Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Play Store blocks AuroraStore, hurting GrapheneOS users

gitlab.com

Post reply on HN
Print view View original

111–120 of 313 posts

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#111

Post by gruez »

exceptione wrote: post #98
nickspacek wrote: post #68

Earlier quoted context omitted.

https://grapheneos.org/usage#sandboxed-google-play > Google Play receives absolutely no special access or privileges on GrapheneOS as opposed to bypassing the app sandbox and receiving a massive amount of highly privileged access. It doesn't mention IMEI here, but hopefully READ_PRIVILEGED_PHONE_STATE is included in "privileged access."

There is an AppStore app, I am not sure if this is the one we are talking about? https://github.com/GrapheneOS/AppStore/blob/main/app/src/mai... > That one lists: ACCESS_NETWORK_STATE ENFORCE_UPDATE_OWNERSHIP FOREGROUND_SERVICE FOREGROUND_SERVICE_SPECIAL_USE INSTALL_PACKAGES INTERNET POST_NOTIFICATIONS QUERY_ALL_PACKAGES RECEIVE_BOOT_COMPLETED REQUEST_DELETE_PACKAGES REQUEST_INSTALL_PACKAGES UPDATE_PACKAGES_WITHOUT_U…

That's grapheneos's own app, separate from the play store or play services.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#112

Post by exceptione »

mindslight wrote: post #100
exceptione wrote: post #52

Earlier quoted context omitted.

That can't be true? https://grapheneos.org/faq#hardware-identifiers > As of Android 10, apps cannot obtain permission to access non-resettable hardware identifiers such as the serial number, MAC addresses, IMEIs/MEIDs, SIM card serial numbers and subscriber IDs. Only privileged apps included in the base system with READ_PRIVILEGED_PHONE_STATE whitelisted can access these hardware identifiers. Apps targeting Android 1…

That's the application software side. I would assume the IMEI and IMSI are both going out to the cell network though, and I would presume that it's trivial to tie a phone number to those with how the mobile industry generally sells subscriber data to various data brokers. The only question is how permissive those data brokers are (their major constraint is how much most people become aware of this dynamic), but when…

Are you talking about the US here? I am hoping this would be off-limits in Europe.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#114

Post by lern_too_spel »

ssernikk wrote: post #69

I maintain my grandmothers phone, which comes down mostly to just updating WhatsApp once in a while. Obviously she doesn't have a google account, so I've installed her AuroraStore. It's a shame that there is no official way to install apps on android without a google accout[1], since it's a basic functionality, just like calls or a web browser. [1] For obvious reasons I don't want her to download apks from the intern…

App verification means she can safely install apps from the Internet. The app developers can simply serve the apks from their own websites.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#115

Post by Borealid »

DaSHacka wrote: post #33
troyvit wrote: post #14

I use Aurora on GOS. I get that they say sandboxed Play is more secure than Aurora, but I prefer it for its lack of toxicity and absence of shitty dark patterns. I think the increased popularity of GOS is going to draw in more users like me who picked it for reasons adjacent to Graphene's original purpose, and I hope it's not too annoying for their community.

I actually think there's already a lot of us in the 'community' as-is. I personally describe it as 'Valuing Privacy/Freedom over Security'. One pretty clear example of this is how they don't recommend using FireFox Mobile and F-Droid, both of which I use regardless because I'm not willing to put up with worse privacy/usability tradeoffs in the name of (imo 'hyper-')security. I think it's fine the mission of the proje…

They're both security, just security "against" different things. Graphene frequently fails to clearly describe the threat model when calling something "more secure".

For example, let's say hypothetically I want to be secure against the threat of Google pushing a targeted update to my phone that runs malicious code. Turning on automatic software updates from Google would make me vulnerable to that threat. Using MicroG instead of Google Play Services would make me less vulnerable to that threat. But Graphene devs say things like "MicroG is less secure than Google Play Services".

Similarly, if you want privacy you might secure your device by locking the bootloader with your own keys - not a third-party vendor's keys. Saying that's "insecure" is extremely misleading: it just puts you in charge of security, instead of abdicating to someone else.

I wish there were something like GrapheneOS that let you choose, yourself, who to trust instead of requiring you trust an OS vendor implicitly.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#116

Post by Flip-per »

dmantis wrote: post #58
pyrophane wrote: post #8

GrapheneOS actually recommends against using Aurora and instead just using the Play Store, so this shouldn't really hurt users. For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.

Sometimes you just can't. For example, the banking app I have refuses to be installed from the Play Store on GrapheneOS due to "not-certified" device, but works perfectly fine when installed by Aurora. The check seems to be purely store-based and never enforced later.

Do you trust the banking app installed from Aurora enough to do your online banking? I don't, and I really wish there would be a decent way to verify that the installed/provided apps are legit. For me this is the biggest downside of using GrapheneOS, which I'm otherwise extremely happy with.

(for me, the whole point of using GrapheneOS is privacy and not sending data to Google, so using the PlayStore is not an option)

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#117

Post by edoceo »

drxzcl wrote: post #86
goodmythical wrote: post #37

Earlier quoted context omitted.

assuming the number you get hasn't previously been assigned to a google account

I've had no end of trouble registering an account on our corporate SIMs as the phone numbers (not the actual SIM cards) had been recycled as employees leave.

So many systems cannot handle known pattern of a phone number changing. Who's decided these are imutable values? That I have only one? That it's not shared?

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#118

Post by exceptione »

gruez wrote: post #111
exceptione wrote: post #98

Earlier quoted context omitted.

There is an AppStore app, I am not sure if this is the one we are talking about? https://github.com/GrapheneOS/AppStore/blob/main/app/src/mai... > That one lists: ACCESS_NETWORK_STATE ENFORCE_UPDATE_OWNERSHIP FOREGROUND_SERVICE FOREGROUND_SERVICE_SPECIAL_USE INSTALL_PACKAGES INTERNET POST_NOTIFICATIONS QUERY_ALL_PACKAGES RECEIVE_BOOT_COMPLETED REQUEST_DELETE_PACKAGES REQUEST_INSTALL_PACKAGES UPDATE_PACKAGES_WITHOUT_U…

That's grapheneos's own app, separate from the play store or play services.

True. I think this one is closer to the truth: https://github.com/GrapheneOS/platform_packages_apps_GmsComp...>

There is no READ_PRIVILEGED_PHONE_STATE mentioned there.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#120

Post by panja »

Flip-per wrote: post #116
dmantis wrote: post #58

Earlier quoted context omitted.

Sometimes you just can't. For example, the banking app I have refuses to be installed from the Play Store on GrapheneOS due to "not-certified" device, but works perfectly fine when installed by Aurora. The check seems to be purely store-based and never enforced later.

Do you trust the banking app installed from Aurora enough to do your online banking? I don't, and I really wish there would be a decent way to verify that the installed/provided apps are legit. For me this is the biggest downside of using GrapheneOS, which I'm otherwise extremely happy with. (for me, the whole point of using GrapheneOS is privacy and not sending data to Google, so using the PlayStore is not an option…

Doesn't Aurora download the packages directly from Google?
Post reply on HN