Separate dedicated phone or GrapheneOS's sandbox?

datlee

A few apps that life is forcing me to use that are either the devil himself (Google) or need the devil's permission to function (Google framework).

I would like to keep my real identity separate and isolated from everything else that I do when I'm not using platforms that know my real identity.

Example:

My email provider would know my real identity because there would be things in my inbox that have what identifies me, such as my name.

Things that I could use without having to reveal my real identity would be something like the browser.

So I have the email provider, "A" and then I have the browser, "B".

I don't want A to know about me on B or even know that I'm on there...and vice versa.

My initial plan was separate phones for both...no sharing networks.

But if I can achieve the same isolation with one phone, then I'd prefer that. So I was wondering, is it possible? Does GrapheneOS provide airtight isolation if I used its sandboxing feature for A?

Appreciate your feedback!

jarelllama

datlee There are many ways to track a user between devices. Looking at your scenario, your IP address could definitely link your two devices together. This requires your email provider and the websites you visit to have the same trackers. (Google Analytics for example)
A VPN while using your email service/web browsing could be a solution. GrapheneOS allows you to use different VPNs per profile/user.

I would like to also point out that sandboxing is a feature already in AOSP and not GrapheneOS specific. From my understanding, it is more of a security feature than privacy feature. Just look at sandboxed Google Play Services as an example. It is sandboxed like any user app but that doesn't stop it from being able to communicate to apps that consent.

nrt

datlee
User profiles provide the best isolation. Consider using 1 profile for your real identity and a second profile for your google apps with a throwaway account.

https://grapheneos.org/faq#non-hardware-identifiers
"However, profiles are the only way to provide a strong assurance of separate identities since the application model of the OS is designed to support communication between apps within the same profile, but never between them."

evalda

datlee if you threat model is not too high and you're just looking for privacy, you can have 2 profiles on the same GOS phone setup this way:

Profile for things that know your identify. Use a VPN or not. Use normal settings like languages, time zone, display size that you would normally have.
Profile for things not associated with your identity. Use VPN from different provider vs VPN in the first profile. Pay for it anonymously. Use a different browser (vs the one used in the first profile) AND change settings like languages, display size, theme so that fingerprinting can't easily link you to the first profile (this part is very important).

nrt

GrapheneOS profiles dont prevent device fingerprinting. If you visit the same website on multiple profiles and they run javascript (canvass fingerprinting, cross-browser fingerprinting, etc) they can know its the same phone.

datlee

nrt In that case, whats the benefit of the sandboxing of Graphene

Whatnoww

nrt Isn't it just that they know it's a Pixel model in particular? IP also helps of course, but let's assume we're using a VPN for the sake of argument.

nrt

nrt GrapheneOS profiles dont prevent device fingerprinting. If you visit the same website on multiple profiles and they run javascript (canvass fingerprinting, cross-browser fingerprinting, etc) they can know its the same phone.

Using default profile settings I should have said.

nrt

To restrict what an app can do.
You should read
https://grapheneos.org/features

nrt

https://source.android.com/docs/security/app-sandbox
GrapheneOS further hardens the app sandbox

nrt

Whatnoww
"In addition to not having a way to identify the hardware, apps cannot directly identify the installation of the OS on the hardware. Apps only have a small portion of the OS configuration exposed to them and there is not much for device owners to change which could identify their installation. Apps can detect that they're being run on GrapheneOS via the privacy and security features placing further restrictions on them and hardening them against further exploitation. Apps can identify their own app installation via their app data and can directly (until that's removed) or indirectly identify a profile."
websites can run javascript code that fingerprints your device and vpn's cant prevent this.
So lets say I log into facebook in 1 profile using a vpn; in another profile using a different vpn I access my other "anonymous" facebook account. Facebook is highly likey running javascript code that will associate the 2 accounts across profiles.

datlee

nrt Couldn't an app upload device fingerprint to its servers?

So app A on profile 1 sends device fingerprint to server X.

App B on profile 2 sends device fingerprint to server X.

App A and B share/own server X, and thus link user that way.

rhimbo

evalda
Could you elaborate on what exactly you mean by "pay for it anonymously?"

nrt

datlee
If App A and B talk to servers owned by same company, sure they can be associated.
Pseudonymous outlook account in profile A, linkedin account in profile B; both owned by microsoft. Its entirely possible microsoft is linking those accounts thru fingerprinting.
What evalda is suggesting to change settings like display size, languages, theme does change your fingerprint and is able to defeat fingerprinting code from websites such as https://abrahamjuliot.github.io/creepjs/
Profiles allow users to change some default settings such as display size, thereby changing your fingerprint.

nrt

nrt this method appears to work, but in the future as device fingerprinting becomes more advanced it will probably stop working.

other8026

rhimbo they probably mean use some sort of cryptocurrency to pay for the VPN service. Many VPNs accept them.

evalda

rhimbo Monero or cash in the mail

rhimbo

other8026
Ah, OK, thank you. I didn't even think of that (I avoid crypto like the plague).

I was thinking that a credit card is not anonymous. Even if you don't create a log in on a site selling the VPN subscription, they know who you are by your credit card details.

Chipper

Although if your crypto was bought via a centralised regulated exchange then it will have kyc (know your customer) requirements.... So anonymity is legislated out of the system... Essentially you want a decentralised exchange that allows for peer to peer cash based purchasing of crypto... Essentially meet a guy in the park he gives you crypto you give him cash... No i dont have recommendations. Or get a pre paid debit card.... Which you obviously buy for cash... In a store without cameras... Or from your numbered account in a tax haven i guess... Im sure there are many more ways but of course the government frowns on this behaviour because clearly if you dont want to be observed to the nith degree you are hiding something.... (Heavy sarcasim as i happen to manage being a responsible and conscientious person while still expecting my privacy to be respected )

other8026

rhimbo totally spaced on another one. Some accept cash. You just mail them the cash and they credit your account.

ryrona

rhimbo other8026 I never understood the reason for paying for a VPN anonymously, your VPN provider would know your true IP address anyway. They are the only one that does after all. If they can protect your true IP address, they can protect your payment details too. At least that is how I have been thinking about it. If one cannot trust any VPN provider like that, one has to use something multi-hop like Tor or something anyway, which also happens to be free.

matchboxbananasynergy

ryrona Your IP can change (you can go to a different place, use public Wi-Fi etc). Your personal details can't (usually) change.

evalda

ryrona I never understood the reason for paying for a VPN anonymously, your VPN provider would know your true IP address anyway.

If you pay with a credit card, the chances are a payment processor will also know (and log) your IP address.