New GrapheneOS user, advice on profile separation

Ximile

Hello everyone,

I finally made the switch and installed GrapheneOS on my Pixel 6

I've watched a few videos and read some beginner guides about getting started with GrapheneOS, but I'd like some advice regarding how to organize my user profiles.

I'm not aiming for maximum security, but I would still like to isolate some applications.

My current idea is to use three profiles:

Owner

Only used to install applications
Then disable them and install them in the other profiles

My main daily profile
Most of my applications

Google

A dedicated profile for Google services
Apps like Google Maps, Drive, etc.

I have a few questions about this setup:

Does this kind of profile separation actually make sense, or is it unnecessary / overcomplicated?
If I disable apps in the Owner profile, they shouldn't be able to communicate with each other from there, right?

More generally, do you have any recommendations if I want to continue in this direction?

Thanks!

NoahRaketic

Ximile Using the owner profile exclusively to push apps is not common and doesn't have any privacy or security benefit. There is also no inherent security or privacy issue with having everything in the owner profile. Profiles are recommended to be used for different personas, not app categories.

You should try to be clear about what you're trying to achieve with this setup, past "isolation" which is vague and doesn't mean anything on its own. This concept is usually much more needless and complicated than it's worth.

MyIdentityIsntImportant

Ximile I finally made the switch and installed GrapheneOS on my Pixel 6

Welcome to the club.

Ximile I'm not aiming for maximum security, but I would still like to isolate some applications.

If "maximum security" is not the goal, then I'd advice not splitting things up into profiles any more than necessary. While multiple profiles do offer better security, they can & will also be really inconvenient over the long term. You won't want to use a set-up for long if it's annoying, leading to lots of re-installing & unnecessary work down the road (been there, done that, having used separate profiles for basically everything before personally).

Ximile Does this kind of profile separation actually make sense, or is it unnecessary / overcomplicated?

Private Space can act as your "Google profile." It provides the same security & isolation as a full profile with the difference that it's much, much more convenient to use. I'd personally recommend using a Private Space for your Google apps any day over a full profile.

Ximile If I disable apps in the Owner profile, they shouldn't be able to communicate with each other from there, right?

Apps can't communicate over profiles. Even if multiple profiles have the same app installed, all of them are considered separate & independent instances which are isolated from each other.

Ximile My main daily profile

I also used this set-up for a time until it got too cumbersome. It sounds like a good idea at first, but hear me out. There are lots of settings that only the Owner profile can change; you'd be surprised how many settings you think are "basic" are blocked from being changed in secondary profiles. Every time you want to change one of them (even temporarily), you have to log out of your "daily" profile, log in to Owner, change the setting, and then log back into "daily." Over time it will get frustrating.

The security benefits for the average user are also minimal. Your main threat probably comes from the apps you install; if you only install trustworthy apps, it's basically one & the same whether they are installed in Owner or a secondary profile. You'd only be frustrating yourself if you don't use Owner as your daily driver.

TL;DR; Use Owner as daily driver & use Private Space for Google apps.

Good luck & have fun.

Ximile

Thanks for your answers,

I think I probably misunderstood the purpose of user profiles in GrapheneOS. My idea was mainly to isolate certain apps but it is not the main purpose.

NoahRaketic

My main reason for installing GrapheneOS was to move away from Google services as much as possible. But I haven't managed to get rid of my Google accounts yet, so I still rely on some apps like Maps or Gmail. The same goes for apps like Messenger or WhatsApp.

MyIdentityIsntImportant

So my initial idea was to keep those kinds of apps separated from the rest of my daily apps so they couldn't collect data related to them.
But it sounds like using multiple profiles for this is overkill ( and changing profiles several times a day didn't appeal to me haha )

So it would be better for me to just use the Owner profile as my normal daily profile, and then use Private Space for the apps I want to isolate.
I’ll need to look into how Private Space works, since I haven’t explored it yet. From what I understand it’s like a smaller profile inside the main one? I’ll search infos about it.

Thanks again for your answers!

NoahRaketic

MyIdentityIsntImportant While multiple profiles do offer better security

Secondary user profiles are not designed as a security boundary and should not be treated as such. There is not an inherent security benefit to moving apps across different profiles.

MyIdentityIsntImportant

NoahRaketic I'd argue having the ability to split user data behind multiple different passwords and encryption keys is a security benefit, as per GrapheneOS documentation.

https://grapheneos.org/faq#encryption

N1b

NoahRaketic Secondary user profiles are not designed as a security boundary and should not be treated as such. There is not an inherent security benefit to moving apps across different profiles.

You might be right on the technical level, as in "very same setup won't cause an inherent security benefit on user vs owner profile". But what about security in the many other ways such as

stopping apps to talk with each other and potentially leaking more data about you (that can be used to attack you)?
preventing police or border control to get access to all your data and logins at once (and not just a harmless vetted profile)?
being able to quickly destroy all sensitive data but keeping your phone working in an unsuspicious manner (which a factory reset or duress pin couldn't provide)?
preventing a child to mess with developer settings when given access to your phone for a game they like?

I think these are all valid attack vectors that user profiles increase protection against. Maybe it's not necessary for OP's threat model, but that doesn't mean it's not a valid security strategy.

Ximile So it would be better for me to just use the Owner profile as my normal daily profile, and then use Private Space for the apps I want to isolate.

Indeed that seems to be a more convenient setup with little to no drawbacks for what you want to achieve. Have a look at this site to get a better idea of the different profile setups and their benefits (maybe for future changes in your threat model) and this video for private space functionality.

dhhdjbd

I have myself spend way too much time thinking about the "best" profile setup,
and i am pretty sure it is a
Owner profile to install apps

user profile with private space for everything else
(and then the "dangerouse" apps into private space)

(for usablilty and security / privacy compromise i mean ofc ^^)

NoahRaketic

N1b stopping apps to talk with each other and potentially leaking more data about you (that can be used to attack you)?

It doesn't stop hostile apps from leaking data.

N1b preventing police or border control to get access to all your data and logins at once (and not just a harmless vetted profile)?
being able to quickly destroy all sensitive data but keeping your phone working in an unsuspicious manner (which a factory reset or duress pin couldn't provide)?

These are both fair.

N1b preventing a child to mess with developer settings when given access to your phone for a game they like?

Developer options should be disabled. You need to authenticate to enable them. Also, it's best to use app pinning when handing the phone to someone else who needs a specific apps. That way the child can't open settings or any other app while the parent is not watching.