Just got a pixel and installed GrapheneOS - best way to install apps?

UpStream

soon404 Check out this post:

https://discuss.grapheneos.org/d/6095-what-is-a-good-appstore-to-use-on-graphene-considerations

soon404

mmmm Hmm I see, I'm reading up on it right now. Any opinion on what the best option is for the apps I mentioned? Telegram, Session, Orbot, a VLC player, file unzip app?

Probably going to just use regular google play for my banking and other stuff.

fid02

soon404 GrapheneOS recommends people use the Play Store instead of the alternative app stores that fetch their apps from the Play Store. You can read more about this here: https://discuss.grapheneos.org/d/11849-spoofing-install-sources-for-non-play-store-installed-apps/2

Simply install Google Play Services from the app called "Apps", accept the installation prompts, and interact with the notifications shown to you. Then launch the Play Store and install your apps as you normally would.

soon404

fid02 Thank you, will read that now :)

soon404

fid02 I've read and understand now, here's my issue though - the throwaway google account needed seems a bit..counter intuitive. Doesn't really seem like there's a way to make a completely anonymous one.

Besides, won't having play store installed on the device just have it in the background.."spying"? Or won't it know my activities on apps and therefore be able to technically profile who I am?

I've seen people say to download them on a different profile but I don't really understand the benefits of this, still a big noob lol

de0u

soon404 Just installed Graphene without any issues, went through a couple YT tutorials and read up on the important settings and I think I'm satisfied in that regard.

Please be aware that people on YouTube make all sorts of suggestions about configuration. It is probably best to resist any recommendation to remove any permissions from, or disable, any app that shipped as part of GrapheneOS.

soon404

de0u Thanks for this. The only ones I changed were to reboot when not unlocked after certain period of time, pin scrambling, a couple wifi & bluetooth settings etc.

fid02

soon404 Doesn't really seem like there's a way to make a completely anonymous one.

There is: https://discuss.grapheneos.org/d/3366-how-to-create-google-account-anonymous/66

If by anonymous you mean that they don't know who you are, then this is anonymous. You are not giving up personal information.

soon404 Besides, won't having play store installed on the device just have it in the background.."spying"? Or won't it know my activities on apps and therefore be able to technically profile who I am?

That's not how it works, not at all. Play Store can't see your activities in other apps. Play Services on GrapheneOS run in the standard app sandbox, without the privileged access it has on stock OS. In other words, it cannot do anything more than any other app you install on your phone.

Being an app store, it will need to see which apps you install and have installed. Like any other app, it can collect your activities within the Play Store app itself. Of course also your IP address, if that matters to you.

I've basically paraphrased the entry about Sandboxed Google Play on grapheneos.org: https://grapheneos.org/features#sandboxed-google-play

soon404 I've seen people say to download them on a different profile but I don't really understand the benefits of this, still a big noob lol

There are several benefits to user profiles. But as a new user, I personally recommend not using them unless you have a clear reason to do so. I'm not saying that to dissuade the usage of profiles in general. Rather, I'm observing many users who start out by separating their apps into two or more profiles, because they think this is a necessity to use GrapheneOS (it's not; it's your choice) and then come here and express how exhausted they are with constantly switching between profiles, and then saying that GrapheneOS is not for them because it's too tiring.

It's interesting to discuss privacy practices, but when installing GrapheneOS for the first time, I recommend starting out simple. Use the Play Store, install the apps you usually use, then slowly go from there based on what you want/need further.

de0u

soon404 The only ones I changed were to reboot when not unlocked after certain period of time, pin scrambling, a couple wifi & bluetooth settings etc.

Good.

Note that you might wish to set your home Wi-Fi network to "per-network randomized MAC" because some older or lower-quality Wi-Fi routers have DHCP implementations that behave poorly if devices change their MAC addresses many times per day.

soon404

de0u What does this do? Sorry, I'm still quite new to this so the terminology is something I'm still learning lol

As I understand, that setting generates a new MAC address every time i connect to the internet or?

de0u

soon404 There are three options, described here. Does that help? Or is it possible to ask a question about that text?

Vagabond8630

Aeon summed it up pretty well, and I have a similar setup.

FOSS apps
- Installed via Obtanium if possible, F-Droid Basic if not
Non-FOSS apps
- Installed via Google Play store using anonymous GAccount within Work profile via Shelter in owner profile

To create an anonymous GAccount, you can follow this method by @fid02.

The GOS community recommends using the Play Store, but if you are willing to sacrifice security for privacy, or do not want to use sandboxed Google Play services, you could use AuroraStore's anonymous account to download proprietary apps. But be aware that this decreases your security, is often unreliable, and therefore not generally advised.

