When I don't have a laptop with me, I sometimes do server admin stuff using my smartphone. It's a reasonably secure phone because it runs a hardened Android distribution called #GrapheneOS. Or so I thought. Shoddy apps can of course violate your security and privacy on any operating system.
As a matter of fact, I once set up a Mastodon server via SSH using my smartphone as a terminal. My terminal app of choice is nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqqkp4cp8q00wrejgfyn7dmrjv36rdntrm4h8namll3d5jwn2ypufs6hv53m (nprofile…v53m) – it almost feels like Debian Gnu/Linux.
Today I found out that the #Termux developers do not care about their users' privacy: They put Google's DNS resolvers as defaults into their app and do tell their users about it. Which means that until today, Google learnt about each hostname I resolved in Termux, although I had configured my smartphone to use a different DNS resolver. The Termux developers were alerted to this bug ten years ago by nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqql7vwd57qv9f3828lp2r0hewykxy2zk2mnjyf4lujpr30vrxqtnsjdyvk2 (nprofile…yvk2) but chose not to do anything about it.
Someone wrote a shell script to correct this. But it requires special permissions you can only grant via ADB. So I just used a text editor to replace Google's DNS resolvers with privacy-respecting ones gleaned from nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq276r74yjdughqx9rgtwtcsdw8quetk6tam89jn07qg2zsk0un64qgq37xe (nprofile…37xe)'s recommendations in my first link: editor /data/data/com.termux/files/usr/etc/resolv.conf
#TIL #dnsleak #terminal #android #app #privacy
Christian Peach
npub1dl…xz9ej
2026-09-24 17:32:40 UTC
Author Public Key
npub1dl4s5rfplevd7gyt7x9m8jmr8ahwfym4ha2gn82mtuxu97xd0yjqpxz9ejSeen on
wss://relay.ditto.pubPublished at
2026-09-24 17:32:40 UTCEvent JSON
{
"id": "f0a830199792bd94443c013c3df1cdc94691a5ffb929e65f8e082e0e50ba652e",
"pubkey": "6feb0a0d21fe58df208bf18bb3cb633f6ee49375bf54899d5b5f0dc2f8cd7924",
"created_at": 1790271160,
"kind": 1,
"tags": [
[
"p",
"05835c04e07bdc3cc90924fcdd8e4c8e86d9ac7badcf3eefff8b69274d440f13",
"wss://relay.ditto.pub"
],
[
"p",
"07fcc7369e030a989d47f85437df2e258c450acadce444d7fc904717b06602e7",
"wss://relay.ditto.pub"
],
[
"p",
"57b43f54926f117018a342dcbc41ae383995db4beece594dfe02142859fc9eaa",
"wss://relay.ditto.pub"
],
[
"p",
"8b3395d1aa08796a5708ac477c8b17dac944dc9543a81eebd5523d940b2d1706",
"wss://relay.ditto.pub"
],
[
"p",
"69fa755707625971ad9638f508ee91537c0ed2ccc89ffdb65c34f0e1ea0fe52d",
"wss://relay.ditto.pub"
],
[
"p",
"6192cf57a4514a58d898f35ceb22d1e0aaabcd9aafa19e39188ad05dcf4d650c",
"wss://relay.ditto.pub"
],
[
"t",
"grapheneos"
],
[
"t",
"termux"
],
[
"t",
"til"
],
[
"t",
"dnsleak"
],
[
"t",
"terminal"
],
[
"t",
"android"
],
[
"t",
"app"
],
[
"t",
"privacy"
],
[
"proxy",
"https://fedifreu.de/users/chpietsch/statuses/117327210802816742",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "When I don't have a laptop with me, I sometimes do server admin stuff using my smartphone. It's a reasonably secure phone because it runs a hardened Android distribution called #GrapheneOS. Or so I thought. Shoddy apps can of course violate your security and privacy on any operating system.\n\nAs a matter of fact, I once set up a Mastodon server via SSH using my smartphone as a terminal. My terminal app of choice is nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqqkp4cp8q00wrejgfyn7dmrjv36rdntrm4h8namll3d5jwn2ypufs6hv53m – it almost feels like Debian Gnu/Linux.\n\nToday I found out that the #Termux developers do not care about their users' privacy: They put Google's DNS resolvers as defaults into their app and do tell their users about it. Which means that until today, Google learnt about each hostname I resolved in Termux, although I had configured my smartphone to use a different DNS resolver. The Termux developers were alerted to this bug ten years ago by nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqql7vwd57qv9f3828lp2r0hewykxy2zk2mnjyf4lujpr30vrxqtnsjdyvk2 but chose not to do anything about it.\n\nSomeone wrote a shell script to correct this. But it requires special permissions you can only grant via ADB. So I just used a text editor to replace Google's DNS resolvers with privacy-respecting ones gleaned from nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq276r74yjdughqx9rgtwtcsdw8quetk6tam89jn07qg2zsk0un64qgq37xe's recommendations in my first link: editor /data/data/com.termux/files/usr/etc/resolv.conf\n\n#TIL #dnsleak #terminal #android #app #privacy",
"sig": "89d96ccacac45cf715042fe50e498ce054af12c8968d9b6e2f9ac33928fb0795256f261895d8e7e1b018660a67ca8900003391f8c70408049492e775feaf9591"
}