I know Samsung phones are horrible when it comes to privacy, but is using NextDNS, RethinkDNS, and disabling the boatware enough for an S26 Ultra? I really prefer Samsung’s hardware for photography and videography. I already have a Pixel that I’ll eventually flash ri GrapheneOS. The S26 Ultra is more for travel, photos, and videos.
Maybe @ignoramous will know?
Even on GrapheneOS, there’s a few connections that go outside the VPN tunnel. I imagine it’s more on a Samsung.
I don’t think those things will meaningfully improve security.
Why won’t it meaningfully improve security? I’ve Googled this topic myself and it seems like a lot of assumptions are made without any specifics provided. What if the Samsung device is behind a router with a VPN enabled? What is being sent back to the mothership? From which app?
From a privacy point of view, there’s little (in the grand scheme of things) a DNS based blocker like NextDNS can do. With a network tool like Rethink DNS + Firewall, there’s additional per-app control, but it is also limited in the sense that, your privacy is at the mercy of app developer the minute the user chooses to install their apps (by the way of permissions that the OS auto-granted to it) and the permissions the user grants.
As for not trusting the OEM (in this case, Samsung) itself, there’s no other avenue left but to not purchase from the OEM.
- OEM apps can also be setup to bypass any & all mechanisms you may put in place on a non-rooted Android, including using NextDNS with a DNS changer app or with Android’s built-in Private DNS (and that’s assuming the “DNS changer app” isn’t flawed on its own, which many are: For instance, DNSNet, AdAway, DNS66, Blokada, personalDNSfilter do not handle DNS over TCP, which trackerware SDKs like Gamooga and InMobi do use).
- OEM controls most of the higher privilege bits on its own devices (think
rootaccess but even more powerful, asrootis generally confined to the Kernel that “supervises” Android, whereas OEMs can control the underlying hardware and in Samsung’s case, the underlying “hypervisor” that in turn “supervises” the Kernel totally & absolutely).
That said, one can still take measures readily accessible to limit (even if not eliminate) their exposure: One can, for instance, “debloat” using various tools; MuntashirAkon’s App Manager can firewall “intents” (a common but the not only form of inter-app IPC on Android), and restrict components part of various installed apps. Use firewalls like InviZible Pro or PCAPDroid or Rethink DNS + Firewall (a FOSS app I co-maintain) to monitor network activity of installed apps, restrict IPs & domain, add per-app routing rules (to selectively use VPNs for some apps but not the others).
In Rethink, specifically, there’s per-app “Isolate” mode which lets (by default) block/deny all domains & IPs for a given app except for the ones you explicitly allowlist / trust. This is neat for apps like WhatsApp or Gmail, where one only wants those apps to talk to Meta/Google owned IPs (turn on Configure → Settings → Show provider information to let Rethink fetch “ownership” information about every IP Android is sending traffic to) and not any other (for example, when someone sends a e-commerce link to you in WhatsApp, WhatsApp will auto-fetch the page from your public IP to load a thumbnail preview of the link, thereby leaking the fact that “your IP”, which can be a very precise fingerprint vector, is interested in that linked-to product, and the next thing you know, you’re seeing ads about it, about its competitors, etc).
The GrapheneOS community is serious about fixing “leaks” when VPN is in “Block connections without VPN” mode (the default on GrapheneOS). Except for Connectivity checks and Captive portal checks, you should make them aware of “leaks”, if you know of any.
Of course, controlling your network to a large extent does improve your security posture (otherwise major business, banks, institutions wouldn’t have any use for any of the stuff that CrowdStrike / ZScaler / F5 Network / Cloudflare / Palo Alto Networks / Cisco / Tailscale / etc are selling… and they’re selling it to the tune of billions). What it cannot do is solve all your security problems. A truism goes, different tools for different jobs.
In one sense, I loathe this defeatism stance (nothing can ever be secure because X, Y, and Z) some are predisposed to… even if they’re not totally wrong. Both, security and privacy (of which there are many kinds) demands layered defenses.
I really appreciate the time you took to give me your informed opinion.
The goal is to eventually have three phones, segregating my activities. For a travel phone, I really do feel like Samsung has better features and hardware than a Google Pixel, but all is not lost because I’ll install GrapheneOS on it. I want to have an iPhone to play with iOS apps.
I intend to do all web browsing, phone calls, and Signal through GrapheneOS.
So give what you have said, do I have to worry about VPN leak if I use the Samsung through a router with a VPN?
How does Rethink differ in terms of capabilities and features compared to PCAPDroid and InviZible Pro?
Rethink sounds great, and I think by default I want everything blocked, and I’ll selectively unblock what is needed for my phone to be usable. Would you say this is a good idea or not?
What goes outside the tunnel on GOS? I know wifi calling does, but anything else?
Correct me if I’m wrong, but on a router with a VPN, WiFi calling doesn’t go outside the tunnel.
Thank you for your message.
IIRC from what I gleaned from PG forums and discussions and stuff, it’s preferable to stay away from debloating tools because they have elevated permissions and affect security, right?
Probably can, if using a esim/sim.
I haven’t done the analysis myself, but what I can tell you is, Rethink’s focus is on building a “network sandbox” and anti-censorship features. As such, we are serious about both security and transparency (ex: right to information). A very different ethos to both those projects.
That said, InviZible Pro & PCAPDroid are both maintained by individuals with significant technical chops.
Good idea, yes.
Do point me to the discussion. From what I know, debloating with adb (not root) or Shizuku (which uses adb) is okay, from a security PoV, especially when you want to use the OEM’s product but simultaneously don’t trust the OEM (ideally, as mentioned in my previous comment, you are better off not using OEMs you don’t trust).
Yes that’s what I was referring to. Maybe leak is not the right word but I consider it to be.
WiFi texting, the stuff ignoramus listed. They don’t consider it a finished feature I guess. Features overview | GrapheneOS