Reducing friction with MFA and local password managers

AffableAlligator

I’ve decided to take the plunge and do a test run of GrapheneOS after a lot of research across various forums and here. One question I have is how do you minimize friction with your password manager and authenticator app across profiles? I aim to have six or so profiles and leave the Owner profile as is. I personally don’t trust cloud-based password managers, so I use KeePassXC. For my authenticator, I’m using Ente Auth.

My approach for KeePassXC would be to store it in a shared storage space and give other profiles read access. Then I’d have to install the KeePassXD client in each profile. That’s easy enough. Ente Auth is more the issue. Yes, I could enable cloud sync, but I’d prefer not to.

As far as I know, GrapheneOS has no native clipboard sharing feature across profiles (if I’m wrong lmk). Is there a better way to go about this?

NoahRaketic

AffableAlligator I aim to have six or so profiles and leave the Owner profile as is.

Can I ask why? This isn't at all necessary for the security/privacy benefits of GrapheneOS, and in fact has very few security/privacy benefits in the first place.

AffableAlligator As far as I know, GrapheneOS has no native clipboard sharing feature across profiles (if I’m wrong lmk). Is there a better way to go about this?

If you need this level of syncing between profiles, I don't see the purpose for separating these different profiles. They're not designed as a security boundary and are most effectively used to separate different personas with their own suites of apps, contacts, photos, etc.--not for separating categories of apps.

AffableAlligator

NoahRaketic I see. Maybe I’m thinking of profiles wrong then? My understanding is that separate profiles provide separation at the app and communication layer. I had wanted to separate based on degree of privacy and function. Maybe I’m going a bit overboard.

Owner (untouched)
Daily (non-google play services apps) that I use everyday and are privacy respecting
GApps (apps that depend on Google Play Services)
Work (work related apps and authenticator that need google play services)
Financial (banking related apps)
Testing (testing new applications)

My goal is to minimize the big tech, corporate window into my life. I didn’t want Google Play Services to collect data on me, if I can help it. Even if it’s sandbox, I’m skeptical Google Play Services will work if I just sever its network connectivity entirely. Granted, my Pixel hasn’t arrived yet, so maybe it does work. ¯(ツ)/¯

littlerack

AffableAlligator I’m skeptical Google Play Services will work

I grant it network permission on rare occasions, and only to specific domain (using RethinkDNS), to enable use of few apps that rely on Google maps. Some apps just need to see services installed and that's enough. Highly depends on your app set.

Your profile schema will result in severe usability issues.

I use owner with play services and private space for work apps as they don't need access to phone/sms.

grain0613

I have a similar setup with you. But I keep my financial apps together with the other GApps apps.
I don't mind cloud syncing of password manager and oauth (Bitwarden and Ente) so I install those in both Owner and GApps.
Other friction is email if you want to use your email with apps.