User Icon

SystemLow69

GrapheneOS set up with only the primary (one) user does not display a user icon for user switching.

But the moment you set up a second user, a user icon appears - to enable fast & easy switching.

My unique threat model dictates that a potential adversary, upon successfully taking physical possession of a un-wiped device, should not easily discover that it contains multiple profiles.

Is there some way to make that user icon disappear? And switch users some other way …

Thanks.

Artn

SystemLow69 If an adversary knows about this function in Android, they can see a more evident "End session" on the screen when the phone is switched to a secondary profile.
I am not sure how a threat model can be unique; however, from what you are describing, you need the existence of the main profile to be hidden, which currently you can do by creating a private space and moving the content of your main profile there.
From the perspective of requesting for this feature, it may be possible for the developers to enable switching profiles only when the profiles are unlocked, so that someone accessing a locked device will not be able to see the existence of multiple profiles.

SystemLow69

The threat model is such that the first adversarial person to take possession of the device … probably he will NOT be technically inclined. He will know how a phone works, as a layman knows, but it is unlikely he will know about hardened devices or user profiles. During that initial interaction, if a device wipe can’t be done through the duress code, it would be nice to reveal only the profile that is active at the time of device compromise. One way to advance that objective is to make sure the device doesn’t immediately reveal the existence of multiple profiles by the appearance of the user icon whilst the adversary is tinkering with the screen. Eventually the device will flow through the adversary’s chain of people and it will end up in the hands of a proper technical guy with the means to get what he wants from the device. The idea is to protect the most sensitive profiles as long as possible. The device owner will be under duress throughout the escalation.

Dumdum

SystemLow69 it is unlikely he will know about hardened devices or user profiles.
...
make sure the device doesn’t immediately reveal the existence of multiple profiles by the appearance of the user icon

Uh, if this theoretical "not technical" person doesn't know about user profiles, then why would the user icon make them realise the existence of user profiles??

Artn

SystemLow69 It is safe to switch off user switching from settings of the main profile, and turn it back on without loosing your user profiles. However, if a non-technical user will figure out the possible existence of profiles, then via a quick web search, they can figure out how to check for multiple users and possibly reactivate switching.
The user icon in any case is not a specific threat on the hands of a knowledgeable layman.

SystemLow69

Another option could be to have a distress code that kills/wipes the sensitive profiles. But leaves a main/generic profile intact, thusly enabling the device owner to be interrogated about the generic profile.

SystemLow69

Artn

Excellent. That gives me a good workaround. Thank you.

GrouchyGrape

@"SystemLow69 I'm trying to understand why it matters if the "non-technical" person sees the existence of other profiles? It's not like they can access them if they're properly secured?