I don’t know the exact reason why Android requires the primary user to enter their PIN/password before any other user can log in, but it may be due to the fact that the primary user is also the “system” user which is “always running even when other users are in the foreground.
Android hasn’t used FDE for a couple of years now. File Based Encryption (FBE) has been required instead since Android 10. With FBE, each user has their own credential encrypted storage location for apps, which are encrypted with the credential from that particular user. (I verified this while testing. When you boot and unlock the primary user, other users data at /data/user/{id} is still encrypted until you unlock them.)
There might be, though I couldn’t find any. I poked around /data on a rooted Pixel that had just booted but hadn’t had its primary user unlocked yet, and I was able to access most files in /data/system still.
In order for the FDE to have any usefulness, the key has to be derived from a secret that only the user of phone knows (I.e. a secret PIN, password or pattern)
Let me know if you have any feedback about this article 😁
Full disk encryption?
Android hasn’t used FDE for a couple of years now. File Based Encryption (FBE) has been required instead since Android 10. With FBE, each user has their own credential encrypted storage location for apps, which are encrypted with the credential from that particular user. (I verified this while testing. When you boot and unlock the primary user, other users data at /data/user/{id} is still encrypted until you unlock them.)
Maybe there are other system files required that are encrypted with the primary user credentials
There might be, though I couldn’t find any. I poked around /data on a rooted Pixel that had just booted but hadn’t had its primary user unlocked yet, and I was able to access most files in /data/system still.
Pretty much my thoughts, yes.
In order for the FDE to have any usefulness, the key has to be derived from a secret that only the user of phone knows (I.e. a secret PIN, password or pattern)
Android devices stopped using FDE a while back. In fact, support for FDE was removed entirely in Android 13.
Sorry, but that’s not true. While technically true, that full disk encryption doesn’t exist anymore, they use file based encryption which, functionally, is the same thing. Source: https://www.androidauthority.com/how-to-encrypt-android-device-326700/
File based encryption is not functionally “the same thing”. The AOSP documentation explains how FBE works much more accurately.