Obtanium vs Play Store

hello-gos

What is the most secure place to install open source apps from if they exist on both github and play store. For example KeePassDX, Aegis Authenticator, FUTO Keyboard, etc.

One argument I saw was that play store has the exact same binary but is more secure because harder to get compromised apk uploaded.

DeletedUser550

hello-gos
If an app I wanted to download was on GitHub and Play store, every time I would download it from GitHub.
To be honest I just ignore G@@gle, so probably would not know it was on the Play store or even bother to check..

becine

Play store.

hello-gos

becine do you know why?

AcclaimSublevel19

Play Store has proper verification of Downloads and app submissions are moderated. Obtainium is generally only recommended when used alongside AppVerifier for apps not available in the Play Store. Very few apps can be verified with AppVerifier in practice though (due to not publishing their certificate hash independently) so Play Store is a better solution.

As a side note, Aurora is just a more insecure version of Play Store and only weakens your security for a negligible privacy improvement.

Elgoog

AcclaimSublevel19

AcclaimSublevel19 Obtainium is generally only recommended when used alongside AppVerifier....

As I understand it, verification with ApkVerifier means I can be confident that the app I've downloaded is exactly the app the developer intended, with no janky code inserted by a third party. But it gives me no assurance that the developer did not insert malicious code in the app either intentionally or through carelessness. In regard to carelessness, the fact that so many developers fail to post app signatures leads me to suspect that many care little about security.

No app on which I have run ApkVerifier has ever failed to verify. I will continue to use it, but am I wrong in suspecting that, at least for the download channels I use, ApkVerifier addresses only a small part of the risk?

hello-gos

AcclaimSublevel19 regarding aurora store, are you not getting complete privacy if you use the anonymous mode with vpn compared to play store (unless you used a burner email/phone)?

Also, could you please elaborate on why it's insecure?

tux_

AcclaimSublevel19 Not having to use any of Google's libraries is not a "negligible" privacy improvement, it is a massive one. And by all accounts the Play Store is also used to distribute malware, including Google's own.

de0u

Elgoog As I understand it, verification with ApkVerifier means I can be confident that the app I've downloaded is exactly the app the developer intended, with no janky code inserted by a third party. But it gives me no assurance that the developer did not insert malicious code in the app either intentionally or through carelessness.

Correct. That is the nature of a signature check.

AcclaimSublevel19

hello-gos Aurora Store does none of the integrity checks Play Store does and it's also perfect for a man-in-the-middle attack: nobody can guarantee you that the APK you got from Aurora is the exact same as the one distributed by Google Play unless you explicitly install both on a test device and compare them. Aurora Store obviously lacks Google's capacity to secure their platform which introduces another point of failure, much easier to compromise than Play Store and that could mean malware for your device if that ever happens.

Byku

hello-gos your question is very justified. This has been discussed at length many times but I too wonder what threat model justifies using Play Store instead of Aurora.

The Play Store:

sends telemetry every minute
lots of ways of tracking your behavior, some can be disabled in its settings
proprietary, no way of knowing what it's really doing
has ads
gatekeeps you from downloading some apps depending where you live
is attempting to trick you into installing things you don't want

Aurora Store:

no telemetry
doesn't require user profile
no ads
can bypass gatekeeping by spoofing
clean UI with no bs
tries to give you actually useful info about the apps

The main issues raised against Aurora are:

no verification of metadata - only relevant on first installs, downloads are from Play Store anyway, MITM attacks were a serious possibility when it didn't use encryption which is no longer the case, most of you will be behind a VPN (or better yet Tor) anyway which lessens this threat even more, the most realistic threat here would be if Aurora Store itself was the bad actor but it's a well known and long existing project
serving wrong versions of apps - a theoretical problem only when you are spoofing a different device
no automatic updates in anonymous mode - valid point but if you use Play Store like is often recommended here i.e. keep it in a separate profile together with disabled apps for updating them than there is no advantage
apps checking if they're installed from Play Store - this is valid and the only practical problem I've come across

So all in all what kind of severe threat model do have to have to be afraid of Aurora Store? If it's targetted malware than your adversary would be very powerful and couldn't such an adversary just force Google to cooperate. Isn't Aurora even safer in this scenario because you don't use a unique user profile? Or is there something else I'm missing?

