Action required in Play Store: Play Store tries to update "foreign" apps

chogo

From time to time I get notificantions "Action required in Play Store". When I open the notification/play store, play store asks to update apps that were not installed via play store. Is there a way to tell play store to ignore those apps in the future?

Naudiz

On the app's page in Play Store there is a 3-dot-menu in the upper right corner, where you can disable auto updates for that specific app.

Sindbaaad

Unfortunately, I have to raise this topic. I ran into a similar problem after some kind of update. Every few hours I get a notification from the google play that action is required. When you go to google play, you get a message that you need to update some apps. I haven't installed any apps from the google play. All applications are installed from either f-droid or aurora. I've tried disabling notifications from google play and google play services completely. It didn't help.

Naudiz I can't find these three dots. Perhaps you talk about some old version of Google Play...

chogo

Oh. I knew that this existed but I never looked into this for apps that I did not install via play store. Thanks for the hint.

chogo

Unfortunatelly, the message reappears even for apps where automatic updates are not allowed...

pxlkng

Sindbaaad
Don't use F-Droid or Aurora Store, they are insecure and dangerous. Aurora Store also doesn't improve privacy over the official Play Store.

Use the official Google Play Store, it is the most secure and private way to get apps on GrapheneOS that are not available on GOS App Store or Accrescent.

fid02

Sindbaaad Play Store is reading the list of installed apps and is offering to update the ones it detects in its library of apps. This is normal.

fph

pxlkng Aurora Store also doesn't improve privacy over the official Play Store.

How so? I can at least think about one example where Aurora improves privacy: when using Play Store, Google gets to know if I visited the Google Play store page for the My Little Pony app, and can tie this information to a unique phone id. When using Aurora, connections to the Google Play servers are anonymized.

Such a blanket statement seems inaccurate.

pxlkng

fph
The official project account recommended against using Aurora Store. Please do your own research.

Apart from that, you are not anonymous or more private while using Aurora Store. Many apps on the Play Store bundle Google Play libraries and those still run on your phone, even if you didn't have Play Services installed. That would theoretically allow Google to link the apps you use to the same user profile anyways. But what threat model does this endanger?

Also apps, including Google Play Services, can't access hardware identifiers.

pxlkng

fph So they can't link anything to a "unique phone ID". It doesn't have access to that. Play Services are completely sandboxed and unprivileged on GOS. They can only get a random ID that is unique to app installation+profile combination, not your device.

fph

pxlkng enable Google to collect data like installed apps

I wasn't writing about an installed app:

fph when using Play Store, Google gets to know if I visited the Google Play store page for the My Little Pony app

fph

pxlkng

You are right that "unique phone id" is incorrect, but there is an identifier that is unique for that app, and that is enough to track the user. Google knows that app installation 12345 is the one that looked at the My Little Pony app page, and knows that app installation 12345 very often connects from the same IP as the browser that accesses pxlkng@gmail.com; they seem to visit the same locations at the same time. Is any of this incorrect? Is this not a valid threat model?

pxlkng

https://grapheneos.org/faq#hardware-identifiers (including non-hardware identifiers section below)

pxlkng

fph

Aurora Store doesn't change any of this.

fph

pxlkng

It changes, because Google does not have access to Aurora Store's unique app id, as far as I understand. How would Google determine that the phone that checked the MLP app via Aurora Store on February 20 is the same one that uses the Gmail account?

pxlkng

fph

No, it doesn't change this.
Play Store apps bundle Google libraries, those run anyways and enable Google to collect data like installed apps and unique app installation id.

pxlkng

fph Have you even read my replies above? I already explained that apps from the Play Store bundle Google libraries and those run even without Play Store installed.

fph

So I believe my question stands:

fph How would Google determine that the phone that checked the MLP app via Aurora Store on February 20 is the same one that uses the Gmail account?

DeletedUser127

pxlkng apps obtained via Aurora come with the same libraries that use many APIs dependent on presence of Play Services and without them many simply don't work. Without authentication to Google they are likely assigned pseudoanonymous ID, correlating can be provided by other tracking libraries not dependent on Google Play. But generally speaking, tracking is diminished compared to infrastructure incorporating Play Services, for each app at a different level according to libraries used.

Never said it is equally secure but there is a userbase that is interested in this approach, especially if they look to get access to apps that don't require network in order to function.

pxlkng

DeletedUser127
This is not true.
Bundled Google Play libraries don't need Google Play Services installed. You are not avoiding anything except security by using Aurora Store.

DeletedUser127

pxlkng maybe you should have a look at how Play services work and quit the parroting and stubbornness.

https://developers.google.com/android/guides/overview

What IPC when there is nothing to talk to?

pxlkng

DeletedUser127
This is not about IPC. The Google libraries don't need anything to talk to, they run on their own, like I have said multiple times at this point.