I just downloaded the APK from this domain and installed and activated it on my Android 11 OnePlus phone.
I then visited a mildly-dodgy site in a private tab in the DuckDuckGo browser app. I then closed DDG.
The dodgy site’s domain is now shown in Blokada’s logs, which are visible to anyone with access to the device; defeating the purpose of using a private browsing tab.
Suppose, for example, the user has an abusive spouse who checks their phone, so they rely on private browsing.
Solutions to this issue could be:
- make logging optional
- make it possible to exclude certain apps from logging
- make the log editable
- make the log deletable (entirely or in part)
- make it possible to suspend logging for set periods