Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Play Store blocks AuroraStore, hurting GrapheneOS users

gitlab.com

Post reply on HN
Print view View original

241–250 of 312 posts

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#241

Post by aesh2Xa1 »

DaSHacka wrote: post #15
pyrophane wrote: post #8

GrapheneOS actually recommends against using Aurora and instead just using the Play Store, so this shouldn't really hurt users. For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.

Although the nice thing about Aurora Store is it allows you to install apps without a google account linked to your device, keeping Google Play Services signed-out. Somewhere in the FAQ GOS advertises that Play Services can be used without signing in, but they also recommend the official Play Store (which requires signing in) and explicitly don't recommend Aurora (which doesn't). Unless I'm missing something, I don't…

Some apps offer direct APK downloads from their websites. If Google Play Services is detected, they use it for push notifications. Otherwise, they fall back to an internal background connection. WhatsApp is an example.

You still need to supply Play Services:

GrapheneOS uses Sandboxed Google Play. LineageOS requires flashing a package like MindTheGapps. There is also microG, an open-source reimplementation of Play Services APIs.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#242

Post by kasabali »

pyrophane wrote: post #8

GrapheneOS actually recommends against using Aurora and instead just using the Play Store, so this shouldn't really hurt users. For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.

> For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.

I dare you try creating a Google account that isn't tied to anything else.

Nowadays you can't even create an account in desktop browser without first having to scan a qr code from a mobile device first.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#243

Post by kasabali »

megagpt1 wrote: post #31
joekrill wrote: post #18

Earlier quoted context omitted.

> a Google Account that isn't tied to anything else. Isn't that pretty much impossible? You need a phone number for verification, which effectively ties it to that phone number.

You can create an account with no phone number during Android device setup. You can also just get a burner phone number for a few bucks.

> You can create an account with no phone number during Android device setup.

Yeah now they have IMEI and all the other device specific info anyway they might as well forego the phone number

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#244

Post by kasabali »

exceptione wrote: post #52
asnelt wrote: post #48

Earlier quoted context omitted.

Even with a burner sim, there is the International Mobile Equipment Identity (IMEI) number, which is tied to the phone, and is known to all apps with the android.permission.READ_PRIVILEGED_PHONE_STATE permission.

That can't be true? https://grapheneos.org/faq#hardware-identifiers > As of Android 10, apps cannot obtain permission to access non-resettable hardware identifiers such as the serial number, MAC addresses, IMEIs/MEIDs, SIM card serial numbers and subscriber IDs. Only privileged apps included in the base system with READ_PRIVILEGED_PHONE_STATE whitelisted can access these hardware identifiers. Apps targeting Android 1…

Play services isn't an "app", it's a highly privileged system service that has access to everything and some more.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#245

Post by Borealid »

microtonal wrote: post #236
Borealid wrote: post #115

Earlier quoted context omitted.

They're both security, just security "against" different things. Graphene frequently fails to clearly describe the threat model when calling something "more secure". For example, let's say hypothetically I want to be secure against the threat of Google pushing a targeted update to my phone that runs malicious code. Turning on automatic software updates from Google would make me vulnerable to that threat. Using MicroG…

But Graphene devs say things like "MicroG is less secure than Google Play Services". It is. microG runs Google DroidGuard blobs in a privileged process (to pass Play Integrity Basic). Reminder for those who forgot about DroidGuard: it's an obfuscated binary blob delivered to you by Google on each request that uses a special VM with constantly changing registers, etc. to avoid analysis. On GrapheneOS that crap runs in…

[flagged]

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#246

Post by Ajedi32 »

palata wrote: post #230
Ajedi32 wrote: post #175

Earlier quoted context omitted.

You can't grant yourself admin access with the official build. Only the Graphene devs have the ability to push changes to the OS on your phone. Yes you can fork the software and build a version with your own signing key, then wipe your phone and install your custom build and thereby take back control, but then is that really still Graphene? I think it's fair to say that that's at least borderline anti software freedo…

> I think it's fair to say that that's at least borderline anti software freedom Then you don't understand software freedom either. Software freedom doesn't mean AT ALL that random projects on the Internet MUST implement the features YOU want. Never, not at all, it's not borderline, it's not up to debate. Software freedom is about being able to use the software the way you want, as in "you get access to the sources,…

> Software freedom is about being able to use the software the way you want

You can't use the software in the way you want if it uses hardware backed cryptography to block you from doing so.

> you get access to the sources, you modify them, build them and run them

This is completely infeasible for 99% of the population. If you technically have a freedom but have no practical way to exercise it, it may as well not exist.

You could argue "but someone else could modify it for you, build it, and make an easy way for you to install it", and normally I'd accept that, but given that installing that modified version would require you to completely reset your phone and install the new modified OS from scratch, I think it's debatable at that point whether you'd still be running Graphene, rather than a fork. And if exercising your freedom requires you to stop running Graphene and start running something else, is it really fair to say Graphene itself supports that freedom? Like I said, borderline.

If you're still not convinced, consider what would happen if companies started using remote attestation to verify you're running the official GrapheneOS build and block forks...

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#247

Post by aniviacat »

g-b-r wrote: post #191
aniviacat wrote: post #43

Earlier quoted context omitted.

For me, the issue also only occurs sometimes. Usually I can download apps like normal.

Even in the last days? If you use anonymous accounts it seems to affect everyone, when it works it only works for a few downloads

Yeah, just updated my apps without an account.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#248

Post by everyday7732 »

g-b-r wrote: post #194
ChocolateGod wrote: post #29

So an app that uses an unofficial API broke when that API changed? Not news nor "blocking".

No API changed. They just, almost for sure, decreased their rate limits. It affects using Aurora Store "anonymously" because that means using shared accounts, so far higher activity per account. It's possible they're also detecting contemporary usage of the same account. But there's a slight chance that it's just due to someone abusing the accounts outside Aurora Store.

If it's rate limits, I wonder if Aurora Store could just download and mirror the apk for the top 40 most popular apps (probably >50% of their downloads) and serve that mirror to most Aurora Store users who click the "download" button? Then for less popular apps they can use the old system.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#250

Post by g-b-r »

everyday7732 wrote: post #248
g-b-r wrote: post #194

Earlier quoted context omitted.

No API changed. They just, almost for sure, decreased their rate limits. It affects using Aurora Store "anonymously" because that means using shared accounts, so far higher activity per account. It's possible they're also detecting contemporary usage of the same account. But there's a slight chance that it's just due to someone abusing the accounts outside Aurora Store.

If it's rate limits, I wonder if Aurora Store could just download and mirror the apk for the top 40 most popular apps (probably >50% of their downloads) and serve that mirror to most Aurora Store users who click the "download" button? Then for less popular apps they can use the old system.

Things along that line could indeed be a way to lessen the problems
Post reply on HN