How does Private Spaces isolation compare to secondary user profile?

DeletedUser370

I can only answer the questions that relate to usability, based on the user-facing interface of the Private Space feature in Android 15 Beta on stock PixelOS.

ryrona If I have understood it correctly, the private space can have an always-on VPN set up even if the main user does not have any VPN, and all apps in the private space will run through this VPN.

You can install any VPN app in the Private Space (PrS) profile, and choose to only use it in the PrS. You don't need to have or use a VPN in Owner. The Owner and PrS have separate VPN slots, and "Always-on VPN" and "Block connections without VPN" can be configured separately in the Settings app (opened from Owner). Screenshot: https://ibb.co/F3cD1zj

Notice that the Settings app distinguishes between the PrS and Owner VPN slots by adding a tiny icon to the PrS-specific settings.

ryrona All screenshots show unlocking is by fingerprint. Does this mean there is no separate encryption passphrase for the private space?

On PixelOS, you have to unlock the PrS with the PIN/password for the PrS after every device boot. After that, you can use fingerprint unlock for any successive unlock attempts. On PixelOS you can't "end" the PrS session without rebooting – but on PixelOS you can't end any other profile session anyway, without a device reboot.

ryrona Does notifications work in private space?

Yes.

ryrona Are notifications from main user and private space shown together the same, like they originated from the same user?

Notifications from Owner and PrS are shown together in the notification bar and pull-down menu, but the notifications from PrS are tagged with a separate icon. Screenshot: https://ibb.co/BndbBkT

I personally would've preferred the PrS icon to be larger and more prominent, although it matches the size of the notification headline.

The app switcher will also distinguish between actively running apps with the PrS icon. Screenshot: https://ibb.co/n3y1MZ3

ryrona Do they share contacts?

I added a contact to the Google Contacts app in Owner, then opened the Google Contacts app in PrS: the PrS did not show any contacts. So at least UI-wise, they don't appear to be shared.

flighty_sloth

DeletedUser370 Thanks for all this info.. so the prs can just run in the background and you'll be able to see any notifications and the content from the owner profile? This sounds amazing.. do you know if the PrS apps are isolated from doing IPC with the apps in owner profile?

ignition

DeletedUser370 You can install any VPN app in the Private Space (PrS) profile, and choose to only use it in the PrS. You don't need to have or use a VPN in Owner. The Owner and PrS have separate VPN slots, and "Always-on VPN" and "Block connections without VPN" can be configured separately in the Settings app (opened from Owner). Screenshot: https://ibb.co/F3cD1zj

Notice that the Settings app distinguishes between the PrS and Owner VPN slots by adding a tiny icon to the PrS-specific settings.

Does this mean VPNs can be nested? If the VPN in your Owner profile is turned on, and the VPN in the private space is turned off, does the private space see your real IP or the IP of the active VPN in your Owner profile?

MARKU5

DeletedUser370 Are private spaces available on secondary profiles? If so, is it possible to have multiple private spaces? A private space on the owner profile and a private space on a secondary profile, for example.

Viewpoint0232

DeletedUser370

All of this sounds and looks exactly like a work profile. Is there any difference?

Also how do you add apps to the private space? I assume they need to be installed within the private space from an app like Play Store or F-Droid. Is it also possible to clone apps from the main profile to the private space and they get updated when you update them in the main profile?

DeletedUser370

flighty_sloth do you know if the PrS apps are isolated from doing IPC with the apps in owner profile?

My answer to this question would be an assumption, not based on insight into the code or documentation. I have only tried the Private Space feature on PixelOS as an end-user.

flighty_sloth

ignition Correct I believe they operate independent of eachother, either one that doesn't have a VPN will be your real IP. In the scenario you described the private space should see your real IP

ignition

ignition Does this mean VPNs can be nested? If the VPN in your Owner profile is turned on, and the VPN in the private space is turned off, does the private space see your real IP or the IP of the active VPN in your Owner profile?

@DeletedUser370 can you please confirm what is true here?

DeletedUser370

ignition Does this mean VPNs can be nested?

I don't understand what this means.

ignition If the VPN in your Owner profile is turned on, and the VPN in the private space is turned off, does the private space see your real IP or the IP of the active VPN in your Owner profile?

