General usage: short how-to's and quick tips

adelina

• You can put your data at rest quickly and easily without rebooting
• Don't need to erase your phone to erase data. Just delete profiles with sensitive data.
• after a reboot, personal data is behind two passwords/PINs
• a very easy way to do battery saving if a personal profile has VPN or Google Play Services running all the time, taking up battery
• sensitive global system settings are in the owner profile. If the owner profile only accepts a password/PIN, no biometrics, the phone would be a little safer

There might be more advantages I didn't think of.

I do this, personally. I find only one drawback to this method, which is it's a bit of a nuisance to switch back and forth sometimes when I need to make changes to system settings. However, I find it worth the extra effort.

unwat Amazing information! Thank you very much for this! I already thought of these reasons, but it's good to confirm. Also, the owner profile needs to be unlocked before I can unlock a secondary user profile, right? That way I could use biometric unlocking methods for convenience, but an attacker would need my password for the owner profile first, which is a different thing in some jurisdictions (police access). Is this correct?

adelina Also, the owner profile needs to be unlocked before I can unlock a secondary user profile, right

Yes. The owner profile holds system settings, so it has to be active for the phone to operate.

I keep my owner profile locked with a password. So, for example, if I'm in the US and I hear the cops breaking down my door I could end whichever secondary profile is running and they can't access anything.

unwat I feel like this scenario is not really the one GrapheneOS is designed for. This is not really a privacy issue any more at the point the cops are breaking down a door. Most likely, they and/or prosecutors are going to be able to manipulate you into giving them access to the phone.

If this is actually the scenario GrapheneOS is designed for, then it seems like they need an emergency wipe protocol--like, in a couple taps plus a password, I can start a process that either (a) deletes a secondary user profile, or (b) does a factory reset on the phone.

unwat what would be system settings?

unwat a very easy way to do battery saving if a personal profile has VPN or Google Play Services running all the time, taking up battery

I don't follow.

1. Why would Play Services drain more battery? Aren't they supposed to preserve battery thanks to centralized push notifications?
2. Even if they did drain extra battery, and you offloaded them to a user profile, wouldn't they still drain that same amount?

juicer

You're right about both points.

My point was that if the owner profile has nothing installed and you have a secondary profile for most day to day use, if you want to save battery you can easily terminate the profile's session. Google Play Services does use battery. Not too much, but more than an empty owner profile.

Like sometimes I'll just end all sessions and leave my phone on owner. My idle battery usage is way lower that way. Like maybe 3 times less usage while the phone is sitting idle.

Cigurd

You're right. I was just using that as an example that I think is kind of funny. If that thing were to actually happen to me I'm sure I'd be too busy freaking out to end my profile's session.

In all seriousness, I like that I can put my data to sleep without a reboot. It's very convenient.

TTS synthesising text into audible speech

To listen web pages in Vanadium, there is the open source app TTS util, with RHVoice or any text-to-speech engine app.

@Hulk, what are the benefits of setting an eSIM in Stock Android versus setting it up in GOS with sandbox Google Play and them removing Google Play once it is set?

Hulk

So the benefits of the tidy profile system relate to physical exfil and tampering, right? I've wondered if there could also be some benefit from a remote hacking perspective.

At first I thought that, similarly to making your main Linux user a non-root secondary user so that you can always escalate yourself to admin and regain control when your daily user inevitably gets hacked or aquires a virus, the GOS user spaces could prevent malware and hackers from escalating and infecting other users (and their data). Someone at GOS has since clarified that user spaces don't provide additional sandboxing, however.

But couldn't we still leverage user spaces to monitor and rule out malicious persistence?

An essentially bare main user profile suspended in carbonite would be easy to monitor for any changes, and as none should be expected, they would indicate tampering or unsolicited downloads with some confidence. Tertiary user spaces can be locked down in settings so that no new downloads occur (but presumably app data can still populate and function dynamically).

So maybe an extension to the attestation app (comparing our own encrypted system snapshots) could help us monitor user-state for any changes and work like an anti-evil-maid to confirm things are as expected in the OS user space?

What do you all think? Seems like a really long winded and pretentious way of saying compare to backups really, doesn't it....