yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] MrT69:
Thanks a lot for this comment!!!!

The idea behind all of it is that Router and Firmware manufactor creating 2 VLANS within there boxes. One VLAN is for Dad and Mum and the other is for the kids. Each VLAN can use it's own DNS.

keweon Kidsafe is technically a nice solution but this can't be free of charge for public use. This would be a damn expensive technology.

I guess 12 EUR per year is a fair price. This would be 1 EUR per month. Public Hotspots as like as McDonalds or Burger King, Kindergarten, Schools and University should get this for free. If the EU or some local goverments spend some money into this project than I can do it for the half of the price. I don't want to become a millionaire with this. I just want to have a paid infrastructure, a Team and the option to offer a 24/7 Service for this.

That's my dream. I want to offer the option of a clean internet for all.
[Android Software/Hacking General [Developers Only]] Timmmmaaahh!:
That's a very reasonable price! I'd even pay that for the public keweon you're already running for us all. I think I'll even point my DD-WRT infused router to your DNS to test it across my entire home network (it's just running on my phone right now).

I don't necessarily agree with the public hotspots. I mean, if people connect to these things without a proper VPN, they know they're asking for trouble.

I sincerely hope you get to realise your dream. I've made a case for the XDA Portal, I hope it helps :fingers-crossed:
[Android Software/Hacking General [Developers Only]] MrT69:
Everything what makes keweon globaly know will help. Million thanks!!!!!!!!
[Android Software/Hacking General [Developers Only]] MrT69:
keweon Server Update

After a view tests with my test companies it seems I have increased the performance of the DNS response time. Now it's time to update the public servers.

The DNS answers can be up to 25% faster than before. It's up to you to test and feedback would be great. Tomorrow at 4 AM GMT+1 the DNS update is in place and active.

I really have no idea how this change have impact to the current VPS environment. We will see it tomorrow morning.

Hope you enjoy this!
[Android Software/Hacking General [Developers Only]] MrT69:
keweon Update

The US Company "Cloudflare, Inc." is currently taking a deeper look at the keweon project. I also have had a short conversation with Matthew Prince (CEO) - many thanks to him - and he told me that Adblocking & things like that is not the goal of Cloudflare but he will delegate the keweon Project to his team.

He kept his promise and after a view mails I know that Cloudflair will currently take a look at it. Only take a look! No one within the world will get direct access to my servers.

From my point of view this is a real honor for me and keweon. I have no clue about Cloudflare Inc. and my question to all of the keweon user is now:

I have no problem with a big player because I have my vision. Without a common goal there is no way. If they agree to my basics it I'm fine. That would mean no tracking, no sniffing, no logging. 100% privacy. And with them I have currently a good feeling.

I would have a real problem if the users will have the feeling that this is a way to track and sniff data. Based on there new DNS Server I have a good feeling about Cloudflar.

Actually they flood the Internet with there privacy protection DNS Server. Without any filtering and without any logging. It would be a big high 5 for Google. It's a high 5 for them within the face. Love this.

What do you think about when Cloudflare will cooperate with me and they will host keweon for real? What is your trust into this Company? What would you think about all of this?

I'm asking YOU because keweon is also YOUR system!!!
[Android Software/Hacking General [Developers Only]] jyoti.id:
I don't know how all these works, so if you are confident about it & trust them, then im ok with it ?
[Android Software/Hacking General [Developers Only]] MrT69:
Wowwww... Thanks ???

I have a good feeling with them but at the moment I'm light-years away from a decision.

I only want to prevent that I lost 60% or more of the users when I realy move.

Transparency is important for me because no one knows everything.

And you can be sure that I have an damn high level of requirements on privacy. Anything else would make no sense.
[Android Software/Hacking General [Developers Only]] J4jks:
Wow BIG US company is looking into keweon..

It would be great if they support you to do your work on keweon on (y)ours terms for privacy

No tracking, no logs , no backdoors nothing.

If they support keweon you'll get big environment as you wanted I hope,which allows you to make it more privacy

I don't know much about Cloudfare, a BIG US company,which started DNS service without any logs,more privacy friendly ,from US...!!(?)

