Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Play Store blocks AuroraStore, hurting GrapheneOS users

gitlab.com

Post reply on HN
Print view View original

121–130 of 312 posts

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#121

Post by lenerdenator »

catlikesshrimp wrote: post #97
lenerdenator wrote: post #64

[flagged]

AOSP is still open. The problem is nobody wants to bear the (monumental) cost of polishing and convincing brands to allow installing it in THEIR devices. Google was motivated back then for creating an alternative and openness was a good bait.

The fact that no one wants to bear the cost to pre-load it on devices, when combined with the fact that it's not nearly as easy to install OSes on mobile devices as it is on most laptop/desktop/server machines, means that it might as well be closed-source. The point of software is to be executed. If I don't have a good way to execute the software for its intended purpose, I have a collection of ones and zeros, and nothing more.

The window to have a real open mobile OS is starting to close. If there is to be a meaningful change, it must happen soon.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#122

Post by exceptione »

Borealid wrote: post #115
DaSHacka wrote: post #33

Earlier quoted context omitted.

I actually think there's already a lot of us in the 'community' as-is. I personally describe it as 'Valuing Privacy/Freedom over Security'. One pretty clear example of this is how they don't recommend using FireFox Mobile and F-Droid, both of which I use regardless because I'm not willing to put up with worse privacy/usability tradeoffs in the name of (imo 'hyper-')security. I think it's fine the mission of the proje…

They're both security, just security "against" different things. Graphene frequently fails to clearly describe the threat model when calling something "more secure". For example, let's say hypothetically I want to be secure against the threat of Google pushing a targeted update to my phone that runs malicious code. Turning on automatic software updates from Google would make me vulnerable to that threat. Using MicroG…

  >  Turning on automatic software updates from Google would make me vulnerable to that threat. Using MicroG instead of Google Play Services would make me less vulnerable to that threat
I would say that any auto-update mechanism is a threat, so in both cases you would disable auto-updates.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#123

Post by iAMkenough »

alt227 wrote: post #105
catlikesshrimp wrote: post #96

Earlier quoted context omitted.

I am in the same boat. Keep in mind that you are trusting both google and meta. At least you can update whatsapp once every three months (for now)

Is it not possible to just download the updated whatsapp apk from some online source? That is the benefit of android after all, side loading is still possible relatively easily.

I'll be your random online source if you want. Just give me a few days to work on an APK for you to download and install.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#124

Post by mindslight »

exceptione wrote: post #112
mindslight wrote: post #100

Earlier quoted context omitted.

That's the application software side. I would assume the IMEI and IMSI are both going out to the cell network though, and I would presume that it's trivial to tie a phone number to those with how the mobile industry generally sells subscriber data to various data brokers. The only question is how permissive those data brokers are (their major constraint is how much most people become aware of this dynamic), but when…

Are you talking about the US here? I am hoping this would be off-limits in Europe.

Yes I am talking with a US perspective. I would hope the GDPR would prevent such things in (most of) Europe. But I also personally wouldn't assume so given that there are still the same dynamics of keeping the info flows private to avoid scrutiny, and claiming plausible "legitimate purposes" and "consent".

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#125

Post by Gander5739 »

Flip-per wrote: post #116
dmantis wrote: post #58

Earlier quoted context omitted.

Sometimes you just can't. For example, the banking app I have refuses to be installed from the Play Store on GrapheneOS due to "not-certified" device, but works perfectly fine when installed by Aurora. The check seems to be purely store-based and never enforced later.

Do you trust the banking app installed from Aurora enough to do your online banking? I don't, and I really wish there would be a decent way to verify that the installed/provided apps are legit. For me this is the biggest downside of using GrapheneOS, which I'm otherwise extremely happy with. (for me, the whole point of using GrapheneOS is privacy and not sending data to Google, so using the PlayStore is not an option…

Android apps are signed. Can't you verify the signature?

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#126

Post by Ajedi32 »

dingaling wrote: post #80
Cider9986 wrote: post #55

Earlier quoted context omitted.

GrapheneOS is focused on privacy but that must come from a secure baseline. GrapheneOS is much more privacy focussd than any other mobile operating system. Accrescent is the end goal for a secure and private app store but it's still in alpha. GrapheneOS is also the best for degoogling (eliminating all google services) because it comes with zero Google services unlike all the other ones listed here: https://eylenburg.…

The problem is that to achieve privacy through security, Graphene has to treat the user as a potentially hostile actor. Therefore, the system needs to protect itself and other apps from the user. Which is very much contrary to software freedom.

Verified boot does indeed make this more complicated, but it's totally possible to build Graphene with your own signing key and get full control over the OS that way (i.e. https://github.com/schnatterer/rooted-graphene).

Looking at their public statements on the matter, it seems like the problem isn't exactly that they treat the user as a potentially hostile actor so much as that they treat the system UI and persistent storage as a potentially hostile actor (though I admit from a practical perspective that's nearly the same thing): https://www.reddit.com/r/GrapheneOS/comments/13264di/is_root...

I wonder how they'd feel about something like protected confirmation to enable sudo: https://source.android.com/docs/security/features/protected-...

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#127

Post by maybewhenthesun »

pyrophane wrote: post #8

GrapheneOS actually recommends against using Aurora and instead just using the Play Store, so this shouldn't really hurt users. For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.

The main reason for me to use GrapheneOS would be to sever the umbilical cord to google.

I don't really see the point of using GrapheneOS instead of Stock Android if I then have to use the play store.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#129

Post by crtasm »

iAMkenough wrote: post #123
alt227 wrote: post #105

Earlier quoted context omitted.

Is it not possible to just download the updated whatsapp apk from some online source? That is the benefit of android after all, side loading is still possible relatively easily.

I'll be your random online source if you want. Just give me a few days to work on an APK for you to download and install.

How do you plan to get Meta's private signing key so Android will allow it as an update?

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#130

Post by gruez »

exceptione wrote: post #118
gruez wrote: post #111

Earlier quoted context omitted.

That's grapheneos's own app, separate from the play store or play services.

True. I think this one is closer to the truth: https://github.com/GrapheneOS/platform_packages_apps_GmsComp... > There is no READ_PRIVILEGED_PHONE_STATE mentioned there.

That's also incorrect, because the gmscompat app is just a helper app. Play services can and does request additional permissions. Those permissions are handled by the OS under the play services app, not gmscompat. If you want RCS for instance, you must grant play services and google messages phone and ICC auth access, which isn't seen in gmscompat at all.
Post reply on HN