Direct access to "getaddrinfo" disablement

[ghost]

Mullvad VPN uncovered Android VPN DNS leak bug that occurs with help of "getaddrinfo" C function and the same article states that Chrome gets direct access to that function. Perhaps Cromite can do something about it until Google fixes this bug:
https://www.bleepingcomputer.com/news/security/android-bug-leaks-dns-queries-even-when-vpn-kill-switch-is-enabled/

[uazo]

thanks for the report but it is an android problem not a browser issue.

from https://mullvad.net/en/blog/2022/10/10/android-leaks-connectivity-check-traffic:

Privacy concerns
The connection check traffic can be observed and analyzed by the party controlling the connectivity check server and any entity observing the network traffic. Even if the content of the message does not reveal anything more than "some Android device connected", the metadata (which includes the source IP) can be used to derive further information, especially if combined with data such as WiFi access point locations. However, as such an de-anonymization attempt would require a quite sophisticated actor, most of our users are probably unlikely consider it a significant risk.

As a comparison, the privacy and security focused Android based distribution GrapheneOS provides users with the option to disable connectivity checks. If that option is enabled, the above leaks could not be observed by us.

on the other hand, I thought the dns patch was blocking access to that api, instead I saw that it uses it. I have to check why.

[ghost]

That was in 2022 and didn't think it was related to the recent (2024) DNS leak bug. Hopefully May 2024 Android Security update addresses this issue.