Super Funicular

Posted on Aug 26

Lock Everything Except the Camera: An Android Private Space Walkthrough for a Phone Mounted in a Hallway

#android #privacy #security #mobile

Short answer: A phone doing camera duty is mounted where people walk past it, and it is usually still signed in to whatever it was signed in to when it belonged to somebody. The instinct is to isolate the camera — put it in a secondary user, or in private space. Both of those work by stopping the apps of whoever is not in front of the device, which is the one thing a camera cannot survive. Android's own documentation points at the opposite arrangement: leave the camera in the main space and put everything you would not want read from the hallway into private space instead. Here is the whole procedure, and the five things private space will not do for you. Background Camera RemoteStream is what I build; everything below is about the platform, not the app.

This is the practical companion to Your Camera Phone Is Still Signed In, which argues why Android's isolation primitives are the wrong shape for an unattended device. That piece ends on a one-line prescription. This one is the walkthrough, with the documentation quoted and the limitations listed in the same place, because a procedure you cannot see the edges of is not much use.

Why the obvious version does not work

Two sentences from Google's private space documentation decide the entire layout.

The first is what happens to an app inside a locked private space:

"Completely stopped. These apps can't perform foreground or background activities, like showing notifications."

And the warning attached to it, in plain language:

"You should not use private space for apps that need to provide you with functionality in the background when your private space is locked."

A camera is the textbook example of an app that needs to work in the background. The same passage picks a different one to make the point — "medical apps can't track health information when the device is locked" — but the shape is identical. Private space is a safe. A safe is a bad place to keep the one thing whose job is to stay awake.

The second sentence is the one that pays for the article:

"Apps installed outside of private space won't be affected by these restrictions, even if you also have a private space on your device simultaneously."

So the arrangement runs backwards from the instinct. The camera stays out of the vault. Your mail, your messages, your banking app go in. The camera is unaffected because it is not in there, and the things that would be legible to a courier standing in your hallway are stopped, hidden, and unable to raise a notification.

Before you start: whether your phone can do this at all

The documentation is specific about the preconditions, and a couple of them catch people out.

Android 15 and up. Below that, the feature does not exist and no setting will reveal it.
Not a managed device, and no supervised account signed in on the main space.
Not inside a secondary user. Google states it directly: you cannot use private space when "It is within a secondary user." If you already tried the give-the-camera-its-own-user approach, the two remedies do not stack, and you will need to unwind one.
Not as a guest. "You can only use private space as the main user of the device."
Fewer than five users or profiles on the device.
It can also be disabled by the device manufacturer or an enterprise admin, so the option may simply not be there on a given handset.

Check first. This is the sort of thing that is much less annoying to discover before you have taken the phone down off its shelf.

The setup, in order

Straight from Google's steps, with the camera-phone reasoning attached.

Settings → Security & privacy → Private space. Authenticate with the device screen lock. If the phone does not have one, you will be asked to set one up — which is worth doing anyway on a device other people can reach.
Tap Set up, then Got it.
Decide about the account. You are offered the option of signing in to a Google Account. Google's own recommendation is a dedicated account, because private space "doesn't automatically read the accounts in your main space" — and if you sign in with an account you already use elsewhere, "synced photos, files, emails, contacts, calendar events", browsing history, bookmarks, saved passwords and app download history become available outside the space. You can skip the sign-in entirely; you just cannot install from the Play Store inside the space without one.
Set the private space lock. Either reuse the device screen lock or choose a separate PIN, pattern or password. On a phone that lives in a hallway, separate is the point of the exercise.
Install the apps you want hidden, inside the space. Long-press an app in All Apps and tap Install app in Private space, or open the space and tap + Install. Note what this does and does not do: "The new instance of the app is installed. The previous instance isn't copied or modified," and "private space doesn't allow you to move an app's data from the main space app into private space." You are installing a second, empty copy — then you uninstall the original from the main space, or it is still sitting there in the launcher doing exactly what it did before.
Turn on automatic locking. This is the step that makes the whole thing hold. In the private space settings, Lock private space automatically offers three options: "Every time device locks", "5 minutes after screen timeout", and "Only after the device restarts." For a mounted phone, the first one is the only one that matches reality — nobody is going to come and lock it by hand.
Optionally hide the container. Under "Hide," turn on Hide private space when it's locked. The container then disappears from All Apps whenever the space is locked. There is a neat detail here: the "Reset private space" action shows in System settings even when you do not have one, so its presence tells a person nothing either way.

What the camera side needs from you: nothing

That is the point. The camera app was never moved, so nothing about it changes. It sits in the main space with whatever foreground-service and permission arrangement it already had, and the private space restrictions do not reach it. There is no camera-side configuration in this procedure at all, which is the strongest argument for doing it this way round.

Five things private space will not do

Every one of these is stated in the documentation, and each one matters more on a device that lives on a shelf than on one in your pocket.

1. It is not hidden from a computer. Google: private space "can be uncovered through computer access, which includes Android Debug Bridge (adb) commands, device logs, or by apps." The threat model is a person glancing at a screen, not a person with a cable and time.

2. It bypasses your VPN. "Private space apps bypass virtual private network (VPN) on the device." If your mental model of this phone was "everything on it goes through the tunnel," that model now has a hole in it, and the hole is exactly where you put the sensitive apps.

3. There is no recovery if you forget the lock. "Use unlock factor recovery. If you forget your private space unlock factor, you won't be able to access the space." It is in the "you can't" list. Your options are to remember it or to delete the space, and deletion takes the app data with it: "The app and its data are deleted with no backup."

4. It is not backed up. "Backup and restore app data as part of device back up" is unsupported, and "when you restore the device from a device backup, private space won't be restored." Anything that lives only in there lives on exactly one device.

5. A short list of ordinary features stop working inside it. No widgets or home-screen shortcuts, no Quick Share receiving, no smart-home pairing, no Find Hub, no voice commands, and no work profile. Bluetooth is one-way: you can send from private space apps, but the space "doesn't appear as a share target" when another device tries to share to it.

None of these is a reason not to do it. They are reasons to know what you have built before you rely on it.

The part I cannot help with, and would not want to

A camera app cannot tidy the rest of your phone for you, and you should be wary of one that offers.

Reading or suppressing another app's notifications on Android requires a notification-listener grant — access to the entire contents of every notification on the device. That is close to the last permission you would want a camera app to hold, and an app that asked for it in order to clean up a hallway display would have bought something small with something very large. The controls in this article live in system settings, owned by you, applying to everything, and that is the right place for them.

If you do nothing else from this page, do the cheap thing first: on the camera phone, open Settings → Notifications, and under "Privacy," look at Notifications on lock screen. Decide deliberately whether Show sensitive content should be on for a device mounted at reading height in a room other people walk through. Private space is the thorough version. That setting is the two-minute version, and it is the one most people have never opened.

DEV Community