For notes, I love Logseq, which is an open-source note-taking app that is more than just a notes app. It comes with a bit of a learning curve, as it's more of a personal knowledge management tool rather than just an application to store notes, but it's extremely powerful.

soon404

Vagabond8630 Appreciate this - i've seen a lot about people using solely google services on a different profile instead of their main one. What does this do as oppose to just downloading it on my main one with all my other apps?

fid02

Vagabond8630 The GOS community recommends using the Play Store, but if you are willing to sacrifice security for privacy, or do not want to use sandboxed Google Play services, you could use AuroraStore's anonymous account to download proprietary apps.

Compared to using an anonymous Google account, how does this increase my privacy?

Vagabond8630

soon404 The setup you're referring to is mainly for people who want a setup where their main profile is 100% google-free with only FOSS apps, while maintaining a separate compartment that has the Google stuff installed.

This will definitely offer better compartmentalization and privacy protection, but it comes with some downsides:

A setup without sandboxed Google Play services (GPS) may result in increased battery consumption due to messaging apps needing to maintain a constantly open websocket for notifications instead of relying on GPS. From personal experience, Telegram is fine, but Signal has horrendous battery drain when used without GPS.
You'll need to switch back and forth between different profiles and it is structurally impossible to have data flow back and forth between different profiles. This is usually a feature, not a weakness, but there are times when I want to have data flow from a trusted app to a proprietary app. An example is copying bank details from Signal and pasting it into a proprietary baking app.

soon404

de0u Hmm I see, I think I understand now. The default setting generates a random new MAC address for every network i connect to (including my home one whenever i connect), whilst the "per network randomized" option generates only one for each network?

de0u

soon404 Yes. The default is fine for many people (at home or about), but it is useful to be aware of the home-router case.

soon404

de0u Thanks!

Aeon

de0u

When I had my Pixel for a week with Graphene my wifi suddenly stopped giving out new IPs.

after checking the routing table was full. Deleted all entries manually and changed the MAC randomization settings on my phone. No trouble since :-)

soon404

Vagabond8630 Thank you, that has cleared up a few confusions :D

Subliminal

Below is AI generated content and may contain inaccurate content.

App Installation Options
Google Play Store:

Pros: High security, broad app availability, seamless updates.
Cons: Requires a Google account, less privacy.
Usage: Best for essential apps like banking apps, which require strong security measures.
How to Use: Install Google Play Services from the "Apps" app on GrapheneOS, then install the Play Store and use it as you normally would.
Aurora Store:

Pros: Access to Google Play apps without a Google account, maintains some level of anonymity.
Cons: Security not as robust as direct Google Play Store use, potential for unreliable updates.
Usage: Good for general apps where you want more privacy but can compromise a bit on security.
How to Use: Download and install Aurora Store from its official website or a trusted source.
F-Droid:

Pros: Focus on open-source apps, strong privacy.
Cons: Slower updates for some apps, not all mainstream apps available.
Usage: Ideal for open-source apps and privacy-focused users.
How to Use: Install F-Droid from its official website.
Obtainium:

Pros: Fetches and updates apps from official websites or GitHub, strong privacy.
Cons: Requires manual setup and maintenance.
Usage: Good for apps not available on other stores or for those who want to avoid centralized app stores.
How to Use: Download and install Obtainium from its official GitHub page.
Recommended Apps and Sources
Telegram:

Option: Telegram X or the FOSS version.
Source: Aurora Store or F-Droid for FOSS version.
Signal:

Source: Directly from Signal's official website or via F-Droid.
Session:

Source: Available on F-Droid or directly from the official website.
VLC Player:

Source: F-Droid or Google Play Store via Aurora Store.
WinZip Alternative:

Options: ZArchiver or 7Zipper.
Source: F-Droid or Aurora Store.
Orbot:

Source: F-Droid.
Notes App:

Option: Notally, Joplin, or Standard Notes.
Source: F-Droid for Notally and Standard Notes; Joplin can be downloaded from its official website.
ProtonMail:

Source: Directly from the ProtonMail website or Aurora Store.
Crypto Wallet (e.g., Exodus):

Source: Directly from the official website or Aurora Store.
Tips for Best Practices
Compartmentalization: Use different profiles for different types of apps to enhance privacy and security. For instance, keep your main profile Google-free and use a secondary profile for apps requiring Google services.
Updates: Regularly check for updates, especially if using F-Droid or Obtainium, to ensure apps are up-to-date and secure.
Permissions: Be cautious with app permissions and review them regularly to minimize exposure.

soon404

Subliminal Thanks so much, this is great - is there a privacy & security "issue" with just downloading every one of these from the Aurora store instead of getting them all through F-droid?

Vagabond8630

fid02 You wouldn't be connecting directly to Google's servers when using Aurora Store, and you can skip needing to create and log into a Google account altogether. You also don't have to have GPS installed at all if going the Aurora route. Whether that has tangible privacy benefits compared to using an anonymous Google account with sandboxed GPS, I'm not sure.

To be clear, thanks to your advice, I use an anonymous Google account to download apps through the Play Store, but I wanted to let @soon404 know of alternatives.