134
Play Store blocks AuroraStore, hurting GrapheneOS users (gitlab.com)
submitted 1 month ago by to c/opensource@programming.dev
32 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 18 points 1 month ago (8 children)

The GrapheneOS team explicitly recommends against installing the aurora store for that exact reason. If you can install the stock play store with a burner email then the aurora store doesn't actually give much of a privacy benefit (you are still uniquely identified either way) but aurora store is playing a game of whack-a-mole with Google.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 5 points 1 month ago* (last edited 1 month ago) (1 child)

    I have heard it has some security problems as well, which might be a big deal if your threat level is higher. At the same time, Aurora store works without google play services installed, doesn't that have some privacy benefits? I have heard that google play services in GrapheneOS has the same permissions as a regular app, however, I still feel the pull to be without them on my main profile and feel like I don't really get the implications of that. Maybe it collects less data but surely it's still a lot?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 1 month ago

    to me it's pretty simple: Do you value privacy more than having easy access to "normal" apps? If yes, skip aurora store; if no, use aurora store.

    Anything more than that gets into putting in a bunch of effort and worry for not much benefit.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 1 month ago (2 children)

    No, Aurorastore is still worlds more private than Google Play, and until now it was really reliable!

    It runs as an unprivileged user app and uses randomized accounts. You can add all apps you dont want Google to know of to your blocklist, so the unique fingerprint from your app list is extremely reduced. Google Play doesnt do that. Aurora is WAY better for privacy

    For security yeah, you can use google play and add the signatures to VerifiedApps

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 1 month ago (1 child)

    It runs as an unprivileged user app and uses randomized accounts.

    Google play services under graphene are all also unprivileged.

    You can add all apps you dont want Google to know of to your blocklist, so the unique fingerprint from your app list is extremely reduced

    I wouldn't say extremely, as you still need to keep all of the apps which you install from the store itself unblocked to get updates. Anecdotally for me, that list is all of the niche apps which I can't use FOSS alternatives for, like banking, work, transit, etc. so it's very likely still uniquely identifying. If you're hiding system services in Aurora that you don't want it touching, that makes it even easier to identify you, because Google play doesn't do that.

    Aurora is WAY better for privacy

    I'm not a security researcher and am basically regurgitating what the Graphene team has said about it, as I think they know a lot more about how the play store works under the hood and the information that is required to send to Google than I do. I think they have a blog post about it somewhere.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 1 month ago

    Yes they are unprivileged, and the gmscompat tool doesnt give them more access that is true. Still it is google software with the intention to control your device and spy on you, while Aurorastore is a slim app that even allows to restrict the apps it tells to Google.

    If you're hiding system services in Aurora that you don't want it touching, that makes it even easier to identify you, because Google play doesn't do that.

    It is less data. GrapheneOS will have less system apps than stock android so that immediately gives it away.

    Asking Google for updates is also different from telling it a complete list of your installed apps. You might simply not try to update these system apps currently.

    In the end, it is really good that play services work on GrapheneOS, but they are still more invasive as regular user apps than alternatives.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 month ago (2 children)

    Ah yes let me hand Google access into what apps I have installed on my phone. Definitely a reasonable thing to do.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •