Automatic Aurora-Store Update / start of Aurora-Store ?

pxlkng

pxlkng GrapheneOS is not about degoogling, which is a very idealistic term often sacrificing security and privacy.

There are areas where it benefits security and privacy to avoid Google (privileged Play Services) and there are areas where you want Google for security and privacy (Pixel phones, AOSP, etc)

A GrapheneOS phone is not degoogled. It is still hardware manufactured by Google and you are still running proprietary Google firmware, as well as AOSP which is made by Google and Linux which has heavy contributions from Google.

Delaney

pxlkng exactly my point. If "degoogling" is impractical, then to those people who want that, there is little reason to use GrapheneOS

upstage4186

pxlkng I don't know how you jumped to the conclusion that what I said would in any way imply even in the slightest bit that GrapheneOS would have no benefit anymore

Oh I didn't mean to imply that. It's just that security and privacy don't exist in isolation for me. And I know unprivileged play services are better than privileged, but I thought there was a huge difference between unprivileged and NO play services. But as the apps are from the play store anyways, and have google's libs bundled, maybe it's not as clear-cut as I assumed.

My Pixel developed a hardware fault and I sent it off for repair, in the meantime I trialed a OnePlus 13 and really enjoyed the multi-day battery life, nicer screen, fast charging, etc. I'm trying to decide if GrapheneOS + crap hardware is better than crap software + awesome hardware.

Thanks again for your explanations.

upstage4186

Delaney

I think it's a matter of degrees. You're never going to fully de-google while still using Android because AOSP is obviously Google-made.

To me it means being able to remove the closed source stuff as much as is practically possible. That's why I figured sticking with Aurora would give me more privacy, while sacrificing some security. Maybe my APK files aren't being verified, but I'm also skipping the install of play services, connecting with a singular account, registering for notifications with Google's push notifications, etc.

There are trade-offs between convenience, security, and privacy to be made, and you'll have to pick and choose your battles. But at least GrapheneOS gives you the weapons to fight these battles. :)

As has been mentioned, sandboxed play services still gives you big privacy wins vs other Android distros.

Viewpoint0232

pxlkng There is no privacy without security. Reduced security means reduced privacy.

Many people parrot that line but it's just not true. Of course, more security is better than less security, but the more secure option is not necessarily the more private option. If you live in a house without curtains but ten locks on the door you're not more private than if you live in a house with curtains but only one lock on the door.

Aurora Store is clearly more private than Play Store because 1. you don't need a Google account and 2. you don't need to install Play Services.

pxlkng You can just create an anonymous Google account

It's not trivial. They'll either want your IP (no VPN/Tor) or your phone number. It seems to be really unpredictable whether they demand a phone number or let you skip that step.

Delaney If "degoogling" is impractical, then to those people who want that, there is little reason to use GrapheneOS

I wouldn't say that. By default, GrapheneOS doesn't make any connections to Google, doesn't come with any Google apps etc. It's fully degoogled by default beyond the unavoidable fact that you need use Google-branded hardware and that Android itself is made by Google. The only ways to be more degoogled on a smartphone would be to get a GNU/Linux phone like the Pinephone (but then you have many other downside, most of all a lack of apps) or to get an iPhone (but then you just swap Google for Apple).

GrapheneOS gives you the choice what you want to do: no Play Services and no Play Store apps, no Play Services and Play Store apps from Aurora Store, sandboxed Play Services and Play Store apps from Aurora Store, or sandboxed Play Services and apps from the Play Store with Google account.

pxlkng

Viewpoint0232 Many people parrot that line but it's just not true.

It is true.

Viewpoint0232 Of course, more security is better than less security, but the more secure option is not necessarily the more private option.

You misunderstood. Security is a requirement for privacy. That means you cannot have privacy without security, but doesn't mean that security also brings privacy with it.

Viewpoint0232 Aurora Store is clearly more private than Play Store

It is not. Please do not spread misinformation.

Viewpoint0232 you don't need a Google account

This is wrong. It is still requiring a Google account, you are just using one from another person, which is not good and has various negative implications on security and privacy.
And having to use an account doesn't make it less private anyways, like I explained in my previous messages.

Viewpoint0232 you don't need to install Play Services.

Also doesn't matter. Like I explained as well previously, Play Services being present is not what decides if tracking, data collection and telemetry happens or not.

Aurora Store is not avoiding Google or any of its data collection. Aurora Store is not more private.

Viewpoint0232 get a GNU/Linux phone like the Pinephone

Such devices are incredibly insecure and heavily advised against. Do not use such a device.
Desktop systems are far from the security that you have on AOSP as they are lacking any proper security model and hardening.

As this conversation seems to only continue and spiral into more people trying to argue for Aurora Store, as well as having lost its purpose long ago with the OPs question already being answered, I'll ask the moderators to consider locking this thread.

upstage4186

pxlkng You misunderstood. Security is a requirement for privacy.

