Re: PSA: Windows Aloha browser system-wide IP leakage & dangerous design

Maria Sophia wrote:
> In summary, the Windows Aloha browser is a scam because Aloha's Windows VPN
> does not register a WFP callout, does not create an NDIS 6.x virtual
> adapter, does not bind DNS to a tunnel interface, and does not register
> with NCSI, meaning Windows has no way to detect the tunnel, enforce
> VPN-aware firewall rules, or prevent traffic leakage when the tunnel
> collapses.

UPDATE. 

Good news, sort of. Well, not as bad news as it used to be, I guess.

Up until about version 4.18.0.0 (where 4.19.0.0 was released May 29, 2026),
prior Aloha versions would randomly drop the VPN while you were using it.

Since that's sadistically the very last thing anyone would expect a VPN
browser to do, that "feature" alone made the Aloha VPN browser worthless.

Luckily, the sadism of the developers seems to have abated somewhat in that
the current versions no longer randomly drop the VPN without any warning.

They still drop the VPN randomly.
And there still isn't any warning.

But if you keep the mouse on the browser at all times, they don't drop it.

It's only if the focus isn't on the browser now, that they will randomly
drop the VPN connection (usually within a minute or two in my experience).

When you manually bring the focus back on the browser, the VPN connection
stays off, but you can reconnect by clicking the gray VPN shield which, in
prior versions, would turn blue (indicating the VPN shield was active).

In Aloha version 4.18.0.0 and newer versions, clicking the gray (off) VPN
shield just brings up a dialog box asking you to pay to keep the VPN on. 

At the bottom of that dialog box is teeny tiny print where you can select
 "Continue with free servers"

Clicking on that teeny-tiny extra line will then turn the VPN shield blue.

And now you're back to the original setup (where it will stay blue until 
you remove focus on the browser, in which case it randomly turns gray).

In summary, the mechanism for Aloha to maintain the VPN connection has
drastically changed, where it takes more mouse movements now than before, 
but at least if you keep the focus on the browser at all times, the VPN no
longer sadistically randomly drops right out from under your feet.

It's still a terrible design, but at least it's no longer pure evil sadism.
-- 
Knowledge is just knowing what is while experience is knowing what happens.