Best way to add an always on VPN to new profile?

[deleted]

Agrapheneuser You might be interested in reading this and this to get a general idea of a threat model and how it relates to using commercial VPNs.

so unless and until you choose to run them you don't need VPN? So can safely set up the profile, go online without vpn, install the vpn, just by being careful not to run any apps before that's done

You said it yourself. If you want the app to get an IP address of your VPN provider just don't install it before you configure a VPN.

As to your first point it's just what it is.

Agrapheneuser

Thanks [deleted] Appreciate you replying. Also thanks for the link to the android bytes podcast in the other thread, which was interesting.

I think I'm fairly comfortable - as much as one can be! - that I understand my threat model, at least in so far as why I'm using GOS and VPN in the first place. I do trust my VPN provider, not sure I'd say the same of every mobile base station to which I connect. I was curious therefore you're response seemed to play down the importance of using VPN at all (at least in the first few minutes of installing a new profile), and I was interested as to your or others views on that, in case i was misunderstanding it?

Assuming I've not misunderstood, I'm pretty comfortable I should us a VPN, and apply a 'All the gear all the time' approach as best practice. As such, very interested if anyone has any advice, hints or tips, or anything likely to be in development, to getting the always on VPN up and running quickly and easily in new profiles, especially when travelling and not having access to a VPN router / other phone with VPN'd WiFi hotspot. It does seem a bit awkward right now.

Thanks!

[deleted]

Agrapheneuser you're response seemed to play down the importance of using VPN at all (at least in the first few minutes of installing a new profile), and I was interested as to your or others views on that, in case i was misunderstanding it?

I definitely downplayed the importance of spinning up a new GOS profile while being connected to a VPN to me. As I said, your mileage may vary. Should you for whatever reason need be connected to a VPN at all times you should definitely look into some portable routers and make sure they work with your VPN provider. I wouldn't know much about it as somewhat of a frequent traveler too. It's just a non-issue for me.

Agrapheneuser

Thanks Bud,
I'll look into it, but given one of the most exploited vulnerabilities is inconvenience, and I'm very human, keen to find a clean software solution, if possible... Not to mention policing that routers vulnerabilities - can it compete with a new pixel running GOS and all the effort and thought goes into keeping it tight?

Carrying a USB C memory stick to transfer the apks is possibly as close as I've got so far, but still hoping there's a solution that doesn't require carrying hardware??

Anyone?... Or am I the only one who does try to spin up new profiles away from home, and trusts his VPN provider more than base stations.... I'd be real interested if there's a technical reason that's daft?...

Thanks!

lemonadehabitat

Agrapheneuser Not a solution right now, but there is this Android 13 feature that hasn't been enabled in AOSP or GrapheneOS: installing existing apps in other profiles.
Maybe after the work for A13 is mostly done, the devs can consider enabling this for Graphene.

Although what I'd do is to spin up a few profiles at home, install vpns, and use them when I'm away.

Agrapheneuser

Thanks lemonadehabitat !

Appreciated. I'd just encourage the devs to make that change - would be so helpful... I'm sure this not being able to easily install VPNs on first use of a profile is a bit of vulnerability, even if more human than binary, so may carry some priority?

'To be sure' I tend to delete my burner profiles after use, so i'd need a few set up before I left!! - but maybe that's overkill and I could reuse them?

An ability to duplicate an existing profile would be ideal!

Thanks!

lemonadehabitat

Agrapheneuser Well, there you have it. They turned it on! Props to the dev team.

Fhggyy5767

lemonadehabitat that was a hell of a passphrase

lemonadehabitat

lemonadehabitat Ugh, I hate Linux's middle mouse button. Thank you for making the edit.

retired-mod-account

In a recent release, there is now an ability to copy apps from Owner profile to other secondary or guest profiles.

Also passphrase may have been pasted by accident from a message above. Please change whatever account uses that.

Arnauld

retired-mod-account

there is now an ability to copy apps from Owner profile to other secondary or guest profiles.

And how do you do that? Thank you.

MetropleX

retired-mod-account In a recent release, there is now an ability to copy apps from Owner profile to other secondary or guest profiles.

Arnauld And how do you do that? Thank you.

Arnauld SETTINGS>SYSTEM>MULTIPLE USERS>SELECT USER>INSTALL AVAILABLE APPS

Arnauld

MetropleX Thank you.

vfqilvqvmc

Alternatively you could use a 'Private APN' sim card to push all data traffic through your own network infrastructure via one of the many IoT/M2M telephony providers, although you would require an external server (e.g. pfSense) with ipsec + vpn routing configured that the Private APN carrier can route via.

This is much more expensive than simply configuring a VPN, as ontop of the VPN you'd need to get the Private APN sim ($100+/mo, extra for data) and the VPS infrastructure to do your own IP routing ($20-50/mo).

Then any data the phone uses will be tunneled through your own VPN & infrastructure, although traffic will still be observable at the carrier/intercept level unless you configure our own VPN ontop of that...