New to GrapheneOS with a few questions

PintOfGuinness

I'm a new GrapheneOS user, looking forward to a de-googled future!

I have done quite a bit of reading, both here and on the GrapheneOS Features / FAQ pages, and have a fairly solid grasp of the main features. The OS has already been installed on my device, and so far everything's working as it should.

That being said, I have some questions remaining, mainly surrounding Google Play / Google Play Services, and having multiple profiles setup.

As an example, I could see having 3 profiles: a "secure" profile with no Google, a "banking" profile for bank apps that require Google to be installed, and a third profile for apps like news or online shopping.

If I install Google onto the "banking" profile, Google Play Services are not accessible to the other profiles, correct?
I understand that the notification forwarding feature will send notifications from other profiles, to the currently active profile. Say a banking app delivers its notifications via Google Play Services. If notification forwarding is enabled, will the notification be accessible even if the currently active profile does not have Google Play Services installed?
If I install my VPN app on my "secure" profile, and establish a VPN connection, does that connection persist if I change to another profile?
How well do mobile security / antivirus apps, such as Bitdefender Mobile Security, function when multiple profiles exist? If each profile's apps are isolated from the other profiles, does that, in this example, require 3 separate installations of Bitdefender?

Thanks in advance!

kopolee11

PintOfGuinness I'll leave it to others to elaborate, but the answer to your questions is yes to all of them.

However, note that antivirus apps on Android-based operating systems is generally considered unnecessary, since all the apps are already sandboxed.

unwat

PintOfGuinness If I install Google onto the "banking" profile, Google Play Services are not accessible to the other profiles, correct?

Apps usually communicate via inter-process communication, IPC. IPC isn't possible across profiles. Technically, it's possible to communicate using network permissions, but that's not likely.

PintOfGuinness I understand that the notification forwarding feature will send notifications from other profiles, to the currently active profile. Say a banking app delivers its notifications via Google Play Services. If notification forwarding is enabled, will the notification be accessible even if the currently active profile does not have Google Play Services installed?

Yes. Effectively what happens is the system delivers the real notification to the corresponding profile from the corresponding app, then sends a different notification to the active profile from "system". The forwarded notification will have less information though. If I remember correctly, it just has the originating profile name and the originating app name. No other information is forwarded.

PintOfGuinness If I install my VPN app on my "secure" profile, and establish a VPN connection, does that connection persist if I change to another profile?

Yes. As long as that profile is active, it'll maintain and send traffic over that VPN connection.

PintOfGuinness How well do mobile security / antivirus apps, such as Bitdefender Mobile Security, function when multiple profiles exist? If each profile's apps are isolated from the other profiles, does that, in this example, require 3 separate installations of Bitdefender?

Just like kopolee11 said, antivirus apps aren't really necessary on Android due to the differences between how desktop OSes and Android work.

PintOfGuinness

kopolee11 unwat Thanks for the responses, these explanations really cleared things up!

unwat Just like kopolee11 said, antivirus apps aren't really necessary on Android due to the differences between how desktop OSes and Android work.

Back to antivirus apps, given the differences in how apps run sandboxed on Android, I understand why they would not be necessary. However, as I'm more familiar with desktop OSes, I would by default be apprehensive towards "not" using an antivirus app, though I'm eager to learn and discuss.

My primary concerns regarding "not" using an antivirus app would be:

The Google Play Store has been known to host malware and cannot be relied upon to vet and secure apps, whereas an antivirus would be on guard for PUA's and malware.
When web browsing, if the given website has inadvertently let their certificate expire, or has been misconfigured, an antivirus will prevent the page from loading and restrict any data exchange with the potentially compromised website.
Despite the known fact that SMS is insecure, many entities continue to use it to deliver notifications. For the time being, we cannot 100% avoid it. Many antivirus apps check received SMS messages for malicious links, and alerts if one is detected.

Arguably these threats could be mitigated by (1) carefully selecting apps only from trusted developers and legitimate organisations, (2) heed any warnings from the web browser itself about any issues with certificates, and (3) using common sense and not clicking any links sent via SMS (ideally avoid SMS as much as possible in favour of more secure protocols).

I suppose it all boils down to the concern of not placing all eggs into the same basket, and not relying on a single line of defence. An antivirus app would add a layer of defence, though as others have previously said there are important differences between desktop OSes and Android-based devices. Would this be a layer of defence that isn't required?

[deleted]

PintOfGuinness From my experience I can tell you, I learned not to rely on antivirus on Android (and Windows also) since I got fed up with Bitdefender's intrusive advertisement of their other products. Now that I looked at it, most of its apps has FB trackers built-in, I'm glad I parted ways with them, never looked back. Common sense approach as you say, solid VPN and zero GSF dependent apps is my way to go. I have to use messenger and banking app, no way around that, but try to give them as little as you can. I am kind of sceptical of profiles, if you're not careful enough with web browsing, your profiles (same IP) will be at some point linked through fingerprinting (just my opinion), whether you use Google Play or not.

unwat

PintOfGuinness

I think the best argument against AV can be found in this article: https://privsec.dev/posts/knowledge/badness-enumeration

PintOfGuinness Would this be a layer of defence that isn't required?

AV software requires a ton of access to the device in order to run. Many would argue don't trust any apps, especially ones that need lots of privileges to run. AV requires too much trust. Many say it's "better" to not trust anything and rely on the sandbox and Android security model for the rest.

Other "tech illiterate" people, like my grandma, might not have the understanding required to know when to be suspicious and when they can trust something, but it's likely whatever OS they're running already has invasive features built in to protect them. In that case, I'd say AV is actually extraneous since Stock OSes and AV software would have similar bad apps/domains/whatever lists.

Graphite

PintOfGuinness The Google Play Store has been known to host malware and cannot be relied upon to vet and secure apps, whereas an antivirus would be on guard for PUA's and malware.

It wouldn't be a separate app like antivirus to check the integrity and reputation of apps. It'll be on the app store.
Google Play does have a function to retroactively warn if an app was removed for being PUA or malware.
An antivirus would do no better, relying on 3rd party information regarding an app's reputation after its installed.

PintOfGuinness When web browsing, if the given website has inadvertently let their certificate expire, or has been misconfigured, an antivirus will prevent the page from loading and restrict any data exchange with the potentially compromised website.

Again, not the job of a separate app. Most modern mobile browsers will block such websites. You can make them even more restrictive with settings, about:config, or addons.

PintOfGuinness Many antivirus apps check received SMS messages for malicious links, and alerts if one is detected.

Checking links for high risk reputation, should again, be something the browser does.

Antivirus/Antimalware should be a function of the OS, so that you're not giving extremely sensitive privileges to a 3rd party. For the protections you described though, they aren't related to antivirus or antimalware.

PintOfGuinness

[deleted] Now that I looked at it, most of its apps has FB trackers built-in

Was otherwise unaware of this, good to know. Very unfortunate about how it's becoming harder and harder to escape trackers.

unwat AV software requires a ton of access to the device in order to run. Many would argue don't trust any apps, especially ones that need lots of privileges to run. AV requires too much trust. Many say it's "better" to not trust anything and rely on the sandbox and Android security model for the rest.

Valid point, and one that I'll admit I never gave much thought about in the past, though should have. These clarifications and descriptions about the Android security model are very useful!