Switching from iOS, confused about App Stores and Profiles

Sprout5888 that's fare, people should use whatever they think suits them best. I wouldn't recommend less secure options tho...

Better ways to install apps on GOS are Play Store, Aurora or downloading apk directly from developer (and setting up RSS feed to update it manually unless the app can update itself).

Honestly I trust F-Droid a lot more than other app stores. The scripts that audit the code may not be perfect, but the fact that it is open sourced means the repo maintainers, devs, and other contributors are looking through it too

The Google Play Store, on the other hand, is a minefield of spyware and malware. This is nothing new, it has always had this reputation, but it never stops or even seems to slow down.

• https://www.malwarebytes.com/blog/news/2022/11/malware-on-the-google-play-store-leads-to-harmful-phishing-sites
• https://www.tripwire.com/state-of-security/more-malware-infested-apps-found-google-play-store
• https://www.pcmag.com/news/36-malicious-android-apps-found-on-google-play-did-you-install-them
• https://www.zdnet.com/article/google-play-malware-if-youve-downloaded-these-malicious-apps-delete-them-immediately/
• https://www.bleepingcomputer.com/news/security/android-malware-apps-with-2-million-installs-spotted-on-google-play/

Even the apps that are not blatantly malware sometimes have undesirable features that are not disclosed on the Google Play Store, where on F-Droid I have sometimes passed on an app due to a disclosure of unneeded telemetry or ad content.

BluishHumility I see what you mean but we should separate choosing an app vs way to install it. You can find apps on f-droid web site, read about it and if you like the app, download it from developer's website.

Still, I would defer to the F-Droid version as it notifies whenever an update can be pulled down. I would be less inclined to trust a clunky RSS job with this than a trusted maintainer's F-Droid repo.

In the end, each person must choose for themself what method they are most comfortable with--as this discussion reveals, there are many factors to consider and no one method which is universally best.

coffeefun I'm switching from iOS, with the goal of reducing my exposure to surveillance capitalism. I've never used an Android phone, and multiple app stores and profiles are confusing me. I don't use many apps, even on iOS, so I'm hoping the switch to GrapheneOS will be relatively easy. However, I don't know if I need Google Play, and if I do, if it is best in the owner profile or secondary profile(s). Please help an old fool!

On top of all these questions, I still don't understand what are the privacy benefits to using Aurora Store over Play Store if I use a single-use fake email address with the latter?

Greetings another old fool:-)
It can be very overwhelming once you start noticing privacy issues here and there. But let's not drown in despair :-) If you're not in a real danger and just want to minimize the data that could leave your device, than you can test what is a viable option/ settings for you.

You stated that you need notification, than Play services it is, or migrate to services that have a working solution without Google. Protonmail doesn't have notification system that wouldn't depend on Google, yet. There are some apps that have working solution without Google: Signal, Fairmail, Tutanota.
It is highly recommended to read https://grapheneos.org/faq and https://grapheneos.org/usage, but for this case especially this would be helpful: https://grapheneos.org/faq#notifications

As for Aurora vs Play store, in Aurora you do not have to use any account at all. Once you install Aurora, give needed permissions it would welcome you with the list of your apps and you can install whatever you want. If you would prefere Google play, I would recommend going through the gmail settings and turn off everything and set it with your phone so that nothing is backed up to your gmail (automatic sync OFF).

Because you haven't used Android, I would recommend starting with one profile and familiarize with the system and settings. Adding new profile and learn how to be comfortable with multiple profiles can come later.
Good luck.

coffeefun
Hi, Im sure evalda will answer those queries but just regarding the apk direct from a developers website (say for example Proton) you would just need to check their website everyday and the version number to know when there is a new update available. When there is if you just download that one it will overwrite the older version you have. Hope that helps.

Why protonmail?
If you use a proper email client (fairemail preffered, or k9mail less preferred) with an IMAP service, then you get push notifications without needing google services at all.

My personal choice would be to avoid anything that requires google services for notifications, since any data that is fed through google... they know about. They don't necessarily know the content of the message if its encrypted, but they can certainly know details about the message.

coffeefun A question I have is, what are the privacy pros/cons of using sandboxed Google Play on GrapheneOS compared with iOS? I assume that GrapheneOS without Google Play is better than iOS, but it's not clear what are the pros/cons with Google Play, with respect to privacy.