What do you mean by a profile "seeing" the IP address of another profile? Unless the question is deeper than what I've already explained, I think my previous explanation that the Owner and PrS profiles have separate VPN slots should be sufficient to answer your question. I've already derailed this topic enough with my usability perspective of PrS. I won't answer any further questions.

ignition

flighty_sloth In the scenario you described the private space should see your real IP

If this is true then the VPNs are not nested

flighty_sloth

MARKU5 No, you can only have one private space and only on the owner profile.

MARKU5

flighty_sloth Thanks. Yeah I just found that question was answered in another thread as well.

I wonder if adding support for private spaces in secondary profiles is something the GrapheneOS team would consider doing?

flighty_sloth

ignition True not nested, not sure why I wrote "correct" at the beginning, my apologies that was an error, the rest of what I wrote after the first word is what I meant.

ignition

DeletedUser370 I don't understand what this means.

That was in the question that followed. If the VPN in your Owner profile is active, but there is no active VPN in your private space, is the reported IP of the private space your real IP or the IP of the Owner's active VPN when you check an IP testing site in a browser (or even the disconnected private space's VPN)?

I think my previous explanation that the Owner and PrS profiles have separate VPN slots should be sufficient to answer your question

Being able to run more than one VPN simultaneously would require this regardless so I am not sure how this could possibly be relevant.

I've already derailed this topic enough with my usability perspective of PrS. I won't answer any further questions.

My question is very literally about the topic, VPNs and isolation, so I am not sure how this is spun as a derailment but I cannot force you to answer.

DeletedUser370

ignition I'm sorry for being cross.

ignition If the VPN in your Owner profile is active, but there is no active VPN in your private space, is the reported IP of the private space your real IP

Yes.

ignition

DeletedUser370 Yes.

Thanks. That is an unfortunate design choice.

roamer4223

ignition "That is an unfortunate design choice." Out of interest, why do you say it's an unfortunate design coice? Surely this way is preferred, as you can have a separate 'identity' in each profile.

If you want to have a VPN in each profile, you can. You can also have one profile with one VPN and one with another, or one as your actual IP. Then you can keep certain apps in each profile, depending on which IP you wish them to be routed through.

I know that having seperate IP addresses aren't enough on their own to stop cross profile fingerprinting, but it is an element of it at least.

If I'm misunderstanding what you mean, let me know though

ignition

roamer4223 why do you say it's an unfortunate design coice? Surely this way is preferred, as you can have a separate 'identity' in each profile.

Because it means it's impossible to nest VPNs, which is necessary for certain higher privacy and anti-censorship postures, but also impossible to simultaneously run a full, privacy-preserving VPN app and something like Blokada because the VPN connection from your Owner profile isn't carried over to the private space.

If there was at least a toggle to allow sharing, I could run a VPN in the Owner profile and Blokada or something else in the private space, and stick to using the private space for everything I cared for while remaining confident I had full coverage across my device. The current design means my Owner profile VPN is meaningless to the apps in my private space, so I'm forced to choose either running the same VPN again in the private space, forfeiting Blokada, or Blokada, forfeiting the VPN.

I know that having seperate IP addresses aren't enough on their own to stop cross profile fingerprinting, but it is an element of it at least.

This type of fingerprinting is a very insignificant concern compared to the inability to simultaneously run a full VPN app that allows you to switch locations as needed plus offers obfuscation/anti-censorship measures and a firewall app like Blokada.

The current compromise often recommended is a not particularly intuitive hack offered by some firewall apps that have secondary VPN functionality but you forfeit expedient location changes and now have to place your trust in them to not introduce subtle bugs that break the VPN, a big ask for something of secondary concern to them, while they're focused on building out their firewall/dns features. Even worse, this compromise is off the table if you rely on the anti-censorship/obfuscation measures the full VPN provides.

There is also the nesting VPN case which is increasingly relevant in today's political climate where more privacy-respecting VPNs and services are censored in favor of those that, while secure, are more useful to goverments because of data they retain. If such a toggle existed, I could run my privacy-respecting VPN in the Owner profile and the less privacy-respecting one in the private space without exposing my real IP to nested VPN. This is the principle underlying iCloud Private Relay but without being limited to Safari browser or their mail app.

roamer4223

ignition I think the main issue here is, this is not what the Private Spaces feature is for. Unless I'm mistaken, It's basically similar to using a work profile with an app like Shelter, but without the need to use a third party app, or without needing to switch between the built-in user profiles either. It allows you to keep certain apps seperated from each other so they can not use IPC, or see each other. I assume it's not as isolated as the built-in user profiles but it's also slightly more convenient. You are looking for a completely different feature, as far as I can tell.

