[deleted]
Hey, I thought I'd try to answer some of my own questions:
- App list - This seems to be separate, atleast using PackageManager API.
- VPN-only on main profile does not affect the work profile. I tried accessing a website that I had hosted locally, and it's not accessible through work profile.
- Notification does not seem to be accessible across the work profile. I tried using this & this, and I got an error message mentioning "work profile apps cannot change notification access".
So, unless there's a way to give access to the work profile, I don't think it's possible.
- IPC between main & work profile apps was not possible. I tested it with this repo.
- Clipboard should not be accessible when the app is in the background. I got the following error message when I tried it: "Denying clipboard access to com.example.datacollect, application is not in focus nor is it a system service for user 5".
But I could access it once it the window got back the focus (a toast message is shown when new clipboard data is accessed).
A hack is mentioned here, where the activity could be transparent, and it pops up and disappears. But I couldn't get this working perfectly, as I could still see a popup of the transparent activity where you'd lose focus to whatever you were doing. Maybe there's a way to perfect this, but I don't know.
- I tried this app to get some info on the device, mainly hardware info. The device ID was similar across user profiles, and different in the work profile. I believe this can be used to identify the user uniquely.
The device fingerprint was similar across all profiles, and likely everyone with the same device config should fall under this.
More info here & code here.
- I tried to use AdvertisingID, but I believe you need to have published an app on the play store. I didn't go any further.
This doesn't cover the possibility of using internal APIs using reflection, or other hacks.
If anyone has more ideas, or thoughts about this, I'm very interested.
So far, I can't think of a compelling reason to use separate user profiles. Work profile seems to isolate the apps mostly.
The only concern I could think of is, if there's some malware or malicious code running on the work profile, and somehow, it could affect the main profile (eg, clipboard access, sharing screen, etc).
I don't know how easy that situation is, but in my opinion, I don't think it'd be that different with actual profiles.
What I would've personally liked is a hybrid, where I could have an empty main profile, a second profile, which in-turn uses shelter for the proprietary apps. In situations of low battery, or just random issues, I'd just be able to close the other profiles.
Unfortunately, second profiles are not allowed through shelter. Maybe I'll try using Insular or TestDPC at some point, but it's not that important for now.