Hacker News Reader

Comment by TFNA | Hacker News Reader

On GrapheneOS you can install your bank app in a different user profile, and run Google Play sandboxed, so this scenario of a bank app doesn't result in anyone having access to your other information.

View on HN

Note that the user profiles aren't the basis of sandboxing. The bank app is still sandboxed, and GPlay as well if you only use a single profile. Profiles have use cases of course, they offer separate app data, user data and VPN configurations. They also have a separate list of apps marked as installed, a list apps can see in a profile. IPC also can't take place cross profile, which is useful to prevent communication between apps based on mutual consent. Also nice is that they offer separate encryption keys and can be put at rest manually. In the past they also had the advantage of having a separate clipboard but this isn't an advantage anymore given that GrapheneOS recently shipped within-profile clipboard control.

If you dont need any of the above its perfectly fine to run the banking app on your single, main profile.

Can Google have access to the banking information with such setup?

See my reply to the parent of your comment.

No. (Not any more than to the browser data anyway)

I don't understand, what the browser has to do with this. It can work without Google Play.

If you have Google Play in the same sandbox as your banking app, why can't Google access everything there? Or are they in different sandboxes?

Android apps are isolated by default. Graphene can do a bit more, but overall Google Play store doesn't get access to your app data. So what I meant is that your banking data is as safe from the store in the app as it is in the browser.

Reply on news.ycombinator.com