Block ads on Android

Names first. Before reaching any server, your phone asks for an address. The app answers those questions on the device: a name on its lists gets “nowhere”, and the app that asked gives up. Every other name goes to an encrypted resolver, Cloudflare by default, with Quad9 behind it, and Cloudflare in the clear as a last resort. An app that ignores the system and talks to a resolver of its own comes back to the filter too, because every request leaving for port 53 is answered by it. An app that encrypts its own DNS questions can still escape it.

Then pages. In the browsers you leave switched on, the app reads the page before the browser draws it: it hides ad slots, neutralises ad scripts, refuses cookie banners for you when the site offers to reject everything, and takes the ads out of YouTube videos. Same engine as the computer version, with lists chosen for the phone. It needs a root certificate, made on the phone, that you install yourself — the steps are further down.

To do either, the app declares itself to Android as a local VPN. Android shows its own permission prompt. All of the phone’s traffic goes through the app, on the device: the tunnel still leads nowhere outside the phone, there is no server of ours behind it, your IP address is not hidden, and nothing of your browsing reaches the publisher. A connection that doesn’t come from a browser is passed on as it is, byte for byte.

AdHole routes your traffic through no server and hides no address. What the app itself sends out comes down to the resolvers it asks, encrypted ones first; the filter lists, when you update them, and the page-cleaning lists each time filtering starts, if page cleaning is on; and the version check, when you ask for it: it carries the version and the system and, unless you turn off “Anonymous statistics”, a random number replaced every month and the number of requests blocked since the previous check. One more is added whenever none of your resolvers answers a request: the resolver of whichever network you are on, asked in the clear for that request and for as long as the outage lasts — your router over Wi-Fi, your operator on mobile data, whoever runs a public Wi-Fi. That one sees those names again; filtering does not stop, and the app goes back to encrypted the moment a resolver answers. No browsing history is written on the device: only the request totals, plain numbers, are kept there so the counter does not start again from zero at every stop.

It reads the same three lists as the computer version, shipped with the app and updated when you ask. To fit a phone’s memory they are turned into a compact index, compared with the computer’s engine on 5,000 names from the lists: each gets the same answer. It works over Wi-Fi and over mobile data, with no computer left on at home.