Playstore in the "side of burritos" way and concerns

ototufu

Hi everybody. I'm wondering how I can have a better application store setup.

Actually I'm using several profiles, keeping the owner profile completely empty, using f-droid and aurora store to install apps in each single profile. Quite daunting.

Reading this forum it's clear that f-droid and aurora store have several problems,
and accrescent and official play store are the "best" candidates to install apps in a secure way.

Reading several sources (see links at the end of the message for reference), I'm thinking the approach taken by side of burritos in the video "GrapheneOS: After 3 Years, ..." is the best one. You install play store in owner profile with a dummy account and manage centrally all the applications. So you update them once for all profiles, more secure and it's much less dispersive.

But, I've a big concern: since you need to install play services and the owner account cannot be put at rest, there will be some data harvesting running in background continuously by google services. What do you think and what you suggest if some one decides to take this app store approach?

Thank you for your help

References:
https://discuss.grapheneos.org/d/14452-how-to-explain-why-accrescent-over-f-droid/31
https://privsec.dev/posts/android/f-droid-security-issues/
https://www.youtube.com/watch?v=IAoCfrqxIEg

epileptic055

That's the entire idea of an "installer" profile, also SOB says you need to create an anonymous account for each profile, basically a fresh Google account per profile, that way google "technically" doesnt know who you are, its part of a higher threat model than most users would face.

The other idea is that you disable the apps you install, then shift them into their respective profiles, that way it minimises use of said apps, and potential data leakage from the apps.

GOS21606

Disable all (network) permissions in the owner profile, shift your apps to the right user profile and use the apps there without GPS and there will be no data leakage from the owner to Google.

ticklemyIP

The only concern I have is I would prefer to keep the admin profile as default ad possible. However the ability to install apps to secondary profiles from the admin profile is really useful and not available for secondary users as far as I know. This makes using a dedicated update profile hard or impossible. Is there anything I'm missing or anything I could do to make something like this work?