Google Sandbox Profile

RanHerOver

Hi everyone. I have just bought a pixel 5 and I am installing Graphene OS.
The last time I did so was with the google pixel 4a and it was about a year ago. I remember that to use apps that need google play services/google play installed, you needed to create a custom profile and install google stuff there. I also remember that you needed a particular app to install those multiple APKs in that profile or something like that.

Looking around it seems that things have changed a bit. Is it worth it to have a profile dedicated to google-related apps? What's the best approach? I'm asking because my bank apps need google. I don't really care for notification stuff, so that's not a huge problem.

Thank you in advance

evalda

RanHerOver That's a common approach... I think about it a bit different tho.... Separate higher value target apps vs higher risk apps... Like don't put messaging app together with a banking app regardless if they use GPS or not... Hope it makes sense, if not I am happy to explain more

RanHerOver

evalda I think I understand what you mean. Something like "keep whatsapp inside the non-google profile and the banking apps on the google-profile"?

matchboxbananasynergy

I hope the reply I posted here a few days ago helps you:

https://discuss.grapheneos.org/d/2501-privacy-sacrifice-when-using-google-play-services/5

RanHerOver

evalda Oh alright, now I understand. Whatsapp isn't really a threat to me so I don't think I need to keep them separated

matchboxbananasynergy Okay that's a very clear explanation. So if I install the "google stuff" on my main profile, to still make sure I am as private as possible, I could just disable 99% of the permissions that google app require, right? So that I am able to, for example, receive notifications with google play services but they aren't able to track my location and stuff

evalda

I don't think about GPS as a dividing line if that makes sense... It's just another app in GOS... It does not have any special privileges (unlike stock OS)... So if WhatsApp is a threat (as an example) and a banking app is an asset, I'd like to keep them in separate profiles and never run them at the same time (or even run a banking app after running a messaging app).

mythodical

RanHerOver the concern, for me at least, is that Play Services requires network permission to deliver those notifications.

This means Play Services will be able to establish a constant connection with your device, which could arguably be used for tracking, analytics, ad delivery, etc. The Firebase Cloud Messaging (FCM) component of Play Services, used by many apps to deliver those notifications, may reveal some of your activities as well.

RanHerOver

mythodical damn. I'll delete all the permissions until I need to use something then