Multiple User Setup

Thommsan

Hi there,

I have installed GrapheneOS on My Pixel Phone. I have read quite some threads and watched a couple of videos, but I still didn't get the thing with multiple users.

As far as I understand, people are using different user profiles for different occasions, e.g. Google, Banking, Mail, Shopping, etc.

Some people mentioned to install neostore and from that the Aurora store. Some are installing the apps on the Admin profile, others are using separate user profiles to do so.

Hera are some questions, I am wondering:

Should I install neostore (the latest version on github is one year old, so should I install it at all or use a different store?) and Aurora?
Should I install it on the admin profile or a sub-user?
If I install it on a sub-user, are the apps, that are downloaded on the sub-user also available on a third/fourth/etc. user or do I have to install neostore/Aurora on each new sub-user profile?
How many users do you have and what for (just to get an idea)?
Some people mentioned they have dozens of users while others only use the admin. What's the point of grapheneos if you only use the admin and install all apps (incl. Google Play Services) on your admin profile?
If you have e.g. two users (Admin and a sub-user) and you leave the admin completely empty (no apps installed), what's the point of the admin user? What are you doing on that profile in general? And if you have everything on just one sub-user, isn't it almost the same as I would use a normal phone (because all apps are installed in the same place)?
From which profile do you make phone calls, write SMS, etc.?
As you can see, I am a totally beginner and have no idea how to get started correctly. If there is any beginner friendly setup tutorial that you could share with me, I would really appreciate it. If anybody can answer me some of my questions, I would be really grateful. I think what I am missing is a step by step guide how to get started for people like me not really familiar with that kind of technical stuff. I have talked to some people who gave up on Graphene because of the same issue which is in my opinion pretty unfortunate.

I am really sorry for bothering you all with all these beginner questions.

Thanks to everybody for any support in advance.

Best regards

[deleted]

I only use Aurora because for me it has the apps I am looking for and haven't needed to use neostore.
Depends, on the admin user you would be able to push it out to other profiles. If you put it in a profile that isn't the admin, I haven't tested whether you can give it to other profiles like the admin can.
I haven't tested personally, so someone that knows more might be able to comment on this.
5 users. An admin with nothing on it, 2nd profile is for my music and movies, 3rd profile is for my saved photos, 4th, is for my messaging apps and crypto, and 5th is for my gps, newpipe, aurora store, password manager, aegis and standard notes.
To my understanding since the admin controls all other profiles and has all the access, putting apps in here could compromise the system. If there is a security break. So in terms of Google Play Services, it might be safer putting it in its own profile.
Nothing is on my admin profile and it wouldn't be the same as a normal phone. Since the other profiles add a compartmentalization factor, if sub profile is compromised it won't compromise the admin profile controlling everything else. Assuming there are no security issues between users that can be exploited allowing a compromised sub profile to gain access to the admin profile.
My 4th profile.
I just did some research decided on what setup to go with based on what I found out. It may not be the best and depending on how you want to use your phone my setup may not work for you. It ultimately comes down to how you want to use the phone and what your threat level is.

This is just what I think I know, so hopefully if I missed something or someone more knowledgeable comes by they can add to this.

TRInvictus

[deleted] Since the other profiles add a compartmentalization factor, if sub profile is compromised it won't compromise the admin profile controlling everything else. Assuming there are no security issues between users that can be exploited allowing a compromised sub profile to gain access to the admin profile.

Please correct me if I'm wrong, but if I remember correctly, there's no security benefit with this. If the phone is compromised, no matter what user profile, it is compromised. There's no additional security with a "virtual" non-owner user profile, from the security perspective, isn't it?

N1b

I feel you, these profiles have a lot of features and fulfill a lot of goals, so they can be confusing and overwhelming. Btw. I'll refer to "admin" profiles as owner profiles since that's the official term.

Your questions starting with "Should I..." can only be answered by yourself, because there are good reasons for and against the different setups. I recommend you take an hour to make a basic threat model for yourself, it will save you so much time going forward and finding the right answers for you. As for the questions I can answer from my perspective, please be aware I'm a simple user and do not speak for the GOS project.

