If my Android device has other user accounts, am I still protected?

[wessltov]

What I'm doing might not be how the functionality was intended, but my specific question is about something basic.

I have 2 different users on my phone: One that's for me specifically, and one that's for the people I live with. My account is premium-protected, but the general account does not even have Malwarebytes. 
My question is: If one of my housemates downloads/installs something shady, how much is at risk? For example, can we lose files stored on internal or SD memory?

I guess this question pertains to other types of devices (iPhone, PC) as well, but the question only occurred to me when I started sharing my phone.

[mbam_mtbr]

Hi @wessltov,

Although the subscription is via the Google account, I think once it's activated on the mobile device it should be premium for all users.  On the other user account, verify if it's Malwarebytes Premium. 

 

To verify you have Malwarebytes Premium on Android:

1. Open Malwarebytes.
2. Tap the menu icon.
3. Scroll down to General.
4. Tap Premium features.
5. Look for a Your Premium subscription is active! message, as shown below.

[wessltov]

Hi @mbam_mtbr,

My apologies for not responding sooner. If we consider my personal user account "user 1" and the shared account "user 2", user 2 does not have the same premium subscription that user 1 has. Whereas user 1 has a premium subscription through the Google Play Store, user 2 only has the premium trial.

I tried to remove the premium trial from user 2 to see if the paid premium from user 1 would take over, but I was unable to find a way to remove premium subscriptions. This also prevented me from trying a different plan: to remove the Google Play Store subscription from user 1 and replace that with a premium key, to see how that would affect user 2.

The only thing I can think of now is to wait out the premium trial, and see how things change then. If there's anything else I can do, please let me know!

[Porthos]

On 1/5/2022 at 4:07 AM, wessltov said:

I have 2 different users on my phone: One that's for me specifically, and one that's for the people I live with.

I am going to be nosy but I did not know a cell phone can have 2 users. Cell phones are, from my limited experience, one phone per person.

[mbam_mtbr]

22 hours ago, wessltov said:

Hi @mbam_mtbr,

My apologies for not responding sooner. If we consider my personal user account "user 1" and the shared account "user 2", user 2 does not have the same premium subscription that user 1 has. Whereas user 1 has a premium subscription through the Google Play Store, user 2 only has the premium trial.

I tried to remove the premium trial from user 2 to see if the paid premium from user 1 would take over, but I was unable to find a way to remove premium subscriptions. This also prevented me from trying a different plan: to remove the Google Play Store subscription from user 1 and replace that with a premium key, to see how that would affect user 2.

The only thing I can think of now is to wait out the premium trial, and see how things change then. If there's anything else I can do, please let me know!

Hi @wessltov,

I would try an uninstall/reinstall.  When you reinstall, make sure you're using the "user 1" account when logged into Google PLAY.

22 hours ago, Porthos said:

I am going to be nosy but I did not know a cell phone can have 2 users. Cell phones are, from my limited experience, one phone per person.

@Porthos, yes, you can technically have more than one account.  People mostly use this feature to have accounts for their kids on an Android tablet, but you can do it with phones as well.

[wessltov]

On 1/14/2022 at 6:17 PM, mbam_mtbr said:

Hi @wessltov,

I would try an uninstall/reinstall.  When you reinstall, make sure you're using the "user 1" account when logged into Google PLAY.

Hi @mbam_mtbr,

I was initially unable to log into Google Play with my main account because I had set up the Google Account used for the shared access as a child account.

Long story short: "user2"'s Google account is now deleted outright, which left the user2 account empty for me to log into. I ran into the issue that Malwarebytes was a device admin for both user accounts and thus couldn't be deleted for either, but disabling that on one user after the other before trying again was a simple matter.

After doing so, I can verify that Malwarebytes shows a premium license on both user accounts. Now, as long as I don't try anything (even more) stupid like replacing the Google account that is now associated with user2 for another brand new one, I can rest easy.
I would still like for a shared account to be completely walled off from my personal account (as user2 now has the same data (such as contacts) as user1), which would reawaken my original concern of accidentally creating a hole in Malwarebytes' protection of my device as a whole. However, I do realize that basically none of my actions are the intended way to use any of these products, so I would understand if you say that this is as much as you can help me.

[mbam_mtbr]

19 hours ago, wessltov said:

I would still like for a shared account to be completely walled off from my personal account (as user2 now has the same data (such as contacts) as user1), which would reawaken my original concern of accidentally creating a hole in Malwarebytes' protection of my device as a whole. However, I do realize that basically none of my actions are the intended way to use any of these products, so I would understand if you say that this is as much as you can help me.

