Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Play Store blocks AuroraStore, hurting GrapheneOS users

gitlab.com

Post reply on HN
Print view View original

61–70 of 312 posts

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#61

Post by titularcomment »

DaSHacka wrote: post #33
troyvit wrote: post #14

I use Aurora on GOS. I get that they say sandboxed Play is more secure than Aurora, but I prefer it for its lack of toxicity and absence of shitty dark patterns. I think the increased popularity of GOS is going to draw in more users like me who picked it for reasons adjacent to Graphene's original purpose, and I hope it's not too annoying for their community.

I actually think there's already a lot of us in the 'community' as-is. I personally describe it as 'Valuing Privacy/Freedom over Security'. One pretty clear example of this is how they don't recommend using FireFox Mobile and F-Droid, both of which I use regardless because I'm not willing to put up with worse privacy/usability tradeoffs in the name of (imo 'hyper-')security. I think it's fine the mission of the proje…

FYI, there are ungoogled chromium builds for Android. Firefox Mobile really is a lackluster browser unfortunately both from a usability and security standpoint (e.g. IonStack worked on Fennec)

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#62

Post by asnelt »

exceptione wrote: post #52
asnelt wrote: post #48

Earlier quoted context omitted.

Even with a burner sim, there is the International Mobile Equipment Identity (IMEI) number, which is tied to the phone, and is known to all apps with the android.permission.READ_PRIVILEGED_PHONE_STATE permission.

That can't be true? https://grapheneos.org/faq#hardware-identifiers > As of Android 10, apps cannot obtain permission to access non-resettable hardware identifiers such as the serial number, MAC addresses, IMEIs/MEIDs, SIM card serial numbers and subscriber IDs. Only privileged apps included in the base system with READ_PRIVILEGED_PHONE_STATE whitelisted can access these hardware identifiers. Apps targeting Android 1…

I couldn't immediately find whether GrapheneOS grants READ_PRIVILEGED_PHONE_STATE to Google Play. It might very well be that the GrapheneOS sandbox spoofs a fake IMEI, and I do hope so.

In any case, my parent comment was meant for stock Pixels, as mentioned by armadyl further up in this thread.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#63

Post by khriss »

pyrophane wrote: post #8

GrapheneOS actually recommends against using Aurora and instead just using the Play Store, so this shouldn't really hurt users. For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.

> you can sign into the Play Store with a Google Account that isn't tied to anything else.

The problem with this is that increasingly Google is insisting on having a phone number to create a Google account. Further, they are aggressively deleting old accounts that appear to be dormant.

The good old days of creating a Google account with just an email seem to be swiftly becoming a thing of the past.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#65

Post by halyconWays »

pyrophane wrote: post #8

GrapheneOS actually recommends against using Aurora and instead just using the Play Store, so this shouldn't really hurt users. For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.

"For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else."

lol. lamo, even.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#68

Post by nickspacek »

asnelt wrote: post #62
exceptione wrote: post #52

Earlier quoted context omitted.

That can't be true? https://grapheneos.org/faq#hardware-identifiers > As of Android 10, apps cannot obtain permission to access non-resettable hardware identifiers such as the serial number, MAC addresses, IMEIs/MEIDs, SIM card serial numbers and subscriber IDs. Only privileged apps included in the base system with READ_PRIVILEGED_PHONE_STATE whitelisted can access these hardware identifiers. Apps targeting Android 1…

I couldn't immediately find whether GrapheneOS grants READ_PRIVILEGED_PHONE_STATE to Google Play. It might very well be that the GrapheneOS sandbox spoofs a fake IMEI, and I do hope so. In any case, my parent comment was meant for stock Pixels, as mentioned by armadyl further up in this thread.

https://grapheneos.org/usage#sandboxed-google-play

> Google Play receives absolutely no special access or privileges on GrapheneOS as opposed to bypassing the app sandbox and receiving a massive amount of highly privileged access.

It doesn't mention IMEI here, but hopefully READ_PRIVILEGED_PHONE_STATE is included in "privileged access."

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#69

Post by ssernikk »

I maintain my grandmothers phone, which comes down mostly to just updating WhatsApp once in a while. Obviously she doesn't have a google account, so I've installed her AuroraStore.

It's a shame that there is no official way to install apps on android without a google accout[1], since it's a basic functionality, just like calls or a web browser.

[1] For obvious reasons I don't want her to download apks from the internet.

Re: Play Store blocks AuroraStore, hurting GrapheneOS users

#70

Post by tredre3 »

juiceland wrote: post #42
pyrophane wrote: post #8

GrapheneOS actually recommends against using Aurora and instead just using the Play Store, so this shouldn't really hurt users. For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.

> Google Account that isn't tied to anything else. At the risk of being a privacy absolutist / fatalist: Google’s entire business model is surveillance. They follow you around and track your habits so you can be influenced. Given that, a Google account is always tied to something else.

I'm under no illusion that google doesn't know I own my multiple accounts. They most certainly do. I usually use the same user agent (with containers) on the same IP, after all.

But my goal is to avoid a stranger gaining access to my google services if they manage to unlock a lost device or steal my TV/streaming box that has no lock at all.

I wish Google supported a permission system per device. For example on most of my android devices all I really want is to be logged into Youtube and the play store. I most certainly do not want those devices to have access to my contacts, emails, calendar, keep, drive, payment, etc. (I don't personally use all of those things, but you might and that's what a random thief would gain access to.)

Post reply on HN