I don't know much about Blokada at all. However, I know RethinkDNS allows you to essentially do these things. You can download a bunch of multi-hop Wireguard configs from your VPN of choice, such as Mullvad, then import them into RethinkDNS. You can then use your VPN's DNS server or a seperate one if you want (though that would make you stand out more, generally speaking). It has a firewall built in, which tells you which app made which request, and allows you to block DNS or IPs. It also allows you to block an app's internet access entirely, though of course the built-in GOS network toggle is better to use in that case.

I'm not necessarily recommending RethinkDNS or anything. It just seems to be similar to what you're looking for? Maybe I'm way off.

I'm not really an expert so if I'm talking rubbish then please feel free to ignore me. Just wanted to help / understand what you were saying :)

GrapheneOS

ignition Chaining VPN connections is supported. Using local filtering at the same time as a VPN is supported. You're simply wrong about these things. Your issue is that you're using apps not supporting it. It has nothing to do with profiles and it wouldn't make any sense for secondary profiles to go through the Owner user VPN as an additional layer. It goes against the whole purpose of profiles of acting as separate devices as well as they can on the same device. Nesting VPNs is entirely possible and something VPN apps can support already. They can provide configuration for this inside the app or simply support chaining through multiple providers as the default approach. Some apps do support this in some form such as bridge support for Tor which is essentially exactly that provided in a specific way.

The current compromise often recommended is a not particularly intuitive hack offered by some firewall apps that have secondary VPN functionality but you forfeit expedient location changes and now have to place your trust in them to not introduce subtle bugs that break the VPN, a big ask for something of secondary concern to them, while they're focused on building out their firewall/dns features. Even worse, this compromise is off the table if you rely on the anti-censorship/obfuscation measures the full VPN provides.

No, there are apps with first class VPN support in addition to first class filtering support. Apps can support chaining VPN connections too. None of this is relevant to profiles and is something VPN apps need to provide. Most of these apps focusing on 1 specific thing instead of providing everything users want from a VPN app is because almost none of them are trying to make a high quality Android VPN app. Most are simply adding Android support to an existing project and use the VPN service feature for it without considering what makes a good Android VPN service app. There are a few apps trying to provide a good Android VPN service app and fulfilling multiple use cases at once.

ignition

roamer4223 You are looking for a completely different feature, as far as I can tell.

Can't see how because nothing in your description is incompatible with the nesting VPN use case. This is also how things work in the desktop equivalents of a private space.

roamer4223 It just seems to be similar to what you're looking for?

No, because as I said

The current compromise often recommended is a not particularly intuitive hack offered by some firewall apps that have secondary VPN functionality but you forfeit expedient location changes and now have to place your trust in them to not introduce subtle bugs that break the VPN, a big ask for something of secondary concern to them, while they're focused on building out their firewall/dns features. Even worse, this compromise is off the table if you rely on the anti-censorship/obfuscation measures the full VPN provides.

This applies to RethinkDNS as much as it does to Blokada. Rethink is nice but asking me to trust them for critical VPN function is a bridge too far, and not even possible when you need anti-censorship/obfuscation features of a proper VPN app.

gk7ncklxlts99w1

roamer4223

but it's also slightly more convenient

I've only skimread some of the comments here and I don't fully understand private spaces, but from what I can tell, since you can only use private spaces in the owner profile this makes it less convenient. I don't use my owner profile for anything except changing settings and updating the system, I use secondary profiles for everything. I'm not entirely sure what purpose private spaces actually serve, I disagree with the notion that they are more convenient than profiles. And I feel like the ability to daisy-chain VPNs (ie. VPN-over-VPN) is a highly desired feature for many people, as well as various other features to do with VPNs.

This might be very useful for devices not using GrapheneOS, but it appears GrapheneOS already kinda serves the same purpose but is much more flexible. I'm open to being corrected since I'm only just learning about this.

roamer4223

ignition Fair enough then. As I said, I wasn't particularly recommending RethinkDNS, I just misunderstood what you were looking for. There are some VPN providers that have multi-hop on their Android clients as well, such as iVPN. iVPN also has a reasonably customisable DNS blocklist built in to their app. Anyway I guess you'll have to submit a feature request for what you're after. Good luck :)

Carlos-Anso

ignition This is also how things work in the desktop equivalents of a private space.