Hi @wessltov,

Okay, now that you have Malwarebytes premium activated under user1, try adding user2 again and see if Malwarebytes is still premium under that account since Malwarebytes is already installed on the device.  If not, then unfortunately you would need to purchase another premium version for user2.  Since premium is tied to Google Account, this is technically how it supposed to work.

[wessltov]

On 1/18/2022 at 4:27 PM, mbam_mtbr said:

Hi @wessltov,

Okay, now that you have Malwarebytes premium activated under user1, try adding user2 again and see if Malwarebytes is still premium under that account since Malwarebytes is already installed on the device.  If not, then unfortunately you would need to purchase another premium version for user2.  Since premium is tied to Google Account, this is technically how it supposed to work.

Hi @mbam_mtbr

I have now re-added the shared Google-account to user2. Malwarebytes premium remained active for both users, even after I removed my own Google account from user2!
This is exactly what I need, thank you so much for helping!

All that's left is the hypothetical of the original question: Does having users without a premium account leave the device as a whole vulnerable in a way that could influence the premium users?

[mbam_mtbr]

17 hours ago, wessltov said:

All that's left is the hypothetical of the original question: Does having users without a premium account leave the device as a whole vulnerable in a way that could influence the premium users?

Hi @wessltov,

As always, our free version will scan for malware to detect and remove.  However, premium includes our advanced ransomware protection, real-time protection (detects right when something is downloaded even before install rather than waiting for a scan and possibly after installing), and blocks phishing URLs in Chrome.  So there is a tradeoff.  However, if it says Malwarebytes premium is active, you have the premium features.

 

[mbam_mtbr]

1 hour ago, mbam_mtbr said:

Hi @wessltov,

As always, our free version will scan for malware to detect and remove.  However, premium includes our advanced ransomware protection, real-time protection (detects right when something is downloaded even before install rather than waiting for a scan and possibly after installing), and blocks phishing URLs in Chrome.  So there is a tradeoff.  However, if it says Malwarebytes premium is active, you have the premium features.

 

@wessltov One more thing to add is that it may not stay active with premium.  Malwarebytes should periodically check-in with Google PLAY, and at that time it should technically go back to non-premium if the premium-linked account is no longer on the mobile device.  I'd be interested to see if it is still active after a couple of days.

[wessltov]

18 hours ago, mbam_mtbr said:

@wessltov One more thing to add is that it may not stay active with premium.  Malwarebytes should periodically check-in with Google PLAY, and at that time it should technically go back to non-premium if the premium-linked account is no longer on the mobile device.  I'd be interested to see if it is still active after a couple of days.

That is indeed very interesting, I'll report back in a few days on whether the subscription is still active for user2! I restarted the phone a few times and it stayed active, so it might just consider the check for user1 (who is the device administrator) as sufficient for all other users for which that Google account installed apps.

[wessltov]

20 hours ago, mbam_mtbr said:

Hi @wessltov,

As always, our free version will scan for malware to detect and remove.  However, premium includes our advanced ransomware protection, real-time protection (detects right when something is downloaded even before install rather than waiting for a scan and possibly after installing), and blocks phishing URLs in Chrome.  So there is a tradeoff.  However, if it says Malwarebytes premium is active, you have the premium features.

 

Hi @mbam_mtbr

Knowing that, I'm glad I have Malwarebytes set up to scan every day! I wouldn't want to get kicked out of my phone due to something another user has done on their own account, so at least any ransomware other users bring in should have at most 24 hours before it gets picked up by a premium scan.

I'm guessing this also goes for desktop, but luckily I don't have to share that with anyone.

[mbam_mtbr]

39 minutes ago, wessltov said:

That is indeed very interesting, I'll report back in a few days on whether the subscription is still active for user2! I restarted the phone a few times and it stayed active, so it might just consider the check for user1 (who is the device administrator) as sufficient for all other users for which that Google account installed apps.

Just to clarify, user1 is still an account on the mobile device?  I'm just confused as you stated early Malwarebytes premium remained active for both users, even after I removed my own Google account from user2.  I assume my own Google account is user1.

Keep me updated if you would,

[wessltov]

4 minutes ago, mbam_mtbr said:

Just to clarify, user1 is still an account on the mobile device?  I'm just confused as you stated early Malwarebytes premium remained active for both users, even after I removed my own Google account from user2.  I assume my own Google account is user1.

Keep me updated if you would,

@mbam_mtbr Yes, my own Google account is indeed linked to user1, a distinction I have to point out because user2 was without a Google account for a day, after which both user1 and user2 used the same Google account.
In addition, I think my attempt at describing the situation clearly by denoting things as "user" may have accidentally made things more confusing, but I guess that was inevitable considering how I'm taking pieces from different puzzles and using glue to put them together. As such I will make another attempt at describing the situation as it was before and how it got to what it is now:

 

I have my admin-user on the phone that I set up with my personal Google account, which has Malwarebytes premium.
To make the phone usable for the others, I added a new user to the phone for which I also created a new Google account (at the time I made it a child account to restrict downloading and to monitor what they did with my phone). This account as you know did not have Malwarebytes premium, which is why I started this thread.

