Some opinions for my use case

JustaSec35984534

Hello everyone, first of all I would like to thank all of the GrapheneOS devs and supporters for this amazing OS.

So here is my situation, after using DivestOS for about 2 years now, I finally saved some money to get a Pixel 7a and install GrapheneOS on it. I'm soo happy with the Pixel phone and the GrapheneOS, I configured it yesterday but I'm currently in a debate with myself on what to do for my particular use case. Now my threat model isn't high, I'm you're average person who just prefers a smartphone that isn't spying on u and sending all it's data to big tech companies and a person who really hates ads.

I currently have two phones, one is a Pixel with GrapheneOS and one is a Xiaomi with DivestOS. On my GrapheneOS I have installed F-droid, NewPipe, KeePassDX, Aegis, Feeder, Signal (downloaded via the website), BreazyWeather and Retro Music. All of these apps are installed on the Owner profile and their permissions are set accordingly. Now I'm in a debate on how much of a security risk is Retro Music, I saw that the last update on F-Droid for Retro Music was 15 months ago which is a long time but the app can't communicate with internet as the only permission allowed is the access to Music and audio folder ?

And another question I have is that I'm currently starting University and since everything is done via Teams, Viber and Whatsapp I was actually thinking on how to solve this problem. As far as I know I have two options here:

Install LineageOS with Google Play Services on my Xiaomi phone and get a burner number, or
Make a second User profile in GrapheneOS for this stuff. Now I'm actually concerned is this even a good option to begin with, are Viber, Whatsapp etc. isolated from the apps on my other work profile, how much performance and battery usage are 2 profiles use, and would I be able to see notifications on my Owner profile from the other Google profile ? Either way what would u do in this situation would u just go with the other phone and install everything there for work/university etc. or would you go with the graphene profiles route ?

Sorry for the long post, thank you in advanced for the reply's !

Dumdum

JustaSec35984534 Retro Music, I saw that the last update on F-Droid for Retro Music was 15 months ago which is a long time but the app can't communicate with internet as the only permission allowed is the access to Music and audio folder ?

It should be fine, but you can maybe try an alternative such as Vinyl Music Player, if using Retro is a concern for you.

are Viber, Whatsapp etc. isolated from the apps on my other work profile

Yes. User profiles are isolated from each other.

how much performance and battery usage are 2 profiles use

Generally, not too much as long as you aren't running Google Play in both profiles. Even if you did, you could still get 1-2 days of battery if you don't use your device too heavily or use too many apps that run in the background.

would I be able to see notifications on my Owner profile from the other Google profile

You can forward notifications. In the "other Google profile", go Settings > System > Multiple users > Google profile > Enable "Send notifications to current user"

would you go with the graphene profiles route ?

This.

JustaSec35984534

Dumdum Hyy, thank you soo much for the reply, yeah I'll just stick to Retro Music because of the UI plus I used it for 2 years now and I'm used to it I was just concerned about the security could it be an attack vector but it doesn't communicate with the internet so I guess I'm fine ?

For the notifications tho, could the Google profile send notifications to my Owner profile since Imma be rarely logging in to the Google profile except when there is a message I would need to reply to, most of the time I would use the Owner profile with foss apps.

EDIT: Oh and one more thing if I sign off the Google profile I assume notifications won't go through to the main profile since the Google profile is technically logged out/shutdowned if it makes sense ?

Dumdum

JustaSec35984534 could the Google profile send notifications to my Owner profile since Imma be rarely logging in to the Google profile except when there is a message I would need to reply to, most of the time I would use the Owner profile with foss apps.

As I said before, enable Send notifications to current user in the Google profile. This will mean you will receive the Google profile notifications while in the Owner profile.

if I sign off the Google profile I assume notifications won't go through to the main profile since the Google profile is technically logged out/shutdowned if it makes sense ?

I assume you mean End session. Yes, profile is completely shut down, apps can not run, the profile is encrypted.

JustaSec35984534

Dumdum Thank you once again for the reply, I didn't think this through clearly since now I just realized that if I make a new user profile I can't change the SIM card. So I want to use one SIM for my personal stuff or the Owner profile and the second eSIM for the Google profile is it possible to isolate each SIM to a specific user profile ?

JustaSec35984534

JustaSec35984534 Oh and my bad for bad wording I know I can use Viber and Whatsapp without the SIM but was asking about regular phone calls and SMS.

Dumdum

JustaSec35984534 So I want to use one SIM for my personal stuff or the Owner profile and the second eSIM for the Google profile is it possible to isolate each SIM to a specific user profile ?

I don't believe so. SIMs are systemwide as far as I'm aware. I use single SIM so I wouldn't know if there is a way.

Carlos-Anso

JustaSec35984534
If you want to have different phone numbers for different user profiles you can install apps to use VoIP services

JustaSec35984534

Dumdum Do you know what are the risks of using the same SIM card on whatsapp/viber while that same SIM is also used as ur private number ?

Dumdum

JustaSec35984534
I don't use Whatsapp/Viber so I can't say for certain, but as you see here, they shouldn't be able to get anything beyond just the phone number you give them, I think. I assume that's what you mean by risks, anyway?

JustaSec35984534

Dumdum Well yes and no like would you personally use the same number u use on Signal with another app like Viber/Whatsapp or would u just go with a burner number for all of that stuff.

Dumdum

JustaSec35984534
Personally I wouldn't stress about them having the phone number because:

The messages should be E2EE anyway, so for the most part, they'd just know that I'm using both Signal and Whatsapp and that's it. Some people might be bothered by this connection, but I'm not.
If I wanted to keep things truly private/separated from each other, then I'd use one of the phone number-free messengers (e.g. Conversations, Element, SimpleX)

OfflinePuffin

for music I swear by Auxio it is the open source player that Simply works and looks great too... This is not a bit OxygenCobalt has built a great project

OfflinePuffin

Carlos-Anso

If you have a sip you can use jami