App in Private Space can detect VPN is enabled on the main space

someone27281

So I use this govt app for IDs https://play.google.com/store/apps/details?id=com.digilocker.android on my private space where Google Play is installed. However, recently, when I open the app, I get a notification telling me to turn off VPN. My private space is not connected to VPN and the IP shown from Vanadium is real. However, my main space is VPN'ed by Proton VPN. If I disconnect from that VPN, now my digilovker works. I use the VPN in always on blocking mode.

Since the VPN is in blocking mode and is safe to disconnect, I do wonder if this has other consequences. The private space is not supposed to know what my main space is doing, right???

monozygote

someone27281 The private space is not supposed to know what my main space is doing, right???

Unless there's some traffic-over-localhost kinda collusion, from what I understand. If you have something running in 2 separate profiles/spaces, they can collude over localhost. I don't think that's fixed yet. But besides that, I'm curious too why that's happening. Does it also happen over separate profiles (one profile with VPN and other without)? Maybe some kind of an exploit?

other8026

someone27281 I'd suggest taking a look at this issue: https://github.com/GrapheneOS/os-issue-tracker/issues/5225.

And the regular thing I say when the issue tracker comes up: if you want a feature, please don't add comments that aren't related to development. If you want to indicate to the developers that a feature is wanted, you can add a reaction like a thumbs up.

someone27281

other8026

I can't do neither since Github won't allow me to create an account (I run on a VPN as I said)

Google_disliker

Hmm I remember reading this a while ago and would also be interested in learning more about this. Is it possible / likely for this to cause leaks in a main profile with block connections without VPN enabled if the private / work profile isn't connected to a VPN?

Winston

This is surprising to read. Apparently it is the same for other profiles entirely. I've never personally ran into this. I guess im surprised because of vpn connections being isolated (supposedly) across profiles, PS, hotspot, etc.

So, if apps have the ability to see VPN connections in other profiles, what does this mean? I dont really know what im asking...i guess are there any privacy/security takeaways one should have from this revelation?

Winston

At what point in connectivity checks does an app discover a vpn in another space/profile? Lets say i fire up a profile running TorVPN (always-on, blocking w/o), what is the "path" one of these apps would take to discover connections in other profiles and what all information do they actually get?