As the title states, what are your thoughts on the following setup?

**Current Phone**
    • Pixel 9 (want to upgrade when EMTE/FEAT_MTE4 becomes available)
    • GrapheneOS latest Stable channel with Security Preview Releases enabled
    • Major US mobile carrier pre-paid. Signed up with junk info in person (no ID checks) and buy top-up cards with cash at grocery stores. Rarely give out this number.
        ◦ I looked into Cape but I don’t think it provides all that much benefit, especially for the cost. Looking to move to JMP.Chat data only eSIM and phone numbers for call/SMS through their PSTN-to-XMPP bridge. US prepaid debit cards don’t work though because they’re in Canada, but crypto and Privacy.com are options.
    • OS language set to English (US) because I read somewhere that it’s listed in handset to teleco traffic (not sure if just OTA or also SS7) – so I figure if you use a rare language for a particular area, you could stick out.

**Main Profile (no Play Services, no Google app network permissions)**
    • System Settings
        ◦ Network and Internet
            ▪ Preferred Network Type: 5G or LTE only (reduce effectiveness of IMSI-catchers/Stingrays)
            ▪ Protection from 2G
            ▪ Internet Connectivity Checks: Off
            ▪ VPN: RethinkDNS (Always On, Block connections without VPN)
        ◦ Apps
            ▪ Grant special access to hardware accelerator to Google apps: Enabled (needed for Google Camera app)
        ◦ Wallpaper and Theme
            ▪ Additional Lock Screen Settings – Notifications on Lock Screen – Show Private Info: Off
        ◦ Security and Privacy
            ▪ Unlock Device
                • Long-ass passphrase for BFU, Fingerprint+PIN for AFU (power down when crossing a border or getting pulled over, _especially_ if you have nothing to hide – normalize not being a boot-licker - just backup your data in case CBP takes your shit and doesn’t give it back)
            ▪ Exploit Protection
                • Auto Reboot: 4 hours
                • USB-C Port: Charging-only when locked
                • Turn off Wi-Fi automatically: 2 minutes
                • Turn off Bluetooth automatically: 5 minutes
                • Memory Tagging: Enabled by default
                • Native Code Debugging: Blocked by default
                • WebView JIT: Disabled by default
                • Dynamic Code Loading via Memory: Restricted by default
                • Dynamic Code Loading via Storage: Restricted by default
                • Secure App Spawning: Enabled
            ▪ Extra
                • Notifications on Lock Screen – Show private info: Off
                • Allow Sensors Permission to App by Default: Off
                • Save Screenshot Timestamp to EXIF: Off
                • Encryption and Profile Data – Trusted Certificates: (disable any you don’t normally come across and/or from countries you might not trust like China, India, Turkey, Taiwan [they’re not bad but people seem to like to steal their root CAs], etc.)
                • Notify About System Process Crashes: On (crashes are a possible sign of unstable exploit attempt)
                • Automatic Exploit Protection Compatibility Mode: Off
        ◦ Location:
            ▪ SUPL / PSDS: GrapheneOS proxy
    • Signal (account not linked to any other devices, GOS app sandbox is way better than any laptop/desktop that isn’t a single-purpose VM on a trusted hypervisor)
        ◦ Account – Registration Lock – long-ass password (not just numbers)
        ◦ Chats – Create Link Previews: Off
        ◦ Privacy – Disappearing Messages Default Timer: 4 weeks
        ◦ Data and Storage – Automatically Download Media: (none - might prevent zero-click exploits like in image parsers)
    • Molly (similar to Signal settings above, linked to laptop as shared clipboard)
    • Accrescent
    • Aurora Store (anonymous login)
    • F-Droid
    • Cryptomator
        ◦ Additional virtual encrypted filesystem for rarely accessed files for additional protection
    • GBoard (no permissions, especially network)
    • Google Camera (camera/mic/sensors/storage scopes, no network)
    • Google Clock (notifications/sensors, no network)
    • Google Markup [GOS App Store] (no network)
