How do I convert my threat model into a G.OS configuration?

Lizard

Hi All,

I'm a new G.OS user and I've recently installed my first 3rd party app to G.OS which is Obtanium and has been installed on the owner profile. Before I start installing other apps, I've realized that I need to decide how many user and/or work profiles I will use, and what they will be used for.

I've been doing some thinking about my personal threat model and have a basic list of the things I want to protect, and who from, but how do I then convert that information into answers such as:

My threat model determines I can/cannot not use a work profile
My threat model determines I need (x) number of user profiles
My threat model determines I can/cannot use Google services
I will keep the owner profile empty / I will use the owner profile for FOSS apps / I will use the owner profile for everything

It's probably quite a broad question but I want to make sure I get the isolation principles correct before installing additional apps and trying them.

Any pointers or tips on this would be greatly appreciated.
Lizard

other8026

Lizard

This is a topic that many forum users have discussed at length. You may want to search for other threads so you can see what others have said.

Basically, I'd suggest a profile per role. Like one for personal use, one for work. If you want to further separate some things, then do so. Like one for personal user, but no Sandboxed Google Play, and one with Google apps. Though I'd personally suggest you keep the number of profiles to a minimum since switching profiles is annoying, especially if you always need to to switch between work stuff while messaging a family member in another profile.

I think the next bit of advice that I have seen on here and I really agree with is to not overthink it. You can always change your profiles later. You said you'll keep the Owner profile empty. That makes it even easier. If you want to rearrange apps and profiles, all you need to do is delete the old ones and start fresh.

Lizard

Thanks for your reply. I don't really use the phone for my job, so I guess I'll try as you suggested and use two extra profiles to start with, one with GPS and one without. I've seen quite a few people saying about the inconvenience of switching between profiles so I'll avoid the temptation to create too many.

Do you also use Shelter for added convenience of a "work" tab, and would you recommend it? As far as I'm aware the usual response to a question like this is "it depends on your threat model" which kind of leads back to my original post.

Thanks
Lizard

other8026

Lizard Do you also use Shelter for added convenience of a "work" tab, and would you recommend it? As far as I'm aware the usual response to a question like this is "it depends on your threat model" which kind of leads back to my original post.

Sorry, I have never tried any app like Shelter to create a work profile. There are many GrapheneOS users who also use work profiles, so maybe one of them will pop in here and share some of their thoughts. I do know that work profiles provide less isolation than regular profiles, so keep that in mind if you really care about isolating apps, or if you just care a little and prefer the convenience.