Google Account in Different Profile

syzy

I couldn't find a previous post explicitly dealing with this question (the closest was this one: https://discuss.grapheneos.org/d/10062-can-i-install-google-services-to-the-ownernew-account-account), but if I missed something, I apologize.

I'm wondering what the security risks are of signing in to a Google Account on a designated Google user. Specifically, I need to use Duo (and some other apps requiring a Google Account), and so I figured that I could just create a separate Google user, sandbox the playstore and Google Services, and then sign into my Google Account there. From my understanding, it's totally isolated from the owner profile, but are there other significant security risks associated with that?

Thanks so much!

Probably9857

Sounds fine to me. This setup is even recommended in the GrapheneOS usage guide.

If you want to choose which apps use Google Play rather than making it available to all of them, install it in a separate user or work profile for apps depending on Google Play. You could also do it the other way around, but it makes more sense to try to use as much as possible without Google Play rather than treating not using it as the exceptional case.

https://grapheneos.org/usage#sandboxed-google-play-installation

syzy

Probably9857
Yeah, I saw that in the guide, but I wasn't sure if what was being referenced were apps that relied on Google Play Services or actual Google Accounts. The latter is what I'm concerned about.

Probably9857

syzy

Being signed in to an account should not create any additional security risks.

The additional privacy risks of allowing Google to associate your activity in the profile with the account you are signed into seem obvious. You'll just have to decide if that tradeoff is worthwhile.

syzy

Probably9857
But the profile itself remains isolated, and activity in other profiles doesn't "leak" out to be tracked? That's my understanding from the above link.

Probably9857

syzy

That's basically correct.

In theory, there are numerous ways that malicious apps could communicate or link activity across profiles. In practice, Google is unlikely to be doing those things, simply because they don't need to.

syzy

Probably9857 Awesome, thank you so much!