    • Google Photos (storage scopes, no network)
    • Google Files (none, no network)
    • KeePassXD (make sure KDF is argon2)
    • OsmAnd~ (great FOSS offline maps and navigation)
    • RethinkDNS (nightly from GitHub, earlier versions can be unstable)
        ◦ Settings / App
            ▪ Block: Ad Privacy, ANDROID, Android Services Library, Camera, CameraExtentionsProxy, Clock, com.google.*, Gboard, IntentResolver, Markup
        ◦ Settings / DNS
            ▪ Block Lists On Device: (choose all the ones you want)
            ▪ Prevent DNS Leaks: On
        ◦ Settings / Firewall
            ▪ Universal Firewall Rules: Block when source app unknown (On), Block upon DNS bypass (On), Block recently installed apps by default (On), Block port 80 insecure HTTP (On), Block UDP except for DNS and NTP (Off – needed for Signal calls)
        ◦ Settings / Proxy
            ▪ Wireguard to commercial VPN set up – always on, block bypass
        ◦ Regularly check activity log for DNS queries and IP connections/GeoIP countries you’re not expecting from various apps. If something tingles your spidy senses, search it in VirusTotal. You can also whitelist/blacklist domains on a per-app basis.
    • Retro Music (all my music is local, streaming seems dumb)
    • Vanadium
        ◦ Search Provider: DuckDuckGo
        ◦ Privacy and Security
            ▪ Cross-origin referrer policy: Reduce cross-origin referrer
            ▪ WebRTC IP handling policy: Disable non-proxied UDP
            ▪ SafeBrowsing: Disabled (to not send URLs to Google)
            ▪ Always use secure connections: Warn about insecure public and private sites
            ▪ Use secure DNS: (Off – we want system DNS via local RethinkDNS resolver)
        ◦ Password manager: Off
        ◦ Payments and Addresses: Off
        ◦ Site settings: block all in permissions settings, allow Javascript but block JIT/3rd Party Login/Ads
        ◦ chrome://flags (idea is threat surface reduction and enhanced privacy, not 100% sure all of these do so but seems like they do)
            ▪ Accelerate 2D canvas: disabled
            ▪ Experimental WebAssembly Shared-Everything Threads: Disabled
            ▪ WebAssembly lazy compilation: Disabled
            ▪ Future V8 VM features: Disabled
            ▪ GPU rasterization: Disabled
            ▪ Hardware-accelerated video encode: Disabled
            ▪ TLS 1.3 Early Data: Enabled
            ▪ Strict-Origin-Isolation: Enabled
            ▪ Tracking Protection for 3PCD: Enabled
            ▪ Reduce Accept-Language request header and JavaScript navigator.languages: Enabled
            ▪ Enable Fingerprinting Protection Blocklist In Regular Browsing: Enabled
            ▪ Enable Fingerprinting Protection Blocklist In Incognito: Enabled
            ▪ Language detection web platform API: Disabled
            ▪ Signature-based Integrity Checks: Enabled 
            ▪ Block Cross Partition Blob URL Fetching: Enabled
            ▪ HTML-in-Canvas: Disabled
            ▪ Enable Cross-Device Pref Tracker: Disabled

**“Bank” Profile (Play Services)**
    • All my bank apps work, I just need to 2FA every time because it won’t “remember” as trusted
    • AOSP keyboard instead of Gboard on this profile since it has Play Services

The biggest thing I think is worth comparing is the main profile has a lot of individual Google apps but no network permissions for any of them and no Play Services. Because of inter-app communication by mutual agreement, having one Google app in a profile with network permissions could relay the telemetry from all the other apps to Google services. For that reason, in my “Bank” profile, I use the AOSP keyboard because I wouldn’t put it past Google to exfil every keystroke from Gboard if it could (I have no evidence of this but I’ll just assume they would if they could). Another thing I noticed when reviewing the RethinkDNS logs is the Android IntentsResolver was bleeding DNS queries to Google domains before I blocked it. Not sure if apps would try to use it to exfil data by encoding it into DNS queries.

Did I miss anything? Did anyone find this helpful? I know some of it was a little hand-wavy over some of the topics but feel free to chime in if you have any more info.

EDIT: fixed bullet point hierarchy with code block