Aurora not so bad comparing with Obtainium?

Kong

First of all, I am a new user. Just one week with Graphene.

I think that I read some articles, and topics about Obtainium, which is considered as a secure and private alternative to Aurora, Play and F-Droid.

In my opinion being Obtainium user is quite risky.

From the beginning of my journey with GOS I was using Aurora Store without Google services and installing only open source apps without Google trackers. The exception was GCam.

Aurora updates are great, I have never problems with them.
I understand that the main problem with installing from Aurora is probability of downloaded malformed application?

Is it not same if you are connecting to wrong source with Obtainium for example?

Assuming that I am downloading proper apk from official source, then checking it integrity with database can I have right to believe that using Aurora as the updater may rescue me from malware apps? If it's true, then I do not want to use Obtainium anymore.

DeletedUser495

Kong https://discuss.grapheneos.org/d/28117-aurora-storef-droid/2
https://discuss.grapheneos.org/d/28123-watch-interview-with-grapheneos-on-david-bombals-latest-video/42

MetropleX

Kong Aurora Store is a frontend to the Play Store but it adds significant issues including with security for example it doesn't check Play Store signing metadata, trusts all web certificate authorities only secures downloads via HTTPS and has usability issues around the shared accounts among others.

It is however a useful tool in niche cases such as those mislabelling app store listings with Play Integrity despite the apps themselves working fine on basic verification.

Obtainium is pretty much the same apart from you're removing a trusted party by downloading apps directly provided by developers and in many case verifiable against at minimum a hash or using AppVerifier too.

Apps downloaded by Obtainium through the sources it supports will work without issue.
Apps downloaded by Aurora are only going to work if apps don't check the installer of record, if they do and as they would, they expect to see Play Store and it's not there, there are apps that simply won't work from that source.

Obtainium will also attempt background installations of apps.
Aurora doesn't.

23Sha-ger

Kong Obtainium, which is considered as a secure and private alternative

Considered by who?

Kong In my opinion being Obtainium user is quite risky.

Now we are talking.

Kong I understand that the main problem with installing from Aurora is probability of downloaded malformed application?

This is not recommended on GOS, you can use it, but it gives no privacy/security benefits.

Kong Is it not same if you are connecting to wrong source with Obtainium for example?

There is no "wrong source", you download apps from Google. Aurora is just a proxy to do this.

Kong downloading proper apk from official source, then checking it integrity with database can I have right to believe that using Aurora as the updater may rescue me from malware apps? If it's true, then I do not want to use Obtainium anymore.

Those are entirely separate things. Aurora is a proxy to the officeal Play store, Obtainium is just an app for
Play apps. Some apps will be only on Github/F-Droind which Obtainium is for. Most of apps, and I talk about
a big number, more than 99%, will only be abailable using Play store.

Delaney

What are you trying to achieve exactly?

Kong

23Sha-ger Considered by who?

If you read opinions among community I think you can conclude it. But we are not robots. We can interpret text in our own way.

Delaney What are you trying to achieve exactly?

I am wondering if I was using Aurora Store would I reinstall apps gathered from it, and move them to the Obtainium. But what if after every update and new installation I check apps with AppVerifier and they are confirmed? Should I worry about something?

Kong

@DeletedUser495
Thanks, I will be reading soon!

MetropleX

23Sha-ger Aurora is just a proxy to do this.

Not entirely just a proxy there is a lot Aurora falls short in in comparison to Play.

GrouchyGrape

23Sha-ger Obtainium is just an app for
Play apps

Not sure what your mean by this, but that's not accurate. Obtainium doesn't do anything you couldn't do manually, download and install apk's from more "direct" sources than through the Play Store. However, it adds several amazing QOL features.

23Sha-ger Most of apps, and I talk about
a big number, more than 99%, will only be abailable using Play store.

I think you'd be surprised how many apps are available outside the Play Store. Out of all my apps, 10% are from the Play Store, the rest are obtained directly from the developers.

M_2_Sade

MetropleX In the case of a banking app (not found on obtainium) where would you recommend to dwld from ?

gristle-cause

I wouldn't say Obtanium is inherently risker. I would say it shifts trusted parties. Instead of trusting a storefront as a middleman between you & a developer to inspect, build, & maintain a secure application, you are trusting (1) the developer to provide a secure build & (2) yourself to vet the developer, verify the app install, and maintain the application.

Some folks have, in the past, found reason to doubt their trust in the Aurora storefront's cybersec practices. I won't rehash that here, but I encourage you to read up on past discussions. If your threat model prioritizes security & you find Aurora's issues to be a threat, seek alternatives like Obtanium or sandboxed Play Store

userofgos

M_2_Sade Google Play Store and if it fails to install from there because of the Play integrity check then resort to Aurora store (and verify the hash) or use the website.

Kong

Interestingly AppVerifier had last commit 3 months ago. Is this project going to be closed?

de0u

Kong Interestingly AppVerifier had last commit 3 months ago. Is this project going to be closed?

I suspect it's fine.

Novalissoide

GrouchyGrape precisely.

DeletedUser495

All differences aside, let's remind ourselves we are all pulling at the same end of the rope towards security and privacy. I would like to wish every member of this forum all the best in their endeavour to achieve just that. You won't hear from me again (and not that you care, I understand), but I will keep an eye on you from the shadows.

Novalissoide

DeletedUser495 i will honestly miss you a whole lot..