Whatever they think about keweon play with your terms

Privacy ,no logs,no tracking :good:
[Android Software/Hacking General [Developers Only]] Timmmmaaahh!:
Are you kidding me? TPB is one of their clients, of course I support Cloudflare! I mean, if a pirate can trust them, anyone can, right? :D

There has been some controversy around the company (see Wikipedia page) but overall they seems pretty solid and neutral so that's a careful 'go for it!' from me.

The question you should ask yourself is 'do I need them?' and 'do the pros exceed the cons?'. Perhaps you should make a list of (potential) pros and cons first.
[Android Software/Hacking General [Developers Only]] dodobila:
Since I am a total noob, the only person I trust is you. So feel free to do exactly how you feel.
[Android Software/Hacking General [Developers Only]] namhoang235:
yes, i've see, thank you <3:good::good::good::good:
[Android Software/Hacking General [Developers Only]] MrT69:
Whenever you see something is wrong, let me know this! :D

I'm pretty sure if all users would give feedback within the next 2 Weeks keweon would be alsmost free of any errors.

;)
[Android Software/Hacking General [Developers Only]] MrT69:
I was using my brand new whitelist algorythm for your domains. It's a cute thing.

Let me know if it's working now.
[Android Software/Hacking General [Developers Only]] MrT69:
UPDATE FOR TOMORROW

Fixed Sony devices with update problems.

Still troubles with AMAZON Apps on a some devices.

I guess during this weekend also this should be fixed.

Feedback please and enjoy it!
[Android Software/Hacking General [Developers Only]] MrT69:
Still not working... Damn.

It's still seeking for "Network Status" and it's contacting a lot of GOOGLE addresses. But even when I open them on my test server it's not working.

Someone here arround with an idea or an recomendation??

I can't do a deeper investigations because it's the mobile device from the sister of my girlfriend. No chance to root it.

Would need some help please...
[Android Software/Hacking General [Developers Only]] MrT69:
SONY UPDATE PROBLEM FIX

At the moment I can only offer a work arround to fix this problem. If you are using the "Fake VPN Tool" from Frostnerd than you can do this within an easy way.

Keep in mind. This tool will not establish a VPN connection because the VPN "simulation" is required to change the DNS Server. THERE IS NO (!) VPN TUNNEL TO ANY SERVER!

Thanks a lot for your work Daniel!

Create an exception and your mobile device will stay free and the App is working.

You only need to create an exception for Software Updater and everything is working again. It's just an interim solution but it's working.

Thanks a lot to Chavez and Mireille for your support! Sometimes it's to easy to find a simple solution :)
[Android Software/Hacking General [Developers Only]] D-dy:
Hi...

I wanna add dns Singapore on build.prop :

net.ppp0.dns1=45.76.151.221

net.ppp0.dns2=45.76.151.221

net.dns1=45.76.151.221

net.dns2=45.76.151.221

Is it right?

Thx
[Android Software/Hacking General [Developers Only]] AdroitAdorKhan:
If you are not sure what you are doing, in any case if it goes wrong, you can use magisk module from Midnight's!
[Android Software/Hacking General [Developers Only]] levone1:
[MENTION=304818]MrT69[/MENTION] - quick issue, (I know you're busy with much...), not a big problem, just reporting - When I have Keweon certificate installed, repository apps won't get a connection. I'm on Sailfish OS, so mainly I get it with apps that connect to openrepos.net, (Warehouse app, Storeman app...). However, I also had the same problem on Android, with Xposed repository. Easy workaround is to use certificate mgr to uninstall certificate, connect to repos to check updates, etc, then reinstall certificate.

Is it just an issue of whitelisting, or something else?

Thanks
[Android Software/Hacking General [Developers Only]] J4jks:
I've been using but no such issues with xposed or any

In able to connect to repos ,xposed and d download modules

I'm on android not using with magisk module
[Android Software/Hacking General [Developers Only]] MrT69:
I guess it's somewhere in the Blacklist Database.

I will check it and set it on the Whitelist. Tomorrow it should work.

Thanks a lot. Whenever you see something will not work, let me know.
[Android Software/Hacking General [Developers Only]] MrT69:
I don't understand why it's working without the certificate but not with the certificate.

That's strange.

The certificate is responsible to terminate all the HTTPS errors because of blocking HTTPS domains. You will get a 200 answewhich shows everything is fine.

