Best practise

Skjold

Hello everyone. I will soon get my Pixel 9 Pro and plans on installing GOS on it. My main purpose is to avoid Google as much as possible and increased privacy. The plan so far is to use different profiles like many of you do. I think of using the owner profile only for downloading all the apps that I need behind Orbot or VPN. Then push them to other profiles. In that regard I have some questions.

If I use Google Play store (dummy account) on the owner profile and push the apps to different profiles, then the apps will be updated when needed on the owner profile and the updates will be pushed to the different profiles right?
If I where to only use F-Droid and Aurora store for apps on the owner profile, will those apps get updates? and if yes then would those updates also get pushed to other profiles?

I was thinking of using 6 different profiles like this and this is before I know if the apps has Google services dependencies except pCloud that has confirmed they need Google services.

Owner profile (Call and text disabled if possible?):
Use either or both Google play store and aurora store behind Orbot or Proton-VPN with kill switch enabled to download and update apps. On this profile the apps will have denied network access. Then puss them to different user profiles.

Personal profile (Call and text enabled. Daily primary used, Google free, Proton-VPN for use if I am on a public Wi-Fi):
ProtonMail, Proton Pass, Signal messenger, Aegis 2FA, Vanadium or Brave browser, KeePassDX, The authorities official 2FA app. Car app (Volvo), Alarm (Verisure) app and PushOver app (pfSense notifications and alarms)

Financial profile (Call and text disabled. Not used daily, Google services installed and OpenVPN-Connect installed for connection to home router when on public WIFI):
2 different bank apps, my mobile pay app, Official electronic mailbox from the authorities, Vanadium or Brave browser, Aegis 2FA and KeePassDX

Data storage profile (Call and text disabled. Not used daily, Google services installed):
pCloud storage (this app needs Google services but if "Financial profile only need Google services to and no Google log in, then I could use pCloud in that profile)

Media profile (Call and text enabled. Daily used when doing physical training. Google services installed and Proton-VPN for use if I am on a public WIFI):
Spotify, Fitness app for access to GYM, Movie player of some sort, TV channel subscription, 4 different charging apps for EV and Uber.

Travel (Call and text enabled. Only used when traveling through airports and only if they demand looking at my phone. Google store and services installed with another fake account):
ALL FAKE ACCOUNTS to use with for example Facebook, Instagram, Movieplayer, E-mail account of some sort, And other stuff...

A lot of text and I appreciate any input to how I can loose Google the most and give you all a thanks in advance :-)

Best regards
Skjold

Delaney

Skjold If I use Google Play store (dummy account) on the owner profile and push the apps to different profiles, then the apps will be updated when needed on the owner profile and the updates will be pushed to the different profiles right?

Yes

Skjold If I where to only use F-Droid and Aurora store for apps on the owner profile, will those apps get updates? and if yes then would those updates also get pushed to other profiles?

Yes and yes.

Skjold On this profile the apps will have denied network access. Then puss them to different user profiles.

You can disable them altogether in the owner profile, which would save on performance and battery.

Skjold I was thinking of using 6 different profiles like this

Are you sure you want to use that many? If you're using all of them frequently, then switching between profiles can be very time consuming in the long run and you may risk experiencing burnout.

Brothe3r_max

Skjold This is basic setup for user profile

https://seprand.github.io/articles/best-user-profile-setup/

23Sha-ger

Skjold If I where to only use F-Droid and Aurora store

Don't. Not only it's not recommended, some apps like banking will refuse to work.
A sandboxed Google Play store with a fresh account made just for using the store and update the apps - is all you need to have. You will have proper notifications and Google can't really use the data since there is not much in it.
Just a list of apps a random account installed from the public store. Obviously don't use this account for anything else like maps or search.

Brothe3r_max

Skjold If you have two Google accounts on the same device, Google will indeed always recognize it and keep track of the two separate accounts.

Please see
https://discuss.grapheneos.org/d/17118-identifiers-across-private-space-and-profiles

Skjold

Delaney
Hello Delaney
Thanks for the input. I have thought about it but as I see it the daily use will only be the personal profile and then the Media when I excercise. The travel only when traveling to other contries. The Financial and Data profiles only when needed and that is not very often.

SgtSurehand

Regarding travel profile, if they can compel you to unlock that profile, they can do that with all other profiles and it is easy to find out you run multiple profiles from your lock screen. So you shouldn't spend time creating fake info.

Skjold

SgtSurehand

I didn't know that! As I read this I got the idea that each profile would have its own encryption so if they are in the travel profile they would never get access to other profiles? Read what i have marked in BOLD from Graphene FAQ?

Sensitive data is stored in user profiles. User profiles each have their own unique, randomly generated disk encryption key and their own unique key encryption key is used to encrypt it. The owner profile is special and is used to store sensitive system-wide operating system data. This is why the owner profile needs to be logged in after a reboot before other user profiles can be used. The owner profile does not have access to the data in other profiles. Filesystem-based encryption is designed so that files can be deleted without having the keys for their data and file names, which enables the owner profile to delete other profiles without them being active.

