2

Orbot requires a rooted device for transparently providing proxying to all applications, but if I understand correctly, the application OpenVPN doesn't.

I understand those two applications do different thing, but it seems to me that if OpenVPN can route all your traffic through a VPN without root, then Orbot should also be able to dispense with it.

9
  • AFAIK Orbot allows transparent proxying (specifically VPN) without root, but app-specific settings (inclusion and exclusion lists) are only possible with root permission because of the need to alter ip-tables.
    – GiantTree
    Feb 9 '15 at 18:14
  • No it doesn't. Transparent proxying with Orbot requires root
    – Arthur B
    Feb 9 '15 at 18:16
  • Well, I never used Orbot without root because of the specific lists where I can enable Orbot for some apps only and not for all. Transparent proxying hides the fact, that you are using a VPN/proxy, maybe that needs root.
    – GiantTree
    Feb 9 '15 at 18:28
  • This probably just boils down to the fact that Tor is not a VPN. Android has an API for apps to set up VPNs, but Orbot presumably can't leverage them. I'd guess it's working more akin to something like Wireshark, in that it intercepts packets system-wide and modifies them. Android does not have an API for that (AFAIK). I don't know the underpinnings of Orbot well enough to know if that's actually the case, though. Feb 9 '15 at 19:18
  • 2
    Note my phrasing a bit more closely: the API allows an app to set up a VPN, not act as a VPN. As in, it allows applications to add new VPN entries to the system settings, just as a user could by hand, then enable and disable the connection and send/receive data though the system's tunnel. The app itself is not acting as a network bridge or anything of the sort in that scenario, it's just creating a configuration entry and flipping it on so it can talk to it. The OS is still doing all of the network routing. I don't know if Orbot needs deeper access to packets, but it sounds like it might. Feb 9 '15 at 19:26
3

The problem here is that Orbot is built as a network proxy, rather than a VPN service, and Android does not expose any APIs for raw proxying of network packets.

Per the Orbot description on F-Droid:

Orbot allows access to Tor by accessing a local SOCKS or HTTP proxy. On a rooted device, the proxying can be completely transparent i.e. the app that accesses the network need not be aware of the proxy's existence.

The important distinction here is that Orbot is acting as a proxy, not a VPN. Therefore, it has two options for routing application traffic:

  • Work on an app-by-app basis, with the user setting up proxy settings on each app they want to run through Orbot. No root needed for that, since each app will appropriately route its own traffic to Orbot.
  • Work system-wide by re-routing all network traffic.

Android doesn't provide any APIs for accessing or re-routing arbitrary network traffic because this would of course be insecure. Therefore, Orbot must resort to using iptables firewall rules instead, which requires root access. A VPN app, on the other hand, is able to leverage the VpnService API to construct a VPN connection.

The main difference here is that the system is deeply involved in the creation and management of a VPN connection, even when it is initialized by a third-party application. The user must still approve the connection and the system provides a notification and information dialogs that (in theory, anyway) cannot be hidden or tampered with. The system is also responsible for setting up the virtual network interface that's used for the tunnel.

I am not entirely privy to the Tor protocol, so it could be that acting as a proxy is the only feasible solution at this time. If that is the case, then they simply cannot avoid the root requirement for system-wide routing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.