• General
  • Multiple Users - Could I Get Some Clarification?

I was wondering if anyone could clarify to me the proper usage and capabilities of Multiple User profiles.

I have a standard install of GOS on a Pixel 4XL phone. I have been using it with a single login from the start. ANd even though I haven't been registered on these forums for that long, I've been here long enough to have seen people discussing multiple profiles on here, so I went to do research on it, but found very little usable info on teh interwebz.

What I was able to find was that the option to turn on Multiple Users has to be activated in the Settings. I searched for the phrase in the Settings and sure enough - it's there. Here come my questions:

1 - I presume by turning the option ON, I will be able to create additional users, much as it can be done on computer operating systems, including Windows. Is that correct?

2 - If I create a new user, will everything in it be completely separate and independent from the main user?

I'm asking because there are certain apps I would like to use which require Google Services Framework to function. There are even some powerful Google apps, like Google Lens, which can be quite useful. But I've felt that installing them on my DeGoogled phone would (in my mind) rather defeat the purpose, so I never did. I basically don't want anything Google stuff on my phone for a multitude of reasons. Now...

3 - Let's presume that I create a second account on my Pixel. My main account, which I normally use, doesn't have any apps with GSF or anything made by Google. If I then log out of my main account and log into the second account, and install Google Lens there, would I be able to use Google Lens completely independently of everything in my main account, ie so despite using an actual Google app, it would have no means of knowing what else I have on my phone?

4 - If assumptions in #3 are correct, would I be able to snap a picture of a plant while in my main account, then log out of it, log into my secondary account, launch Google Lens with enabled access to photos, and look up what that plant in the picture is? Obviously, Google services would launch if I launch a Google app, but if I'm in an account which I don't use for any personal stuff, would it lock Google out of spying what else I use my phone for despite running said Google service?

5 - If after using Google services with my second account, I then log out of that second account and log back in to my primary account (which doesn't have any Google services installed), would I be able to continue using my phone knowing that despite having used Google before, whatever I do now, Google will have absolutely no access to it?

Thank you to anyone who'd be able to add some clarity to this for me.

Hi!
All your questions is basically the same and the answer is yes to all of them. User profiles are in practice its own operating system and there is no communication between the profiles. The only thing that gets shared is if you not explicitly allow notifications, phone and SMS support on a secondary profile. But contacts and call history never gets shared, nor any storage directories. Apps in one profile does not know that other apps in other profiles even exist.

If you want to separate IP addresses you can sign up for a commercial VPN provider like OVPN.se or Mullvad.net that allow multiple wireguard tunnels connect to different VPN servers in each profile so not even the IP is the same.

You can also revoke all permissions from the Play services components and the Google Apps you want to use, that way you may be able to use them offline or don't have to see annoying "missing play services" messages in other apps.

    TrustExecutor If you want to separate IP addresses you can sign up for a commercial VPN provider like OVPN.se or Mullvad.net that allow multiple wireguard tunnels connect to different VPN servers in each profile so not even the IP is the same.

    Each profile has a separate VPN slot, so you can even use different providers in different profiles.

    TrustExecutor

    Thanks for your replies, guys. Would using Orbot be sufficient to obfuscate the IP to Google?

      nosferatu
      You can use Orbot as a VPN, so yes. If you are setting it up as a VPN then it will be used throughout the entire profile, so make sure to take connection speed limitations of the Tor Network into account if you plan to use something intensive.

      As mentioned prior, you can also disable the Internet access of Google Play Services and other apps via the Permissions settings. I have no idea if Google Lens will work with the internet access disabled but you can give it a try.

      I created a new profile, but it's been a while since I've gone through the setup process and am encountering difficulties I don't recall having when I first installed GOS.

      Can you guys tell me if F-Droid was pre-installed by default in the primary profile? If not, what's the correct way to install it on the device (in the newly created profile)? I tried downloading from the f-droid.org website, but when I click on the file to open, I get the error message saying: "App not installed as package appears to be invalid". What am I doing wrong?

        nosferatu you're trying to install an older version of F-Droid than the one you have in other profiles.

        F-Droid notoriously puts an outdated APK on its homepage for whatever reason. Side of Burritos on YouTube made a video about this exact thing:

        https://youtu.be/E3erRhXPPNY

        Keep in mind it's not specific to F-Droid. It just happens a lot with it because of what I mentioned with them listing an outdated version of the app on their homepage.

          Installing apps in different profiles relies on enabling app installation to that user profile, which can only be toggled from your owner user.

          A good approach, if you're likely to have several profiles, is to leave your owner profile for app installs only. Install all apps there, disable them, and don't use it for anything else besides app updates.

          Think of it as the most efficient springboard to spawn other users from without having to repeat app downloads.

          Any photographs you take in one user profile will only exist in that user profile. You can't log out of the user where you took the photograph and then load it up in another without transferring the files by means outside of GOS like USB transfer, email, cloud storage, SFTP.

