User profiles vs work profiles vs private spaces

DinaricZoomer

Hello,

I was wondering what your preferences are regarding the options in the title of this post. What are the pros and cons of each?

I understand the differences between a user and work profile, but I am unsure how private spaces differ from work profiles.

What do you use, and why?

My thoughts:

I might get a Pixel soon and was considering to use user profiles to separate my personal FOSS apps into the owner user profile. Here I would have the default apps, f-droid, Telegram, Proton apps, and a bunch of misc FOSS apps. Would it make sense to install microg here for notifications in case some of these need it? I would also use Aurora instead of Playstore. Does this approach make any sense?

I would then create one or more separate user profiles that use Google services. These would be for banking, occassional social media use, Google dependant apps, etc. Basically for stuff that is more invasive and/or closed source.

What do you think? 😃

Eumenia

DinaricZoomer I would recommend to put the proprietary apps in private space if you've them often.

SignalLottery

I want to know this too

taoeffect

Copying an answer from: https://crib.social/notice/ArxaIjecr1xLRPiJTU

There are 3 main kinds of profiles:

1) User (including Owner)
2) Private Space
3) Work profile

Each have their own apps, app data, profile data including a home directory, their own disk encryption keys and their own VPN configuration.

Private Spaces and work profiles are similar to a user but nested inside of another user for actually usage them.

Private Space is more similar to a user and is a user-facing feature and can have a custom lock method or reuse the one from the user.

Work profiles are created and managed by a profile management app. They're meant for bring your own device enterprise deployments. They can be used by end users via one of several local management apps for work profiles.

At the moment, a work profile and Private Space can only be created in Owner, and there can only be up to 1 of each. We want to support having a Private Space in each user and potentially multiple per user with a special UI for using the other ones in the future.

taoeffect

taoeffect Copying an answer from: https://crib.social/notice/ArxaIjecr1xLRPiJTU

See that thread for possibly additional info as well. E.g.:

Oh, I think I get it, one reason to use a Work Profile would be to avoid having to create new settings and new accounts (e.g. in Google Play Store), but still somehow benefitting from isolation, is that right?

buscopina

taoeffect Thank you for the link. That indeed sounds very promising and will solve a lot of my actual headaches once more than one private space feature will be available.

Viewpoint0232

Scroll down to be the bottom of this page and you'll see a table comparing the differences.

For me personally, I prefer the work profile for keeping proprietary apps and Play Services separate from the owner profile. It's the least annoying way to keep these apps from separate, with the least "friction" in UX.

Elgoog

Now that private spaces are available for all profiles, I was thinking of changing from my current configuration:

1. Owner profile, with Google Play services; used only to push apps to other profiles.
2. Daily profile, background running allowed: All apps not requiring Google services; used most of the time.
3. Google profile, background running not allowed: Used only when I need apps requiring Google services.

by making the Google profile simply a private space within the Daily profile. But then I got to thinking, what's the point of the owner profile? Would I be losing any security or privacy by using the owner profile as my daily driver, with all my non-Google apps, and sticking the Google apps in the private space? That would be simpler. It makes my daily profile less secure, in that only one screen unlock is required to reach it, but I could compensate by using a longer PIN.

Am I missing anything?

Nettishrin99

Elgoog I am actually thinking of doing the same as my current profile setup is very similar to yours. I have temporarily moved all GPS apps to private space on my daily profile. The only other profile I have is owner, but now I am wondering whether it just makes more sense to use Owner as daily profile and move GPS apps to Private space?

user2025

Not sure it helps you but ...ill try sharing mine usage.

I have few profiles:
Owner
Personal
meWork
clientsFacingWorks
NewsSocial
GoogleWorks
Disposable
GuestOnceoff

Google for me it has its own profile,separated from owner,works. There,i have frameworks and few apps that needs access go frame or play.

Certain profiles has a private space where i have browser with login credentials to lets say some portals with the clients setup, likw webhisting, M365,Cloud IAAS/SAAS/PAAS...dont tave the laptop all the time with me.

VPN is enabled and running fine on all the profiles.

My main issue is that i cannot find an Android browser which supports profiles native. So,that i can start browser and be promoted to choose a profile that has a login,passwords,cookis and so on.

The risk of crossover contamination is minumum, in terms of apllications,data,settings.

One thing that pisses off annoyingly is that im not aure in which profile im running "now"...and cannot find a away to easily identify the session...

Lastly, big thanks to Graphene DevTeam for their works.

Elgoog

Would anybody care to share how they have changed their configuration of profiles to take advantage of private spaces being available throughout?

user2025

Just pay attention to how you deploy applications.

You can push install available application from owner to "secind" profile and have same application (with separate settings and extensions).
Also,you can install application inside the "second" profile(s) and they will stay inside with no relation awareness between profiles.

Private,as well, i think, i found settings are different & separated between a profile app and its private installer app: they dont share settings or extensions even in the same profile.

user2025

Well...a feature that is very very worrying & annoying...

So, switched from owner to work profile.
Working a bit.
Lock the phone via power button.
When it screen comes on i have an option to unlock the phone ...OR.. to terminate session !

Pressing "terminate session"...ends my work profile and returns to owner screen (to login).

Thats not how was supposed to work,isnt ?
I dont want to terminate the work profile active session unless im unlocked ! Hmmm...help ?

trynda

Would it be possible to create a different lockscreen pattern for different profiles?

The use-case I'm thinking about is in cases where personal safety is compromised (think being held at gunpoint by a thief forcing you to move money to their account or airport officials illegally asking to unlock your phone), in that case, a fake profile (that hides all the other profiles) would be activited if a certain screen pattern/lock/fingerprint is used to unlock the phone.

userofgos

trynda Would it be possible to create a different lockscreen pattern for different profiles?

lock screen patterns are insecure and will not be added to GrapheneOS. https://discuss.grapheneos.org/d/16393-maybe-re-instate-pattern-unlock/16

trynda a fake profile (that hides all the other profiles) would be activited if a certain screen pattern/lock/fingerprint is used to unlock the phone.

You're probably the 100th person to ask for this and likely not the last. There's a ton of threads on this, here's a few: