Install app from Google Playstore and update throught Obtainum

X41M3S

Hi,
I have a question that’s been on my mind for a while.
I switched to GOS over a month ago, and I’m very happy with it. Before that, I started de-Googling and de-Microsofting my life, and so far it’s going great.
So far, I haven’t missed anything these companies offer (well, maybe Google Maps and their traffic info a little bit).

And here’s my question. I need to install banking apps on my phone.
My first - and actually repeated - attempt was to try to create a Google account that isn’t linked to anything I’ve used before. Unfortunately, I can’t do that without providing a phone number. I’ve tried about 15 times now, using a different method each time. Unfortunately, it always ends up requiring either a QR code or a phone number.
So now I’ve started thinking about another option. On my other phone, I have these banking apps installed directly from Google Play. I can easily transfer them to my other device using LocalSend.
If I install such an app (sourced from Google Play), can I then safely update it using Obtainum with automatic updates, for example from APKPure? Is there any risk that it will update the app to a compromised version?

In reality, I only need 4 banking apps and don’t want to install anything else from the Google Play Store, so this would be the perfect solution for me, instead of buying a new phone number just to create a Google account.

MyIdentityIsntImportant

X41M3S I switched to GOS over a month ago

Welcome to the club.

X41M3S attempt was to try to create a Google account that isn’t linked to anything

If you're having trouble creating a disposable Google account, it's usually due to the IP address you're using during account creation & the medium you're trying to create the account from.

If you're using a VPN, Google tends to require verification due to poor IP reputation. This can be fixed by changing your VPN exit node until you find one that isn't "tagged" for more verification by Google; but do note that this isn't a guarantee since all nodes of your VPN provider(s) can be tagged. The other solution is to not use a VPN during account creation & instead go to a place with a public Wi-Fi. That way you'll blend in while creating the account & can then enable your VPN again after it like usual; this method should also work from your home Wi-Fi or cellular data connection as long as you're not using a VPN.

The medium you try to create your new disposable Google account also matters. For example, trying to use a desktop browser invites more scrutiny than trying to create an account through the native Google Mobile Services interface on Android. So, just create your account through the (sandboxed) Google Play store on your phone.

X41M3S can I then safely update it using Obtainum

No. Obtainium cannot fetch apps/updates directly from the Google Play Store, even if you've installed the app(s) in question from there before. You'd have to set it up to fetch updates from third-party mirror sites (such as APKPure you mentioned), but this comes with obvious security implications. You'd be trusting the third-party hosting site to provide you with unmodified & uncompromised versions of the apps you'd be installing. Considering that you're talking about installing banking apps, a prime target for basically all non-state threat actors, I'd personally reconsider this approach.

I'd recommend trying to find a method of creating a Google account first. If that doesn't work, I'd either look into getting a disposable phone number for the account creation or ponder using the Aurora Store. I'd never consider using a third-party APK hosting site for my banking apps & I won't recommend it to you either.

You got this. Goog luck!

NoahRaketic

X41M3S Your least bad option (if you absolutely can't use Google Play) would be to get the certificate hash in AppVerifier from the phone where you already have the banking apps installed. Then, (if you must not use the Play Store) install the banking app via your preferred method and verify it with AppVerifier. This guarantees that the APK is genuine (but it still could be outdated; check the version). Aurora will be somewhat better than APKPure because you'll be able to update more easily and you won't receive outdated builds.

MyIdentityIsntImportant No. Obtainium cannot fetch apps/updates directly from the Google Play Store, even if you've installed the app(s) in question from there before. You'd have to set it up to fetch updates from third-party mirror sites (such as APKPure you mentioned), but this comes with obvious security implications. You'd be trusting the third-party hosting site to provide you with unmodified & uncompromised versions of the apps you'd be installing.

If the app is first installed from an official Play Store build, and then updated via a different source, that second source does not have to be trusted not to modify the APK. Due to AOSP certificate pinning, APKPure would not be able to tamper the APK without the system rejecting it. The only problem is that the user will run behind on updates.