            Toomanyuserprofiles Thank you for pointing that out. It really makes sense that the devs would make it that way. So I will just have to take a pic I want to run through Google Lens with the secondary profile.

            matchboxbananasynergy I'm sorry about that. You have given me the time of your day by responding to my concern and I didn't even watch the video you linked before asking further. I apologize for my inappropriate behavior.

              Hi guys,
              great question from @"nosferatu", great answers!

              I can only add my experience with a few tips for beginners, who will read this thread later:
              I am also a fan of Josh/Side of Burritos and have learned much about GrapheneOS from this smart guy!
              But the GUI/menus of GrapheneOS and the way to install sandboxed Google Play Services has changed a little since the beginning and it looks completely different now if you compare it with Josh's great YT videos (1–2 years old).
              That can confuse beginners a little bit, but it's no real problem.

              – I use my owner profile clean (without Google Play Services).
              – For banking apps and few other apps which need GSF I have a second profile named Google.
              This profile I use not every day and for minutes only – check my bank account, use DHL app when waiting for delivery of a parcel, using “My o2” provider app by Telefónica sometimes to check for a better tariff plan etc.
              Make a photo with Google Camera and watch/edit it thereafter with Google Photos, maybe use the eraser or crop the image. For GCam and Photos apps I have set the storage scope to camera path only: Main storage/DCM/Camera.

              Two advantages of my setting:
              – My owner profile is clean – no Google Play Services.
              – I can save much energy (battery lasts longer) …
              … because of having rarely used apps separated to a “Google-profile” I don't switch to owner profile after using it!
              Instead I log off, so “sandboxed Google Play” does not have to run permanently in background, consuming energy…
              Logging off makes the profile inactive so that none of the applications installed in it can be run. It also deletes the disk encryption keys from memory and hardware registers, returning the user profile to sleep mode.

              In another thread of this great forum I read about no need for Google Play Services, when using GCam.
              This needs a GrapheneOS update from April 2023.
              I have tested it by installing GCam w/o permission for internet on my owner profile.
              And because GCam needs Photos app as preview (!), have also installed Photos app w/o permission for internet.

              Conclusion: works fine! GCam and Photos on owner profile with storage scope path: Main storage/DCM/Camera.

                Eagle_Owl Thank you for your input. Could you please explain "the storage scope"? What is it and how exactly do I go about setting it up the way you did?

                  • [deleted]

                  Eagle_Owl just a control question, do both your profiles use the same internet access points or different and do you use location services in any of them?

                    nosferatu

                    I recommend to study the website grapheneos.org, especially the menu Features. ;-)

                    Quote:
                    GrapheneOS provides Storage Scopes as a fully compatible alternative to the standard Android storage permissions. Instead of granting storage permissions, users can enable Storage Scopes to make the app assume that it has all storage permissions that it asked for. On Android, an app that doesn't have any storage permissions is still allowed to create files and directories, and is allowed to access the files that it created. Users can optionally add files and directories as storage scopes to permit the app to access files created by other apps.

                    For more details, see the usage guide section on storage access.

                    Long story short: Don't give apps permission to any directory. Give them Storage Scopes, instead.
                    Advantage: apps can only read & write their own written data, no others! Spying at other app's data is impossible!
                    For the most apps it needs only to activate Storage Scopes w/o giving them a special directory.
                    I recommend also to watch Josh's YT video https://www.youtube.com/watch?v=WjrANjvrSzw for this. ;-)

                    [deleted]

                    Thanks for asking. Good question!
                    Yes, every profile can use the same internet connection.
                    I prefer mobile telephony connection because I don't have landline. And it's more secure as a foreign WiFi.
                    For this, I have a tariff with unlimited data volume.
                    Location services: I have them off as default, but give permission for three apps which needs them:
                    My banking app, Organic Maps, WiFiAnalyzer.
                    Why Location services for a Banking app: it's a security function: if someone from another country were to log in with my (stolen) data and order a transfer, it would trigger an alarm. Or using my credit card from another location as I use it on regular basis.

                    9 months later

                    Eagle_Owl In another thread of this great forum I read about no need for Google Play Services, when using GCam.
                    This needs a GrapheneOS update from April 2023.
                    I have tested it by installing GCam w/o permission for internet on my owner profile.
                    And because GCam needs Photos app as preview (!), have also installed Photos app w/o permission for internet.

                    Conclusion: works fine! GCam and Photos on owner profile with storage scope path: Main storage/DCM/Camera.

                    I just tried to sideload Google Photos but it complains :

                    "Operation completed with errors

                    Google Photos_6.68.0.600535764.xapk

                    1 INSTALL_FAILED_NO_MATCHING_ABIS:

                    INSTALL_FAILED_NO_MATCHING_ABIS:

                    Failed to extract native libraries, res=-113

                    2 App not installed"

                    (latest build feb 2024 android14)

                    May I ask from where you installed it ? Aurora ? May I ask app version that works with which build release?

                    • de0u replied to this.