Interesting thing and currently no idea why. The only thing I can offer is to connect to my private server an log everything to see what's going wrong.
[Android Software/Hacking General [Developers Only]] D-dy:
Thx. But, on older android magisk not supported. So directly i edited build.prop , but again I dont know what to set on secondary dns...
[Android Software/Hacking General [Developers Only]] MrT69:
I'm out on Android ROM Dev from Version 5. The last Edition which supports the DNS within the build.prop was Android 4. Higher versions will not longer support DNS within the build.prop because Google has removed this.

At this point I really have no clue.

If you want to use a secondary server just use a different country. You need to check the speed but actually I can't offer a secondary for each country. The provider has to often reboot or maintenance for each country. The other thing is the price. At the moment it's OK but than the price would double from 700 to 1400 EUR per month and this would become to expensive for me.
[Android Software/Hacking General [Developers Only]] AdroitAdorKhan:
Then I would suggest you to use Override DNS app to use KeWeOn!
[Android Software/Hacking General [Developers Only]] MrT69:
For Android I recommend this:

https://play.google.com/store/apps/details?id=com.frostnerd.dnschanger

From my point of view the best DNS App and Open Source. It is a Fake VPN App and there is no real VPN connection to any server.

If an App is not proper working than create an exception until I have solved it. I'm using this tool since round about 2 years on my mobile device. Thanks to Daniel again for this work.
[Android Software/Hacking General [Developers Only]] AdroitAdorKhan:
Yea, I have used this one too. But I don't like VPN thing to keep always turned on! And, as my device is rooted, I used that one. But now I'm using KeWeOn on my router, so I don't need this atm!

And, I would like to know a bit more about CloudFlare, are they gonna support you with your work?

Anyway, thanks a lot for your great job with this project! :good:
[Android Software/Hacking General [Developers Only]] MrT69:
Cloudfare Status

I was asking the CEO of Cloudflare to support me. He delegated the keweon project to his Project Manager.

On Friday last week they decided not to support me without any real reason. This was the answer from them:

After this mail I have send an answer with a question and this is still not answerd. I don't care about this and giving up is actually not an option because there is still a chance.

Of cause I'm frustrated but I still belive there is a way. ;)
[Android Software/Hacking General [Developers Only]] J4jks:
To support keweon they want something in return ;)

Let's Hope for the best:good:
[Android Software/Hacking General [Developers Only]] Timmmmaaahh!:
It's pretty obvious that they dropped any interest. Shame they don't see keweon's potential. Thank you for your open communication about this.
[Android Software/Hacking General [Developers Only]] MrT69:
I have take a deeper look into there "Privacy DNS Server Infrastructure".

There are round about 80 Servers. This servers are almost redundant and global shared.

I know this by 100% sure this will cost round about 1.3 Million Euro per year.

Now calculate the global load balancer. This will cost round about 2.5 to 3 Million per year.

In addition they would need some certificates for the TLS DNS Infrastructure.

The traffic differences compared to TLS vs. NON-TLS is incredible high. Because of TLS they need damn heavy Hardware because this is a RAM intensive thing. Every 1.5 sec the non used TLS Session will be dropped.

The entire Infrastructure needs to be supported by 24/7. For this you need a minimum team of 8 to 10 people which will also cost some money.

Security for DNS is also incredible expensive. As I have had my Test Servers within the Equinix Data Center in Munich it was a need to protect them with 2 Cisco ASA and a deep packet inspection to prevent Attacks against my serves. 2 to 8 MS around the globe was the final result.

Once a year they will get external support and consultants. They are responsible to cross check the entire infrastructure that everything is working without logging.

If you think about all of this and if you now think about the fact that they offer this for free than think about your comment again. ?

I still believe that they are doing what they told us. I believe in the good.

What's about you?
[Android Software/Hacking General [Developers Only]] J4jks:
I don't know much techy details how things work in detail but pretty sure ,it costs

I was just kidding, not serious about "they want something in return"

I'm very thankful for keweon(YOU) :svetius:to protect my(our) privacy.
[Android Software/Hacking General [Developers Only]] MrT69:
Million times thanks to you.

I know sometimes it seems I still believe to purple rain and flying unicorns. ?

