Profiles Scenarios

LuckyLuke

Hello,

I have a few more questions about how profiles work and what benefits I can get from them. Let's take a look at this step by step: starting point is a freshly installed GrapheneOS with only FOSS apps in the owner profile.

• Scenario #1:

If I now install sandboxed Google Play in my owner profile, it shouldn't make any difference from a privacy point of view compared to before, right?
Because my FOSS apps don't have any dependencies on Google services and therefore don't interact with them. It should be the same the other way around. Since the Google services are sandboxed and have no permissions, they can't interact with my FOSS apps either. So it makes no difference if they are present or not.

• Scenario #2:

Let's go one step further: FOSS apps and sandboxed Google Play are installed on my owner profile. Now, if I want to install a proprietary app, for example Netflix, I have the option to install it in my owner profile or in a new user profile.

Would there be any difference at all between these two options from a privacy perspective?

As I understand it, a second user profile would not give me any privacy benefit in this case. In the owner profile, Netflix would also be sandboxed, can only see its own files via storage scopes, and otherwise has no way to interact with my other FOSS apps.

• Scenario #3:

The last scenario is to install a proprietary app that requires access to personal data. Let's take WahtsApp. Again, I have the choice to install the app in my owner profile or in a separate user profile.

This time, there is a difference. For WhatsApp to work, I have to allow the app to read my contacts. If that's not a problem, you can install Whatsapp in the owner profile. But if it bothers you, you have to install WhatsApp in a different user profile. There you can create a new contact list, which will only contain the contacts you need.

The conclusion for me from these considerations is that it does not make sense to use a second user profile if you do not use a VPN and only use applications that correspond to scenario 2.

Am I right about this, or have I not considered something?

So my setup will look like this:

• Owner Profile: 
    ◦ install sandboxed Google Play (without account if possible)
    ◦ revoke all permissions from sandboxed Google Play (network & sensors)
    ◦ install all my apps (FOSS & GooglePlay)

• Second User Profile:
    ◦ install sandboxed Google Play (with throw away account )
    ◦ this profile is only used to update my GooglePlay apps, because PlayStore in my owner profile doesn’t have internet connection. Apps are installed system wide, so updating apps here will update the apps in the owner profile too.

• Third Profile (Maybe)
    ◦ for my banking apps. More for security reasons than privacy reasons.

[deleted]

LuckyLuke Am I right about this, or have I not considered something?

I would only add that you should know, what you are trying to achieve, what are your needs and how you're going to use your phone. There is no right way for all. Personaly, I think it is more about how you behave online and how do you use your devices than searching for an imaginable tweak to achieve perfect privacy and security online, which seems to be an oxymoron to me.
You clearly gave it some thoughts, you probably know, that it is OK for you to switch between profiles all the time. Will your profile be always online? Do you need apps notifications?

mythodical

The potential issue that I see with scenario #2 is that many apps which require Play Services/Store require that those Google components do have network permission. This can be a privacy concern in itself, if avoiding Google telemetry, tracking, and data-sharing via IPC is a goal.

Personally, I only use the Google Services Framework (no perms), and I only use the owner profile. As a result, I manage my expectations of app capabilities. I understand that some apps simply will not work, or at least not provide real-time notifications, and I am okay with that. If I ever come across a Play-dependent app that I simply cannot do without, I will consider installing Play to a secondary profile. This has not been an issue so far.

LuckyLuke

I thought that the availability of PlayServices would be sufficient for most applications. I need to test this further. But then it still shouldn't make a difference if these apps run in my owner profile or a separate user profile? Internet connected PlayServices should still have no interaction with my FOSS apps?

I don’t rely much on Push notifications from Google. My favourite Messenger App, for example, has its own push service.

Like mythodical said my goal is to avoid Google telemetry, tracking, and data-sharing as much as possible. I will not use any VPN setup. The question is whether splitting FOSS and GooglePlay Apps makes sense at all? I don't want to give up convenience if I gain nothing from a privacy perspective.

mythodical

LuckyLuke Many FOSS apps are available in Play-based variants, taking advantage of Play libraries, etc. And I would be surprised if there weren't others that may also utilize Play components when they are available on the system, even if they don't advertise themselves as Play-dependent.

In addition to these apps possibly sharing data via IPC to Google services within the same profile, Play would also be aware of all of the apps installed within the same profile. Whether any of this is a concern is entirely up to you.

LuckyLuke

mythodical I am aware that Google applications like YouTube and Maps, if I install them together in one profile, can communicate with each other without my control.
But they do that anyway, whether I have them installed together in my owner profile or together in my user profile. So I shouldn't get any benefit from installing them in a second user profile, as long as they don't communicate with my FOSS applications or ask for permission to access personal data (as in my Whatsapp example). And they shouldn't do that through the GrapheneOs sandbox. This is the point I would like to have confirmed by a more tech savvy person than me.

unwat

LuckyLuke

I always suggest people treat profiles as identities, like the website suggests (oddly enough in the non-hardware identifiers section).

