Blokada has paid features and subtle trackers

Blokada upsells a paid VPN service right on the homescreen. Tagging the app
as such, as it is an anti-feature as far as f-droid is concerned.

Blokada has stuble tracking in its code. For ex:

1. go.blokada.org is redirected through a known analytics company, rebrandly.

2. Blokada generates unique-id per installation regardless of whether a user
is a paying customer or not, and shares it with their servers.

3. Blokada sets SOA records to "invalid.blokada.org" whenever DNS resolutions
are blocked. This is unnecessary and leaks identity to other installed apps as
to what or who blocked the request.

4. Blokada seems to aggressively construct a user-agent with a lot of
revealing information about a user than necessary, and there's no way to
opt-out of that.

5. Also, there's no way to stop Blokada right now from contacting its servers
to fetch "repo.json" which contains update channels, build-types, etc;

6. Another annoying thing is Blokada downloading hostfiles from its mirrors
instead, and not letting users disable that option and/or add their own mirrors
I get why this is required for an app with an installation base as large as
Blokada's but, for f-droid builds at least, there should be a switch to let
me disable periodic blocklist updates from their mirrors. Note how these
periodic updates coupled with an aggressive user-agent string, generating
per-installation unique-id, and using rebrandly for url-based tracking
completely breaks all notions of privacy that users of such an app are
looking for.
This commit is contained in:
Murtaza Aliakbar 2021-03-08 18:13:20 +05:30 committed by Izzy
parent f344ad3222
commit 4f3b7b20e9

View file

@ -1,3 +1,6 @@
AntiFeatures:
- NonFreeNet
- Tracking
Categories:
- Internet
License: MPL-2.0