Aurora sandboxed in Graphene? More private?

K8y

Hello,
I've seen some here say Aurora is not as secure as Google Play on Graphene, but is it more private? Specifically does it sandbox the apps you download from Aurora, or do only sandboxed apps come from GOS Google Play?

My concern with Google Play downloaded apps is that they are all tied to the one account you must use to download the apps.

And so if I download my Instagram & others with my name as well as Signal app for secret chats, they all can be tied together and back to my Google Play account. Whereas with Aurora they would not, but rather be decentralized, correct?

Watermelon

K8y but is it more private?

Firstly, as far as I know, it's not more private than using sandboxed Google Play with a Google account you create dedicated for it. Aurora may also serve you apps or versions of apps that aren't intended for you because of using a shared Google account. Secondly, the security risk of getting rogue apps from Aurora isn't worth any supposed privacy benefit.

K8y Specifically does it sandbox the apps you download from Aurora, or do only sandboxed apps come from GOS Google Play?

It's not the app stores that sandbox apps on GrapheneOS, it's GrapheneOS which sandboxes all of your apps on it. Plain Android and Apple's iOS also sandbox all apps on them.

K8y My concern with Google Play downloaded apps is that they are all tied to the one account you must use to download the apps.

And so if I download my Instagram & others with my name as well as Signal app for secret chats, they all can be tied together and back to my Google Play account.

The fact that Google could know you use Signal doesn't let them know which Signal user you are. Also the chats on Signal are nonetheless encrypted end-to-end and Google shouldn't get the key to decrypt them. Although, the official Signal app incorporates within it code from Google; you may want to consider using the "FOSS" version of Molly instead (EDIT: I don't recommend getting Molly-FOSS from F-Droid as their website suggests, instead go to the built-in GrapheneOS App Store and install Accrescent, then open Accrescent and install Molly-FOSS). Molly connects to the Signal service and can cross-communicate with contacts who have Signal instead of Molly.

Instagram isn't private because its parent company does terrible things to their users' privacy, so I'm not sure that Google knowing you use Instagram is such a scary thing?

K8y Whereas with Aurora they would not, but rather be decentralized, correct?

Centralization/decentralization is a property of the service itself and doesn't depend on whether you installed their app from a certain source. Both Signal/Molly (again, Molly connects to the Signal service) and Instagram are centralized services. There's decentralized alternatives though, and there's many forms of how a decentralized service could look like. You can use a site like AlternativeTo.net to look for alternatives.

user0

I do trust Aurora store - what can they do with our data? Not an expert here, but I hope this is secure and private.
And the sanboxed google account - no. Graphene can cut as much as possible data google can access but this is attached to me anyway. Especially when my phone number is not possible to have without passport attached to it.

Watermelon

user0 phone number

You don't have to add a phone number to your Google account?? That's as far as I know.

K8y

Watermelon Plain Android and Apple's iOS also sandbox all apps on them.

I thought sand boxing was a unique special feature exclusive to GOS...does Graphene do anything more to keep apps separate from each other?

Thanks for being thorough!

user0 number is mandatory to get the verification code

I think sometimes it is, sometimes not...it is strange. Maybe it depends on the settings or device...

user0

Watermelon number is mandatory to get the verification code, when creating account

fid02

user0 number is mandatory to get the verification code, when creating account

K8y I think sometimes it is, sometimes not...it is strange. Maybe it depends on the settings or device...

Not mandatory. See this: https://listed.to/p/vznkmwrV5w

Watermelon

K8y does Graphene do anything more to keep apps separate from each other?

Yes. First of all, GrapheneOS tightens the restrictions against apps running on it, secondly it gives you more granular control for example with the Network permission, Sensors permission, Storage Scopes and Contact Scopes, and thirdly apps are always allowed to communicate with each other, each app decides which other apps can communicate with it and how, but GrapheneOS lets you more easily utilize different profiles (user accounts, Private Space, etc.) which prevent apps from communicating with each other even with the ways the apps themselves permit for other apps to communicate with them. Also GrapheneOS fixes some holes in communication of apps between different profiles. In addition, both GrapheneOS, plain Android, and iOS sandbox the internal components of the operating system behind the scenes, but on GrapheneOS this sandboxing is also strengthened, not just the sandboxing of user-installed apps.

Note that I'm not part of the GrapheneOS project, I'm just saying what I've learned from the GrapheneOS website. You can also check the features list. For example, there's a component called SELinux which is also used on Android to sandbox internal OS components and user-installed apps, and on GrapheneOS this SELinux component is used much better than on plain Android.

Dumdum

K8y I thought sand boxing was a unique special feature exclusive to GOS

Only the sandboxing of Google Play.

fid02

K8y does Graphene do anything more to keep apps separate from each other?

There's quite an extensive list of features here, and some of the sections will be able to answer that question: https://grapheneos.org/features

Watermelon

Dumdum Ah yes that's where her confusion came from. On GrapheneOS the Google Play Store is also a normal app itself like all other apps. This is in contrast to plain Android where Google Play Store is preinstalled and granted privileged access that normal apps don't have. Putting Google Play Store as a normal unprivileged app would've caused Google Play Store to break, but that's where the GrapheneOS-exclusive compatibility layer for sandboxed Google Play comes into the picture.

K8y

Dumdum Only the sandboxing of Google Play.

I would like to make sure I am downloading apps correctly, specifically I have a question about the black and white graphene "app store" icon...is this supposed to do something? I click on it and it just says settings... No option to download other apps from it that I can see...

user0

fid02 ok, tomorrow I'll go to mall or similar place with public wifi try this out, and give a response 👍

user0

fid02 damn. So this was the IP. I tried a lot of times before and all went to ‘provide number‘. I used vpn and rotated different countries and servers, unsuccessfully . This time I used cellular + vpn and it worked from the first time. Nice. 👍
Phuck google anyway. 🙂

de0u

K8y I have a question about the black and white graphene "app store" icon...is this supposed to do something? I click on it and it just says settings...

If the upper left of the screen says "Settings" with a left-pointing arrow to the left, tap on the arrow.

K8y

de0u If the upper left of the screen says "Settings" with a left-pointing arrow to the left, tap on the arrow.

I did but it took me back. Is this supposed to download apps? because I don't see any way to do that from this app...

de0u

K8y It is not possible to download apps from the Settings screen. Pressing the left arrow should take you to the main screen, which should show apps. What exactly happens if the left arrow on the Settings screen is tapped?

K8y

de0u it just has a list of about 10 apps, like Google Play, PDF, and Vanadium.... Is that it?

de0u

K8y it just has a list of about 10 apps, like Google Play, PDF, and Vanadium.... Is that it?

Indeed the list of apps officially shipped by the GrapheneOS project is currently short. That said, one of them is Accrescent, which itself is an app store.

In general it is difficult to ship high-quality, privacy-respecting apps and to ship a large number of apps. So far the GrapheneOS project is focusing on quality over quantity.

K8y

de0u oh OK, I just wanted to be sure I wasn't missing something. Thanks