Neo Store is still in active development from what I can see. Seems like there wasn't an important feature or fix needed in a while, but nothing to worry about. If you are willing to trust Droid-ify or Aurora Store which both have also not received updates in a while, you'll be fine with Neo Store. Many users need both Aurora/Playstore and F-Droid/Neo/Droid-ify to get everything because some apps are exclusively in one source.
Do you want to update everything from the owner profile and push the apps to the respective user profiles? In this case you need to have all your appstores there. This will save you time and effort since you won't jump profiles all the time or have conflicts between updating apps from different sources.
Only apps installed on the owner profile can be pushed to users, so if you install an app in a user profile, you'll have to install the exact same (!) app again in another user profile to use it there.
I used to have up to 4 users, now I have 2 devices which I use 99% in my owner profile. Only for a crypto hardware wallet I have made a separate user and I access it rarely since it's for storage rather than spending.
AOSP in general and GOS in particular have great app sandboxing and features to mitigate the privacy and security risks in having multiple apps installed in the same profile. It's different on a Desktop computer OS or even the main Pixel OS where Google has privileges to see basically everything. For many users (me included) one profile is more than enough for our threat model.
The owner profile needs to be there, it's part of the Android security model, needs to always be unlocked upon reboot and it has some exclusive settings (such as developer options or WiFi auto off). This should not affect the everyday experience or what your apps can do in general, so from the user perspective I feel no difference in using either. I don't know what you mean with "normal phone", every modern Android and iOS device comes with security models far superior to Windows, Linux or MacOS and GOS is further strengthening it.
Everything from the owner, I've read that there are limits to third party SMS apps on user profiles but I can't comment on that.
My best advice here is to just start simple. Leave everything at the default settings and in the owner profile and take your journey one step at a time. When I first used GOS, I was discovering so many cool features and security/privacy improvements that the idea of an even more advanced setup was quickly forgotten. The more you figure out what is and isn't important for you, the better you'll adjust the small things to your liking down the line. Using GOS in the first place is such a huge improvement for any threat model, it will likely be the most important step already. The rest is a journey, so take it slow and enjoy if you're not in a life threatening situation anyway.

I hope this helps you. Have fun and welcome to the community!

TRInvictus

Hi @Thommsan
I was facing the same questions as you do when setting up GOS the first time. I currently use the owner profile for everything (99% of time, no G services). A second profile is for banking app with G services (which doesn't work yet).
Carefully select the apps you want to use and trust, carefully grant any permissions (and revoke wherever possible).
Make use of GOS's storage- and contact scopes, they're very good to manage access permissions, give your apps very specific access only, and nothing more.
If you have any apps you don't trust, but rely on, cage them into an own profile. And restrict their internet access (eg. RethinkDNS, isolation mode) + VPN.

[deleted]

TRInvictus
https://grapheneos.org/features#improved-user-profiles

Under "Improved User Profiles"

To me this indicates each profile is compartmentalized, so if one profile is compromised the others are still secure. Maybe I'm reading it wrong, but that is my understanding from the verbiage here.

de0u

[deleted] To me this indicates each profile is compartmentalized, so if one profile is compromised the others are still secure.

At present I believe multiple user profiles are more a privacy measure than a security measure. Even in a single profile app actions are controlled by the OS, but within a single profile apps are allowed to detect each other and communicate. It is true that inter-app communication within a single profile might enable some attacks, but I do not believe multiple profiles provide a dramatic force field of extra security beyond the regular GrapheneOS app sandbox.

That said, I am not an expert.

TRInvictus

@[deleted] Ok, there's definitely an extra of security in the file system using its own per-user keys. I don't know exactly it's underlying implementation, if it is a full copy, resp. own mirror of the complete system files, for each user. That'd require quite a lot of disk space tho.
As @de0u says, I'd be interested to know how GOS's user compartmentalization would add on security beyond the app sandbox.