Mention Android firewall caveats for OS comparison

[Ganwtrs]

@ignoramous

https://discuss.privacyguides.net/t/protection-against-surveillance/32692/13

There’s no “firewall” on Android that’s enabled by default. All incoming connections are blocked but that doesn’t mean installed apps can’t punch hole through it (they can; as that’s how P2P stuff even works on Android).

[thestinger]

Android does always have a firewall. That doesn't mean blocking apps from making connections. The comparison already has this:

Network controls for apps

Whether it's done in a good way is a different story but it's there.

[eylenburg]

@Ganwtrs I think you're referring to this row?

There's a tooltip text already stating that "there is no user-facing configuration interface included in Android and changing the firewall rules of the built-in firewall requires root access". Is that what you mean? Or in which way is the built-in Android firewall significantly different from the one on other systems?

(Workarounds exist for outgoing data such as blocking apps with a pseudo-VPN app like RethinkDNS.)

[ignoramous]

Or in which way is the built-in Android firewall significantly different from the one on other systems?

The thing is, folks unintentionally end up spreading disinformation (which has since been deleted by a "team member" at Privacy Guides; so I don't remember exactly that "team member" said, but it was... patently... false. I've flagged such misunderstanding on PG's "knowledge base", but 🤷 ex: privacyguides/privacyguides.org#3183 (comment) / ex: privacyguides/privacyguides.org#3179 / ex: privacyguides/privacyguides.org#3176). There's a pattern where folks link to web pages and draw completely incorrect conclusions. PG is just one example (but one you've contributed to):

... whats written on [Privacy Guides] is generally perceived as the truth, as it had to have been researched before it was added, the discussion from when it was added is in this case the source that is provided by default. If one wants to claim the site is wrong (and if that is the case, please do) then the burden of proving that it is wrong/should be changed is on the one making the claim.

Source

(Workarounds exist for outgoing data such as blocking apps with a pseudo-VPN app like RethinkDNS.)

"pseudo-VPN" sounds like an insult (: Rethink, since ~30 months ago, can split-tunnel to multiple WireGuard upstreams, btw; and since about ~3 months ago, multi-hop one WireGuard over another, too.

[thestinger]

The Android firewall rules are changed by various forms of user setup such as the GrapheneOS Network toggle which changes the eBPF configuration or just installing/uninstalling apps with the INTERNET permission without it. There are various settings which do control it. VPN service apps rely on the firewall for leak blocking and the GrapheneOS improvements to that are firewall changes.

[Ganwtrs]

@ignoramous

I don't remember exactly that "team member" said, but it was... patently... false.

Please let me know if I got something wrong, but if you look at the previews for the replies, the conversation before editing seemed to be something like this:

[@friadev to OP:] Also you are going to want to enable the firewall on all your devices, on iOS and Android it’s on by default. In Windows set it to public network and on macOS make sure it’s on in the network settings.

[ignoramous:] What is ON on Android by default? A firewall?

[fria:] Yes

[ignoramous:] No. There’s no “firewall” on Android that’s enabled by default. All incoming connections are blocked but that doesn’t mean installed apps can’t punch hole through it (they can; as that’s how P2P stuff even works on Android).

Even though the conversation was edited before I filed this issue, I tried to piece the conversation together and was inspired to file the issue after doing so.

Regardless, it seems I interpreted something you said wrong, leading to misconceptions on my end. I apologize if that has troubled you

Off-topic

Details

"pseudo-VPN" sounds like an insult (:

The Rethink FAQ does say it's not a VPN yet, so you might want to update that