DNS Leak on iOS

[Tor_M]

Hello,

I am getting DNS Leaks using Blokada, using the Blokada Profile for iOS on iOS 15.0. I tried to disable IPV6 in the Router and no changes.

[PrintableCharacter]

Hi,
Blokada Cloud is using Google DNS.
We filter your traffic on our servers and relay the dns queries to Google DNS.
Don’t worry:
They won’t know who’s looking for what since all they see is Blokada Cloud looking up IPs and web adresses on their DNS database
Here’s more:

DNS Leak on iOS

DigitalCourage doesn’t has a single server outside of Germany. They’re a german NGO Blokada Cloud was created to offer stable adblocking on ios again. This was made necessary by apple changing their ads framework. Blokada cloud for android is being pushed to the Google play store since that’s where our app got kicked out regularly. This does not affect v5 and its development. I’m really sorry to disappoint you here but the bloka AB is based in Sweden. Hence Swedish jurisdiction applies not …

[Tor_M]

That’s scary, even if you filter it. I also saw a connection to ‘ghs.googlehosted.com’ in the logs.

[Tor_M]

Is there not a more elegant solution that one can see and verify it goes through Blokada - or that you get your own DNS Resolver?

But even then, surely even Quad9 would be more decentralised.

[PrintableCharacter]

@Tor_M

Is there not a more elegant solution that one can see and verify it goes through Blokada

If there’s activity in the activity screen inside the app or on app.blokada.org that shows its working

[C0nfuzed_AF]

It’s critical that user-side choice of DNS provider is not limited beyond the v4/v5 (Android) in-app DNS list. I’ve never used Google DNS for very good reason.

Moving beyond the privacy concerns of Google DNS, is the censorship. This is why the option to change DNS servers on the fly has been a feature of Blokada. When Cloudflare arbitrarily blocks access to Archive.is/Archive.today/Archive.ph, I switch to DigitalCourage. DigitalCourage doesn’t have enough servers in North America, and thus is too slow to be my primary DNS provider. Plus I like the option to switch to Cloudlfare’s malware protection servers, using AdGuard DNS to lighten the app adblocking load (until it’s server addresses got mixed-up in Blokada), and was on Quad9 for a few months until it became ridiculously overhanded on website filtering/censorship.

If Cloud is going to be the ultimate stand alone on both iOS and NOW Android (le sigh), then it must offer the same granular controls — especially with DNS. A cloud-based solution is not the best solution in the use-case of what’s supposed to be a system-wide firewall, DNS “changer,” and ad-blocker. That is what Blokada is.
Not to mention, the moment your servers go down, or inevitable DDoS attacks, there’s no ad blocking or DNS for the user.

Lastly, I have concerns regarding Blokada’s pricey VPN service that offers to tunnel traffic thru “Blokada’s” own encrypted DNS servers. Are these also Google’s? See Mullvad VPN for industry standard ethical privacy standards & provider that fully encrypts traffic thru their own DNS. I’ve long waited to see Blokada VPN’s privacy policy, no logs policy, whether you’ll implement a canary in case of search warrants, etc so I could finally use a VPN with Blokada, but no dice. Please post.

[Tor_M]

for iOS one can just create/install a Profile, avoiding another App that chews battery.

What I do agree with and a major concern, is the Google DNS servers. These should be changeable in the WebUI for Blokada Cloud, to remain flexible for all clients/profiles/settings.

Cloudflare is a pariah, blocking all Tor addresses and making the Internet unusable.

[PrintableCharacter]

@C0nfuzed_AF

DigitalCourage doesn’t have enough servers in North America

DigitalCourage doesn’t has a single server outside of Germany. They’re a german NGO

@C0nfuzed_AF

A cloud-based solution is not the best solution in the use-case of what’s supposed to be a system-wide firewall, DNS “changer,” and ad-blocker.

Blokada Cloud was created to offer stable adblocking on ios again. This was made necessary by apple changing their ads framework. Blokada cloud for android is being pushed to the Google play store since that’s where our app got kicked out regularly. This does not affect v5 and its development.

