3 ms·

ChromeOS developer here (opinions are my own, etc etc), writing as a user though since I don't work on this specific field myself but I've been using chromebook

ChromeOS developer here (opinions are my own, etc etc), writing as a user though since I don't work on this specific field myself but I've been using chromebooks daily with multiple accounts (corp and personal) daily for the greater part of a decade. You have a few options on how you log into ChromeOS. Once you boot the device, you can choose which account to sign in as. If it's your corp account, you get whatever corp policies get applied to you (like no play store, no linux, etc). If you log into your personal account, you don't get those restrictions (there's a note to be made here for stuff like enrolled devices which I don't think applies to OP and I'm not too familiar with anyway). However, once you are already logged into an account on the device, you can also choose to "sign in with another account". This makes you run two accounts at the same time, you can swap between them without using passwords, etc (it's like switching a virtual desktop/workspace). You can even transfer windows from one account to the other so you can simply alt+tab between them as you would on a single account (for example I am typing this at work on my personal account in a window running inside my corp account). In this situation, whichever account logged in first is the account that "owns" the session and has policies applied. If you log into your corp account with play store disabled, and then log into your personal account as a secondary account, you can't use the play store on it. If you log out everything and re-log with your personal account, you will still be able to use the play store there.

xg15 5y ago
Thanks a lot for that info, that clears up a lot! So an unmanaged Chromebook can't be "taken over" by logging into a managed account, the policies are only active until you reboot. Still, if account policies "leak" into unmanaged accounts when both accounts are active at the same time, this sounds like a potential vulnerability: E.g., if the managed account has a policy that sets proxy settings or force-installs a particular browser extension, would those policies also be applied to the unmanaged account?
- Morgawr 5y ago
  > So an unmanaged Chromebook can't be "taken over" by logging into a managed account, the policies are only active until you reboot. That's my understanding, yes. You can't "infect" an unmanaged account from a managed one, as far as I know at least. > E.g., if the managed account has a policy that sets proxy settings or force-installs a particular browser extension, would those policies also be applied to the unmanaged account? I'm not 100% sure if those policies would apply, I admit I'm not familiar with the account enrolment details of ChromeOS since I work at a much lower level. However, from what I know, whenever you go to sign-in to a secondary account in the same session as your primary one, there's a big warning telling you to be careful because you're basically "entrusting" your secondary account to the primary one and to not share an account session with another account you do not trust. This I always assumed was due to reasons like (for example) ending up literally sharing account2 window with account1 session, if you bring a program running in the account2 "domain" (filesystem, etc) into the account1 UI session, the account1 can take a screenshot of it (screenshot will be saved into account1 local files) and that can leak data obviously.
nybble41 5y ago
> In this situation, whichever account logged in first is the account that "owns" the session and has policies applied. So if you log in to your personal account first, and then into the corporate account, the corporate policies are not applied to either account? There are probably a bunch of corporate types who will be very surprised to learn this…
- Morgawr 5y ago
  I admit I've never tried this so I don't know which policies do or do not apply and how. For things like the play store (which is what I've worked on in the past), only the "primary" account (the one you logged into first) will have access to it so if your secondary account has the play store blocked anyway, you won't be able to use it with that account so it doesn't matter much. I don't know about other policies.
- riking 5y ago
  Typically, the corporate login will be blocked if you attempt this.

xg15 5y ago

Thanks a lot for that info, that clears up a lot! So an unmanaged Chromebook can't be "taken over" by logging into a managed account, the policies are only active until you reboot. Still, if account policies "leak" into unmanaged accounts when both accounts are active at the same time, this sounds like a potential vulnerability: E.g., if the managed account has a policy that sets proxy settings or force-installs a particular browser extension, would those policies also be applied to the unmanaged account?

Morgawr 5y ago
> So an unmanaged Chromebook can't be "taken over" by logging into a managed account, the policies are only active until you reboot. That's my understanding, yes. You can't "infect" an unmanaged account from a managed one, as far as I know at least. > E.g., if the managed account has a policy that sets proxy settings or force-installs a particular browser extension, would those policies also be applied to the unmanaged account? I'm not 100% sure if those policies would apply, I admit I'm not familiar with the account enrolment details of ChromeOS since I work at a much lower level. However, from what I know, whenever you go to sign-in to a secondary account in the same session as your primary one, there's a big warning telling you to be careful because you're basically "entrusting" your secondary account to the primary one and to not share an account session with another account you do not trust. This I always assumed was due to reasons like (for example) ending up literally sharing account2 window with account1 session, if you bring a program running in the account2 "domain" (filesystem, etc) into the account1 UI session, the account1 can take a screenshot of it (screenshot will be saved into account1 local files) and that can leak data obviously.

nybble41 5y ago

> In this situation, whichever account logged in first is the account that "owns" the session and has policies applied. So if you log in to your personal account first, and then into the corporate account, the corporate policies are not applied to either account? There are probably a bunch of corporate types who will be very surprised to learn this…

Morgawr 5y ago
I admit I've never tried this so I don't know which policies do or do not apply and how. For things like the play store (which is what I've worked on in the past), only the "primary" account (the one you logged into first) will have access to it so if your secondary account has the play store blocked anyway, you won't be able to use it with that account so it doesn't matter much. I don't know about other policies.
riking 5y ago
Typically, the corporate login will be blocked if you attempt this.