69
My Android phone has apparently leaked the list of all the apps plus browsing history I've ever installed via DNS? (lemmy.dbzer0.com)
submitted 8 months ago by to c/privacy@lemmy.dbzer0.com
12 comments fedilink hide all child comments
 

I was checking my Pi-Hole and noticed a lone spike of 700+ requests coming from my phone (Android 16) this morning. Upon checking the logs, it's all bogus domains corresponding to package names of apps I have previously installed via the Play Store, but never on this phone.

Going further back in the query log, I realized it also includes the package name of an app I developed years ago but never published on the store, nor on this phone. There's also a whole bunch of my browsing history apparently, domains I haven't visited in years - from the age of some of them I'm pretty sure it's Chrome history, as I only used Firefox sync for a brief period and my local history is <1y.

What the actual fuck? This is a Nothing Phone 3a, updated to Android 16 just a couple of days ago.

you are viewing a single comment's thread
view the rest of the comments
[–] 17 points 8 months ago* (last edited 8 months ago)

The contents of proton pass are end to end encrypted

That's precisely why they can't do the scan from their servers. They don't know the domains - they're decrypted only on your device.

this has caused my whole vault to be leaked to public DNS servers via unencrypted UDP

I feel like this is a tad dramatic. Surely, your vault contains more data, probably more sensitive, than just domain names.

  • permalink
  • fedilink
  • source
  • parent