UserProfile worth the hassle?

Curious

Yo,

I want to ask about your opinion.
There is a banking app that requires GPS to function obviously and people normally separate those into diff user profile, but this app also works as auth for phone calls and my question is, that isn't better at that point to keep it in owner profile for seamless call/texts interaction.

Also since I mostly install apps from Play store (no F-droid, Aurora or Obtanium) for security (me not being confident using them) and easy update management, is it bad idea to put all in one profile? Most apps are FOSS able to work offline and without extra permissions but are also accessible via Play store to install (Fosiffy basics, Proton, 2FAS, Brave) etc.

I mean at this point one would have only one profile with Gps active and minimal apps needed + inbuild apps.
Is there any big disadvantage in this setup for privacy and security, compare to separation of profiles?

Xtreix

Curious is it bad idea to put all in one profile?

No, it's completely fine to install everything in the same profile where all applications are strictly sandboxed, whether it's the default owner profile, a user profile, or private space, the security/privacy of the sandbox is the same.

The only thing that the user profile does is prevent consenting communication between applications via IPC (inter-profile sharing), which could improve privacy, except that you could very well have applications that communicate with each other within the same profile.

The most legitimate reason to use user profiles is if you have multiple personas, or if you share your device with family members. Compare this to user profiles on Google Chrome, for example : you want to separate your work profile, where you log in with your real identity, from your main profile, or you want to separate your school profile from your gaming profile. If you don't have multiple personas, user profiles aren't really useful.

Also, I don't know why a banking app would need access to GPS. Have you tried the app while denying GPS access ? Some apps ask for permissions because they expect to get them, but they work without them.

KitsuneNoBaka

Curious you could use work profile or private profile - no need to changing profile as they work on one desktop

wizoatk

Xtreix Also, I don't know why a banking app would need access to GPS.

Location feeds into their fraud detection.

Probably9857

Xtreix Also, I don't know why a banking app would need access to GPS.

wizoatk Location feeds into their fraud detection.

I'm 95% sure the OP is using GPS to refer to Google Play Services.

They repeatedly associate GPS with separate profiles, which would be completely unnecessary if referring to location, which can be restricted to specific apps.

wizoatk

Probably9857 I'm 95% sure the OP is using GPS to refer to Google Play Services.

That does make more sense. My bad.

llama420

I've found that banking apps tend to find a way to leak things, even on Graphene. Big reason why banks always pester you to download their apps. Best to just log into their website. Also, if google play services are used across multiple profiles, Android in general has a limitation where the same apps installed in multiple profiles will share the same DRM ID, allowing any invasive app (anything google makes) to associate them all together.

Curious

llama420 I mean even when you use banking on web, you still need app for 2FA or transaction confirmation. Which sadly every traditional bank has their own in-house solution app instead of supporting any global standard like Yubico etc. or you can chose SMS 2FA, which is better than nothing, but you don't want this if possible for security reasons.

So even you are using web, you still need app to authenticate access.

And yea GPS is Google play services (not actual geolocation stuff)

llama420

Curious There are 2FA apps that can be blocked from the internet. I use FreeOTP+, available on F-Droid. Open source, no internet required, and works with everything. Even google is convinced it's a google authentication app.

Curious

llama420 I am aware of them, also using one of them but bank is sadly bank, from their perspective there is no will and worth in paying extra cost to implement the system, also going to other bank is not an option because all do the same :D, on the other hand, in this case it helps identification and tracking, which is not bad in this case.