Encelados I first used Aurora Store but then read that it might not be legal as Aurora Store uses a "fake Google account" to access Play Store
Aurora Store's anonymous account is probably violating Google's terms of service, but probably isn't breaking any state laws. It's a huge difference: if you break terms of a service, you're ineligible to use it; if you break state laws, you could be fined or jailed (or worse!). So please differentiate and don't call it “illegal”, call it a “violation” for example. (That's not to say I'm encouraging violating terms because it's not illegal.)
Encelados The discussion concerns "Google Play Integrity". […] GOS eventually responded saying something about "spoofing" and that "Permitting individuals to spoof it is fine to them [Google]". The word "spoofing" has a slight illegal ring to my ears so it now has me wondered what is actually being meant?
Play Integrity is a set of anti-competitive services offered by Google, marketed to app devs as security features, although they really don't enforce security, but rather enforce Google's monopolistic practices, which is blatantly illegal (disclaimer: I am not a lawyer).
Android that comes with Google Play Store, the largest app store for Android (not by chance, read on), must abide to Google's monopolistic policies. This includes, for example, the manufacturer being required to bundle all the Google bloatware preinstalled with invasive access (Chrome, Gmail, Google Drive, Google Photos, and all their other crap, Gemini too I think nowadays). This gives Google a business edge because users can install alternative services, but they already have Google preinstalled, so why should they? Google can't give Apple's excuse that it's their own proprietary OS, because it's not. Android is open source, it has always been since it's inception, and that's how it's been intended to be always, as far as I know. Android's source code is published as Android Open Source Project (AOSP). Manufacturers, and the GrapheneOS project, take AOSP and build upon it, having their own operating system derived from AOSP. Yet they all must preinstall Google's shit with invasive privileged access, or suffer the consequences. Manufacturers comply. GrapheneOS doesn't, and can't without reforming what it is, as per what they have said in their official posts in the past.
The most talked about feature in the Play Integrity suite is the Play Integrity API. It's an API that apps can call to check whether the operating system you're running is certified with the Google Play monopoly crap. Since GrapheneOS isn't, some apps, like bank apps, that use this API then tell you that your device is “insecure” or “rooted” or other nonsense, and tell you to revert to stock. Root is incompatible with the security model of Android and GrapheneOS. GrapheneOS tries hard to contain all OS components and user apps to the lowest privileges possible, and isolate them all from one another (this is called: “sandboxing”, because the sandboxed app/component is put into its own little playground), whereas “root” means that you can grant any app that you want complete unrestricted privileges on your device (which is obviously the opposite of putting something in a sandbox). GrapheneOS also tries hard to make sure that whenever you boot up your phone, you're running the authentic GrapheneOS, not modified by malware (this is called: “verified boot”, because you only boot verified software). (You could still have malware installed as an app, but any malware-made (or user-made) modifications to the OS are detected and rolles back, and if it's not possible to roll them back, your phone is prevented from booting to prevent the modifications from having further effect.) When GrapheneOS does this, it captures certain information about this and forwards it to a chip inside the phone called the “secure element” generically, or the specifically in Pixel 6 and later, the Titan M2 chip; since this chip is separate from the OS, it can create messages and sign them in a way that mathematically proves that the messages came from the chip rather than from the OS running on it — it uses that to create a message with info about the running OS after the OS has passed all these checks that it's authentic and all of that stuff (this is called: “attestation”, because the secure element attests info about the security of your device). This is meant to be used by apps that require online services, they send this signed message to the service (this is called: “remote attestation”, because you're attesting to a remote service that checks you), and the service only allows you to enter if you're running their app on a secure device where these checks are working properly, and the checked OS is known to not have this “root” feature. The thing you quoted talks about people who use the root access they have to install a key (the piece that's needed to create these mathematical signatures) that was stolen from the “secure elements” (not exactly, this feature can also work with something less secure than the secure element, but let's ignore it for simplicity) of some old insecure devices. When Google lets their Play Integrity API approve these users, it's because Google can see that these users are sending messages, containing info about widely varied and sometimes relatively up-to-date Android versions running on widely varying hardware, but signed by the same old devices, but Google lets them pass the highest grade in their Play Integrity API despite that. The Play Integrity API receives the raw signed attested info from the secure element, and based on this assignes the grade (strong, device, basic, or no) and returns the grade to the app service that requested your device to be checked. The fact that the app service gets only an opaque grade signed by Google's Play Integrity API servers rather than the raw info signed directly by the secure element on your device is one reason why the Play Integrity API is less secure. The fact that Google assigns the strong grade to known-insecure devices is another reason. GrapheneOS itself isn't interested in using stolen keys, and GrapheneOS itself provides a built-in app that they invented, called Auditor, that relies on the raw signed data to attest to you (yes, you the person) the raw security information of your device. This app obviously needs to tell you truthful information, otherwise it'd be pointless.
