User owner as standard user?

wired

Is there a reason (security or privacy-related) not to use the user Owner for everyday use?

When I set up my Pixel 7a with GrapheneOS (now build 2024121200), I immediately created a new user - as I am used to from Kubuntu-Linux. However, I quickly learned that GrapheneOS regularly restarts and then switches to owner. Since this bothered me and I did not understand the purpose of this function, I deactivated it. Now I am still annoyed that you always have to switch to the user owner for the (thankfully) frequent updates. Of course, you cannot switch this off.

Now I am considering resetting the phone and installing everything that works without Google in owner. Disagree?

KleinesSinchen

As far as I know it is a limitation of Android requiring to unlock owner before you can access other profiles/users.

Auto reboot (default 18 hours without unlocking at least one profile) is used to purge encryption key from memory ("put data at rest"). That makes unauthorized access to your data considerably harder. Apple added this function recently as well with the timer set to 3 days.

As for using owner or secondary users… that depends on your preference and if you want to protect some things more than others. I like compartmentalization

Besides owner with complex PIN, I'm using a weakly PIN protected profile just for the bus ticket.
The second profile is for personal/private stuff with diceware passphrase
A third one with mediocre password serves for Google Play Store via TOR using throwaway account.

Secondary accounts can log out (→ data at rest) any time – owner requires reboot.

Owner has the additional benefit of allowing simultaneous access to "Private Space" and "Work Profile" without switching profiles if desired.

wired

KleinesSinchen Auto reboot (default 18 hours without unlocking at least one profile) is used to purge encryption key from memory ("put data at rest").

The problem is that a radio alarm clock runs on my standard user. It does not work if the user owner has been activated overnight or the phone is in "Before First Unlock" state. If I have understood this correctly, end session will complete the same purpose, only at the time of the time.

JollyRancher You can substantially increase security and privacy via appropriate use of user profiles, but it comes at some cost in terms of ease of use.

I am ready to pay this price - up to a certain point. That's why I use GrapheneOS. ;)

c86 If I recall a big benefit of the setup is the ability to completely purge the user profile, then quickly setting it up again, if something goes wrong as opposed to factory resetting the entire device.

This is a good point that didn't come to mind yet!

Is a new user / guest based on owner? When I recently created a guest for test purposes, I was already wondering what "Install available apps" does.

I think, I will keep owner clean.

Thank you for your help!

wuseman

KleinesSinchen Owner has the additional benefit of allowing simultaneous access to "Private Space" and "Work Profile" without switching profiles if desired.

You mean we can have both at the same time!?

Open_Source_Enjoyer

KleinesSinchen Besides owner with complex PIN, I'm using a weakly PIN protected profile just for the bus ticket.
The second profile is for personal/private stuff with diceware passphrase
A third one with mediocre password serves for Google Play Store via TOR using throwaway account.

Is there are downside of using the same password for every profile?

KleinesSinchen Secondary accounts can log out (→ data at rest) any time – owner requires reboot.

So when i click "end session" in a profile, the data is more secure?

JollyRancher

GOS used in the owner profile with Sandboxed google play is still a far more secure and private smartphone that you are getting basically anywhere else.

In terms of ease of use it's also pretty good.

You can substantially increase security and privacy via appropriate use of user profiles, but it comes at some cost in terms of ease of use.

If your threat model is on the low end of the scale then you will be just fine using Owner as your daily driver.

c86

I've heard some complaints about phone / SMS having issues when everything is done in a secondary profile following Clean Owner profile documentation. It was nothing major from what I remember, just users missing calls or notifications from time to time.

If I recall a big benefit of the setup is the ability to completely purge the user profile, then quickly setting it up again, if something goes wrong as opposed to factory resetting the entire device.

c86

wired I was already wondering what "Install available apps" does.

It let's you load apps you select from the owner profile across to the guest profile you've created. Can be done at any time. Updating these apps is universal and handles in the owner profile.

Or you can just load directly in the guest profile with APK files or another Google account. But you'll have to handle updates in said profile.

KleinesSinchen

Somehow I missed these replies. Sorry.

wuseman
Yes, you can have both at once.

Open_Source_Enjoyer
Well, I can think of some downsides:

If anybody shoulder surfs or guesses your PIN/password they can get into everything
A complex passphrase might be overkill for some profiles not worth the inconvenience

Yes, "end session" makes data more secure.

Open_Source_Enjoyer

KleinesSinchen If anybody shoulder surfs or guesses your PIN/password they can get into everything
A complex passphrase might be overkill for some profiles not worth the inconvenience

I get you point, but I prefer to use one password for all profiles to keep the risk of forgeting it low.
To protect against shoulder surf / visual "hacking" i only use fingerprint unlock when strangers are around