Network detection working the wrong way around.

[navid-zamani]

[Since there seems to be no bug tracking section for this project and no category for it either, I’m putting this into general discussion.]

I noticed, that, strangely, the app contains a network detection for no reason. But instead of protecting you from connecting over the open Internet, it seems to disable the app unless it is on the open Internet, where IMHO it should never be, since CalDAV is not necessarily encrypted, and even if it is, the app does not offer verification of the server being who it says it is. So any server with TLS that is certified by any of the sleazy CAs whose root certificates are installed on standard Android could decrypt all private data it receives.

There’s a switch to allow only WIFI and only certain SSIDs, but that does not work, since if the WIFI has no Internet connection, Android just enables mobole data (4G here) and the app connects over there. Which I can prove by pressing sync and watching it it trying to connect happily, until I switch off mobile data which makes it thow an error saying that it failed. Even thoug wifi (with an exclamation mark for 'not on the Internet') is still on and works fine. kdeconnect has no problem like that and connects to my home server via wifi an any case, even if there is no Internet connection.

Plus SSIDs are easily faked. A public wifi at a shop I frequent has not one, but two IT students living in the apartments above faking the SSID to MITM all conncetions. Which thanks to them acting like repeaters is easier than ever. So SSIDs should never ever be trusted.

Can you make it work right, and only allow connections to hosts the user approved? Like make the wifi detection work in the above case too, and only trust a server that can prove it is who it says it is without relying on TLS certificates the user didn’t personally allow?

I feel very uneasy, knowing that the app just tries to sync my data to random servers on the net if I’m not switching off mobile data or prevent the phone from switching to other wifi nets, while actively blocking me from connecting to my home server just because it isn’t on the Internet.

Thank you in advance! The app’s a great adapter to link my PIM database to legacy iCal/VCard/web-first software until my own PIM solution is working!

[rfc2822]

I noticed, that, strangely, the app contains a network detection for no reason.

To be exact, Android contains a network detection, and the reason is that it expects synchronization to be done over network. DAVx⁵ uses the synchronization framework of Android.

But instead of protecting you from connecting over the open Internet

This is how most of all people use the app – over the Internet.

So any server with TLS that is certified by any of the sleazy CAs whose root certificates are installed on standard Android could decrypt all private data it receives.

If you don't trust the PKI, you can select Distrust system certificates in DAVx⁵.

Plus SSIDs are easily faked.

Yes, the "restrict to Wifi SSIDs" is not a security option, but only for convenience. See the manual: "It is not intended as a security function, but to avoid network connection error notifications."

Can you make it work right, and only allow connections to hosts the user approved?

I don't like that you define what is "right", but I absolutely see the need of a small fraction of users for synchronization without the Android sync framework. Agreed :)

I feel very uneasy, knowing that the app just tries to sync my data to random servers

This is just wrong. The app won't synchronize anywhere else except to the servers you have configured. Their certificates are verified by PKI (or, if you choose so, only by manual verification).

But the good news: We have already planned to use not only the sync framework, but also the AndroidX WorkManager API to run synchronization. Then it will be possible to run synchronization without Internet. However I think this will only work for manual synchronization, because without network check, the app can't know when there is a network and thus when it shall synchronize.

[navid-zamani]

Great. I had a large response, but it got lost due to Android’s UI being such a trainwreck. (The visuals for copying a selected text and canceling the action are exactly the same).

So… nevermind. sigh

Or, to keep it short:

1. The same IP or domain can be a different server on a different net. So it is false that it only connects to where it is told to connect.
2. As the former owner of the domain web.de and stepson of a former spy, it’s funny that people think CAs aren’t abused. Look into the list.of installed root certs. Erdogan can issue any cert via Turktrust. Let alone Russia and China or the NSA etc for their respective citizens.
3. I decided to install a permanent system VPN and a firewall to force anything through my home server’s more andvanced firewall and routing. I really need to get a Fairphone for my own patches though.

[rfc2822]

The same IP or domain can be a different server on a different net. So it is false that it only connects to where it is told to connect.

If you use HTTPS (which is required for any security), there will be a certificate warning when connecting to a different server. If you don't accept this certificate manually, no data will be sent.

As the former owner of the domain web.de and stepson of a former spy, it’s funny that people think CAs aren’t abused. Look into the list.of installed root certs. Erdogan can issue any cert via Turktrust. Let alone Russia and China or the NSA etc for their respective citizens.

Again: If you don't trust the PKI, select "Distrust system certificate". In this case, you have to manually accept every certificate; connections to other certificates will be rejected.

I decided to install a permanent system VPN and a firewall to force anything through my home server’s more andvanced firewall and routing. I really need to get a Fairphone for my own patches though.

As far as I know, the Internet check of Android is just a GET /204 without any cookies (run by process 1000 or something like that). Is that really a problem?

But as said before: we're planning to use the WorkManager, which (as a side effect) should allow to synchronize regardless of Android's Internet detection, too.