Hacker News Reader

Comment by nefariousoctopi | Hacker News Reader

> Works, but only in main profile.

Would anyone know why? My understanding of profiles is arguably very limited, but I always saw those as equivalent to device owner profile from app runtime standpoint.

View on HN

I’m not very familiar with android because I don’t daily it, but I have an old Pixel 4 with GOS that I was using to evaluate GOS. I know for example that some MDMs don’t work on a secondary “Work” profile in GOS, despite it being one of the main use cases for secondary profiles. If I recall correctly, it was because of how some MDMs can be configured by the organization’s admin they require some handshake with the Owner profile that doesn’t work in GOS. you would have to install them on the owner profile defeating the point I think,

Certain MDM apps support using the Play Integrity API to ban using non-Google-certified devices. Some MDM apps simply don't know how to successfully create a functional work profile without Google Play being automatically installed in it which can be worked around and we can provide an easier way to deal with it. Work devices should really be separate devices provided by the company instead of them managing a work profile on your personal device though.

It's worth noting AOSP and GrapheneOS have both drastically changed since Android 13 on the Pixel 4. GrapheneOS is based on Android 17 since June 2026 and soon Android 17 QPR2 in December 2026.

I don't get why people accept that kind of intrusion into their own device commonly known as BYOD. If a smartphone is necessary to carry out work duties, let the employer provide one.

Thank you. That’s totally fair. I know I’m using an unsupported old device and that it’s better to have a separate work managed device. I just hate the idea of carrying 2 phones and was hoping there is a way I could still use GrapheneOS while containing what MDM can do. Though I realize MDM’s whole point is control of the device, so perhaps what I’m looking for is a logical contradiction.

An app is able to check if it's running in the main profile: https://stackoverflow.com/a/54765470

I can't think of a legitimate reason to check this and refuse to run in a secondary profile. But banking apps sure love to cargo-cult invasive nonsense.

Reply on news.ycombinator.com