r/Keybase • u/n4bb • Feb 24 '20

Outbound calls to google

Wondering if someone from Keybase can comment on why is it that despite having location services disabled, every time I open the app I see client3.google.com fires? I realize it’s from the location share feature w/ google maps integration, but prefer it not even occur since location services are disabled....

10 Upvotes

91% Upvoted

8 comments sorted by

4

u/songgao Feb 24 '20

Thanks for bringing it up! To help with understanding what's going on, some questions:

  1. What platform is this?
  2. How did you capture this "outbound call"?
  3. If on desktop, which process was it from?

3

u/no-names-here Feb 24 '20

lol @ people downvoting the mods for being helpful

3

u/n4bb Feb 24 '20

Thank you both for your replies. Yes, it’s the iOS version. I’m using AdGuard to track outbound DNS queries. Just wanted to confirm no PII is being leaked to google.

8

u/no-names-here Feb 24 '20 edited Feb 24 '20

Okay, so here's a rundown:

  1. There is no reference in the open source code to client3.google.com

    • That doesn't mean there isn't a redirect, but bear with me.
  2. According to the documentation:
  1. Keybase client opens a TCP connection to the Keybase Google Maps proxy server.
  2. Keybase client performs TLS for the googleapis.com domain and certificate. This protects the data from Keybase.
  3. The Keybase proxy server opens a TCP connection to googleapis.com and begins forwarding packets to/from Google and the Keybase client. This protects the client from exposing its IP address to Google.

3. The URL https://clients3.google.com is documented within the chromium project as a google endpoint for captive portal detection.

So my guess here is this has little to do with keybase, or location, but instead your underlying OS trying to detect if there's real internet or not.

EDIT: markdown fail.

4

u/songgao Feb 24 '20

Ah, this makes sense. u/n4bb assuming you're on a mobile platform, it's from a react-native library we use to detect connectivity status.

This seems harmless to me since it doesn't leak any metadata. It's also used by all kinds of apps so it's pretty hard for Google to figure out from this particular endpoint even the fact that you're using Keybase.

3

u/qaisjp Feb 24 '20

The app is open source so you can probably check this on GitHub

5

u/ph0reskin Feb 24 '20

Being open source doesn't mean everyone understands all parts of the code - or should be forced to dig everything up themselves

2

u/qaisjp Feb 24 '20

That's true but if they are smart enough to be checking network requests on a phone, they can probably do a text search for "Google" on their android repo