what is " tolerable " to run in the main profile

yoda68

Hello all,
I returned to GOS, as 2 years ago, even if I loved it, too many apps in my day to day were giving me headaches on GOS. Now they work well on my Pixel 6 !! Good job

THE EXPLOIT PROTECTION COMPATIBILITY MODE feature did help with some apps.. COol !

I am a GOS noobie but for now :

I installed apps I use very very often in the main profile (If I consider them " quite safe"). I did add Telegram and Signal in my " main profile" who has access to contacts, text etc
Apps as Instagram, FaceBook, Whatsapp, are in a difference profile with very few access, and NO CONTACTS unless those I am forced to used.

Does it make sense ?

I did installed GoogePlay store in the main profile and in the " DANGEROUS APPS PROFILE".

I do use GBOard keyboard to be able to dictate message... For now, I have not been able to make it work properly when removing network access to it...

DOes it make sense ? any comments or suggestions are welcome...

Yoda

matchboxbananasynergy

Your setup sounds fine. A lot, if not most people who use GrapheneOS don't even use multiple user profiles. It's not always necessary. Sandboxing is provided for all apps regardless.

You can read some thoughts on user profiles here:

https://discuss.grapheneos.org/d/168-ideas-for-user-profiles/2

I hope that helps!

yoda68

matchboxbananasynergy

In a perfect GOS World (and a bit paranoid LOL ) Just in case I did some mistakes, what would be your list of Google services, to ideally not be given " not have network access " ?

I don't remember if I needed to install extra ones to make Google play and GBOARD works correctly...

Tks for your help !!

yoda68

OK I tried and if network is disable for GBOARD ( I saw this suggestion in this forum somewhere) then I can't dictate memo... So I'll try to not to go crazy on tweaking Google component...

mythodical

yoda68 I don't use it myself, but this post may help you get it working without network permissions.

yoda68

Google products having NETWORK ACCESS in my Main (Owner) profile

GBOARD, Google Play Services, Google Play Store, Google Services FrameWork

is it the same for most of you ?

mythodical

yoda68 I only use one profile (owner), and I only use GSF in order to get basic app functionality (no permissions granted). No Play services or store.

I use an RSS reader (Feeder) to track FOSS apps, and the Aurora Store for anonymous
management of Play store apps.

I do use Gboard (no permissions), but will be switching to FlorisBoard full-time once predictive text and inline autocorrect are available (next milestone release).

yoda68

mythodical tks for sharing !! Much appreciated

[deleted]

mythodical Hi, if you want a good app to replace feeder I advise you optainium https://github.com/ImranR98/Obtainium/releases/download/v0.9.12-beta/app-arm64-v8a-release.apk
-aurora store and as anonymous as the playstore with a fake account set up but less secure

mythodical

[deleted] for sure, I mentioned Obtainium in a recent post as well. I'm pretty happy with Feeder at the moment, but thanks though.

evalda

I personally don't use the main profile because you can't wipe the data in it unless resetting the whole phone. Individual user profiles are great for many reasons one you can quickly wipe all profile data securely by deleting the profile without affecting others. This is a killer feature in some circumstances.

Eirikr70

I personnally have two profiles :

main without any Google service (apart from GBoard without network access), with all my daily apps (mainly but not only FOSS, mainly but not only installed with Obtainium),
one with what I call "invasive" apps, with Google Play Services, apps installed through Aurora Store. That profile remains switched off probably 99% of the time.

I think that this separation of profiles is probably overkill for my threat model (surveillance capitalism for average Joe) since sandboxed Google Play services would probably have a similar result, but I started that way and I'm happy with it.