But hey, I have a lot of fun with all of you and there are other hobbies which are more expensive than keweon. ?
[Android Software/Hacking General [Developers Only]] Ch4t4r:
My guess actually would have been higher. But oh well.

Well as this 1.5 seconds is actually the values I measured I can only support this statement. Each DNS request using TLS transmits about 8 kB of data. One user generates 5000 - 10000 DNS requests a day with 3-5 hours of active device usage. That's about 5.7 tB for only 5000 users over 30 days. As users tend to have multiple device the numbers should be a lot higher.

I'm currently integrating DNS over TLS in my app (that's where the 1.5 seconds come) from - the official documentation "stipulates" to keep connections open as long as possible but cloudflare closes each connection after this interval. To figure this out took me some time. Under this condition DNS over TLS is most probably doomed to fail, which users likes to spend several megabytes of (mobile?) data on just DNS requests. Not to mention the extra battery consumption for the encryption (a lot!)
[Android Software/Hacking General [Developers Only]] levone1:
Glad to do that if it would help. Let me know what to do. I just tested again to be sure: started app store without certificate, and loaded and updated no problem. Then closed store, installed certificate with certificate mgr, and opened again, and no connection. Uninstalled certificate, and tried again, and working fine.
[Android Software/Hacking General [Developers Only]] Timmmmaaahh!:
Who ever said unicorns don't fly in purple rain? ;)

[IMG="Purple Unicorn Flying in Purple Rain"]https://lh3.googleusercontent.com/BRZbPfmwSTjOvK8OrJDjSoOxiRK8wUyPdw6gVz3ZFh6eG2QHWpt8o6rktsBrwpfAUQoSi52PXtbGg_VWLHAlhNq_3S_VnTIpJyPlXgQ2mmfxzSqV6km5jjJIicMFqvH38vXeRmOsMtxpd5uxwhAwIuxcHbNtu27-zC0bBr5j9kGugeSQ-5yt6Fqlempv8lRu00sLkRbjWpvVQ8EpnXutHh9GbRCuRSG-pzIVkpFgmOpIV2pjjo64hRQyZiSVRTv5Aw0xVtjg1s75FrSNLnMka1KQO3EmydpScQ-25TJXHZsey1pzuwcdwk4G2uGut3hu0YIvU2JbFA1beAzoO8qUrpEj_DWvIF1_H3IBbsfyoNJiWculuv02nTF38AGRoeUOvBAETZHrnMvw9pP6bgQY33ZtV6d3a-lYYjW2-m0tSTywCNQUjPYfhsnLkJmzhYi5g6DcJs9wz1xQmuWEX4R4HADPxTaxYekrLE0S0piJP9w5dzCY1qplxqZVYFG5SJDPGi8YAdzjqEiYhfpBvmO1iZJy7WYwK7BERcLqalCFe3ddh9m_-2d77ejFbHqZ_n7oRAwQvtf-0sN4rS9jmipZdSEeGZQ07_TVTN1XaNzcyAhPKyVzy_T02vCcx-dmh_hdAEWxZjMvc9wJ54jWof3ndkZK04EpdA6MPQ=s300-no[/IMG]

That's not necessarily true. Even though a user has multiple devices, he only has one mind and can focus on only one device at a time. That said, there may be higher usage due to multiple devices in a sense that a user can now be online in more places but since mobile traffic has been a thing for over a decade that shouldn't really make much of a difference today.

You said something else that piqued my interest: "Each DNS request using TLS transmits about 8 kB of data"

8 kB, isn't that massive? If I write out the entire alphabet and 10 digits in one line, I have to fill 189 lines in order to reach 8KB.

If I did my searching right, a DNS request looks like this, right?

0000 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00 ........ ......E.
0010 00 3c 51 e3 40 00 40 11 ea cb 7f 00 00 01 7f 00 .<Q.@.@. ........
0020 00 01 ec ed 00 35 00 28 fe 3b 24 1a 01 00 00 01 .....5.( .;$.....
0030 00 00 00 00 00 00 03 77 77 77 06 67 6f 6f 67 6c .......w ww.googl
0040 65 03 63 6f 6d 00 00 01 00 01 e.com... ..

