Relay 2.8.3

Relay 2.8.3

Share your phone's internet with your PC. Tap Start Sharing on
the phone, click your phone in the list on the PC, tap Allow.
That is the whole setup.

Everything runs between your two devices: no account, no server, no
telemetry. The connection is an encrypted WireGuard tunnel, and
every application on the PC goes through it -- not only the browser.

Over your Wi-Fi, the phone's hotspot, or a USB cable -- whichever way
the two devices can already see each other.

---

🔎 Relay can now name the setting that is blocking it

Android has a switch called "Block connections without VPN". It drops
everything that is not the VPN tunnel — including your phone's replies to your
own PC, which is exactly what Relay needs to send. Your PC finds the phone,
asks to connect, and never hears back.

It is the most common cause of
#126, and until now
nothing on either screen said so. Answering it meant asking the user to go and
find a settings page and report back what they saw.

Now the phone checks it. When the switch is on, the banner says so by name,
explains that it drops replies to your own network, and gives you a button
straight to the VPN screen:

"Block connections without VPN" is on
That setting drops everything except the VPN — including this phone's replies
to your PC, so your PC can reach the phone but never hears back. Open VPN
settings, tap the ⚙ beside your VPN app's name, and turn it off.
Your VPN keeps running, and Relay will share it.

"Turn off your VPN" is never the advice. Sharing it is the entire point.

Where to find that switch

It is not inside your VPN app — a user looked there first, and that is the
natural place to look. It belongs to Android:

Settings → Network & internet → VPN → the ⚙ beside your VPN app's name

And it only appears once Always-on VPN is turned on. If you see nothing
there, this is not your problem.

What Relay deliberately does not claim

• It cannot tell you which VPN app. Android leaves exactly one of these
  settings readable to an ordinary app and closes the one that names the app.
• The button cannot open the page the switch is on. Android exports no
  route to it, so the button opens the VPN list and the message names the last
  tap itself.
• "Off" does not mean nothing is wrong. A plain full-tunnel VPN with no
  always-on configured causes the identical fault while this setting reads off —
  so when Relay cannot confirm the switch, it shows the general message 2.8.2
  already had, rather than sending you to look for something that may not be
  there.

Every diagnostic report's header now carries it, on every start:

Lockdown: on  (Android's "Block connections without VPN")

⚠️ Not yet confirmed on a phone. The Android annotation that makes this
read legal is verified in AOSP's own source for API 31 through 36 — but no
device has actually been asked, and OEM ROMs are exactly where this kind of
setting differs. Nothing depends on it: if the read fails, Relay falls back to
the message 2.8.2 already shipped. Treat the new banner as unproven until a
phone has answered. The four checks that would settle it are in
docs/testing.md.

Everything in 2.8.2
is in this release too — the USB tethering race, the four separate failure
messages, the VPN warning rebuilt on evidence, and Windows updates that actually
install. If you are coming from 2.8.1 or earlier, read those notes as well.

---

Download

Platform	File	Requirements
Windows	Relay-Setup-x64.exe	Windows 10/11. Per-user install, no admin prompt.
Windows (32-bit)	Relay-Setup-x86.exe	Only if you know you need it.
Android	Relay-android-arm64-v8a.apk	Android 8.0+, 64-bit ARM — almost every phone since 2017.
Android (any device)	Relay-android-universal.apk	Same app, every CPU type. Larger. Use this if the one above says "app not compatible".
Android (stores)	Relay-android.aab	Not directly installable.

Install

1. Install both apps.
2. On the phone, tap Start Sharing. Put both devices on the same
   Wi-Fi, turn on the phone's hotspot, or plug in a USB cable -- with a
   cable, Relay offers to switch USB tethering on for you.
3. On the PC, open Relay. Your phone is already in the list. Click it.
4. Tap Allow on the phone.

No camera on the laptop? The two-digit code works on its own. Prefer
the QR? It is still there.

Windows SmartScreen warns on first run because the installer is not
code-signed yet: More info -> Run anyway. See docs/release.md.

If Android says "App not installed", that one message covers
several unrelated causes. The two most common: an older copy built
from source is still installed (uninstall it first - a different
signing key blocks the upgrade), or Play Protect blocked the
sideload (Install anyway in its dialog).
docs/install-troubleshooting.md
covers the rest, starting with how to see the platform's real error.

Verify your download

SHA256SUMS.txt is attached.

sha256sum -c SHA256SUMS.txt

Privacy and security

• Nothing leaves your two devices. No accounts, no servers, no
  telemetry, no analytics. The diagnostic log is no exception: it stays
  on the phone until you choose to share it.
• Reading that VPN setting reads nothing else. Relay asks Android one
  question — is lockdown on — through an ordinary public settings call. No
  reflection, no hidden API, and it cannot see which VPN you use.
• The tunnel is WireGuard. Its keys are minted for each pairing and
  destroyed when sharing stops.
• Keys are never broadcast. The phone announces only enough to be
  found; the keys travel over a short exchange that you approve on the
  phone, with the requesting computer's address shown.
• DNS and IPv6 cannot go around the tunnel. While connected, Relay
  blocks name lookups to any resolver but the tunnel's, and refuses
  IPv6 outright because the tunnel carries IPv4 only.
• The Windows update checks its own bytes — when it downloads them, and
  again before it installs them, because in between they have been sitting
  on disk.
• Nothing outlives the app. No system-wide setting is changed, and
  those filters are destroyed by Windows the moment Relay stops -- even
  if it is killed -- so a crash cannot leave you unable to browse.

Anyone on your network can see the phone is sharing and can ask to
pair -- that request is what the Allow prompt is for, so do not
approve one you did not start.
SECURITY.md
has the full threat model.

What changed

The readable version is in
the changelog.

Every commit in this release

• Date 2.8.3, and record what it has not proven (#137)
• Name the setting that is blocking it (#136)