I am not sure what you consider "the desktop equivalent" but suspect this may be a big part of he reason you are disappointed. You are attempting to replicate a somewhat complex setup in another OS, there are big differences as to how things work in these operating systems, and nobody has created something that provides what you want.

The way networking, profiles and VPNs work in Android may appear a bit strange when compared to what you are familiar with from desktop operating systems but there are reasons. Much network functionality is split per profile running through the VPN of that profile. Some things are handled solely by the kernel and effect the whole device. This contributes to the leaks we have been fixing. There is a lot of complexity to everything which has made fixing the leaks very difficult. It also makes making any changes difficult. Also potentially maintaining those changes. Which means any changes have to be very carefully considered and, particularly if complex, ideally avoided. We cant risk big changes landing in AOSP which could completely break networking or changes we have made which people rely upon.

ignition The current compromise often recommended is a not particularly intuitive hack offered by some firewall apps that have secondary VPN functionality but you forfeit expedient location changes and now have to place your trust in them to not introduce subtle bugs that break the VPN

I would not call it a hack or presume that an app designed just for running a VPN would be higher quality. Many VPN apps are not great. Notice the project has a very short list of recommended VPN apps.

"The only app we can recommend is the official WireGuard app."

ignition Isn't that just, if it even is possible, the Rethink and Blokada compromise discussed above but worse?

Its technically possible to have networking from any given profile run through nested VPNs. Any VPN company could make their VPN app support this kind of nesting.

An independent project could make an app that sits in the VPN slot and offers this nesting and likely also the location switching and other features you desire.

It appears your imagined ideal is a device wide VPN but also being able to run VPN apps in individual profiles with any VPN connections also nested/routed through the device wide VPN. I am not at all sure GrapheneOS will ever take on the work to implement and maintain this.

I think it may be wise to split this conversation off to a new thread as its veered significantly off topic. There are existing apps and methods that can achieve nesting of network connections. Also GrapheneOS aims to offer the possibility to run desktop operating systems, which would have their own networking stacks, in virtual machines.

gk7ncklxlts99w1

ignition

Is the feature you're looking for the ability to do VPN-over-VPN?

ignoramous

rdns dev here

ignition This applies to RethinkDNS as much as it does to Blokada.

I take insult to be lumped with Blokada.

ignition Rethink is nice but asking me to trust them for critical VPN function is a bridge too far, and not even possible when you need anti-censorship/obfuscation features of a proper VPN app.

Rethink is focused on anti-censorship, and we continually add (and want to add) improvements to that end, even if you may not notice it.

Also, it is a bit of a stretch passing your opinion (about what's critical for our project) as a fact. Have you got a personal email from me where I decried that WireGuard is a bridge too far for Rethink (a bit rich as we've been working on just the WireGuard bits for close to a year now, btw)? If not, you should consider if deriding our little project is of any constructive use to anyone.

ignition

roamer4223 There are some VPN providers that have multi-hop on their Android clients as well

You are misunderstanding something. While similar, multi-hop and nesting VPNs are two different things.

Multi-hop is a same provider feature, with servers of both hops owned by the same provider and known to not just them but also its adversaries. The exit hop here is the important one and, for very private VPN providers like IVPN, your internet use gets blasted with a mountain of captchas or outright blocked by websites and apps because all of IVPN's servers are publicly known.

Nesting is multi-provider. If you read through the iCloud relay article, you'd see how they explain this. One provider is used for the entry relay and a different, unrelated provider for the exit relay. From a privacy and anti-censorship angle, this means you can use IVPN, which is highly private, as your entry relay and they'll know your real IP but you could now, assuming it wasn't deprecated, much more safely use something like Google One VPN as your exit relay without exposing your real IP to Google.

Advantages of nesting in comparison to multi-hop are significant, including much fewer, if any, captchas and blocks since the algorithm is almost always Google's or trusts Google, and websites and apps (some of the biggest owned by Google themselves) will only see Google controlled IPs, deeming it safer because its VPN is not at all as private as IVPN. Another privacy and censorship advantage is your ISP, and government that may know about IVPN, gets blinded to the details of your use of the less private nested VPN. Yet another advantage is you can retain your privacy while gaining high availability in the sense that you can use IVPN, which has servers in only a few locations, as your entry relay but another, less private VPN with a wider selection of locations as your exit.