Profiles should be used when separate identities are desired. Profiles can be used as temporary ephemeral identities by creating them for a specific need and then deleting them.

So, for example, personal, work, spycraft. Apps cannot communicate via IPC or list packages from other profiles.

LuckyLuke So I shouldn't get any benefit from installing them in a second user profile

Agreed. Don't give any apps any permission to do anything then who cares if they communicate with one another?

LuckyLuke

unwat Don't give any apps any permission to do anything then who cares if they communicate with one another?

That is not my point. Applications should have the necessary permissions to do their job. But nothing more. Means

Google Maps only needs network permission
Youtube only needs network
Netflix needs network and storage scopes

Maybe these applications communicate with each other via IPC, maybe not. I don't know. So let's assume that they do. Now, what happens if we add some FOSS applications like Signal and K9 Mail? Will the 3 "evil" applications also communicate with my FOSS applications?

If so, it might make sense to split them into different profiles. But if not, there is no reason to separate them, right?

unwat

LuckyLuke

My bad. By "anything" I meant nothing sensitive. Network and storage scopes don't give apps access to anything sensitive, so even if the apps do talk to each other, they can only share what they have access to, which is virtually nothing. But they probably wouldn't even share that because there's no point.

IPC must be mutual, so it's very unlikely that any of the FAANG companies' apps would set up mutual communication with random FOSS apps, or vice versa.

IPC is also very restrictive. If companies want to share data, they'd just store everything they can on their servers, then share data directly with each other.

mythodical

LuckyLuke Now, what happens if we add some FOSS applications like Signal and K9 Mail? Will the 3 "evil" applications also communicate with my FOSS applications?

That's the thing. You won't know for certain without reviewing the source code for each and every open source app, after each and every app update. Apps can push/pull information to/from other apps via IPC so long as there is mutual consent between the apps.

For example, it was recently discussed in this forum how one app on the user's phone was delivering Google ads, even though the app itself had no network permission. This was due to the app's ability to deliver ad services via Play, which did have network permission on the device.

For most users of closed source apps, it isn't possible to know what, if any, data is shared between apps via IPC. For open source apps, you either have to blindly trust that data isn't shared, or do your due diligence and review the source code to ensure data isn't shared.

LuckyLuke

Thank you for your further explanations. I will adjust my setup a bit from the original post. I will use my owner profile for administration purposes only. I will install the sandboxed Google Play, create a throwaway account here and install all the apps I need as dummies. All apps will be revoked of all permissions in this profile. They will not be used here.

Then I will create a second user profile that will be my daily driver. Here I will also install the sandboxed Google Play, but without Google account and without any permissions (no network either). Kind of a dummy, so to speak. Then I will clone all my apps to my user profile via the administrator profile.

This way, it’s enough for me to use only one user profile without constantly switching back and forth. Only for update purposes I will switch to the administrator profile every now and then.

With this setup I should also avoid mythodical mentioned case with delivering Google ads via PlayStore. Because there is no network permission and no linked Google account. I tested it with google maps and it seems to work.

Looks like a plan for me :)

Dknow

LuckyLuke
Hello,
I am new to GOS and planning my profile setup.
Your scenario would fit my needs too.
But is it actually possible to clone apps between administrator profile and user profile or do I have to use a Google-Account to install apps via Play Store in the user profile and log out / delete account afterwards?

[deleted]

Dknow
When you create new profile, you will have a pop up asking if you want to allow texting and calls for the profile and also you will be shown a list of apps from the main profile and you can pick which apps you'd like to "clone" into the new profile. The app per se is "shared" between profiles, so you won't need to install it again and new installation won't waste space, the app data is unique for each profile, and isn't "shared" between profiles.

Dknow

[deleted]
Thank you for your reply!
I tried that, but I didn't have the pop up.
I think that's because I use an old (unsupported) Pixel as a test system.
Since I can't test that, could you please tell me if it is possible to select / install apps after setting up the user profile or just during the creation process?

[deleted]

Dknow
I can't answer that properly as I only use main profile, and only when I need to "test" an app that I don't trust (like Spotify) I create a new profile and after a while I delete it.

I do not know if this is the right place to place a comment like this, but I find it quite interesting, that a lot of paid app that I bought in Play store doesn't really need Google play or Play services. I backed up apk files that I bought and not all but a lot of them works without an issue.

Back to the profile creation: you can test it yourself, when you allow multiple users and click create new profile, you will see following options/ toggles:

allow texting and calls
disallow installing apps
disallow installing apps from third party sources
install available apps
delete user

pjv

Dknow Since I can't test that, could you please tell me if it is possible to select / install apps after setting up the user profile or just during the creation process?

You can do it after as well.

Dknow

Thank you both for your help!

Unfortunately I don't have the option to "install available apps" on my test device.

But now that I know, I will switch to GOS with my new Pixel.

Thanks!