Are there severe disadvantages when using the owner profile as the main profile?

Open_Source_Enjoyer

locked Assuming an attacker manages to gain access via some app, then he has more control than he otherwise would have, if he gained entry into a secondary profile.

If someone have full access to the owner profile, can
he get into other profiles and bypass the lockscreen of them?
If not, then the owner profile with the same apps as the main profile and the same sensitive data, would carry no more risk then a separated main profile, or do I get this wrong?
If using the owner profile doesn't make things worse in the worst case, then there would be no real counter argument against using the owner profile as the daily driver, but much benefits considering my laptop with wifi problems.

Open_Source_Enjoyer

Eagle_Owl No, there are no real dangerous disadvantages for your planned scenario.
It is the most common practice and most comfortable method.

Thank you, i think i will go for it.

23Sha-ger

Open_Source_Enjoyer I will only grant network permission to open source apps

While open source apps tend to be more transparent, there are a few exceptions:
https://discuss.grapheneos.org/d/9310-simple-mobile-tools-bought-by-zipoapps

So a trusted closed source app (like a major bank) is less likely to compromise your device unlike
some hobby project on Github. Bottom line, it's about the permissions you grant, not the code.

Open_Source_Enjoyer

23Sha-ger While open source apps tend to be more transparent, there are a few exceptions:
https://discuss.grapheneos.org/d/9310-simple-mobile-tools-bought-by-zipoapps

So a trusted closed source app (like a major bank) is less likely to compromise your device unlike
some hobby project on Github. Bottom line, it's about the permissions you grant, not the code.

Of course I don't install random open source stuff and give it root access just because it open source.
But i think big open source projects are better than something like banking apps, not in terms of security, but in terms of privacy.

locked

Eagle_Owl I am in no way suggesting that using the owner profile is insecure at all, and I understand that it is a common practice, or do I dissuade anyone from doing so. The OP simply asked a question and I tried to give an informed answer. If your concern is a highly privileged app exploit or targeted attack, then using a secondary profile as the daily driver still offers meaningful isolation. A compromised secondary profile can’t access system level settings, other profiles, or device admin controls. It also can’t delete other profiles or interfere with their data. That’s a clear security boundary worth mentioning. It all comes down to your threat model. To be clear, I made my argument, assuming an attacker has already gained access....

Open_Source_Enjoyer

locked I am in no way suggesting that using the owner profile is insecure at all, and I understand that it is a common practice, or do I dissuade anyone from doing so.

👍

locked If your concern is a highly privileged app exploit or targeted attack, then using a secondary profile as the daily driver still offers meaningful isolation. A compromised secondary profile can’t access system level settings, other profiles, or device admin controls. It also can’t delete other profiles or interfere with their data. That’s a clear security boundary worth mentioning. It all comes down to your threat model. To be clear, I made my argument, assuming an attacker has already gained access....

You are right that there are some security considerations with this, but i think that i can't use USB-Tethering from any other profile then the main profile, is a big problem for me.

DeletedUser313

locked

Can the owner profile transfer files from secondary profiles in any way?

locked

yore

Have a look at the following thread.
https://discuss.grapheneos.org/d/4867-secondary-user-profile-as-a-main-one-advantages-and-disadvantages

Pavestone2734

One advantage of secondary user profiles is that your are able to put your data back at rest by wiping encryption keys from memory (via ending session). You cannot do that with the Owner profile, only by rebooting. However there's nothing wrong with using the Owner as the main profile if using one or more secondary profiles would be too uncomfortable. You can utilize Private Space in the Owner which is well integrated and is almost like another profile. Use it to either store your personal private data at rest (idk how ending session/wiping keys work in the private space), or separating sandboxed google play and the apps that need it.

gk7ncklxlts99w1

I think the far more likely exploit is physical access. I do think it's worth using a secondary profile as your main for most people (most people who use GrapheneOS, that is). But you're still pretty secure even if you use owner.

mmobder

Open_Source_Enjoyer check what I have collected here (and I assume it's not all) https://discuss.grapheneos.org/d/16754-pls-help-to-collect-inputs-only-that-influence-users-scheme-setup-in-a15/14

zzz

DeletedUser313
Not by default.

You can use the Inter Profile Sharing app from Accrescent for a reasonable solution, although it has its quirks.
https://discuss.grapheneos.org/d/17513-inter-profile-sharing-app-on-accrescent

Other options are internet-based apps or a usb-c flash drive.

DeletedUser433

Is it normal that switching profiles (running in the background) causes the phone to heat up?