Apps that say they requires Google play services but works without

Duckduck

Hi guys. I try to keep my phone Google free. But some of my most used apps either will not open without having Google play services (GPS) installed, or will show a prompt when opening the app, that it needs GPS to be installed on the device. Most of the time, the prompt can just be dismissed and the app works fine without.

My question to you are, are these limits or prompts in any way connected to how you install the given app, or will they always show, if thats how it works?

I use Aurora store and apks, but could be cool if you could trick these anoying prompts if installed in another way. I know a bit about the Play check integrity, are these two in anyway connected?

Michiel

Duckduck I install most of my apps in the owner profile with Google Play and push them to a user profile without Google Play Services. Most apps just work, some miss certain features (notifications, a message board), some drop an error (a news app that wants to play a video) but work without noticeable issues and a few won't even start. In a profile with Google Play Services some apps check if the same Google account is used as in the owner profile and refuse to run if this is not the case. Nonetheless, the vast majority of apps work fine without Google Play Services.

raccoondad

Duckduck "are these limits or prompts in any way connected to how you install the given app, or will they always show, if thats how it works?"

These apps need google play services and their APIs, no play services, no API, app doesn't function correctly.

pxlkng

It is highly recommended to avoid Aurora Store, as it is dangerous and severely insecure while providing absolutely no privacy benefit. Google gets just as much data as it would get if you would use sandboxed Play Services, which is not much to begin with. It is merely a placebo and more secure as well as more private to just use the official Play Store with sandboxed Google Play on GrapheneOS, due to it being completely sandboxed and confined like any other app with no special privileges. (reference)

Sideloading APKs are is also recommended against, due to its unsafe and attack-susceptible nature.
If you absolutely need to sideload APKs, please use Obtainium (its not an app store but kind of like a feed reader) coupled with AppVerifier (which you can get from Accrescent) to verify the apps signature against the one provided by the apps developer.

The recommended app stores are in order of preference:

GOS App Store
Accrescent (obtainable from GOS App Store)
Google Play Store (obtainable from GOS App Store)

this should cover most apps.

Duckduck

pxlkng thanks for the answer but quite off topic.

Noone out there knows if it is possible?

mrn

pxlkng

Google gets just as much data as it would get if you would use sandboxed Play Services

Oh really?
Aurora allows you to spoof your device model, along with using anonymous accounts, used by many other users at the same time, which helps you blend in, now assuming we also use a VPN, and you are Google free except for Aurora, it makes it way more difficult to track your usage back to you compared to using a broader amount of services in the Play Services ecosystem, linked to an individual account.

And that's only the privacy side, but if we go to the fundamentals, I assume that Aurora only exchanges the minimum data necessary for the app to work, where for the Google Play Store, it's likely that it exchanges quite a bit more data than what we could consider the minimum to download an app (although that is just an assumption of mine).

Don't get me wrong, I am not a developer, but I find it a bit of a bold claim to say that Google gets as much data about you if you use an anonymous account in Aurora, compared to using the Play Services along with the Play Store, I would be glad to hear how that works.
Security wise only, yes, the Play Store is a safer way to get your apps.

mrn

Duckduck I don't rock the Play Services myself, so I can't help you personally, but I have a friend that has a certified device, basically, he uses a Samsung on stock OS, but logged off Google Play, and only uses Aurora Store to get his apps. He also gets these prompts of missing GPS, and as such, he is unable to use certain apps, but considering he is on stock and never modified his system, I'm gonna assume he passes integrity certification. So either it is a matter of getting apps from Aurora, but more likely, he is not connected with a Google account in the GPS, which cripples some of its services?
Someone correct me if I am wrong.

pxlkng

mrn

Many apps coming from the Play Store bundle Google's libraries. Those run even without Play Services installed on your device and still facilitate Googles tracking and analytics - just as much as it would do with Play Services installed. Aurora Store doesn't change anything from this.
For example the device spoofing is useless, as the analytics libraries running your device can detect the model easily themselves. And the spoofing done by Aurora Store actually creates more issues than it solves, as it can lead to the wrong app versions being downloaded, or similar.

Aurora Store is merely a placebo and doesn't actually avoid any tracking, since you have the tracking libraries still running on your phone. With the addition of its heavily flawed approaches and legacy architecture, it is severely insecure and dangerous to use and not at all advised by the GrapheneOS project.

I linked a message containing detailed explanations and posts by the official GrapheneOS project account supporting this. You could also go on the discord/matrix channels and ask there and will get the same answer from multiple people if you don't believe me.

At the end of the day everything is confined to the app sandbox anyways - Play Services as well - so the amount of data available is minimal in the first place.

DeletedUser227

mrn the fact of IPC is often downplayed as a communication between apps, while it mainly happens between apps calling APIs provided by Play services, hence this is why it's so hard to address without breaking things.

