Best User profile strategy for privacy

W1zardK1ng

lawman First you need to know your threat model and what you are trying to protect against. User profiles are so powerful but gets inconvenient if you have multiple of them.
If you are a regular person with normal life, just use the owner profile and use a secondary profile or private space for apps that need isolation or you barely use.
If your threat model is low you don't have to use any complex setups, just use the phone as normal. I have tried multiple setups with different profiles but later realised that it doesn't worth the inconveniences i was having with these kind of setup.
I have owner profile with google play services installed and logged in with a throwaway email and a secondary profile with some banking apps which i barely use. Most of my apps are the open source but installed from playstore for the few apps which are not available in plays store i use obtainium.
I didn't even took time to delete the secondary account and move to private space because i barely use those apps.

lawman

W1zardK1ng

is private space less secure than profiles?

thanks

lawman

oci3o very useful. thanks

where do you put social media apps like whatsapp. bummer so many apps need playservice like whatsapp.

the banking/crypto apps need to be kept in separate profile, but pity I won't then get banking notifications. Can't be helped I suppose.

oci3o

lawman WhatsApp goes into my daily profile because I use it so much.
Only social media I use is mastodon, and then I only browse, I just use a PWA for that site, I would have a seperate profile if I used say Facebook, keep the profiles to the owner, so Meta includes Facebook / Instagram etc.

mmobder

lawman no, instead it's more convenient from usability point of view

mmobder

oci3o what's the justification of such a complexity? Not the generic "it's obvious", but fact-based justification

lawman

mmobder In the current GOS state, I could see the following benefits:

1) Isolating apps which rely on google services.
2) Isolating private apps such as banking/crypto which you want to keep offline moreso
3) Reducing the number of running apps at one time to increase battery / decrease data usage / decrease heat
4) Reduce visible apps if owner profile access is required by an adversary

There would be a far greater number of benefits if
5) hidden profiles was permitted by GOS developers.

Wadder

lawman there was a group of individuals within the community that started a GrapheneOS tutorial/ advise guide and the first article they produced was based on profiles and best practice, see the link below.

https://seprand.github.io/

Please note that there hasn't been much development on the project since the original piece was uploaded but there has been a number a article requests.

mmobder

Wadder on profiles and best practice

unfortunately, the article is rather a collection of how people are typically setting up their profiles and doesn't really question if certain claim is valid or not.
There are few exceptions - a too generic "For most use-cases, using secondary user profiles to further isolate apps is unnecessary", and few others like fast non-owner profile deletion and putting data at rest. It doesn't really mention all the downsides of multi-profile setup (like expectedly failing alarms in non-owner) and doesn't really details what are the negatives of "work-profile" (apart from it's not being "mainstream" compared to PS).

So that site is the dead one.

newbie24689

Wadder WOW! A well-written, succinct article about things to consider when configuring your phone. Obviously, no pat answers - but I need an overview like this and some time using the phone before I can hone in on a "best for my use" setup.
When/IF IPC can be scoped, the user will have LOTS of possibilities.
I don't travel internationally any more, but the possibility of "cloud computing" should enter the mix as well.
Obviously, using a minimal number of apps reduces the complexity of the solution.
Thanks for noting this article!!

de0u

lawman There would be a far greater number of benefits if [...] hidden profiles was permitted by GOS developers.

The GrapheneOS developers have not disabled an existing hidden-profile feature, so "permitted" seems like a very inaccurate characterization. You are asking them to design and implement and test and maintain a hidden-profile feature.

mmobder

lawman Isolating private apps such as banking/crypto which you want to keep offline moreso

this statement is sooo controversial - I have to receive notifications about events on my bank acc or CC, especially those like revolut so I know strange things are happening there.

mmobder

lawman Reducing the number of running apps at one time to increase battery / decrease data usage / decrease heat

this is rather a per-app expectation, not a per-profileat least for me.
Current default setting ON for per-app battery use (allow background usage) and network use (allow background data) isn't my favorite for user-installed apps. So I have to manually disable those.

lawman

de0u you are correct. I mispoke.

raevero

FWIW I've been using gos for a week now and consider myself a low threat target. I have no reason to believe that my critical info is at risk. My bigger concern has always been what is Google doing with my data?

To that end, all apps that require play services are in my private space. Everything else is in the main profile. During work hours, my private space remains mostly unlocked and the remainder of the day, it's mostly locked. My understanding is that when locked, play services is shut down.

So far, this setup works for me. Not terribly inconvenient and if I understand properly, Google is getting very little... If any.... Info from my phone now. Mission accomplished.

de0u

mmobder unfortunately, the article is rather a collection of how people are typically setting up their profiles and doesn't really question if certain claim is valid or not.

I suspect it is possible to file issues and even pull requests at https://github.com/SePrAnd/seprand.github.io

mmobder

oci3o , I disallow installing apps via the owner profile here.

what's the benefit? none of 3rd party app will be able to silently setup another app anyway

oci3o

mmobder Its just to keep things tidy, and avoids accidentally using them outside the profile.
It also helps by disabling all permissions for the app, so any potential leakage by leaving the app enabled should be mitigated.

mmobder

de0u I suspect it is possible to file issues

I've left comment in the original thread back then, with no effect, but yep, will consider registering another git acc and re-submitting it. I've linked the thread with collection of "side effects" of using PS/non-owner, etc that may be helpful to choose one scheme or another depending on their typical use case without recommending particular setup. https://discuss.grapheneos.org/d/16754-pls-help-to-collect-inputs-only-that-influence-users-scheme-setup-in-a15/26

The 2nd one could be "Please rename the article to "Collection of how various users are setting up their profiles", as for "Best User Profile Setup on GrapheneOS" it lacks reasoning for all the claims at the moment.
But I consider it "controversial" so won't submit).

I better try to first collect inputs here from knowledgeable people.

The same principle GOS is following in their official Guide is entirely missing in that profiles community guide, as there are just generic claims that IPC is blocked (though network loopback is entirely open, so I dunno if that makes any difference), so if network communication is OFF for Play Services / Store / apps, will there be a difference?
So instead of a reasoning-based guide it's rather how ppl are got used to do something according to state of their BELIEFS, not a GOS standard afaik.

mmobder

oci3o It also helps by disabling all permissions for the app

enable before using the app and then disable after each use? WoW, not my level of endangerment.