GrapheneOS enables support for ending secondary user profile sessions after logging into them. It adds an end session button to the lockscreen and in the global action menu accessed by holding the power button. This fully purges the encryption keys and puts the profiles back at rest. This can't be done for the owner profile without rebooting due to it encrypting the sensitive system-wide operating system data.

Using a secondary profile for regular usage allows you to make use of the device without decrypting the data in your regular usage profile. It also allows putting it at rest without rebooting the device. Even if you use the same passphrase for multiple profiles, each of those profiles still ends up with a unique key encryption key and a compromise of the OS while one of them is active won't leak the passphrase. The advantage to using separate passphrases is in case an attacker records you entering it.

Skjold

SgtSurehand

Ah sorry misunderstood. So you mean that if I hand them the travel profile then I would get asked to unlock the other ones? That is of course a possibility. I would then just hope they wont notice multiple user profiles ;-)

Skjold

Brothe3r_max

Thank you

FaberCastell

23Sha-ger Obviously don't use this account for anything else like maps or search.

Do you suggest a 2nd account for Maps etc?
Or can you just use it without being logged in?
Imo it is one of the main apps where there is not really an equally good substitute...

Skjold

23Sha-ger

Thank you for this. Google store on owner profile it is and will not use that profile for anything else than to update the apps and push them to other profiles. So if my understanding is correct then worst case scenario is that apps may need "Google services" running on the other profiles?

23Sha-ger

FaberCastell Or can you just use it without being logged in?

This. Or the web version without login if you really need Google maps and not a FOSS app.

Skjold So if my understanding is correct then worst case scenario is that apps may need "Google services" running on the other profiles?

Apps in secondary profiles can have Google services as well, everything about it should be on the Seprand article.

Skjold

23Sha-ger

Again many thanks for the help. Just wondering if i were to install "Google services" on one or two of my other profiles, what kind of info will they send back to Google? I know they are sandboxed, so does that mean that Google won't recieve any info from my usage of apps or information on that profile?

FaberCastell

23Sha-ger if you really need Google maps and not a FOSS app

Have been using Organic maps, and it is fine for the limited amount of navigation I need a maps app for (generally prefer to preplan my route tbh)... but it doesn't have the user base to really fill out the other features, eg reviews, interesting places etc

Is there an alternative you would recommend?

23Sha-ger

Skjold does that mean that Google won't recieve any info from my usage of apps or information on that profile?

If it's a separate profile then no, that's the idea of having multiple profiles. But again, if it's just an account for installing apps, there is nothing much they can save on you. You can do a Google takeout [Google Takeout is a tool developed by Google that allows you to export and download a copy of various types of data currently stored in your Google account] and see what they have on you. Should be nothing valuable.

FaberCastell Is there an alternative you would recommend?

I use GMaps WV which is just a webview wrapper for the mobile maps. You don't really need an app for that, a PWA
or an incognito window will achieve the same, I just like the convenience of having it pinned with an icon.

area51

Skjold My main purpose is to avoid Google as much as possible and increased privacy.

Install GrapheneOS and use your phone as you would normally... Job done.

goharali

Yes, if you install apps via Play Store in owner profile, updates will apply there and reflect in other profiles.

Yes, apps from Aurora or F-Droid in owner profile will get updates (if manually updated or using privileged installer for F-Droid). Updates will reflect in other profiles.

Your profile setup looks solid and privacy-focused. Consider:

Use Shelter or Insular for sandboxing if needed.

Keep Google Services only where essential.

Disable owner profile’s network entirely (AFWall+, NetGuard).

Prefer Aurora Store over Play for anonymous installs.

Overall, your plan is privacy-conscious and well-structured. Just refine app permissions and network access per profile for max isolation.

Dumdum

goharali Disable owner profile’s network entirely (AFWall+, NetGuard

This prevents system updates, so not really a good idea unless you want to sideload updates.

Skjold

goharali

Thank you very much for this.

If I want to use only F-Droid and Aurora for downloading apps, then you say that either I have to manully update or use "privileged installer for F-Droid" That will make sure that apps from F-Droid AND Aurora store is updated?

Regarding "Disable owner profile’s network entirely (AFWall+, NetGuard)" as Dumdum says will cut off the owners profile from getting anything. Would it make sense doing that and maybe once a week disable (AFWall+, NetGuard) just to make updates? or should I keep from installing (AFWall+, NetGuard) and get updates when they are announced?

23Sha-ger

goharali Prefer Aurora Store over Play for anonymous installs.

You should not use Aurora in any case, you are just adding another 3d party to the chain of trust by doing that.
While it could be a solution for some custom roms, in GOS you have the Play Store sandboxed - meaning that
using it with a throwaway account is the safest and most reliable way to get updates.
Not only that, apps that check if they were installed from Play (mainly banks and games) will work correctly.