Private Space on Android 15 GrapheneOS

raccoondad

moddel it seems to be explained in detail in androids documentation: https://source.android.com/docs/security/features/private-space

DeletedUser266

Murcielago
From your experience, how do you share pictures from Private space to the Owner profile? I intend on installing Pixel Camera in Private space...

Arnauld

DeletedUser266 I use Inter Profile Sharing between profiles: https://github.com/VentralDigital/InterProfileSharing

Murcielago

DeletedUser266

My current workflow:

Pictures: I share photos I have taken with Pixel Camera via File Picker with Aves Libre (installed in Owner Profile) - this copies them to Owner Profile.

Videos: Same way + eventually editing videos beforehand in Private Space with Google Photos (I haven't gotten used to Open Video Editor and also haven't found another open source video editor app).

Big drawback: Aves Libre only appears as a suggestion in File Picker if you want to copy a single photo or video.

I rarely use the Pixel Camera (actually only for video and i don't shot lots of videos), so I can live with that drawback but if you want to transfer lots of files there are probably better ways like the already mentioned InterProfileSharing.

If anyone knows a way better way of copying several files simultaneously from Private Space to Owner Profile please let me know.

DeletedUser313

GrapheneOS The clipboard is shared, but we could add a setting for it

I'm in favour of this as some apps keep copying from the clipboard for no reason. I don't believe this is an accident either

Open_Source_Enjoyer

DeletedUser313 I'm in favour of this as some apps keep copying from the clipboard for no reason. I don't believe this is an accident either

Such apps should be avoided in generell if possible

DeletedUser266

I actually prefer the shared clipboard for my use case. But an toggle could be useful.

DeletedUser313

Murcielago

Can't you zip all the files with 0% compression and transfer it as a single zip file

DeletedUser313

Now that Private Space's encryption is fixed, is it just as secure and private as a secondary user?

ryrona

DeletedUser313 Now that Private Space's encryption is fixed, is it just as secure and private as a secondary user?

If you disable clipboard sharing too, yeah, it should be.

The system file picker allows selecting files from either inside or outside the hidden space, but this requires you as the user to do that. So while it makes the risk of user mistakes slightly easier, it shouldn't pose much of a security issue in most threat models.

Skyway

There's a lot of posts here sorry if this was asked.
Is there a way to have private space auto start when device is unlocked? Or prompt to unlock private space?

chisc

Skyway You can choose to change the 'Lock private space automatically' private space setting to 'Only after device restarts'.

With that setting, you'll only need to unlock it once after boot, switch to an inactive user profile, or if you ever manually lock it.

Panda-na

I have noticed that having an active VPN in Private Space, while using apps in owner profile, increases the accumulated data in the Private Space VPN (meaning that apps in owner profile goes through the Private Space VPN). I'm using Proton VPN, and the VPN is not active in owner profile, only in Private Space. I can't see anyone else having this issue. Is it only me?

Proton VPN
Private DNS is: Off
2025080400

From GrapheneOS website:

Android VPN configuration is split up for each profile which means work profiles, Private Spaces and secondary users have their own VPN configuration which is a fantastic privacy feature. Android has a standard restriction preventing processes from using a network which the current profile isn't allowed to access. However, this doesn't take multicast packets into account and it's possible to send multicast packets via VPN tunnels belonging to a different profile. GrapheneOS addresses this by extending the standard netfilter configuration with a multicast firewall preventing sending packets through a VPN tunnel which a process isn't supposed to be able to access.

GrapheneOS closes a hole in Android's eBPF-based firewall system which made it possible to bypass the VPN by specifying a specific interface with a special system call.

Probably9857

Panda-na I have noticed that having an active VPN in Private Space, while using apps in owner profile, increases the accumulated data in the Private Space VPN (meaning that apps in owner profile goes through the Private Space VPN).

How did you determine this? How do you know it wasn't one or more apps in the private space running in the background?

Panda-na

Probably9857 Because I only have one app in the Private Space (not counting Proton VPN), and I have disable backround activity for that app, so it does not send any data when not actively used.

Also, in the notification center (swiping down from the top), the Ptotn VPN notification has an active data usage counter. If I start a video stream or download/upload a big file from apps in owner profile, I can see the data counter increasing accordingly. So it is very visible.

Probably9857

Panda-na

There are system apps in the Private Space too...

But what you describe with the video download does indeed seem suspicious. I'll be interested to hear what others think could be going on there.

Probably9857

Panda-na

If you check your external IP address from owner profile, does it give you a Proton server, or your real IP?

That would be pretty definitive if it gave you a Proton address.

Panda-na

Probably9857 Yes, I have already done that. It shows my real IP in Vanadium (in owner profile), and my VPNs IP in Vanadium in Private Space.

So my suspicion is that this is just some DNS bug or something.

Probably9857

Panda-na

Hard to say. It could be a bug in the recent VPN lockdown changes, or maybe an upstream bug. Or maybe there is some logical explanation we haven't thought of yet.

If I have time, maybe I'll try to reproduce later (w/ Mullvad).

Panda-na

Probably9857 I have seen the big increase in data usage (bacue of woner profile use) for a while, so I don't know when this problem appeared, unfortunately.

For a period I used a private DNS while using the VPN (which I know is really not recommended). Then I saw the same thing (or rather, I saw that the data counter for Proton VPN did not count any data when Private DNS was active).

« Previous Page Next Page »