0

How can I set a distinct password for:

  1. The Full Disk Encryption password (used to boot the device)
  2. The Lock Screen password (used to unlock the device)

For security reasons, I use a 25-50 character password to protect my devices when off and a shorter password for the lock screen.

This was previously possible using apps such as:

  1. EncPassChanger or
  2. Cryptfs Password

I just upgraded my phone, and neither of these apps appear to work in Android 10.

How can I set a distinct password for [a] the boot password and [b] the lockscreen password in Android 10?

2
0

Solution: Primary & Secondary account, distinct passwords

This doesn't answer your question directly, but you can probably achieve what you want by using multiple profiles with distinct passwords.

Set the "owner" profile to a very long "boot" passphrase.

Then create a new user profile (Settings -> System -> Advanced -> Multiple users -> Add user). Switch to this user and set a shorter "lockscreen" password.

Now when you boot the phone, in order to access the secondary user's data and apps, you must type the long "boot" passphrase for the "owner" user first, then you must type the shorter "lockscreen" password for the secondary user.

After switched to the secondary user (thereby necessarily having authenticated with both passwords), your lockscreen will be unlocked with the shorter "unlock" password.

If you reboot the device, then you must type both passphrases again. This achieves almost the same end as having FDE with a distinct boot & lockscreen password.

Issue: FDE removed in Android 10

Unfortunately, the solution you're looking for does not appear to be possible because it's not possible to use FDE in Android since Android 10.

According to the ASOP documentation, it is no longer possible to use FDE and the user is forced to use File-Based Encryption

Note: Devices running Android 7.0–9 support full-disk encryption. New devices running Android 10 and higher must use file-based encryption.

More issues: Backups

Unfortunately, the biggest issue with the dual-user approach is backups.

As far as I can tell, both users have distinct files (encrypted with distinct keys that are not shared), apps, and app data.

Moreover, secondary users in Android cannot use adb or become root. Therefore, adb backup and tools like oandbackups will not work because the "owner" user (the only user who can become root) cannot see the secondary user's files/apps/data.

So, if you're google-free, then this solution probably means you cannot backup your phone anymore :(

Update: I was successfully able to restore backups of apps taken on my old phone's "owner" account in oandbackups and restore them to my new phone's secondary user's account with oandbackups following this procedure:

  1. first, uninstall the app if already present
  2. open oandbackup (as the secondary user, needs root)
  3. find the package you want to restore, long-click it -> click "uninstall"
  4. when finished, long-click it again -> restore -> apk (only)
  5. open the app as the secondary user
  6. after opening it, run ls -lah /data/user/10/xyz.tld and make a note of all the owner:group perms of the files
  7. back in oandbackups, choose "restore -> data" for the package
  8. run mv /data/user/10/xyz.tld /data/user/10/xyz.tld.fresh
  9. run mv /data/user/0/xyz.tld /data/user/10/
  10. run chown abc:xyz -R /data/user/10/xyz.tld to match the permissions of the freshly-installed app for this user
  11. run restorecon -R /data/user/10/xyz.tld to fix SELINUX permissions
  12. reboot the phone (if you don't do this, opening the app will immediately crash)
3
  • 1
    Secondary users can access root. The superuser manager has to provide that functionality. Magisk allows running it in multiuser mode. Enable it, install Magisk Manager app in secondary user and test it out using an app which requests superuser permissions, such as Terminal Emulator. It would work. As for adb, it is not about secondary users. It is that functionality you are after is not added in the Android. Android backup relies on backup manager service which by-default doesn't run for secondary users, so adb backup or adb shell bu doesn't work as a result IMO...
    – Firelord
    Jul 5 at 8:48
  • 1
    This is more of a functionality missing than a constraint. As for backup tools, they need to be programmed to work with root acces in secondary user accounts. So far, I have found none (likely because the demand for such feature and the size of users needing such feature is miniscule by any standard). That said, if an app can access root when running under a secondary user, it should not have problem backing up data too. See How to access /storage/emulated/10 (multi-users env) in adb shell on Android 9+ without root access?
    – Firelord
    Jul 5 at 8:52
  • 1
    @Firelord Thank you so much for this! To gain root in a secondary user profile, you must first open the Magisk Manager app in the "owner" profile and navigate to Settings -> Multiuser Mode. Set it to User-Independent = Each user has his/her own separate root rules. Now switch back to the secondary user profile, and you can use Magisk Manager in the secondary user profile to grant root to applications. Hooray! Jul 5 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.