Best way to add an always on VPN to new profile?

Agrapheneuser

It seems out the box, I need to, as a minimum, access the internet without VPN to download the VPN software - and then look up my VPN passwords etc in my paper notebook - each time I add a new profile. This isn't great, especially if wanting to add a profile when on the road / away from a trusted internet connection.

What's best practice here?, and are any of the below already possible?, or likely / possible / reasonable to add in future?

0) some documentation / wiki / notes / how to's on best practice for this? - searched here, and on matrix, but not found?

1) enable a global always on VPN (as an option), on the owner profile. Understand the negatives with this in terms of feeding both profile's traffic down a single pipe, but it would be useful to have as an option. (I've seen various posts on this, seems not available or planned?).

2) allow profiles to see WiFi hotspots broadcast by other profiles. (Assuming Wifi hotspots broadcast by profiles with an always on VPN go through the VPN?).

3) allow a copy-vpn-setup feature between profiles, so the always on VPN data of one profile can be pre-populated in another profile, before flight mode is turned off. As such it ensure the VPN on from the start.

4) allow apps to be installed (or as a minimum to be made available to install), from the owner profile to any other profile.

Thanks for any help or advice. Much appreciated. Loving the android 13, amazing how quickly that was achieved!

Reflux

Agrapheneuser
You could also add a VPN to your router so every device / profile always has a VPN, if your router allows this tho.

[deleted]

+1 to Reflux. VPN running on a router is what you're looking for. Personally I wouldn't sweat it. From the usage guide:

Wi-Fi on GrapheneOS is very privacy-friendly and is essentially anonymous as long as apps do not leak uniquely identifying information to the network. GrapheneOS avoids allowing itself to be fingerprinted as GrapheneOS, other than connections which are documented (see the default connections FAQ) and can be easily disabled or forced through a VPN service.

I'm okay with my device using my ISP to call some of the GOS domains while I fumble around for my WireGuard configs but your mileage may vary.

Agrapheneuser

Thanks for the reply. That's helpful.
However,
1- if I'm at home, I could use my VPN router of course. However, that renders adding a new profile to be something only to be done at base, not when travelling. This is quite a regression as part of the attraction of profiles is to use them almost like VMs, and delete them afterwards. If there's a battery powered VPN enabled LTE router, I guess that's an option, but pretty inconvenient...

2- As for just using it without a VPN, I think there's a few good reasons to use one. Depends on your threats i suppose? Are you saying that all your threats come from / via apps, so unless and until you choose to run them you don't need VPN? So can safely set up the profile, go online without vpn, install the vpn, just by being careful not to run any apps before that's done? I'd be interested to know if that's generally the case?

Thanks!

[deleted]

Agrapheneuser You might be interested in reading this and this to get a general idea of a threat model and how it relates to using commercial VPNs.

so unless and until you choose to run them you don't need VPN? So can safely set up the profile, go online without vpn, install the vpn, just by being careful not to run any apps before that's done

You said it yourself. If you want the app to get an IP address of your VPN provider just don't install it before you configure a VPN.

As to your first point it's just what it is.

Agrapheneuser

Thanks [deleted] Appreciate you replying. Also thanks for the link to the android bytes podcast in the other thread, which was interesting.

I think I'm fairly comfortable - as much as one can be! - that I understand my threat model, at least in so far as why I'm using GOS and VPN in the first place. I do trust my VPN provider, not sure I'd say the same of every mobile base station to which I connect. I was curious therefore you're response seemed to play down the importance of using VPN at all (at least in the first few minutes of installing a new profile), and I was interested as to your or others views on that, in case i was misunderstanding it?

Assuming I've not misunderstood, I'm pretty comfortable I should us a VPN, and apply a 'All the gear all the time' approach as best practice. As such, very interested if anyone has any advice, hints or tips, or anything likely to be in development, to getting the always on VPN up and running quickly and easily in new profiles, especially when travelling and not having access to a VPN router / other phone with VPN'd WiFi hotspot. It does seem a bit awkward right now.

Thanks!

[deleted]

Agrapheneuser you're response seemed to play down the importance of using VPN at all (at least in the first few minutes of installing a new profile), and I was interested as to your or others views on that, in case i was misunderstanding it?

I definitely downplayed the importance of spinning up a new GOS profile while being connected to a VPN to me. As I said, your mileage may vary. Should you for whatever reason need be connected to a VPN at all times you should definitely look into some portable routers and make sure they work with your VPN provider. I wouldn't know much about it as somewhat of a frequent traveler too. It's just a non-issue for me.

Agrapheneuser

Thanks Bud,
I'll look into it, but given one of the most exploited vulnerabilities is inconvenience, and I'm very human, keen to find a clean software solution, if possible... Not to mention policing that routers vulnerabilities - can it compete with a new pixel running GOS and all the effort and thought goes into keeping it tight?

Carrying a USB C memory stick to transfer the apks is possibly as close as I've got so far, but still hoping there's a solution that doesn't require carrying hardware??

Anyone?... Or am I the only one who does try to spin up new profiles away from home, and trusts his VPN provider more than base stations.... I'd be real interested if there's a technical reason that's daft?...

Thanks!

lemonadehabitat

Agrapheneuser Not a solution right now, but there is this Android 13 feature that hasn't been enabled in AOSP or GrapheneOS: installing existing apps in other profiles.
Maybe after the work for A13 is mostly done, the devs can consider enabling this for Graphene.

Although what I'd do is to spin up a few profiles at home, install vpns, and use them when I'm away.

Agrapheneuser

Thanks lemonadehabitat !

Appreciated. I'd just encourage the devs to make that change - would be so helpful... I'm sure this not being able to easily install VPNs on first use of a profile is a bit of vulnerability, even if more human than binary, so may carry some priority?

'To be sure' I tend to delete my burner profiles after use, so i'd need a few set up before I left!! - but maybe that's overkill and I could reuse them?

An ability to duplicate an existing profile would be ideal!

Thanks!

lemonadehabitat

Agrapheneuser Well, there you have it. They turned it on! Props to the dev team.

Fhggyy5767

lemonadehabitat that was a hell of a passphrase

lemonadehabitat

lemonadehabitat Ugh, I hate Linux's middle mouse button. Thank you for making the edit.

retired-mod-account

In a recent release, there is now an ability to copy apps from Owner profile to other secondary or guest profiles.

Also passphrase may have been pasted by accident from a message above. Please change whatever account uses that.

Arnauld

retired-mod-account

there is now an ability to copy apps from Owner profile to other secondary or guest profiles.

And how do you do that? Thank you.

MetropleX

retired-mod-account In a recent release, there is now an ability to copy apps from Owner profile to other secondary or guest profiles.

Arnauld And how do you do that? Thank you.

Arnauld SETTINGS>SYSTEM>MULTIPLE USERS>SELECT USER>INSTALL AVAILABLE APPS

Arnauld

MetropleX Thank you.

vfqilvqvmc

Alternatively you could use a 'Private APN' sim card to push all data traffic through your own network infrastructure via one of the many IoT/M2M telephony providers, although you would require an external server (e.g. pfSense) with ipsec + vpn routing configured that the Private APN carrier can route via.

This is much more expensive than simply configuring a VPN, as ontop of the VPN you'd need to get the Private APN sim ($100+/mo, extra for data) and the VPS infrastructure to do your own IP routing ($20-50/mo).

Then any data the phone uses will be tunneled through your own VPN & infrastructure, although traffic will still be observable at the carrier/intercept level unless you configure our own VPN ontop of that...