I'm afraid that I'm not really an authority on iOS, so it would be very hard to give you an accurate and thorough comparison there. What I will say is that again, with Sandboxed Google Play, you're getting nearly the same app compatibility as Stock OS without really taking a hit in privacy and security.

Google Play Services, Play Store etc. will have the exact same access as all other apps you install, but let's think about what that actually means for you, in broad terms:

1. You should assume that apps within the same profile can enumerate each other. Therefore, Google will know which apps you've installed. Of course, the same thing applies to all other apps you'd install.
2. Apps that you install which utilize Play Services will communicate with Play Services so that it can provide the functionality they need. The information that Google gets based off that varies greatly, and depends on what the app is willing to give it. For example, Signal can use Play Services for notifications. However, Play Services never see the actual message content of the notification. An important thing to note here is that even if you decide to forego Sandboxed Google Play, a lot of the apps you'd install probably have Google libraries in them that they use regardless, so you might want to keep that in mind if your reasoning for not using Sandboxed Google Play is avoiding Google in its entirety.

coffeefun Based on your comment, and those of others, it sounds like the consensus is that F-Droid has security risks.

Correct. At this point, I only use the F-Droid repository as a discovery tool to find out about new apps. If I actually want to download them, I do it through other means, not through F-Droid.

coffeefun I agree, the RSS alternative will require some time investment to learn.

It is not exceptionally hard to do, but it does add unnecessary complexity that you can easily avoid with a traditional app store.

coffeefun I noticed that you didn't include Aurora Store in your list of app sources. Is Aurora Store not recommended? By using it, do I gain any privacy benefits over Play Store? Do I lose any security benefits using Aurora instead of Play?

The primary reason for not mentioning Aurora Store is because I was recommend a one profile setup with Sandboxed Google Play. With that setup, Aurora Store makes little to no sense, in my opinion, unless you're extremely adamant about not having a Google account of your own (one could be created for the sole purpose of using it with the Play Store).

If you're using Aurora Store while you have Sandboxed Google Play, you won't need a Google account, which is arguably a privacy benefit. That said, you're now using a shared "anonymous" account. Aurora Store can't remove Play Store's account requirement, it just optionally allows you to use their own accounts instead of bringing your own.

The above might sound great at first, but it comes with drawbacks. A shared account means shared settings. It means that someone might have opted into a beta version of an app on that account and you're now downloading an update that may break.

There are also other security issues with Aurora Store that make it hard to recommend, though it is handy.

Quote from https://privsec.dev/posts/android/f-droid-security-issues/ which was linked above:

If you don’t have Play services installed, you can use a third-party Play Store client called Aurora Store. Aurora Store has some issues of its own, and some of them overlap in fact with F-Droid. Aurora Store somehow still requires the legacy storage permission, has yet to implement certificate pinning, has been known to sometimes retrieve wrong versions of apps, and distributed account tokens over cleartext HTTP until fairly recently; not that it matters much since tokens were designed to be shared between users, which is already concerning. I’d recommend against using the shared “anonymous” accounts feature: you should make your own throwaway account with minimal information.

This, coupled with the fact that apps are fully capable of communicating with Google all on their own (take a look at Google Maps - it's fully capable of working without Play Services present), make the benefits of foregoing the Play Store (which is more trusted, provided that you get it from GrapheneOS' Apps app, along with being more secure in general) dubious at best.

I personally still use Aurora Store in profiles where I don't use Sandboxed Google Play or for when I create a new profile to test something and don't necessarily want to login with my Google account, but I do it knowing where it does well and where not.

If you have any more questions, shoot!

coffeefun For Aurora Store, is it correct that I won't receive email notifications?

Whether or not Proton Mail is able to send notifications does not depend on how you download the .apk; rather, it depends on what back-end service is available to pull down notifications. If Google Services or microG are not installed, Proton Mail will not be able to send notifications.

coffeefun Other than not needing an account to use Aurora Store, does it provide additional privacy benefits over Google Play? What about security?

