Is using sandboxed Google Play worth it when it comes to privacy/compatibility?

Open_Source_Enjoyer

DeletedUser203 but the often quoted options Fdroid and Aurora store are a nightmare security wise.

They are not a nightmare, you only need to do 2 things:

Don't assume that apps are secure jsut because they are in F-Droid
Check the stores regularly to get updates

Open_Source_Enjoyer

pxlkng This still has nothing to do with licensing.

Not with the legal licence but with the source availability that comes with it.

Open_Source_Enjoyer

pxlkng As I had learned myself some time ago, the network permission being revoked does not completely and reliably restrict every access or prevent all data being sent to the internet. There are ways apps could still do it on other ways, if they really want to.

pxlkng This is not true. While IPC is one possible vector, like I explained above, apps can still exfiltrate data over other means to the internet, bypassing the network permission's restriction, so they do not necessarily need another app or network permission.

Source?

coral-mountain

pxlkng While IPC is one possible vector, like I explained above, apps can still exfiltrate data over other means to the internet, bypassing the network permission's restriction, so they do not necessarily need another app or network permission.

You have provided quite a lot of valuable information. Still, I don't know if I get it all.

It appears that having Google Play and Google Play Services with network permission enabled is not as bad as people usually think. However, didn't you imply that it is only okay if you use FOSS software or proprietary software that you trust? When you use FOSS apps, you can be sure they don't do IPC with Google and you said that proprietary apps can be reverse engineered at least to some extent to see what they share using IPC.

What about apps that I need to use daily and can't trust? Let's see a specific example. WhatsApp is hard to avoid. While the messages in WhatsApp itself are encrypted, what happens when you get a push notification? Can Google see those messages that appear in the notification area?

Also, what other ways can apps use to get the data out without network access? I couldn't think of anything besides Bluetooth. Have you heard of any popular apps that have been caught doing something like this?

sophia_st

I was planning on actually put my sim in my GOS phone I got from a week ago... until now!
I mean, I understand that this is difficult and not for everyone, but I'm trying my best and I think past week I learned about computers more than I did for a year or so.

I still don't have certainty on what to do in regard of how to set things up for me

I was originally posted this:https://discuss.grapheneos.org/d/21783-need-help-from-someone-knowledgeable-with-setting-up-new-device-the-right-way a week ago. My main concern are things/apps that sneak for things they are not supposed to, especially google, but I'm not sure if the alternatives are worth it either, especially now that I read that GCam(not only though, any app really, like even a keyboard app) will probably/or could probably send data over internet despite it will not be granted with network access.

trashaccount

sophia_st [removed]
Whatever you're using now is worse than GrapheneOS so you should move to it as its the best option available. Network permission is NOT trivially bypassable. In theory it could be done when having two apps from the same developer installed in the same profile and one of them have network enabled. Google apps are not doing any of this, nor 99.9% of apps. Don't treat google apps like spyware, as they are not doing more than it seems. If you need more control than this, consider using profiles to compartmentalize specific activities.

Mod note: Removed a couple of sentences.

If you disagree with something someone has said, please find a diplomatic way to do so.

sophia_st

pxlkng using sandboxed Play Services with an anonymous Google Account

pxlkng Use an anonymous Google account without any PII or phone number associated for best privacy

Can you please explain? What is PII, how can I register there without a phone number or IMEI getting exposed exactly?

EDIT: regarding IMEI, I guess it can't access it: https://grapheneos.org/faq#hardware-identifiers

DeletedUser288

sophia_st What is PII

Personally Identifiable Information

Jakelson

sophia_st
Side of Burritos does a good overview of how to use sandboxed GPS with an anonymous Google Account. https://youtu.be/IAoCfrqxIEg?t=393&si=N65ZkjzFEW49tI3C
All of his videos are very useful, and helpful in this process. Some are outdated, but extremely useful and understandable.

Chipper

sophia_st suggesting an anonymous/ or throwaway google account for installing apps as a way of achieving meaningful privacy is wrong. And turns achieveing actual meaningful privacy into a full time job most will fail at.

Largely due to the account not actually being throwaway... Its required for access to the store in order to update right?

As for it being anonymous, thats only true in as much as you can keep the phone seperate from your real life identity.. Which is just going to be too much for most people.

trashaccount

pxlkng Aurora Store also has no privacy benefit over using sandboxed Play Services with an anonymous Google Account.

Just spreading objectively false info at this point.

trashaccount

pxlkng the network permission being revoked does not completely and reliably restrict every access or prevent all data being sent to the internet. There are ways apps could still do it on other ways, if they really want to.

How?

sophia_st

trashaccount Whatever you're using now is worse than GrapheneOS so you should move to it as its the best option available. Network permission is NOT trivially bypassable. In theory it could be done when having two apps from the same developer installed in the same profile and one of them have network enabled. Google apps are not doing any of this, nor 99.9% of apps. Don't treat google apps like spyware, as they are not doing more than it seems. If you need more control than this, consider using profiles to compartmentalize specific activities.

Yeah, I understand all of this.

DeletedUser288 Personally Identifiable Information

Thanks

Jakelson Side of Burritos does a good overview of how to use sandboxed GPS with an anonymous Google Account. https://youtu.be/IAoCfrqxIEg?t=393&si=N65ZkjzFEW49tI3C
All of his videos are very useful, and helpful in this process. Some are outdated, but extremely useful and understandable.

Yes, his channel helped me a lot, I found it after my post though. Thanks

Chipper suggesting an anonymous/ or throwaway google account for installing apps as a way of achieving meaningful privacy is wrong. And turns achieveing actual meaningful privacy into a full time job most will fail at.

Largely due to the account not actually being throwaway... Its required for access to the store in order to update right?

As for it being anonymous, thats only true in as much as you can keep the phone seperate from your real life identity.. Which is just going to be too much for most people.

I was asking more for a knowledge of how would this work/does work in practical terms, but wasn't planning to implement this myself as I'm not really into it so hard, but I indeed try to minimize google in my life so to speak. Thanks for taking the time to explain this, it's not trivial and I do agree with what you said.

« Previous Page