Privacy Implications of using Google Applications

plc000

Hi!

I recently bought a Pixel phone for the sole reason that I wanted to install GrapheneOS on it, which I did. Now I am trying to decide on the setup while trying to reconcile privacy and usability in some way.

I was wondering one thing more than anything - If I use Google Play Store (with a dummy account created in the Play Store app, no phone number) and Google Maps, do I gain anything in terms of privacy compared to - say - using the stock Android my phone came with?

I have not used Google Maps in years since I have been trying to de-google as much as possible, so it would feel strange going back to using it on GOS. Still, I am aware of the sandboxing mechanisms and the rerouting of the location services which makes me assume that it is, in fact, more privacy respecting than using it on just another phone.

I would also like to avoid having to switch profiles when I just need to quickly look up an address. What is the general recommendation from the community?

I also read on the forum that there is no privacy gain installing applications via Aurora Store with a dummy account versus just doing the same in the Play Store. I personally don't care if notifications work or not, so do I have a privacy advantage using Aurora over the Play Store in my case?

Thank you in advance.

mythodical

plc000 I just want to point out that Google Maps doesn't require Play Services for basic functionality. I only install the Google Services Framework component (without any permissions), and Google Maps works fine for looking up addresses, getting directions, etc.

plc000 If I use Google Play Store (with a dummy account created in the Play Store app, no phone number) and Google Maps, do I gain anything in terms of privacy compared to - say - using the stock Android my phone came with?

Unlike stock Android, you gain the ability to dynamically toggle the various permissions for all apps, but that's about it. You would be interacting with the Google Maps app directly, so any information you provide it will be made available to Google regardless of how you installed the app.

I don't believe that the re-routed location services would mean much in this case either, since you would be providing the location data directly to Google anyway.

plc000 I would also like to avoid having to switch profiles when I just need to quickly look up an address. What is the general recommendation from the community?

If it is a simple address search, consider using the Google Maps website (or any other mapping website) within your browser instead. You can even "install" it as a progressive web app (PWA). Just browse to the site, go to your browser menu, then select "Install app".

plc000 I also read on the forum that there is no privacy gain installing applications via Aurora Store with a dummy account versus just doing the same in the Play Store.

My understanding, from the official Aurora FAQ, is that Aurora acts as a proxy to the Play Store when an anonymous session is used.

For anonymous logins, following data is sent to Aurora Dispenser Server:

a GET request to obtain an authentication token. This token is generated server side so no user data is leaked. Requests upon creating sessions are made and sent to Google from the dispenser server's IP.

So, not only are you using one of the pooled authentication tokens provided by Aurora, the connection to the Play Store itself is relayed.

mythodical

mythodical So, not only are you using one of the pooled authentication tokens provided by Aurora, the connection to the Play Store itself is relayed.

I may be wrong about this, as I haven't found any other sources that discuss the IP anonymity. If you use a VPN, this is a moot point anyway.

ve3jlg

mythodical d Google Maps works fine for looking up addresses, getting directions, etc.

You are sending all those details to Google for lookup.

ve3jlg

mythodical If it is a simple address search, consider using the Google Maps website (or any other mapping website)

Use the open source OsmAnd maps app, which works on OpenStreetMap data. OsmAnd respects your privacy. You can look up an address offline.

Its interface can be a challenge to learn because the app is powerful and highly configurable.

I am very happy to have this alternative to Google maps.

unwat

mythodical

I looked in to this one once.

When logging in anonymously, the app contacts Aurora to get some kind of credentials. It didn't work when I did this so I don't know what kind. However, after that all searches, getting package info, then retrieving apks was all done via Google domains.

mythodical

unwat good to know, thanks. I do use Aurora for my Play-only apps, but I also use a VPN so I hadn't given it much thought until now.

mythodical

ve3jlg yes, of course. I was simply pointing out that Google Maps doesn't require Play Services and Store to be installed. As I mentioned in the same comment, anything that you input into the app would be sent to Google regardless.

mythodical

ve3jlg I didn't have much success looking up specific addresses when I used OsmAnd, but I admit that I didn't troubleshoot it for long.

I did download what I thought were the necessary maps for my area (in Canada), but it would only resolve the street and not the specific address when offline.

