Should I extended Insular power to mainland?

GrapheneMask

Let me tell you some about my setup:

I have Graphene OS without Google services with full exploit protection and all security measures. Also, I've set up a work profile managed by Insular. Inside the main profile, I store non-sensitive data, and there are no personal apps. On the other side, inside the work profile, I store sensitive data and personal apps.

And I want to ask some questions of advanced Graphene OS users:

Is my model secure enough, or should I store sensitive data inside the main profile and non-sensitive data in work?
Sometimes it lacks some cool Insular features: app freeze, full deactivation, and app watcher inside the main profile. So should I extend Insular power to the mainland, and what consequences will it have? Will it weaken security and increase the surface of attacks, or will it have many more positive sides?

Thank you for your answer in advance!

Johnnyloans

GrapheneMask

Nice set up.

Use insular if you have use of its features like cloning or freezing.

I would add:
remove the sensors permission from any apps that can function without it.

Under settings > security > more security > allow new apps to have sensors permission

Have this be off.

GrapheneMask

Johnnyloans
I'm trying to give apps a bare minimum of permissions. So I disallow sensors and networks for almost all system apps, but I'm really worry about breaking the system with it.

Johnnyloans

GrapheneMask

I wouldn't touch the permissions of the system apps. if you don't trust the OS, then why are you running the OS?

Avoid developer options if you can.

Upstate1618

No, your setup is not good. You trust a third party app too much. You should use Private Space instead. Work profiles are for work rather than security.

GrapheneMask

Upstate1618
But the private space ain't made for holding there a full user. It was made to be opened only when needed and be closed soon after

Upstate1618

GrapheneMask why do you need a full user?

DeletedUser728

GrapheneMask a full user.

What's missing?

Using work profile, kinda "soon to be deprecated" 3rd-party-app-based (sic! device admin) sounds anything but "security in mind"

Novalissoide

GrapheneMask why not create a secondary user profile?

GrapheneMask

Upstate1618
read above pls

GrapheneMask

Novalissoide
I've described my situation in detailes above, thank you

GrapheneMask

I've read all your replies, and I want to say thank you; I really appreciate it all. And I want to ask you about the best approach in my situation. I need to have multiple instances of the same app running at the same time, e.g., 2 signals or 2 sessions. Of course, I can just put them inside private space instead of the work profile, but private space isn't made to constantly push notifications. Also, I need a place to store private apps and data like crypto wallets, government apps, etc. Besides, I maybe need a place for not really trusted apps.

Currently my setup looks like:
main profile -> general apps, twink accounts
work profile -> personal apps, main accounts
private space -> super sensitive data

I'll definitely need to make my setup more private and secure, but how? Tell me, please.

Upstate1618

GrapheneMask

main profile -> general apps, twink accounts
private space -> personal apps, main accounts
Secondary user -> super sensitive data

There's a setting to keep private space unlocked btw

Novalissoide

GrapheneMask 2 signals

Ordinary Signal can be used side by side with the fork Molly.

DeletedUser728

GrapheneMask private space isn't made to constantly push notifications

What makes you think this way? But your point for reserving PS for smelly or sensitive apps is clear. I would just search for alternative clients then to have couple of accounts running.

Novalissoide

DeletedUser728 What makes you think this way

https://imgur.com/a/kiGSwhw

Private spaces are not suitable for apps that need to run in the background or send critical notifications, such as medical apps. This is because notifications and background activity are stopped when your space is locked.

DeletedUser728

Novalissoide are stopped when your space is locked.

So don't lock it. No need to thanks