Microsoft apps seem to communicate with each other?

xabdax

Hey everyone, I'm just trying to understand how Microsoft apps communicate with each other. I was logged in on the Outlook app with my MS account, and when I recently downloaded MS Excel, I automatically got logged in there as well, without me providing any user name or password.

I can't find my Microsoft account among the others in "Passwords, passkeys and accounts" in my settings, though. Thus I do wonder how Excel obtained information about my login credentials, since I thought these apps are all sandboxed and separated from each other.

de0u

xabdax I thought these apps are all sandboxed and separated from each other.

They are sandboxed, via the Android app sandbox, but the app sandbox is not a way to convert privacy-invasive apps into privacy-respecting apps. In particular, a core part of the Android design is that apps that choose to can communicate with each other via IPC.

Bismark

xabdax
My employer uses outlook and the employees are required to check it once in a while. I went to the webpage for outlook using vanadium browser and somehow I got it to save to the home screen, like a shortcut. Works well, only annoyance is having to log in if you clear you cache and cookies in vanadium. I dont ever open it since I fwd all outlook stuff to my personal email and just use outlook browser app shortcut when I want to send a email from the companies domain.

Anon74

xabdax Hey everyone, I'm just trying to understand how Microsoft apps communicate with each other. I was logged in on the Outlook app with my MS account, and when I recently downloaded MS Excel, I automatically got logged in there as well, without me providing any user name or password.

I can't find my Microsoft account among the others in "Passwords, passkeys and accounts" in my settings, though. Thus I do wonder how Excel obtained information about my login credentials, since I thought these apps are all sandboxed and separated from each other.

de0u They are sandboxed, via the Android app sandbox, but the app sandbox is not a way to convert privacy-invasive apps into privacy-respecting apps. In particular, a core part of the Android design is that apps that choose to can communicate with each other via IPC.

This is main reason why I would separate proprietary apps that should be offline (like Google camera) from proprietary apps that need network access.
The easiest way to do this, is using the private space for proprietary apps with network access.

Oggyo

When they can communicate via IPC, the MS apps use shared account/token information between them.

I guess this is because of the sec. policies when the admin needs to revoke access to the whole suite, not just a single app, and to break the persistent authentication sessions.

xabdax

What other data can these apps share with each other? If I allow one app unrestricted access to my pictures, will the other be able to access them via IPC?

Delaney

xabdax
Probably not. IPC isn't intended for large data transfers. I believe it has a limit of 1MB per transaction.

de0u

xabdax If I allow one app unrestricted access to my pictures, will the other be able to access them via IPC?

In theory, yes. Again, that would require that the apps be designed to behave that way.

xabdax

Delaney so if the app uses and arbitrary number of transactions, it can transfer an arbitrary amount of data bit by bit

Delaney

xabdax so if the app uses and arbitrary number of transactions, it can transfer an arbitrary amount of data bit by bit

That is very impractical and would likely lead to crashes due to IPC restrictions, not to mention a huge performance cost.

What is it you are concerned about exactly? I think it is expected that Microsoft apps can communicate with each other. IPC isn't necessarily required to communicate between such apps.

xabdax

is there a way to stop them from doing that, i.e. strictly isolate them from each other on the OS-level? it seems to me that the sandboxing imposed by GrapheneOS only offers limited privacy if such transactions are still possible

de0u

xabdax is there a way to stop them from doing that, i.e. strictly isolate them from each other on the OS-level?

At present, the way to separate apps is to put them in different user profiles.

xabdax it seems to me that the sandboxing imposed by GrapheneOS only offers limited privacy if such transactions are still possible

Everything is limited. In theory, apps can exfiltrate data via ultrasound.

If you distrust how Microsoft apps will handle your data, providing your data to Microsoft apps may not be the most effective way to act on that distrust.

gvprtskvni

xabdax You should be fine if you use the online web app in Vanadium for one of them.

xabdax

What do you mean by "private space" for proprietary apps?

Dumdum

xabdax
System settings > Security and privacy > Private space

de0u

Delaney Which crashes would result from which restrictions?

Delaney

de0u
https://developer.android.com/reference/android/os/TransactionTooLargeException

I should've clarified it's an exception which can lead to the crash depending on how the app handles it.

Anecdotally, I've heard IPC can be very unpredictable as apps approach the 1MB limit. The docs seem to recommend keeping size to a minimum to avoid this.

schweizer

I do not see the point of separating the apps on client side when everything is connected on server side. With M365 you get email, video conferencing, storage, calendar and contacts all together. Either you want that or you should leave it aside.

de0u

Delaney Thanks for providing the link!

The other poster suggested using multiple small IPC transactions, so the limit on the size of one transaction would not apply.