Google collects a lot of information every time you take an action on the Play Store, such as installing or uninstalling an app. For example:

• System-on-chip name
• Application binary interface
• Number of cores
• GraphicsLibraryES Version
• Available RAM
• Screen class
• Density class
• Screen width
• Screen height
• Device-independent pixel width
• Device-independent pixel height
• Screen refresh rate (for some apps, usually games)
• Android version
• Android SDK
• Device brand
• Device model
• Device Manufacturer (OEM)
• Virtual Machine
• Android ID (supposed to be reserved for “privileged” apps)
• Advertising ID
• Play Referral ID
• Root state (especially for security-oriented and banking apps)
• SafetyNet attestation state (for security-oriented and banking apps)
• Available sensors (including significant_motion, wake_gesture, glance_gesture, and stationary_detect sensors; typically for pedometer utilities, navigation apps, etc.)
• Google Account email (ostensibly for feedback, but take a moment to contemplate the many ways in which this could be abused)
• Approximate location (borough, county, city, state, etc.)
• Country
• Region
• (Preferred) Language
• Installation date and time
• Uninstallation date and time (also used to arbitrate refunds)

If you purchase something from the Play Store, even more information is collected.

Whether or not exposing that information matters is something only you can decide for yourself. The fact that the Aurora store and F-Droid do not collect this data is one of the reasons many folks are drawn to these alternatives.

coffeefun my goal is to move to FOSS apps

The best FOSS apps are in F-Droid. Some of the app versions in F-Droid are explicitly more functional than their Play Store counterparts--for example, have you ever tried running the Play Store version of Termux? It is essentially useless.

Whether or not F-Droid is secure is debatable, but for that matter whether any app store is secure is debatable. Having a phone in the first place isn't secure. In the end, it is up to you to do your research about an app you wish to download and decide for yourself if installing that application is a risk that aligns with your perceived threat model.

coffeefun I noticed that you didn't include Aurora Store in your list of app sources. Is Aurora Store not recommended? By using it, do I gain any privacy benefits over Play Store?

Aurora Store does not collect user data, you can simply download the .apk you need and be left alone. This is from the Aurora Store GitLab page:

For those concerned with privacy, Aurora Store does not require Google's proprietary framework (spyware?) to operate. It works perfectly fine with or without Google Play Services or MicroG.

Ultimately, it is up to you to decide how you wish to manage your device. I personally only download apps from F-Droid, or Aurora if an app I wish to use is not in F-Droid. To others, these alternative platforms may represent some kind of security compromise.

Any choice will have its own set of benefits or drawbacks, and in the end you will have to choose for yourself what is best.

BluishHumility Google collects a lot of information every time you take an action on the Play Store, such as installing or uninstalling an app. For example:

On GrapheneOS, Play Store has the same exact access that all other apps would. Anything that Play Store can see, other apps can too.

Available sensors (including significant_motion, wake_gesture, glance_gesture, and stationary_detect sensors; typically for pedometer utilities, navigation apps, etc.)

It is important to note that you can revoke the sensors permission on GrapheneOS, including for Play Services / Play Store.

BluishHumility The best FOSS apps are in F-Droid. Some of the app versions in F-Droid are explicitly more functional than their Play Store counterparts--for example, have you ever tried running the Play Store version of Termux? It is essentially useless.

This is not (always) on Google. Developers deciding to paywall the full apps on the Play Store, or deciding to omit some feature is their choice, and provided that it doesn't violate the Play Store's policy, they could include it in the Play Store variant just as well.

The reason that Termux is not great when obtained from the Play Store is because Termux themselves have obsoleted it:

https://github.com/termux/termux-app#google-play-store-deprecated

The reason for that is because they no longer meet the requirements to keep being published there. There are issues with the app that they're not able/willing to solve and as a result cannot bump up their targetSdk above 28 (we're currently at 33). That is a security issue, and one of my many gripes with F-Droid. Sure, in this case, F-Droid provides a home for an app that is no longer "allowed" on the Play Store. That said, you should consider whether Play Store's request is unreasonable, and whether obtaining apps from a repository that doesn't check for these things is wise.

BluishHumility Having a phone in the first place isn't secure.

I would argue that our phones are probably among the most secure electronics devices that we own. Unless of course you mean "nothing is ever secure, everything can be compromised, we're all going to die", in which case, fair enough.