "Cloud filtering" as some sort of content blocking API. DNS makes sense.

> It should also be noted that you can use the VPNService in android to only set a DNS server to use, without actually sending any traffic through a VPN. Using the VPNService in this way is not going to be allowed with the new Developer Policy update. When used this way, the privacy issues aren't there--though there is the potential misunderstanding of end users who might think they are using a full VPN when in reality they aren't.

That's good if VPN apps aren't always actually implementing a VPN, and it likely eliminates the battery life issue, but the confusion is a problem as users can't tell the difference between an actual VPN and one that is only doing DNS stuff.

In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me?

> In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me?

I could be mistaken here, but I believe it's only dangerous if you're using an insecure connection (ie, http (no https) which is already dangerous). Or if you install a custom CA certificate--then the VPN could perform man in the middle attacks on your connection.

Android apps need to opt in before they load user-installed certificates. Browsers commonly do that, but almost all other apps don't bother. If you, as a smartphone owner, install your own certificate and set up a proxy to watch what your phone is doing, everything breaks and even Google will report that there is no internet connection at all (killing all kinds of apps using Google Play Services in the process). You need root access to remount the system partition or overlay an image on top of it containing your certificate.

This assumes apps don't use cert pinning. Many chat apps, social media, some games, and all kinds of external libraries employ certificate pinning so that even when a malicious CA generates a certificate for their domain, their clients will not send secrets to that server. In this scenario that means that Facebook won't work even if you manage to get Symantec's private CA keys loaded onto your VPN because Facebook trusts specific Facebook certificates and nothing else.

For unencrypted connections the MitM risk is there and SNI sniffing can be used to log tons of sensitive information in all other cases. However, I wouldn't portray it as risky as this solution may sound on the desktop where there is a proper firewall API.

That's also the core issue, there is no firewall API on Android. The VPN system is the only API that can filter packets (though Google's and the manufacturer's apps can choose to bypass it) so most ad blocking VPNs are actually just user mode firewalls that need to appear as a VPN to work. Alternative solutions include changing your DNS server (to localhost or their cloud servers, depending on if DoH/DoT needs to be enforced) which works less reliably and has very similar risks.

The risk is definitely there, but in practice the risk is lower.

Android has no system-wide content blocking APIs. Furthermore, Google's policy specifically states that VPNs may not "Manipulate ads that can impact apps monetization", proving that this is not about VPNs, but about ad blocking in general.

My solution is a WireGuard VPN to my home network (which is behind PiHole) but a local solution cannot properly block network requests without the VPN API.

Blokada has switched to doing DNS-based blocking through DNS but that's purely to get around Google's arbitrary restrictions on the VPN API.

Users should be able to use whatever network filters they like. If I don't want to send ICMP packets, or DNS packets for certain servers, or any other kind of specific traffic, I should have control over what my device is doing.

Note that the VPN API does not necessitate actually setting up a VPN to a cloud server. The VPN API exposes packets to an Android app so it can decide whether or not to forward the packet, rewrite it, send it through a tunnel, etc. Normally, there is no cloud service when VPN ad blockers are in use. Blokada has switched to a cloud system but only after Google blocked their normal system.

Until Google releases a comprehensive network filter driver API or firewall API there is simply no alternative. The Blokada local DNS server solves one problem (the need for a VPN) but cannot prevent ad libraries from using DoH to work around content blockers.

Do you have a link to the content blocking APIs to integrate with arbitrary apps? For example, random game apps which show in app ads. VPN adblockers can block the ads there. How do I use a content blocking api to do this?

Which content-blocking APIs are you talking about? Blockada just started hosting a DNS server. Google just made it so that blocking decisions can't be made locally anymore and all my used domain names are sent to a third-party server. Given deployment of SSL and even cert pinning in almost all apps I know of, I doubt the local VPN API allowed them to gather much more info than hostnames either.

EDIT: I see you're affiliated with Google Play. You should've lead with that.

Does content-blocking API works for apps? Or only for browser?

Blockada 5's VPN runs entirely on the phone. No problems with battery usage.

Using their DNS with Blockada 6? No thank you.

I'm saving the APK and I will sideload it for as long as it will work. The problem is the maintenance of the blacklist. Anyway, a lot of people are interested in blocking ads, a solution will be found.

Is already there an open source app equivalent to Blockada?

VPN blocks it on all apps, but generally speaking I agree it's better to do this in this order, where possible:

In-app (browser, css aware)

In-dns (local resolver)

In-network (pihole or IP firewall)

Ex-Network (vpn/proxy)

Since the first option has very sparse universal support (and shrinking) - you need to rely on the less savoury options to achieve proper adblocking.

I use firefox with ublock. But that works only for browsing.

You should disclose your affiliations in this case.

yeah nextdns has been working just fine for me.

I'm glad to hear, although even DNS level is somewhat unnecessary.

How else would you block ads?

Apologies, I misread the Blokada comment as implying there was another mechanism – I don't know what they mean by "cloud filtering".

iOS provides APIs to do content filtering at the system level, I assumed they were referring to something similar.

seems like it's harder for sites to detect. For a while I was seeing a lot of "disable your ad blocker" messages, now I just don't, and the ads don't load.

Blokada does use the VPN functionality…

Reply on news.ycombinator.com