Which 'store' to use?

Piwepil

Prrprr2 Sanboxed Play Store with anonymous Google account would be the best. Then the are options like Aurora Store and getting .apk files from developers or github.

As of now F-Droid should be avoided.

[deleted]

Piwepil I after much deliberation I have decided to not give a chance to even sandboxed Google run on my device, the few apps I am using are straight from developers websites or F-Droid . That in itself still can not protect me against my browsing habits and use of inherently insecure services (sms, phone, unencrypted email to name a few), incorrect use of certain system toggles etc. I am generally trying to reduce my digital footprint and I am trying to stay sane in the world where user data monitoring is getting worse by the day. Only thing I can do is watch and learn.

[deleted]

abcZ I believe it's a resource maintained by one of the community moderators so I just deferred to it as a common wisdom since I'm not an Android developer myself. Daniel seems to think similarly if one doesn't want to defer to the advice of some blog.

Graphite

[deleted] Daniel seems to think similarly if one doesn't want to defer to the advice of some blog.

It's still the opinions of one side. Just because someone chooses GrapheneOS, doesn't mean they must agree with Daniel on every security related opinion.
Right now there is a pissing match and extensive drama on this topic. This happens quite frequently with devs in this space. Frankly, the drama/accusations/insults/arrogance is the biggest reason I hesitated with GrapheneOS. But I am glad I ignored all that, because I do really enjoy the OS so far.

roddyd

Some people have started downloading apps directly from Github in a web browser, using an RSS feed to find updates. This avoids many of the pitfalls of both Fdroid and Play Store but is also very cumbersome.

[deleted]

roddyd It's cumbersome for one and it's only works with developers that choose to a) publish their APKs at all (eg. developers of Wireguard don't) and b) somewhere with an RSS feed. But nevertheless, it's a nice approach if you only require a handful of apps.

BluishHumility

Personally, F-Droid is always my first choice. If an app I want to install is not available in F-Droid I will get it from the Aurora store. I do not use the Google Play store for anything.

Depending on your thread model, F-Droid's security shortcomings may be relevant. That is something you will have to determine for yourself. https://privsec.dev/posts/android/f-droid-security-issues/

As was pointed out, this topic has been all but beaten to death here in this forum and elsewhere online. As you can see in this thread, even within the community there are a variety of differing viewpoints; the best you can do is research the topic for yourself and decide on your own how you would like to handle package management.

[deleted]

Graphite

It's still the opinions of one side. Just because someone chooses GrapheneOS, doesn't mean they must agree with Daniel on every security related opinion.

No, it doesn't. It does however seem that this particular OP would be served quite well to just defer to what the lead developer thinks, much like myself frankly. I'm not taking sides here.

drama/accusations/insults/arrogance is the biggest reason I hesitated with GrapheneOS. But I am glad I ignored all that, because I do really enjoy the OS so far.

My exact experience too.

Prrprr2

Thank you all for the answers.
To be honest it has become more confusing, but that makes sense since everyone has their own opinion and preference.

I have also read some things about a custom F-droid repo like IzzyOnDroid or Newpipe, what is your opinion about this? I too personally want to leave as little digital imprint as possible within this mass surveillance era.

Maybe we can make a specific order and see if we can agree with each other. For instance:

Source (github)
Custom F-droid repo
Main F-droid repo
Aurora
Sandboxed playstore

@abcZ @[deleted] @Graphite @BluishHumility @Piwepil @Grkrz @SgtApple @robalob

wivode

Prrprr2

Sandboxed Play Store
Aurora Store
Source
Custom F-Droid repo
Main F-Droid repo

You don't have privacy without security. That's why F-Droid is dead last.

Prrprr2

abcZ how can I find out myself how to built an app from the source?

wivode

Prrprr2
There is no point in building apps from the source if you can't audit source code yourself.

abcZ

Prrprr2 Start by installing "Android Studio" on some computer. Learn the basics of GIT. Download a repository, open with studio, hit the build button.

abcZ

wivode Anyone can start learning to read code and begin some basic checks themselves. Naturally, your ability to do so will improve with experience.

Prrprr2

wivode ahh ok thanks! Why is that most people are opposed to Google playstore while you placed it on #1 & 2?

wivode

abcZ
I don't think that OP's threat model is that high. If it is then GrapheneOS can be built from source too and signed with his own keys.

wivode

Prrprr2 Because Sandboxed Play store requires an account. That's why a lot of people are against it. I personally have an anonymous Google account to use for Play Store and other things.

wivode

Prrprr2
A lot of people are tryhard fans of F-Droid too and they can't take any criticism against it. Same with F-Droid team. They treat all of the criticism like its an attack or something. As of now F-Droid is a threat to your security. No security = no privacy.

wivode

Prrprr2
To be honest we can put it like this. If you think that you or someone else know better than people at privacyguides.org and people of GrapheneOS project than you can use F-Droid. Both projects recommend AGAINST it. Its up to you.

wivode

abcZ
What is the point to “backdoors” or “trackers” on Google Play Services when 99,9% of people use some variation of Android where Google has privileged access to everything on the device via privileged Google Play Services? Meanwhile on GrapheneOS Google Play Services are sandboxed.

Google Pixel devices have proprietary firmware which is made by Google maybe there are backdoors or trackers in that and it has their SoC AKA Tensor so maybe they have hardware backdoors in that too? There are NO LIMITS to being paranoid about something.

All of the apps that someone install on GrapheneOS are STRICTLY sandboxed so they only can do what you let them to do.

« Previous Page Next Page »