Come to think of it I have even more questions:
How is Play Store verifying app signing key on first install? Does it use hashes of the signing keys (like Accrescent) or does it force the developers to upload their signing keys to Google?
Do all apps downloaded from Play Store have some proprietary blobs from Google. When installed on the same profile Play Store can detect when an app is launched, update it and then countinue launching the app. Since it is not privileged on GOS I understand it must do some kind of IPC to achieve this?

de0u

Byku How is Play Store verifying app signing key on first install? Does it use hashes of the signing keys (like Accrescent) or does it force the developers to upload their signing keys to Google?

Both!

My understanding is that for older apps the author signs the APK using a key that Google verifies, but for newer apps the author signs the APK before uploading, and then Google re-signs it with a key they assign to that developer. Either way, I believe Play checks the APK against whichever signing key Google believes should be used for that app.

Byku Do all apps downloaded from Play Store have some proprietary blobs from Google.

I don't think so. I think that would cause "code transparency signing" to fail.

pxlkng

Byku I too wonder what threat model justifies using Play Store instead of Aurora.

Wrong way around. There is nothing from a security or privacy perspective that warrants using Aurora, as it fares worse in both. The only few reasons warranting to use Aurora Store are if you simply cannot use the Play Store, i.e. due to Play Integrity preventing you from even downloading an app.

Byku no telemetry

This is not correct. Aurora Store does not and can not protect you from Google telemetry. Play Store and Play Services are not sole deciding factors in Google being able to perform telemetry or data collection on your device, just installing apps from the Play Store is enough, as many apps from the Play Store bundle Google libraries with them, which can run fully independently without Play Store or Services being present, but facilitate the same access for Google as if those would be present. Due to sandboxed Play Services, this is very minimal data either way.

Byku doesn't require user profile

It still does, it just allows you to use shared accounts not under your control, which has its own security pitfalls.

A quote from the official project account on Twitter:

Aurora Store is a frontend to the Play Store but it adds significant issues including with security. It's better to install apps with the sandboxed Play Store than Aurora Store if you care about securely obtaining apps since Aurora Store doesn't check the Play Store signatures.

Soure: https://xcancel.com/GrapheneOS/status/1923752123214287075

Aurora Store is officially not recommended. It does not improve privacy, it cannot improve privacy, it doesn't avoid any of Googles data collection or tracking and only makes security and privacy worse.

More links:
https://xcancel.com/GrapheneOS/status/1870213640340508841
https://xcancel.com/GrapheneOS/status/1870213474942353510
https://xcancel.com/GrapheneOS/status/1844534513663185124
https://xcancel.com/GrapheneOS/status/1832845902542762448
https://xcancel.com/GrapheneOS/status/1831053343520952611

RandByte

tux_ You're right about the privacy improvement but be aware of something really important : For enhanced privacy with Aurora Store (in anonymous mode of course), you must fiddle with both the "Blacklist manager" and "My apps" screens! And also set AuroraStore to not check for updates automatically upon start.

Evertime AuroraStore connects to the GooglePlay, it sends the whole list of installed apps to Google. That's expected because AuroraStore can't predict in advance what apps exist or not in GooglePlay since you can have as many APK sources as you wish (Obtainium, F-Droid, etc.).

If you really want privacy, you must exclude all non-GooglePlay apps from the list so AuroraStore only check updates for the apps related to the store. In my case, I only use AuroraStore to get a handful of apps I cannot get by other means. Both the "Blacklist manager" and "My apps" are configured so only that handful list of apps get sent to Google to check for new versions.

Also beware, every time you install a new app from an alternate source (Obtainium, F-Droid, etc) it gets automatically added to the list of apps AuroraStore will use and you'll obviously need to update the blacklists (ie: Long press an app name on "My apps" to be able to add that app to the blacklist)

AcclaimSublevel19

tux_ are you aware that most apps from the Google Play Store include Google libraries for analytics, crash reporting and a bunch of other Google services? By downloading the app from Aurora Store, all those libraries are still present and will be sending out info that can be associated with your device (it has unique hardware identifiers) whether you're signed in or not.

An app store as large as Google Play is bound to have malware. The moderation is still very good and is a better option than installing apps that aren't checked by any security system at all. Yes, Google does tend to silently install invasive apps, but the difference on GrapheneOS is that you get a proper pop-up from the system asking you for permission, so you have total control over it. It has nowhere near as many permissions and privileges as it has on other Android OSes.

One more thing to keep in mind: The GrapheneOS developers themselves recommend using Google Play and they are confident in their sandboxing. Quoting from the usage guide:

The Play Store app is also the most secure way to install and update apps from the Play Store.