That's 378 bytes. 8kB = 8,192 bytes (binary) so that would mean a TLS encrypted DNS request consumes almost 22 times as much?

I'm honestly asking, I know nothing about this matter but I'm always up to learn new things and find this subject really interesting.
[Android Software/Hacking General [Developers Only]] Ch4t4r:
Well, with every device being "cloud connected" and always on there of course won't be as much connections as on an active device but a constant stream of requests. I run my own DNS server and have about 25000 requests from my 5 devices per day (of which I use 2 actively- my phone and my PC).

Yeah, that's massive. A normal DNS request I've encountered in my app transmits around 70 bytes of data (well, two times: one request, one answer - which is a bit bigger as most of the times it contains the original question). The problem with TLS is the overhead; the TCP handshake and ack-sym protocol takes some part - but is the least troublesome, the bigger problem is the overhead of the encryption. With every connection to the host you have to assume that some MITM attack might be happening. That's why on every new connection the keys and certificates are negotiated and exchanged. That Ping-pong of data exchange (Agree on protocol -> Select algorithms -> Exchange certificates -> Generate and exchange session keys) sums up to about 8 KB to transmit the payload.

That's why in the original RFC it's suggested that TLS connections stay alive as long as possible. But as this takes valuable server resources current providers don't conform to that.
[Android Software/Hacking General [Developers Only]] MrT69:
At the first look this seems not so much.

Now calculate this with GoogleDNS and you see the difference.

We don't talk about logging and security.

Google 8.8.8.8 has round about 950.000 queries per seconds.

I know no one would use GoogleDNS via TLS but it's a good thing to demonstrate the difference.

Funny numbers. ?
[Android Software/Hacking General [Developers Only]] Timmmmaaahh!:
Man, I'm learning a lot today. Okay, I understand the need of attaching these certificates to a package but does it really need to be each and every one? If you're sending 25,000 requests per day, you'd be causing a load of roughly 200MB. What if this could be tackled with sample checks? Say, every 100th package gets checked? That would be 2,500 packages of 8kB (~20MB) and 22,500 packages of 200 bytes (~4.3MB), totalling ~24.3MB, a major difference in load. I don't know if such a thing is even feasible, just thinking out loud here.
[MENTION=304818]MrT69[/MENTION], you speak of 2 Cisco ASA and a deep packet inspection, does that affect the package sizes as well?

Hah, funny indeed! Via TLS that would mean a load of – this is math I cannot do! – 7.25GB/s (57.98Gb/s)! It's still 181.2MB/s (1.45Gb/s) without TLS. Of course, they have just a little more budget compared to keweon xD
[Android Software/Hacking General [Developers Only]] MrT69:
Yes... but it's only just a little bit more they have ;)

I was using the ASA (5540 & 5510) just to have a safe DNS. SAFE - not secure. That was the reason why I have bought a (used) 5540 with the SSM (IPS) module.

The IDS has no impact to the package size but it will cause a delay. Package arrive, take a look, decide - drop or forward. The reason for CISCO was to test my infrastructure and CISCO 5540 has a package delay of 2ns (nano seconds) within SSL inspection. Damn quick and because of this I decided to use this because it was a need to test the DNS performance AND to make them safe against any attacks.

It was 2015 and it was good enough to test the performance but I'd rather prefere "Scrubbing Center" from the Provider. Plug the server in and you are safe against anything. Cool service.

Level3 (now CenturyLink) made an offer to charge 4.000 EUR per month per each subnet. At the first moment you think it's expensive but when you compare this to CISCO than you would need a minimum of 3 firewalls (redundancy) and expect a fail out. Each of them would cost round about 60.000 plus Service, Support and Setup.

From my point of view the DNS TLS thing is just a hype because you will be not safer than without TLS. DNS via SSL is just a myth that trackinig and logging is not longer possible. From my point of view it's important to have a high secure DNS which is protected against any attacks. This covers spoofing, mitigation, DDoS, poisoning and all common known and unknown attacks. This is the big advantage of a Scrubbing Center connection.

To be protected against DNS tracking, sniffing and privacy break there is only one 100% safe solution. A DNS provider who never will log anything. And I am not alone with this opinion:

https://www.infosecurity-magazine.com/opinions/the-pros-and-cons-of-dns-encryption/

Enjoy it.