I usually use DDG, OpenStreetMap, or Google Maps from the web browser, but I may give OsmAnd another try if it can show addresses offline.

mythodical

ve3jlg Use the open source OsmAnd maps app, which works on OpenStreetMap data. OsmAnd respects your privacy. You can look up an address offline.

Apparently a vast number of locations are not yet searchable by address in OsmAnd, including my own. It's still a no-go for me.

ve3jlg

mythodical Apparently a vast number of locations are not yet searchable by address in OsmAnd,

Interesting. It works in my major Canadian city quite well. But I suspect OSM was able to populate the database from the city's open GIS data (or else there are lots of hard working OSM mappers here).

Make sure that you have actually loaded the offline map for your geographic region. I found this to be a bit non-obvious.

Bootlace1170

You can use google maps with the network access off. Simply go some place that is not your home (or I suppose turn off locations), then download the map area you want. For example the whole city you generally travel. You can then turn off network permission and use it offline. You will still be able to look up directions and use it because location and gps will work. But with network access off, the app can’t communicate with google.

applesbana

Bootlace1170

Can you get turn by turn audio navigation this way?

Aaron

applesbana
Yes, You can get Turn-by-Turn with offline/downloaded Google maps. We use this in the mountains.

But, I would NOT assume that Google Maps "forgets" your previous mappings when offline. I assume whenever I reconnect, Google download stored history then run statistical algorithms to figure out who I am from city, neighborhood, home location, frequented places, etc... Google has directly available location data from what you are doing, then they can easily run "Big Data" (this case is actually quite easy) statistical algorithms on everything they see.

How many Google Map "devices" pull into my garage? How many cars pull into my garage, then drive to my in-laws house, then stop at our favorite happy hour spot, then drive to our favorite grocery store parking in roughly the same location in the parking lot? You are statistically identified very very easily.

These are my assumptions whenever using any Google apps (Maps, Gmail, Adsense, etc).

Having said all this, I have two "polluted" profiles - one for work since we use G-Suite and one for personal (Gmail, Whatsap, Seatgeek,etc) - that I always shutdown when not active. I spend as much time as possible in FOSS only profiles on my GrapheneOS device.

ve3jlg

Aaron But, I would NOT assume that Google Maps "forgets" your previous mappings when offline. I assume whenever I reconnect, Google download stored history

I have always wondered this about Google (and other) apps - if they cache data while offline then load it as soon as they get .05s of network activity, possibly unintended.

Given the business model of Google and other app builders, I safely assume this so do not use them. So I am delighted that OsmAnd works for me.

Thanks for sharing this important point and your response to it.

Aaron

ve3jlg
There is an old youtube where a team have two Android phones, 1 with network off, 1 with network on.

Not only location, but also all sensor data (which we can block on GOS). Really creepy to see that Google tracks not only your location, but through pressure and temperature your windows opening, car doors opening/closing, temperature,...
Big Bro likes Big Data

TrustExecutor

As said before the option to download an offline map and then remove the Network permission works flawlessly. The drawback is that the area is somewhat small. Don't forget to have your Location services permission turned off while downloading the maps.

To mitigate that the Maps app will sync the recent navigations and locations to Google next time we allow the Network permission to connect to their servers to download a new offline map, don't forget to remove storage and cache from the app before doing so.

Aaron

TrustExecutor
Nice work around - clear storage and cache before allowing network connection.
Just don't ever forget or they've got you mapped out. ;-)

applesbana

Aaron

Maybe this is the video you’re thinking of:

https://9gag.com/gag/a1PoB5D

TrustExecutor

Aaron Yes but with a GOS phone, "they" (referring to you, CIA shell company Google) only get you mapped out when you are using the maps app. With a vanilla phone they are getting you mapped out EVERYWHERE ALWAYS.

Sure government agencies can find other ways to map you out using carrier data and potentially unknown 0-day exploits.

Aaron

As a side note, what I tend to do now is go "Old Skool" and memorize how to get where I'm going. Usually it's no more than 5-6 turns and then I've learned the location and directions myself.

GOS is not only a privacy and security play for me but also an unplug a little from the matrix attempt.