I'm sure they know a thing or two about privacy and wouldn't be recommending it if it were truly harmful. Unless you're in danger from a three-letter agency collaborating with Google, it's a much better choice to use the Play Store.

Oggyo

RandByte Evertime AuroraStore connects to the GooglePlay, it sends the whole list of installed apps to Google.

That's true and it's the way to get the upgradable apps. By the way, it's a great way to fingerprint you by the set of already installed apps. :-)

RandByte If you really want privacy, you must exclude all non-GooglePlay apps from the list so AuroraStore only check updates for the apps related to the store.

But how can it be proved that blacklisting an app does not just act as a display filter of upgradable apps, and the app name is not included in the app update check process? Maybe somebody who can read and check Aurora's source code, I guess.

RandByte Also beware, every time you install a new app from an alternate source (Obtainium, F-Droid, etc) it gets automatically added to the list of apps AuroraStore will use and you'll obviously need to update the blacklists (ie: Long press an app name on "My apps" to be able to add that app to the blacklist)

I believe in Aurora's Settings >> Updates, there is such a control - Filter apps from other sources. Of course, if this works the way as assumed the Blacklist manager does re. the update check.

Byku

pxlkng This is not correct. Aurora Store does not and can not protect you from Google telemetry. Play Store and Play Services are not sole deciding factors in Google being able to perform telemetry or data collection on your device, just installing apps from the Play Store is enough, as many apps from the Play Store bundle Google libraries with them, which can run fully independently without Play Store or Services being present, but facilitate the same access for Google as if those would be present. Due to sandboxed Play Services, this is very minimal data either way.

I understand what you're saying is "So what if there is no telemetry in Aurora app? Maybe you'll download an app that has it anyway?" And what if I don't? What then? Let's say I download VLC player for example. It's not sending anything to Google. Am I now safe from telemetry?

Maritime4165

Please forgive the GOS noob questions (Pixel 9 Pro), but does anybody know (or seen) what sandboxed Play Store app telemetry actually contains? It would help me to decide if I am going to continue trying to create an "anonymous" google account (if there is such a thing anyway, over time), as I have exhausted all suggestions to avoid the dreaded QR code for SMS verification step and nothing has worked for me so far (public wifi/no VPN, mobile hotspot, new/clean private browser windows, and booting into a trial of Ubuntu via USB)...

My goal is to avoid google from collecting enough data points to associate me back to my original account, which I want to eventually delete once I have gotten everything I need to work without it (ideally zero GPS). For example, I have been using Bitwarden on all my devices (Brave extension on Win11, app on android tablet and stock PIxels), but the Android client is not on Github. I am already using Optainium/AppVerify whenever I can, but it appears I need to get it from the play store or install the F-Droid client (the latter in not recommended at all from what I've read). If I have to get it from the PS, does anybody know what kind of telemetry would it send back? I assume I will need to create a new bitwarden account and export my previous vault to my new account? For that matter, is it necessary (from a privacy perspective) to create NEW accounts for every play store app I need to run on GOS so I don't connect the dots for Google?

Sorry for the long post but I hope any accurate replies will also help other new users of GOS.

tux_

I think the Play Store vs no Play Store debate boils down to the kind of apps that you want to use. If you are going to use paid apps, then clearly you need a Google account. My suggestion would be to use a new account exclusively for this purpose and an anonymous prepaid credit card.

If you are going to use open source apps only I see absolutely no reason to have Google libraries at all. I like to download apk's directly from the developers (e.g. Signal and others). As far as I am concerned, F-Droid is fine, but some people here consider it "insecure." In don't mind, it is about as secure as a community maintained Linux repo, so it a "risk" I can live with. I see Google as a bigger threat in the grand scheme of things.

Maritime4165

tux_ Thank you for the response. I will take a deeper dive into F-Droid as needed. The only paid app I use/need is ABRP for my EV, but maybe that has an external payment option outside the PS... Other than that and Android Auto, I hopefully won't need to run anything else. I created a private space for any PS apps that require GPS running...

GosGrape

Bitwarden do publish the apk on github and it verifies from the internal database in AppVerifier.

If you are having problems get the setup from here:

https://apps.obtainium.imranr.dev/

Maritime4165

GosGrape Thank you! When I copied the Bitwarden Github release link into Obtainium, it only gave me the option to install the Bitwarden Authenticator apk. I didn't realize that com.x8bit.xxx.apk files are compatible with GOS...