Limitation of a secondary user (feature request)

mhall

I'm loving grapheneos so far. Extra thanks for the developers working hard on this. It's really impressive and the UX feels really responsive and clean.

There is only one big issue and two non critical issues I'm experiencing for my particular use case of setting up a locked down phone:

I have to login as the admin user on device reboot, instead of allowing a secondary user to login directly on reboot is the biggest issue preventing real world use. I understand from an architecture point of view currenly the way the device is encrypted it's required for the admin to login first. While I can undersand the extra security layer for a single person who wants to setup multiple user accounts to sandbox different apps from each other, for the device to be setup as a phone for a kid or intentionally lock down the device for minimalism purposes, the requirement of having to login as admin on reboot severly limits the usefulness and freedom of the secondary user if they are actually a different person. They either 1 need to know the admin password, which allows them to change whatever they want, or 2, their device reboots or runs out of battery and they have to go to admin user and have them unlock their phone who might not live in the same physical location.
Sms message notifications on the secondary user don't have the message details or contact's name. I think I saw another thread saying this happens for secondary users as well.
Sms message notification will not disappear after clicking on the notification and reading the message.

Issues #2 and #3 are using google messages instead of the default sms app. I need to test the system default sms app, but I think the same issue still occurs. In addition, I worry that if #1 was fixed, sms wouldn't work at all on the secondary user, since I think the admin user needs to be logged-in in the background.

Overall, I understand I might have a non-typical use case for the secondary user, but from what I've been reading on other threads, other people seem to desire this ability as well. I think you'd gain pretty good traction from a group of users looking to create more minimalist/locked down phones for themselves. There has yet to be a good option for a smart phone that has the ability to be customized in such an easy way like Grapheneos imo, and it's extremely close to being perfect for it.

Thanks again devs for the work you're doing

Overlay1404

mhall for the device to be setup as a phone for a kid or intentionally lock down the device for minimalism purposes, the requirement of having to login as admin on reboot severly limits the usefulness and freedom of the secondary user if they are actually a different person.

I do not think this is an intended use case of GOS or a goal of the project. I would not expect this to ever work that way.

I imagine being able to bypass the owner profile after a restart would cause some major security concerns as well, if its even possible.

If you do not want your kids to be able to access apps etc an actual "dumb" phone is probably just a better option. Such as a Nokia flip phone. You can always upgrade them to GOS when you trust them enough to be the admin of their own phone.

mhall

Overlay1404 I understand and respect if it's not a use case the developers wish to support. However, I've already seen several posts related to this topic, which leads me to believe it's a desired feature among some grapheneos users.

If the developers want to move away from this concept, I'd suggest renaming "User profiles", as the current name is bit misleading, and grapheneos is treating user profiles as an exception not the norm, which is why these questions comes up. They are really "sub profiles" or a term that helps communicate the login as admin on reboot limitation.

Overall I think this user feature is really cool, and I'm sure it took a lot of work to implement, and phones are almost always seen as single person device. In my case I still want it to be a personal device, but just having the secondary user the freedom to login without the admin password. I respect the technical challenges this may cause, especially if the admin is technically needed to he signed in in the background for SMS, but I wanted to continue to raise this as a requested feature and see if it gains any traction.

mhall

Overlay1404 Also, while yes there are certainty alternative options, like a flip phone or light phone ii, they are all quite limiting.

I'm a software developer, but have little mobile experience. Grapheneos almost made it extremely simple to create a secure and feature rich phone which was customizable but also capable of being locked down. The flexibility is phenomenal.

The best and simplest alternative is probably just using Google's "family link" on a non grapheneos android phone, but the perks of grapheneos sandboxing the play store, and several other security features are worth supporting, and I'd like to do so if the feature we are talking about is supported one day, and I know I'm not the only one

Overlay1404

mhall which leads me to believe it's a desired feature among some grapheneos users.

Users request a lot of features, it does not mean all of them will be undertaken. This is a forum meant for suggestions. Even if it was something GOS wanted to undertake, I would imagine it would be extremely low priority as its not a security or privacy benefit.

I could be wrong, only @GrapheneOS could give you a firm answer on whether its something they will look into.

mhall If the developers want to move away from this concept, I'd suggest renaming "User profiles"

"User Profiles" is not specific to GrapheneOS - This is the common term for the feature across Android devices. I think your confusion rests in that you misunderstood what is meant by a "User Profile" as something to create different profiles for different indviduals. When its really meant for one user to segment the phone for different use cases (such as banking, or work). The Guest profile is really the only one meant for someone other then the owner of the phone to be using.

mhall

Overlay1404 understood, if user profiles is something that exists in stock android as well and works this way and grapheneos is merely providing the feature, then fair enough. I understand what the grapheneos intended use case for them is. I'm merely pointing out that in literally any other implementation of user profiles: websites, gaming, banking, other operating systems, an admin password is not needed to login to a user with non admin privileges. So I think many users unfamiliar with android development will have this misconception initially.

I appreciate your input, let's see what the developers of the project think

mhall

Another thread on this topic: https://discuss.grapheneos.org/d/4246-admin-user-and-regular-user-for-kids-grapheneos-phone

mhall

I see an informative reply by GrapheneOS in this thread about how there are issues in AOSP for mutliple users that GrapheneOS has ultimately fixed. I suppose the question becomes if AOSP supports the user workflow I'm suggesting. There is documentation and information here on the categories of user: https://source.android.com/docs/devices/admin/multi-user#caveats
From my extremely limited understanding, I don't see why the feature isn't at least possible, but I could be wrong. I completely respect the possible technical challenges here.

It ultimately comes down to how GrapheneOS wants to use the multi user support provided by AOSP, and dealing with any limitations AOSP currently has. Anyone who has information feel free to chime in I'd be interested to know if anything is in the pipline for allowing non-privledged user sign in.

mhall

Yeah sadly I'm seeing threads all over the internet where this a problem on the stock pixels as well. So most likely this issue is outside of grapheneos. Seems like this has been a limitation for years. Anyone who knows more fee free to chime in