Another feature in the Play Integrity suite is something that app devs can activate that uses the Play Integrity API inside the Play Store even before the app is installed on your phone. If your phone doesn't pass, the app completely disappears from Play Store on your device and if you already had it installed you just silently stop receiving updates to the app, even if these updates contain security fixes to the version you're stuck with, and even if the version you have stops working. You don't get notified when this happens. If you happen to know the exact name of the app you want and search it, you'll get a message saying something like “Looking for (app name)? This app won't work for your device”. If you manage to open the app's Play Store page inside the Play Store app (such as by opening it from the web browser first), you'll see a red error text saying that the app “won't work” anymore (blatant lie).
And another feature that app devs can activate makes the Play Store automatically inject crap into the app when you run it that does checks. For example, one of the checks it does is whether you installed the app from the Play Store itself, or from another source. It doesn't check that the app is authentic, it could be the exact same unmodified app, but if you installed it from a source other than Play Store (for example to get around the crap in the previous paragraph) then it blocks you from opening the app. GrapheneOS patched this several months ago, you might be interested in their words:
https://grapheneos.org/releases#:~:text=2025052000%20release:-,disable,jailbreaking))
disable anti-competitive code being injected by the Play Store into apps choosing to enable "App integrity > Automatic protection" when there's a valid Play Store source stamp signature (proving that it's an unmodified app from the Play Store, so we aren't disabling an integrity check) since it prevents using the apps on GrapheneOS when apps also choose to enable "App integrity > Store listing visibility" with either the "Device integrity checks" or "Strong integrity checks" values enforcing having a device licensing Google Mobile Services and running the stock OS (circumventing this is protected by the DMCA exemption for jailbreaking)
(I added the emphasis.)
Encelados All I want to know basically is whether I myself am safe and fine using GOS and by doing so I'm not violating any TOS or even doing something that's illegal
GrapheneOS is open source, is itself based on the Android Open Source Project (AOSP), and only supports devices that let their users unlock them and replace their operating system with a custom OS, including the custom OS's ability to use the same hardware security features just as well as the stock OS can use them.
https://grapheneos.org/faq#future-devices
Encelados I could get into trouble by Google suing or anything. I quit using Aurora Store as soon as I found out that it could be considered copyright infringement
I'm not aware of Aurora Store being in violation of copyright. Aurora Store is open source btw. (It's also insecure, so it's good that you don't use it. Take in mind that Android apps cannot be updated if the updated version doesn't match the installed version with its signature, so installing updates through Aurora Store is probably safe, rather than new apps which is risky.)
Encelados I'm in Europe, so should be fine I guess.
France, by any chance?
https://grapheneos.social/@GrapheneOS/115575997104456188
https://grapheneos.social/@GrapheneOS/115583866253016416
https://grapheneos.social/@GrapheneOS/115589833471347871
https://grapheneos.social/@GrapheneOS/115594002434998739
Encelados (hopefully) original Play Store
The GrapheneOS team are professional experts. So when you install Google Play from their built-in App Store, you can be damn sure that they verified it beforehand that it's Google's official untampered Google Play. Although the OS itself doesn't currently block you from installing apps written by others than Google that impersonate Google Play. Although, in the recent weeks I've seen a few posts from the GrapheneOS project account where they say they've become convinced that this is a security issue, and they intend to patch it soon. I don't know how they're gonna handle users who already have installed an impersonation of Google Play (one such “impersonation” which is somewhat widely known in the privacy circles is called microG, an open source (yet also insecure and imperfect) reimplementation of Google Play that's specifically meant to not present itself deceptively as being the original Google Play). It would still not protect you from installing a malicious impersonation of Google Play, but the impersonation would work on you (which is still very dangerous) rather than fooling the apps on your device into thinking they're communicating with Google's official Google Play services.
Encelados Something tells me, they're referring to these 3 types of states: "basic integrity", "device integrity", "strong integrity".
Does GrapheneOS not meet any of them
GrapheneOS currently passes only the “basic” anti-competitive checks, simply because Google chooses to. It's very generous of them, I know. GrapheneOS doesn't pass neither the stronger “device” checks, nor the strongest “strong” checks. “Strong” is still an insecure check that lets insecure devices pass it (not just the old insecure devices I mentioned above), and the check itself and the way it's reported to the apps' services is less secure and less informative/rich than the info reported directly by the underlying feature (attestation). “Device” check is some bullshit between the “basic” and “strong” ones.
GrapheneOS doesn't spoof anything to the Play Integrity API. They say that if they did, their userbase is large enough that Google would notice and block it. As was said, Google can see everything, they just don't care about some people here and there doing it on their own.
Encelados I got confused by the word spoofing and thought, GOS was constantly spoofing / deceiving Google services and was worried that as soon as I log in with my actual Google account they will notice I'm using an OS that's not "playing right".
GrapheneOS includes a compatibility layer to allow Google Play to be installed as a normal app without invasive privileges. So basically it does deceive Google Play into falsely believinf that it has invasive access on your device, while not actually having any, for your protection. What's illegal here is Google's monopoly, not what GrapheneOS is doing. Disclaimer: I am not a lawyer. This might be a violation of Google's terms though, but I don't think so because I've never heard anyone saying that, and quite frankly I don't care, because it's our phones.