Hacker News Reader

Comment by TechDebtDevin | Hacker News Reader

Use and Configure Pi-Hole[0]

[0]:https://jeffmorhous.com/block-ads-for-your-entire-network-wi...

Also a video for those more YT inclined: https://www.youtube.com/watch?v=eCA24qJBG8Q

This does nothing for a mobile device that either concurrently maintains its cellular 'data' connection together with its Wi-Fi connection (and whose apps are permitted to access both)—or leaves the LAN without connecting remotely via a force-tunneled VPN. And even with such a VPN, the cellular NIC continues to maintain baked-in alternate routes on both Android and iOS. All that's before we even get into specific Pi-Hole and LAN config, not to mention DoH.

Krebs and everyone else he cites is right—it's time for Apple and Google to eliminate MAID altogether.

ETA: Do not downvote this parent! Use trustworthy ad blockers anywhere and everywhere you can!

> the cellular NIC continues to maintain baked-in alternate routes on both Android and iOS

How do you know this is the case? (I believe it to be, would like to verify)

Also worth mentioning many apps hardcode DNS servers or fallback to other DNS providers when they fail to resolve hostnames. I see this all the time on my network. (I have a PfSense box that redirects to upstream NextDNS when this happens)

NextDNS is a great alternative for mobile devices

https://nextdns.io

If self-host is your thing, there are blocky [0] or Adguard Home [1].

I self-host DOH using blocky so my Android devices can use it via "Private DNS" that is active on both wifi and cellular.

[0] https://0xerr0r.github.io/blocky/latest/

[1] https://github.com/AdguardTeam/AdGuardHome

[2] https://adguard-dns.io/en/public-dns.html how to configure

DoH/DoT along with hardcoded IPs make DNS ad blocking impossible.

Not completely impossible. You could have a default deny firewall, have your DNS resolver trigger an update to allow outgoing connections to the resolved IPs, and possibly also require connections pass though an SNI-sniffing proxy that only allows domains that your DNS resolver has allowed. Essentially by default you'd be blocking all custom protocols, and you'd only allow what looks like well-behaved TLS web traffic to allowed domains to flow.

Bad traffic could flow to a "good" domain, and then you need to decide whether that domain is actually "good".

couldn't they just hide their ad endpoints behind the proxy that serves their site? I can think of multiple ways to do this that aren't very difficult. I have had to implement something in my work to get past certain adblocking behavior that was going by domain

Sure, but now you've at least made them use a more expensive L7 proxy to do it, and you can decide to block malicious actors like that entirely (blocking the "good" domain).

nginx can do this pretty easily by just using proxy_pass directives, if I recall, it has been a while though

Yes, you can do it with an L7 proxy. You've been able to do that all along though, so I suppose there are reasons why surveillance networks prefer to not proxy through the websites that host their scripts. That has nothing to do with DoH to subvert network security monitors though.

That works for your home network. What about if you're on cellular data?

I use wireguard to tunnel back home, but personally only extremely rarely use mobile data anyway. I normally have it disabled.

Not sure why you're downvoted.

You create a server and host it on IP x. You create a cert for it. You add the public key to your app.

Your app can now communicate with that IP over port 443 with that certificate. Remember that the idea that the domain must match the one in the certificate is a setting, enforced by the browsers. If you run your own code you can perfectly override that.

Now you can do whatever you like on that connection.

In fact, you don't HAVE to go that far. Many applications these days do private key pinning and use that connection to load the ads. IMDb does that on the iPhone.

MyQ and myBMW use the same to 'protect' the connection. MyQ's implementation of this, and subsequent implementation of CloudFlare's bot protection completely broke home-assistant's connection. All because they want you to use their app (and get bombarded with ads).

Doh/DoT was supposed to bring in MORE privacy for users, as it allowed users to resolve addresses without the system servicing the connection (ISP / StarBucks / McDonald's) from being able to see or modify the responses (think captive pages).

But all it brought was more spying. I am a firm believer that I should be able to inspect all traffic that an application sends out over my internet connection.

Do you know of any blogs/articles I can read more on this?

https://ericlathrop.com/2021/03/dns-over-tls-lets-google-ser...

It isn't just people using DNS filtering for ads that have this problem. Network admins at companies face the same problem (see for example https://cleanbrowsing.org/help/docs/block-dns-filtering-evas...)

Some browsers, apps, or devices might let you disable DoS/DoT or might let you configure it to use your own DNS server, but none of them have to let you and even when they give you that option they can still do whatever want (https://discourse.pi-hole.net/t/chromium-bypasses-pi-hole-by...)

Obviously any application or device using a hardcoded IP address will bypass DNS entirely so DNS filtering isn't going to work. See https://old.reddit.com/r/pihole/comments/djacup/im_starting_...

Just because it doesn’t work all the time doesn’t mean it never does. Defense in depth.

One aspect is to use trustworthy software, not written by an advertising company.

https://9to5mac.com/2022/08/18/ios-vpn-apps/

https://www.michaelhorowitz.com/VPNs.on.iOS.are.scam.php

And TLS. Sure it stops lots of other bad things, but it is quite the blocker to doing content filtering of the page contents.

Reply on news.ycombinator.com