@C0nfuzed_AF

whether you’ll implement a canary in case of search warrants

I’m really sorry to disappoint you here but the bloka AB is based in Sweden.
Hence Swedish jurisdiction applies not US jurisdiction or something similar.
There is no law which forces it to listen to it’s users hence such a warrant canary wouldn’t really serve any purpose - at least that’s my takeaway here
It might look good,
But it’d be pretty useless
As long as there’s no law forcing us to log anything, we can’t share anything
Sure… A warrant canary might look good and maybe make you “feel” better.
But it wouldn’t serve any purpose at all here. It’d just be a piece of text on a website with no meaning because nothing is connected to it
Welcome to Swedish legislation.

@C0nfuzed_AF

I’ve long waited to see Blokada VPN’s privacy policy, no logs policy

Here’s the privacy policy of blokada+

Privacy Policy

The underlying policy of Blokada VPN is that we want you to remain anonymous. We strongly believe in having minimal data retention because we want you to remain anonymous. However, in some situations we might process your personal data if you, for example, when you are making payments by Stripe or are sending an e-mail or reporting a problem. In those cases, we might process your personal data and the General Data Protection Regulation (“GDPR”) and other data protection laws may apply to the pro…

And here are the ToS:

Terms of Service

Blokada Plus / Blokada Tunnel (VPN) is a service offered by Blocka AB (559198-8265) registered in Sweden. By using this service, you are agreeing to these terms. The service The service protects personal information with the use of encryption and masks user metadata by hiding the user’s IP address and replacing it with one of ours. This replacement address is shared with many other users, which not only protects each individual’s user data but also breaks the traceable chain between the user an…

@C0nfuzed_AF

Lastly, I have concerns regarding Blokada’s pricey VPN service that offers to tunnel traffic thru “Blokada’s” own encrypted DNS servers.

You seem to confuse something here.
Blokada+ ≠ Blokada Cloud.
Blokada cloud is part of Blokada+ but contrary to blokada cloud blokada+ also offers wireguard based VPN.
Here’s a quote on that.

@balboah

Blokada is funded purely by people like you, independent from any external investors. We’ve turned down many offers to sell data about our users. Blokada is also an ad-blocker, thus making advertisements to grow faster aren’t really an option for us.

Because of the rather limited options for growth and funding, we needs to optimize the expenses for providing a stable VPN service in as many locations as possible while still being in control.
By renting our first generation of servers, we can cut the up front expenses of buying and shipping hardware ourselves. In the long run however, owning our own hardware is something we aim for.

Rest assured that the server software and OS installed are managed by the Blokada team without any dependencies on 3rd parties.

Blokada cloud should not be confused with a VPN:

@balboah

I’m not sure if it was clarified yet but I’ll add that when using Blokada Plus there will be no interaction with Google DNS and you will be using the Blokada resolver dedicated to Plus users. This is the service that we expect privacy focused individuals such as yourself to use.

When using Blokada Cloud, queries that are not already cached will be resolved using Google DNS as described by @PrintableCharacter. Blokada Cloud focuses on ad-blocking with reliable performance, while still adding to privacy as you’re proxied through Blokada. But it doesn’t provide the privacy level of Blokada Plus, Blokada Cloud on its own is not a VPN service and shouldn’t be compared with VPN service providers.

[balboah]

Hello

@Tor_M

a major concern, is the Google DNS servers

I’m not sure if it was clarified yet but I’ll add that when using Blokada Plus there will be no interaction with Google DNS and you will be using the Blokada resolver dedicated to Plus users. This is the service that we expect privacy focused individuals such as yourself to use.

When using Blokada Cloud, queries that are not already cached will be resolved using Google DNS as described by @PrintableCharacter. Blokada Cloud focuses on ad-blocking with reliable performance, while still adding to privacy as you’re proxied through Blokada. But it doesn’t provide the privacy level of Blokada Plus, Blokada Cloud on its own is not a VPN service and shouldn’t be compared with VPN service providers.

@C0nfuzed_AF

If Cloud is going to be the ultimate stand alone on both iOS and NOW Android (le sigh)

Blokada Cloud for Android is optional and will be a separate app download. Read more here:

Blokada Cloud "For Android" ( What should I expect? )

Hello all, As you all know, Blokada Cloud for Android is coming out soon so we wanted to give some details about what the update is going to have. This is what you should know: First, you have certainly noticed that Google takes out Blokada from its play store frequently so we have solved Google’s worries with cloud-based filtering in Blokada Cloud. The current Blokada app (Blokada 5) will still exist and be developed, and it will stay free. A new Blokada app will be released alongside…