Connectivity settings across different profiles

indiDing

Hi,

I´m using two profiles – A (owner) and B ("trash" profile). When I´m logged in to B and change settings like internet on/off or flightmode on/off and switch back A, then these settings are also applied to A.

What I want: B should never have access to internet, while working an A without having to manually disable this stuff on B and then again turn on when I´m back to A. Is there a way to do this (without tasker)?

Hulk

indiDing
Hello!

Internet access is global.
When your phone is connected to the internet, your whole phone is connected to the internet.

You can revoke the Network permission from third-party apps to block them from accessing the internet.

You can also set-up a VPN on your profile B and block all connections without a VPN.

Hope this helps

Hulk

indiDing
I am terribly sorry, but you were extremely misinformed about "trackers".

I will try to explain all of this a bit later (very busy right now).

In the meantime, please read this article:
https://www.ranum.com/security/computer_security/editorials/dumb/

What you refer to as "trackers" is actually badness enumeration, and it does not work.

indiDing

Hulk
I read your article and I understand the idea/philosophy behind this. However, I know what "good" and what "bad" is, I don´t need updating enumerations all the time.

Let´s take one of these apps I mentioned: it needs not more then 2 domains to work properly. This is the good enumeration. All other domains are blocked (bad enumeration). As I don´t update this app since I´m forced from the vendor to do so (or for any other serious reason) my app will typically work for years and within this time it does not change it´s good/bad list. In my case I´m talking about 3 apps, maybe there will be 1 or 2 more over the time. So the workload to set up my good/bad list is on a very low level and then I have freedom for years. That´s another scenario than you desribed in your article, isn´t it? ;-)

indiDing

From what you said ("When your phone is connected to the internet, your whole phone is connected to the internet.") my concept of using two different profiles for the mentioned purposes makes no sense any more :-(

Hulk

indiDing
Your logic is flawed.

Here's a simple example:

Let's say you have a third-party app that requires an internet connection to function properly. Let's assume that you don't trust this app, and you've (somehow) figured out that it only uses 2 servers: server A and server B.

If you want to block the app from talking to server A, go ahead, but keep in mind that your app can still talk to server B, and servers A and B can talk with each other. There is no way for you to stop servers A and B from communicating with each other. There is also no way for you to know what is actually running on the servers unless you have a direct physical access to them. Even if people running those servers would "open-source" stuff that is running on their servers you are still trusting these people. There is no way for you to figure out if they are lying or not

That's why you either allow the app to connect to both A and B, or you disallow everything.

Badness enumeration does not work.

indiDing

Good point, Hulk!

Again an example, let´s take my banking app. It uses 2 servers (e.g. assets.myBank.com) for loading assets and API for business logic (e.g. api.myBank.com). Additionally it uses 3 other domains (e.g. crashlytics, ioam and such plagues). When I filter the bad list I´m fine. I just want to (in best case) stop sharing anything with google and these folks. The only "risk", that the trusted domain (*.myBank.com) will connect to untrusted domains (e.g. crashlytics.firebase.com) and tell google something. As far is I know google offers no such API yet.

Hulk

indiDing
Unfortunately, there is no way for you to find out whether your bank shares any information with Google. At this point you are literally just hoping that they don't.

indiDing

That´s right!
But there´s hope: The reason why a PO (or his dev teeam) makes the decision for including tracking libs, because it´s easy to integrate (trade off: they often force you to update your code), less work for your devs (saves money) and they – I have to admit it – offer a really cool featured system which allows POs and marketing depts. to know nearly everything about your customers. It would mean a lot of extra work for the devs to gather informations and feed a google-API ... and finally, I doubt that google really need some bytes of information from myBanking.com ;-)