With your help and by jumping through quite a few hoops, I managed to get everything working as I had envisioned. To sum it all up (and skipping over a lot of wrestling with Google's child account feature):

1. I deleted Malwarebytes from my device completely.
2. I used my own Google account (the parent) to delete the new Google account (the child). This left the new user without a Google account.
3. I added my own Google account to the new user and used it to reinstall Malwarebytes. From this moment onwards Malwarebytes showed that premium features were available for both phone users.
4. I recovered the new Google account and changed it to a regular adult Google account before re-adding it to the new user.
5. I removed my own Google account (with which I downloaded Malwarebytes and have a premium subscription) from the new user, leaving only the new Google account. Malwarebytes premium stayed active, even after completing multiple manual scans as both phone users and restarting a few times.

I hope this clears up any confusion! If not, I'll help in any way I can!

[mbam_mtbr]

2 hours ago, wessltov said:

@mbam_mtbr Yes, my own Google account is indeed linked to user1, a distinction I have to point out because user2 was without a Google account for a day, after which both user1 and user2 used the same Google account.
In addition, I think my attempt at describing the situation clearly by denoting things as "user" may have accidentally made things more confusing, but I guess that was inevitable considering how I'm taking pieces from different puzzles and using glue to put them together. As such I will make another attempt at describing the situation as it was before and how it got to what it is now:

 

I have my admin-user on the phone that I set up with my personal Google account, which has Malwarebytes premium.
To make the phone usable for the others, I added a new user to the phone for which I also created a new Google account (at the time I made it a child account to restrict downloading and to monitor what they did with my phone). This account as you know did not have Malwarebytes premium, which is why I started this thread.

With your help and by jumping through quite a few hoops, I managed to get everything working as I had envisioned. To sum it all up (and skipping over a lot of wrestling with Google's child account feature):

1. I deleted Malwarebytes from my device completely.
2. I used my own Google account (the parent) to delete the new Google account (the child). This left the new user without a Google account.
3. I added my own Google account to the new user and used it to reinstall Malwarebytes. From this moment onwards Malwarebytes showed that premium features were available for both phone users.
4. I recovered the new Google account and changed it to a regular adult Google account before re-adding it to the new user.
5. I removed my own Google account (with which I downloaded Malwarebytes and have a premium subscription) from the new user, leaving only the new Google account. Malwarebytes premium stayed active, even after completing multiple manual scans as both phone users and restarting a few times.

I hope this clears up any confusion! If not, I'll help in any way I can!

Okay, that makes sense.  To clarity, do you ONLY have the non-premium-linked Google Account on the mobile device?  Or do you still have the premium-linked Google Account on the mobile phone as an admin?

[wessltov]

8 hours ago, mbam_mtbr said:

Okay, that makes sense.  To clarity, do you ONLY have the non-premium-linked Google Account on the mobile device?  Or do you still have the premium-linked Google Account on the mobile phone as an admin?

The latter, yes.

User1 (the admin) has the Google account with Malwarebytes premium linked to it, whereas user2 has the new Google account without Malwarebytes premium linked to it

[wessltov]

On 1/24/2022 at 5:53 PM, mbam_mtbr said:

@wessltov One more thing to add is that it may not stay active with premium.  Malwarebytes should periodically check-in with Google PLAY, and at that time it should technically go back to non-premium if the premium-linked account is no longer on the mobile device.  I'd be interested to see if it is still active after a couple of days.

Hi @mbam_mtbr,

Thanks for standing by! Now 4 days later, it seems like Malwarebytes premium is still active for both users! I have however noticed that scans do take a lot longer for for the shared user than they do for the admin user, as well as "Launcher3" and "Emergency calls" crashing a lot when I'm using the shared user (especially after first logon since a restart, regardless of how long I've used the admin user).

Regarding Malwarebytes' checking in with Google Play, maybe it doesn't check which user downloaded which program? Perhaps it would be fun (if a bit insane) to add a third user to the phone and check what would happen if I used the shared Google account to download Malwarebytes for them.
I might also be able to do some testing such as whether it matters which user tries to use Malwarebytes first (or a few days after a restart).

If I learn anything new, I'll be sure to let you know! If there's anything more I can do, feel free to ask!

[mbam_mtbr]

Hi @wessltov,

I do have one request.  I sent you a PM.  See your PM Inbox