DeletedUser227

pxlkng still facilitate Googles tracking and analytics - just as much as it would do with Play Services installed

Did you read the source code or can you link to a publicly available document from respectable source (other than GrapheneOS team) that confirms this? Ideally I don't want to join third party platforms like Discord or Matrix.

mrn

pxlkng
Thanks for the details. I knew that anyway it wasn't a matter of being 100% "private", just because many, if not most apps you get from the Play Store which aren't fully open source probably have some integration of Google/Facebook analytics and so on.

My mentality is more a matter of limiting as much as possible the data I willingly send them.
Either way most of us know by now that on the web, Google or Facebook analytics are integrated in most webpages, the internet hasn't been "private" for a long time already. I still think that between Aurora, and Google Play, two apps which could both contain the same libraries, more likely than not you will send more data to Google by using the service "the Google way" through their interface.
But maybe I haven't made myself clear enough that privacy just like security is a journey, and not a goal, reaching 100% security and privacy is impossible nowadays even if you stopped owning a computer or mobile (because service companies will have your info digitalized anyway and you have no control over that).

For me, it's not directly a matter of privacy (because I have a Google account with my real information, that I use regularly and don't mind using). My reasons are politically oriented so to speak, I am no one special, just a common citizen, but the fact that nowadays owning a bank account in a country that is not the USA requires me to have either an iPhone or a Google certified Android device makes me very angry.
I don't have anything against Google, I love using their services, BUT, some aspects like not being able to use a local bank account without Google is borderline too dangerous. What happens if the Play Services are fully turned off in a country because of severe restrictions? The entire banking system of that country collapses?

DeletedUser227

pxlkng https://www.youtube.com/watch?v=Zo9qHqTDcgM&t=15m58s

pxlkng

DeletedUser227
https://nitter.net/GrapheneOS/status/1870213347188129811
https://nitter.net/GrapheneOS/status/1870259184828133588
https://nitter.net/GrapheneOS/status/1844534513663185124
https://nitter.net/GrapheneOS/status/1831050436083851721
https://nitter.net/GrapheneOS/status/1817043028688642286
https://nitter.net/GrapheneOS/status/1810304517927231527

Just some quick finds from the GOS Twitter account. You should read every single one. There's probably more.

pxlkng

DeletedUser227

You also don't need to read source code to audit software. Closed source software is just as well auditable and it is absolutely not a black box as to what it does. It can't hide anything, you can see everything it does and decompile/deassemble, as well as reverse engineer it. The licensing has nothing to do with that.

Duckduck

mrn i very much agree with you. The fact that you are forced to use either "official" app store, forcing you to also create an account could possible be illigeal.

What mind boggles me is some of the most needed apps in most european countries. We try to get around it, but even with GOS, GPS are needed. The progress made by GOS with play integrity though, could it change that?

mrn

Duckduck It's gonna be a lot of road blocks for sure. I wish we had a sort of European equivalent to the Play Services and Store, at least to have an alternative. For your question, I haven't been up to date on what they've been doing with Play Integrity, so I wouldn't be able to answer that.

pxlkng

DeletedUser227

This is misguided/bad advice and should not be followed. Both F-Droid and Aurora Store have severe security issues and are to be avoided completely.
Aurora Store has no privacy benefit on GrapheneOS.

You should probably delete this link.

Also why are you tagging me? Other community members and I explained to you the facts about Aurora Store. You are simply choosing to hold onto your misguided and misinformation-based opinions and not take/believe our advice, that's on you.
But keep me out of this and please don't spread that here.

DeletedUser227

pxlkng presuming you are right this hints at the fact that bad advice comes even from highest and most respected places like governments, (badly designed) scientific research and most popular social media influencers. Who can one trust today? Sorry for tagging you but this topic is absolutely worth discussing and dissecting to the smallest detail.

pxlkng

DeletedUser227

YouTube and many other generic popular online platforms are in general not a good place for reliable and accurate privacy and security advice. While I personally never previously watched any of her videos until now, from what I read in the official chat rooms on Matrix/Discord, it seems like Naomi Brockwell is generally not regarded as a reliable source of information and spreads some inaccurate claims and misinformation; the recommendation of F-Droid and Aurora Store being two of those: Both have severe security issues and in the case of Aurora Store, no benefit at all on GrapheneOS over using sandboxed Play Services (if preferred, with an anonymous account). Both should not be used.

Sorry for tagging you but this topic is absolutely worth discussing and dissecting to the smallest detail.

I, as well as at least one other community member already have provided you with a lot of information, details, context and references across various threads.

pxlkng

DeletedUser227

governments

... have never been "highest and most respected places" or in any way leading or actually good in terms of privacy and security. Governments and companies tend to have rather bad security and privacy.

BaronAfanas

The only reason for me to use Aurora Store is to get apps I need to pretend I have a different device to get apps running.