help understanding app privacy 'surface area' in profiles vs shelter auto-freeze

hexagonal-lattice

New to GOS, coming from the other somewhat similar distro that relied on microg/work-profiles. Thank you for all the GOS work, now that sandboxed GSF is supported, i'm thrilled to move over!

scenario:

spotify, netflix, etc needed for occasional usage.
- Apps like this obviously require network access and permission to run in the background.
- I would prefer not to use these, however I'm not aware of anything similar (paid) yet privacy respecting, even ignoring any exclusive content.
- I presume from these necessary permissions that while using them I leak at least some (if not substantial) information, directly or ~ signint/otherwise.
previously I would install both in work-profile (shelter), with auto-freeze enabled. This way, even when i used one app, i could be sure the others are Not running at all (including background), thus preventing (or at least fragmenting/compartmentalizing) some data gathering
now, I install them both in a separate "untrusted cloud services" GOS profile. So, when using none of these, all are "frozen" as the entire profile is ended.

however, my question is: in that separate GOS profile, when it's opened/running, my understanding is there may elements of all apps in that profile running in the background. Should I ALSO install them under shelter, to ensure i can run one at a time without needing a profile for each app?

many thanks!

MetropleX

hexagonal-lattice what elements do you think you are leaking so I can attempt to answer or quote the answer for each to reassure you etc.

hexagonal-lattice

Privacy leakage, mainly MetropleX - here's an example, and thanks for your reply:

Example: Spotify needs bluetooth permissions for obvious reasons. I believe this would allow beacon scanning, thus leaking relatively accurate location, despite location services disabled.

Bluetooth might be needed for some other app, IE it's not driven solely by use of Spotify

As I understand it, using the work profile (shelter specifically with freeze) allows me to "turn off" apps individually. I could replicate this to a point "one profile per app", but that has a lot of downsides and precludes some use cases (such as like using my phone for directions while still being able to change the song).

hexagonal-lattice

MetropleX I should add about the spotify example:

I used that because it seems, reading the permissions (but not being an android developer), that the app has within it's allowed function the capability to easily glean information about my location if not more.

Aurora says: access bluetooth settings, pair with bluetooth devices run in the background view wifi connections (I VPN, but this sounds like scanning outside location services?) view network connections, and discover and pair nearby bluetooth devices
android settings post-install have very different granularity: network, sensors[denied], nearby devices[denied]
Spotify seems fine on quick test (it displays warnings, but functions) with only network allowed in settings (it can play audio to a paired [at the OS] speaker, and receive events from that speaker (Pause, etc)

what else can it do? I'd argue its ~ highly technical based on a combination of sdk version, implementation details, and maybe external things like bluetooth & wifi advert specs, right?

To be specific on my threat model here - I'm trying to maximize my privacy within certain usability bounds. And I'm trying to ensure I understand my surface area so I can at least make informed consent (even if companies don't give this to me directly). Over the last 5 years I've switched myself and the family over to GOS (previously calyx), linux desktop, protonmail, signal, always-on vpn, FOSS contact/calendar/file/password sync, and some others, but this has limits - streaming music is a great example: perhaps I'd give it up; they will not. My privacy is only as good as that of the folks I live & travel with, and who receive 90%+ of my comms. Just trying to rationalize the difference between my request and paranoia haha :)

So Spotify is an attempt to make a 100% concrete example. Since I'm obviously not well versed here, it's probably wrong :) however in the general case, even within the phone/localhost, apps can communicate by mutual consent (which is really opaque to the user, regardless - requires inspecting the ~ manifests AFAICT) ... having an app provably suspended means I don't have to worry at all about what it's doing, now or after a sleezy update, expect when i have it explicitly open.

I do appreciate your replies, thanks!

Conjure6589

If you want to have only one app running at a time in that profile you can turn off internet permissions to all the apps and only enable it for the app you want to use when you're using it.

MetropleX

Conjure6589 another idea would be to use Orbot as the always on VPN with blocked connections in VPN mode and then enable just what apps you want connected at any time from the list of Tor Enabled Apps.

hexagonal-lattice

Conjure6589

the issue with manually entering settings to toggle network for each app, each time (besides it being pretty cumbersome) is I have to proactively remember which is a much harder task in the general case. My spotify example is not the best for this answer (because music would not be auto-frozen on screen off), but you get the idea; for most apps i can auto-freeze them, and thus have them automatically disabled when i move on to something else.

hexagonal-lattice

I did recently enable auto reboot which has some similar benefits to auto freeze and @Conjure6589 's point, but only in !Owner profile for some apps (since music apps can't play from "backgrounded" profiles, afaict)

although thinking more about Conjure6589 - I'm not sure manually toggling network even has the desired effect (without strictly understanding what an app can interact with). Take the bluetooth scanning example. It's entirely logical (and probably required for artist payments) for a commercial music app to log actions taken while the app is offline. So it's not that paranoid a stretch to consider it also storing / uploading later any & all other telemetry they might be interested in or monetizable, like location.