A completely offline user profile

user539

Will this ever be possible to create a completely offline user profile without the ability to access any network.
It could be useful for safe cold storage or even for a profile with gcam and gphotos for taking pictures etc..
Only acces via USB port.
Many useful uses.

de0u

user539 This is an interesting idea. I suspect it is also simpler to implement than other requested enhancements related to profiles and networking (simpler UI, simpler filtering code). You might try filing an issue on GitHub.

Hb1hf

user539 it's not GrapheneOS-level assurance, but there are somethings you may try to emulate it. You can create a profile, set some VPN app with always on, and not enter an account into it. Or maybe install a firewall in that profile and block everything by default.

user539

de0u I am wondering why we don't have this yet. Its such a strong feature that is a must.
Imagine the options, sensitive data storing, even could be used as crypto storage,
Usage of offline apps not having to worry about ipc or network leaks and security, when all is offline in a separate isolated user.

I don't have github account, maybe someone else can do this.

de0u

user539 I am wondering why we don't have this yet.

Perhaps because it hasn't been requested. Or perhaps because it is on the wrong side of a cost/benefit analysis.

user539 Its such a strong feature that is a must.

Well... something like 200,000 people are using GrapheneOS without that feature, so maybe it isn't actually a must.

user539 I don't have github account, maybe someone else can do this.

Ok, will do.

de0u

user539 I don't have github account, maybe someone else can do this.

Issue 4133.

All, please note that the GrapheneOS developers have requested that people not make "I want this too!" posts to GitHub issues, also not make "When will this happen?" posts. If you have a GitHub account, it is fine to use the "Subscribe" button and/or to use reaction emoji. In the past, extraneous posts have caused the developers to lock out commenting.

Also, future readers of this thread, please note that this feature request may well never be implemented, so it is probably not productive to make "Is there a projected date for this feature to be implemented?" posts in the thread, at least not more frequently than one post in six months.

Please note that I do not speak for the GrapheneOS project.

user539

de0u so maybe it isn't actually a must.

Maybe not a must but it is an excellent idea and option.

de0u Well... something like 200,000 people are using GrapheneOS without that feature, so maybe it isn't actually a must.

Graphene is awesome without it, maybe the idea hasn't crossed anyone's mind.
It's not a must but it is an excellent idea and option.

DeletedUser69

user539 how would you make an owner profile offline? By turning WiFi, SIM off and switching on airplane mode. Software toggles should work as intended. Upon switching to new profile, it will inherit those settings and stay offline. This is just an idea, that can be easily executed in few steps. This is presuming that you are in control of the device and you know not to change anything. I think there is something different behind what you are asking for (like another person using that profile with requirement that device is offline, can't help with that).

user539

Hb1hf yes but still have possibilities to go online With a few clicks , and you must trust 2 apps, vpn and firewall.
Real offline is when there are no way to go online.

user539

DeletedUser69 I don't know how, its not my area.
But obviously disabling all network related stuff, without the possibility to enable from owner or user profile.

user539

DeletedUser69 Software toggles should work as intended

Toggles can be toggled again and always to activate, same as to deactivate.

user539

DeletedUser69 I think there is something different behind what you are asking for

I am thinking of a vault

DeletedUser69

user539 You're quick to react, I edited my post in the meantime.

DeletedUser69

user539 I presume you are a grown up and in control of your actions, so my proposition should work for you.

user539

DeletedUser69 That's not the point. To many Toggles with sensitive data together. So it's not foolproof.

Carlos-Anso

Apart from the few leaks that are steadily being fixed up, the app in the VPN slot has full control of all network traffic in that user profile.
Part the reason fixing the leaks has taken so long is that some networking functionality is performed by the kernel rather than tied to a particular user profile, even though the app making those connections is installed in a user profile.

The VPN slot is the place to add the desired profile network blocking functionality. Could be an app made specifically for that task.