Exposed password for owner profile vs normal profile

alibicoaster

I have used separated profile for different application, since one work profile is not sufficient. The new private space could potentially create two profiles inside a owner profile, which makes it worth switching.

However, my concern is that, if there are some legal procedure to request your password, or maybe someone with a $5 wench ask for your password, what is the difference for exposing a normal profile and a owner profile. My understanding is that, owner profile has more permission than a normal profile. Some police has some software to extract information from a phone by USB, assuming the phone is unlocked, can they plan a backdoor by altering some setting in owner profile? Or any other security implication from a normal profile.

Well, I don't really have this issue personally to be fair, just paranoid in case travelling to some more authoritarian country.

ryrona

alibicoaster If they demand you hand over your passphrase to search your device, they probably will demand you to hand over the passphrases for all your profiles, not just one.

As for differences, anyone who has your passphrase for the owner profile can view the system log, which contains log entries from all profiles, and can enable USB debugging to make changes to your device, and even OEM unlock your device to replace the software entirely. This is not the case for secondary user profiles, where they only can access and compromise that specific profile, and some less sensitive global settings.

dc32f0cfe84def651e0e

alibicoaster There is no plausible deniability in GOS. While it protects your data in technical ways, only the user themselves can say no to law enforcement.

alibicoaster

ryrona
Thanks for laying out the implication.

dc32f0cfe84def651e0e
I guess plausible deniability is what I am looking for. I don't have a clear picture of a threat model. What I am thinking is an unlikely scenario where the threat actor like some intimidating enough thief or non-technical police asking for password, and just give them the user's profile passcode, the police may have instruction to stuck an usb to inspect and implant some software, but don't know enough about android user profile. I guess it is not very likely, if they have training about inspecting phone.

Maybe user profile is more about isolating data boundary between different app than physical security.

locked

Should any hostile nation, or authoritarian nation ask for your passphrases, It would be considered a major human rights violation, and it's likely that I would give them the passphrase that they would not desire.