• General

  • Switching from iOS, confused about App Stores and Profiles

matchboxbananasynergy Anything that Play Store can see, other apps can too.

Irrelevant.

It's Google's core business model to fingerprint every person and combine as much data as possible about each together to build a detailed personal profile about them - not so of almost all other apps. They aren't doing this and do not have the extremely broad reach across the internet and devices which Google does, so can only be much less invasive.

Furthermore, for the many users who do not live on the U.S., they do not expose themselves to NSA wiretaps to nearly the same risk if they do not use American-based services like Google's infrastructure.

      ve3jlg GrapheneOS does not bundle any type of Google service or app in it. If someone is not okay with using Sandboxed Google Play after fully understanding how it works and that it is fundamentally different compared to privileged play services that you would find on the Stock OS, they can simply choose to not use it.

      Not everyone's threat model, needs, or expectations are the same. People need the apps they depend on to work. The best way for them to do that is to use Sandboxed Google Play. It is better than using Stock OS with privileged play services, and it is much better, and much more secure than other approaches trying to do the same thing.

      If you can use all the apps you need without Sandboxed Google Play, you're free to not use it; in fact, that would be ideal, but people's journey into privacy doesn't happen instantly, and the more you try to change at once, the more likely you are to completely give up and go back to something objectively worse.

      People who use Sandboxed Google Play on GrapheneOS are already miles ahead of most people when it comes to their phones.

        matchboxbananasynergy Again, this is something that only has to be done for the first install. Subsequent updates are fine, because your device will check that the signing keys match and won't update if they don't.

        If one decides to switch apk sources, will uninstalling the app clear signatures and reset TOFU?

        I realize that user data will be lost.

            ve3jlg If one decides to switch apk sources, will uninstalling the app clear signatures and reset TOFU?

            Yes. Once an app is uninstalled from all user profiles on the device, then installing an app with the same app ID again can have any signature it wants.

            If that wasn't the case, you could move between F-Droid builds (signed by F-Droid) and developer builds (signed by the developer), for example.

            The point about it being in all profiles is important because that thing is universal. If you have a variant of an app of an app in one profile and try to install an app with same app id but a different signature in another profile, Android will stop you, as it detects that you already have it installed with another key.

            Same thing applies to trying to install a version than the currently installed version in another profile.

                9 months later

                matchboxbananasynergy

                Hey there!
                Switching from ios myself and the way you and others have explained couple of questions in this thread is invaluable, if i can suggest to pin this particular thread somewhere easier to find for the newcomers, this here is pure gold!
                Cheers

                  I switched from 2 years use of iOS and Android prior to that.

                  The approach suggested by matchbox is almost the same path I took. I installed a single profile initially without sandboxed playstore and depended upon Droid-ify, Obtainium, and Aurora. Later, I added a second profile with sandboxed playstore and only run limited apps there (Google Maps, Lyft, Hilton, Waze, United, and Marriott. I think only Lyft requires google services but have decided to make that profile travel only.

                    • [deleted]

                    • Post #50

                    Kottonballs how do you do banking? Don't you use an app? How are you satisfied with your FOSS video messaging app (I presume you use one)?

                        coffeefun
                        Hey there, it's been almost a year since you started on the journey, could you help - share what set up you have arrived at so far and how is it serving you?
                        Cheers

                          matchboxbananasynergy

                          hey again!

                          • Wanted to double check if i understand correctly - if i use Obtainium on a single profile device - as long as i check the web site for the app and expect the dev to be responsible about their keys (eg proton, signal, nextcloud) I have no reason to worry about the updates coming through obtanium?
                          • and another thing - if i'd use single profile with obtanium, any options of getting a tesla app and google camera, without using gPlay & aurora store? (i know the question is a bit dumb, i just wanted to make sure)
                            Cheers

                              • [deleted]

                              • Post #53
                              • Edited

                              MrStreisand Wanted to double check if i understand correctly - if i use Obtainium on a single profile device - as long as i check the web site for the app and expect the dev to be responsible about their keys (eg proton, signal, nextcloud) I have no reason to worry about the updates coming through obtanium?

                              Android uses trust-on-first-use model approach where you only need to worry about whether you got the right app initially (ie it's not some fake lookalike). Obtainium is just a scraper. It's does not verify signing certificates and neither does GrapheneOS (for now). If you want to bypass Play Store (or other stores), it's on you to determine you've downloaded the right thing.

                              and another thing - if i'd use single profile with obtanium, any options of getting a tesla app and google camera, without using gPlay & aurora store?

                              You can use APKMirror or APKPure for that, but you need to worry about updating those yourself and above still applies.

                                [deleted] I don't use any banking apps. I have accounts at several banks and do all of my transactions in person or over telephone.

                                I also don't use video chat as I don't want my image data gathered as much as possible. For messaging, I use Session and Element.

                                  coffeefun
                                  For your Spotify problem you can install Spotube in default profile.
                                  It doesn't require play services.
                                  Install spotify in a secondary profile with play services.