What is the best practice to use User/Work profile on GrapheneOS

mmmm

Psycowave is that mean I can also get notification from other user (active) profiles while I am in another user profile?

Yes, but you won't see the notification itself, just that you had a notification and from which app.

Dumdum

Psycowave Other User profiles (may attach work profiles to any one of them if needed)

To my knowledge, work profile can only exist alongside the Owner profile.

spiral

Psycowave

There's no real "best practice," it just depends on a person's use case and preferences.

Similar to how, in Linux for example, one's main User should not have unlimited sudo permissions, it can be considered a good idea to have your daily driver User on GoS inside of a secondary user. Since certain core settings for the OS can only be accessed from the Owner profile, using a secondary User can limit exposure to these settings if, for instance, your phone is snatched out of your hand while inside a secondary user.

GlytchMeister

I was under the impression that the most secure/private practice (and most inconveniently restrictive) was to leave the owner profile alone and only use it for global settings, then do installations on secondary profiles so you can keep them quarantined however you desire. Such as putting all google stuff on one profile so google can't see the rest of the phone (mostly?).

But as said before by others, privacy and security exist on a spectrum that, from what I understand, is opposed by convenience. So everyone needs to kinda figure out their own best practice.

Viewpoint0232

There is no "best practice", it comes down to what balance of inconvenience vs privacy you want to have.

Personally, I am just running a work profile for apps that need Google Play Services for notifications (which in my case is a banking app and an app for my childrens' school), while I keep my main profile completely degoogled. The work profile is very "integrated" so it's very convenient. Notifications work perfectly and I don't have to switch between profiles.

mmmm

Viewpoint0232 I was under the impression that using a work profile rather than another profile, doesn't actually separate your apps from the underlying profile as using actual separate profiles. So surely that means your profile isn't in fact degoogled, as you have gps installed on the work profile layer?

Edit* by the way - I definitely may have misunderstood your usage and/or how it works in general!

Viewpoint0232

mmmm

It keeps files, contacts and apps separate. Even the network stack is separate so if you run a VPN in your main profile it won't run in your work profile. In fact, I'm not sure what the real advantage of a secondary profile would be.

mmmm

Viewpoint0232 inter app comms is my main reason, I assume it can't separate that..

Viewpoint0232

mmmm

I'm very sure IPC is separate with a work profile

mmmm

Viewpoint0232 thats good news, if thats the case. I was always under the impression work profiles (app based, rather than separate profiles) didn't fully separate apps. What app do you use to create a work profile? Do you have some links to provide to back up your statement?

Viewpoint0232

mmmm

I use Shelter.

Google gives guidance how to "connect" apps across profiles: https://support.google.com/work/android/answer/10064639
This would imply that by default apps can't communicate across main/work profiles

mmmm

Viewpoint0232 interesting. Thanks for the info!

mmmm

I do wonder why, as this seems a great solution to the inconvenience of using multiple profiles, whilst still retaining seemingly the same protections, the GrapheneOS project hasn't made more of the option, or more importantly hasn't added a native function to access this type of profile.