Maybe a better way to phrase it is that a baseline level of security is a requirement for privacy, but the two don't scale together linearly. A security improvement in and of itself doesn't necessarily mean more privacy, and it's possible for it to decrease privacy. Each mitigation or strategy needs to be considered separately.

To be honest, I've tried to follow and understand your replies carefully because you seem to be speaking authoritively on these subjects but they don't fully bear out logically to me, no real evidence has been provided, and there's a lot of missing points, e.g. IPC as a potential data leak, the privacy impact of apps registering with FCM, etc.

My understanding is still that Aurora is worse for security but better for privacy (vs Play Services).

Viewpoint0232

upstage4186 My understanding is still that Aurora is worse for security but better for privacy (vs Play Services).

I agree

pxlkng Security is a requirement for privacy.

Security is not a binary thing ("is secure" vs "is not secure").

pxlkng It is still requiring a Google account, you are just using one from another person

So? Exactly that's the appeal and the reason why it's more private. I don't have to give ANY info to Google. I can get an app that's not available anywhere else without having to create an account, without giving Google my phone number or name, from behind a VPN or Tor, without any other Google stuff being installed and constantly running in the background.

DeletedUser495

Viewpoint0232 I think we are looking at the wrong thing here. If you install a Play store app from Apkpure for example, Google doesn't get the same information it would get if you downloaded and consistently used it with Play services installed.

First major difference is a lot of the functionality heavily reliant on presence of Play services would be hindered or outright incompatible.

Second is that you don't get regular monitoring from Play services.

That doesn't mean the app is more privacy preserving or safer to use though, because it can still employ a number of ways of fingerprinting you and tracking your activity via libraries embedded in it if it is allowed to use network (or via IPC but that is very unlikely) on which I have to agree with @pxlkng.

So what I would focus on more is a choice of privacy respecting apps rather than privacy respecting app store. This makes me reconsider and upvote the use of sandboxed Google Play once again.

Using an anonymous Google account doesn't really play any role here if you choose to use apps that are a privacy nightmare and will uniquely identify your profile/device and track you regardless.

pxlkng

DeletedUser495 If you install a Play store app from Apkpure for example, Google doesn't get the same information it would get if you downloaded and consistently used it with Play services installed.

This is absolutely not true and made up.

DeletedUser495 First major difference is a lot of the functionality heavily reliant on presence of Play services would be hindered or outright incompatible.

I already explained that Play Services doesn't really matter for Googles data collection and works without it as well.

DeletedUser495 Second is that you don't get regular monitoring from Play services.

Same point, the "monitoring" is also done by the apps containing Google libraries themselves.

upstage4186

DeletedUser495

AFAIK this isn't about which apps you're installing, it's about whether downloading via Aurora gives you more privacy than downloading via Google Play.

Of course you should choose apps that respect your privacy (if that's what you care about).

Installing Play Store requires installing Play Services, which brings a bunch of privacy drawbacks. E.g. if I use WhatsApp with Play Services installed, it will register itself with Google FCM, which is used for push notifications. That means my notifications will go through Google's servers. However much information is revealed to Google is irrelevant, it's all metadata that can be used to build a profile. If I use WhatsApp without Play Services, it will switch to polling via a direct connection, cutting Google out.

Play Store also requires creating an "anonymous" Google account, which in turn requires me going to a cafe and deactivating my VPN to prove to Google that I'm "reputable". Google will now know which city I'm in.

Then there's the potential IPC leaks which you gloss over.

It seems some people here aren't too fussed about privacy against Google tracking and/or are unwilling to think it all through. That's fine, different priorities. Google could still build a profile via other methods as you say, but this is about minimizing the data we give them.

One thing I'll agree with @pxlkng about is that this thread is maybe going in circles now. Unless @GrapheneOS can weigh in with an opinion from a more knowledgeable position, further argument is pointless perhaps.

other8026

I see the suggestion to lock the thread. I've done so because OP's question has been answered and the discussion has devolved into an argument about Aurora.

I've had this same discussion multiple times, and trust me I can understand both sides' arguments and appreciate where they're coming from. At the end of the day, everyone can make up their own minds as to what they'll use and why. Hopefully they make their decisions based on facts rather than emotion.

I've seen Google this vs. anti Google that arguments be one of the most common divisive arguments in the community. So, while some people may have strong opinions on one "side," remember that there are other people will have strong opinions on the other. I don't think anything along those lines will change anytime soon. Despite some differences, we all value our privacy and our devices' security. I think we can all agree that those things are important and learn to participate in our community alongside people who do or don't use Google Play or other Google apps.

All that said, Aurora isn't officially suggested by the project for more than just the security reason. There are other reasons, including the fact that Aurora doesn't support Play Asset Delivery or Play Feature Delivery and their app has (in the past, not sure if this is fixed now) installed the wrong versions of apps.

« Previous Page