Multiple user profiles + "3D Secure" verifications failing. Options?

jonf3n

I'm using multiple user profiles with GOS to isolate activities and Google services. I frequently have problems with failed credit card verifications. When I try to use a credit card (eg Revolut), it is normal per "3D secure" to be prompted to confirm in the app.

This works fine if the app and browser are in the same user profile, however it usually fails if they are in different profiles. It is not a problem with speed, I can switch profiles, click confirm and get back in 30 seconds or less, but there is something else happening.

Vanadium for example often reloads the page automatically when I return to the profile. And in-app payments just switch to a failure screen.

Something in GOS is allowing apps to know when I switch profiles. Sensors are disabled. Background is enabled.

The user should be in control of this leak of meta data so that apps do not know I'm switching user profiles.

What else should I look at?

raccoondad

jonf3n Something in GOS is allowing apps to know when I switch profiles.

Yeah, processes generally will know when they are being quietly smothered by a pillow. Nothing you can do, you need to have them in the same profile most likely.

Maybe private space? That should prevent processes from being killed/put to sleep

de0u

jonf3n Do all profiles have "Allow running in background" turned on?

pixel47233

jonf3n Vanadium for example often reloads the page automatically when I return to the profile.

Are you using Vanadium's incognito tabs? When I was using multiple user profiles in the past, I saw the same behavior of browser tabs refreshing when switching profiles.

I remember that using Vanadium non-incognito tabs stopped the browser from refreshing tabs when I was testing it.

dawt

It's probably not something the app specifically detecting, and more likely to be caused by the fact that non-active profiles are heavily deprioritized and are likely to get unloaded by the OS. The apps/sites also don't seem to handle refreshes as well, leading to the issue you're seeing.

jonf3n

dawt yeah, it is normal that refreshing a browser in the middle of payment verification will break the process.

But why does it refresh? That is bad behavior. The user should be in control of when it refreshes.

Ideally there should be some way to prevent profiles from immediately shutting down after one switches to another. Like waiting a minute or two.

It does feel like these apps / web pages "know" I switched profiles, which seems like bad sandboxing to me. No?

jonf3n

de0u I'll make sure that is enabled and see if it helps.

dawt

jonf3n It does feel like these apps / web pages "know" I switched profiles, which seems like bad sandboxing to me. No?

It's not "bad sandboxing" because it's not in most sandbox's model to be 100% undetectable. Even the fact you're using profiles is pretty detectable, because user data is stored in /data/user/12 (or whatever) rather than /data/user/0.

schweizer

jonf3n there should be some way to prevent profiles from immediately shutting down after one switches to another.

You can define if a profile is allowed to run in the background or if it is automatically shot down when you switch users. Only the owner is always active.

Other than that 3D secure does not rely on running in the same profile because you can use it for confirming payments on a laptop or dektop computer as well.