I uninstalled Google Messages. Here's why.

Designed1668

naibed It's not that SMS/MMS is safer. I made that pretty clear in my post. It's that RCS via Google Messages is privacy theater/privacy washing. The backdoor comment was not to say RCS is worse for privacy than regular SMS/MMS, it's to say that it's not materially better for privacy. Also, client side scanning is not a backdoor in the protocol, but the result of upending e2ee protections are the same.

There are also privacy tradeoffs for even trying to enable RCS on GrapheneOS. For me, it was the only thing stopping me from removing play services from my owner where it always needs to be running and for others it can mean at least significantly restricting Google permissions or disabling it when not in use.

RCS also stopped functioning as harm reduction when I realized it made it more difficult to convince people to switch to Signal, which would be the more ideal solution.

I was once thought that RCS was the easier solution than trying to get people to use Signal. But, I mean, look at the RCS megathread monstrosity. It's not easy at all. Ultimately, this is a social issue that needs a social solution, not a tech solution. Signal works, we just need find better ways to get people to use it.

ksumit

Designed1668 How do you plan to update Pixel Cam and G-Photos that are only available via Play Store? I've been struggling to avoid Play Services/Store in my owner's profile since I am keen on using Pixel Cam and Slack (because of official reasons).

Designed1668

ksumit If you update an app on one profile or private space, it updates that app across all profiles. You can even disable the app and Play Store will still update it if it's installed on that profile/private space. Every profile/private space shares the same package, they just don't share app data. So it doesn't add storage to install the same app across profiles.

So yeah, I have a profile for updating apps using the play store. I keep all of the apps disabled except for the ones im using in that profile. You can either keep it running in the background or just turn it on manually to update apps on your schedule.

When you update/install an app, it say it's installed from the last source. So despite not having play services or play store installed on a profile, my apps still say they're installed from the play store.

Just keep in mind this means you need to uninstall it from all profiles if you decide to stop using an app. You also cannot downgrade an app or change to a different signing key version of the app (like F-Droid variant) without first uninstalling the original from ALL profiles (this is an Android security measure).

If you want a new app, you'll have to install it twice, once on that profile and a second time in that designated update profile. I'm using the Aurora store on the owner and then immediately overwrite it with the play store on another profile. You could also try disabling play services/store in the owner and re-enabling it for updates, though I feel like my way is easier.

DeletedUser622

ksumit How do you plan to update Pixel Cam and G-Photos that are only available via Play Store?

Aurora.

Designed1668

Designed1668 if you don't trust authors store, even for this small purpose, you could also use adb to push/pull apps from your private space to your owner. LocalSend also lets you send installed APKs to other devices. So you can install localsend on your play store profile to a second device, then back again to your owner profile.

You only have to do this once for new apps. Once they're on the owner, you can push them to other profiles and private space as much as you please.

Developer-Dude

@Designed1668 I totally hear you on this one! I never will use Google Messages. RCS really isn't that important to me. I dislike Google with a passion. :) If the app or service has the word GOOGLE in it, you will never find me using it. I use my GOS phone without Google Play Services and it's great.

Designed1668

Developer-Dude thanks for the support, though I'm not doing this for anti-Google tribalism. Everything is a tradeoff and Google Messages stopped being worth it due to changes in the tech and my evolving views. I still plan to use some Google apps, but either in a more compartmentalized profile or without network access. Should things change, I'll change. It's part of the journey.

Pixel camera + Google Photos without network access is a major selling point of my phone's camera capabilities. And without play services in that profile and minimal permissions, they're as locked down as could be.

I still plan to update my apps via play store. And I will still use Android Auto (on a dedicated profile with minimal installed apps and personal data). And I'll still use Google maps as a fallback option when live traffic and reliability is more immediately pressing than privacy.

Developer-Dude

Designed1668 I'm not doing this for anti-Google tribalism.

I know. ;)

DeletedUser534

Designed1668 Pixel camera + Google Photos without network access is a major selling point of my phone's camera capabilities. And without play services in that profile and minimal permissions, they're as locked down as could be.

Do you have Pixel Camera and GPhotos installed in the Owner profile but not Play Services?? Do you disable them or what? How exactly can you update them if they are installed from Play Store?

gristle-cause

Designed1668 I hate that regions still dependent on carrier SMS for messaging have to basically choose the best worst option. Though everyone else is dependent on Meta, so its kinda a shitshow all around

I largely feel the same way, but consider 100% reliable texting to be a non negotiable. I have MMS deliverability issues when trying to use anything else, so for the time being, I blocked as many outbound connections as possible from GMessages with a firewall & opted to just deal with it

Am naively optimistic that RCS will one day be opened up for alternatives to Google alone

DeletedUser759

I never installed google messages. Why? Because not. Keep things simple...

Designed1668

DeletedUser534 I already tried to answer this. Perhaps I wrote it poorly.

I am using the Aurora Store on the Owner for the initial install to the Owner profile. I then immediately open a separate profile where the play store is installed and I install it again there. I then disable it in the play store profile since I won't be using it there.

All Android apps are only installed once per device, so I didnt actually install two copies of the same app on different profiles. I overwrote the Aurora store version with the one from the Play Store. Going forward, I will use the play store on that designated profile to update the app across all profiles it's installed.

You can try this yourself. Install an app from another source, like Aurora Store, Obtainium, etc. Open the a
App Details page (where you find the Apps permissions) and it will say it's installed from that source. Then install it again from the play store on a different profile. Go back to the original app's App details page and it will now say its installed from the play store, even if you don't have the play store installed on that profile.

For my purpose, the Aurora Store is only necessary for the first install. The play store takes care of all future updates. Once the app is installed on the Owner, you can also "install" it to other profiles in the multiple user settings menu.

You also don't need to use the Aurora Store. Some people don't trust it for security (though, I think updating from the play store removes a lot of those concerns). There are ways to get the app onto the Owner in other ways. For example, ADB will let you pull/push apps. LocalSend will also let you send installed apps to another device over your wifi network. I personally think this is overly tedious and Aurora is good enough for this purpose, but the option exists for those with extraordinary threat models.

DeletedUser534

Designed1668 Nice catch! I haven't thought about that earlier.

It is an overkill for my threat model but good to know! Thx

Nobody

What's all this drama about g-play & services when the main point was Google messenger rcs not being actually secure from Google etc. He even stated he in not doing this as part of being anti-google.

Personally I do not trust the implementation of rcs not to mention the huge amount of meta data Google gets even if the content was unbreakable encrypted which combined with other data...........

I use Molly Signal. If you want to text me you need to use it or your not getting a reply beyond a link to signal. After all regardless if I have my GOS default sms disabled all telco can see any incoming sms to my number. Thus a reply with the links and note that's the only way I com.