Word of Warning When Using Aurora Store or Side Loading to Install Apps

Max-Zorin

I thought I would post this here since many GrapheneOS users side-load or use Aurora Store to download and install apps.

I think everyone knows that logging into Aurora Store with your personal Google account breaks the Google services TOS and theoretically Google could suspend your account (though I haven't heard of this happening in the privacy forums I frequent).

What I didn't know is that some apps and services have in their TOS that you can only install their apps through official apps stores (e.g. Google Play, Amazon App store) of which Aurora Store is not one. Otherwise your account might be suspended for that app or service.

Case in point, I've used the Fongo VOIP app for years as a secondary spam number. I've always installed it via Aurora Store. One day I found out my account was suspended and when I investigated, saw Fongo changed their TOS. It now says users cannot use unauthorized apps stores. Further research shows if you go to Settings > Apps > select an app > then scroll down you will see Store and information on where the app was installed (e.g. F-droid, Aurora, Google Play).

This might be a serious concern if it's an app or service you rely on or have money in credit on that app or service.

Max-Zorin

I guess this was discussed here as well but the thread title not as obvious.
https://discuss.grapheneos.org/d/3852-revolut-app-from-aurora-store-stopped-working-today

Graphite

Apps that insist on Google Play Store, are top of my list to be replaced by FOSS alternatives.
If that's not an option and I absolutely need it, then the app is only installed in a specific user profile.

I've seen a few apps that behave this way. The motivation is usually wanting to implement in-app purchasing.

Graphite

There's a ticket for this BTW.

https://gitlab.com/AuroraOSS/AuroraStore/-/issues/836

Graphite

But probably won't happen. They don't want Google to threaten them.
https://gitlab.com/AuroraOSS/AuroraStore/-/issues/699

W1zardK1ng

In the Feb updated the other privacy os saying, they are now setting “Play Store” as installer when installing from Aurora Store to make some apps work. I dont use that os or dont have any plans to check it.

Dont think Graphene os will implement something like that and i personally dont want it to.
Graphene os's google play setup with a throw away account is much better and safer than Aurora store.

If anyone want they can use a google play setup with a throw away account in a different profile to update the apps, as it will set the installation source as playstore for apps in other profiles the apps will work.

I use only the owner account with a throw away account logged in, everything works as a normal, dont have to deal with these kind of issues.

To my understanding no one really knows what data is being shared using IPC, The non-foss apps installed in a secondary profile with google play services may share data to google and most probably foss apps wont share anything with google play services, so i feel its okay to use everything in a single profile. i wont worry about IPC until aosp comes with more ways to find details on that.

if anyone have more details or feels what i said is wrong, please correct me. so that i can improve my setup too.

Graphite

W1zardK1ng I use only the owner account with a throw away account logged in

You stay logged in? How often do you log out, wipe data, and create a new throw away Google account? If you're not doing it often, Google is still building a profile on your usage.

For many GraphenOS users, one of the major objectives is to stop sending anything to Google. No PSDS and not even connectivity checks.
Sandboxed Google Play is better than stock Android, but it's still a compromise.

W1zardK1ng

I stay logged in, the around 3 months back i wiped and created a new account, im not planning to do it often though.

I gave only the network access to all google services, apart from few device info, ip address and the details of apps i downloaded from playstore there is not much google is collect on this account i belive, also what IPC is contributing.

Unless this data is not connected to my real identity im happy with this setup.
Its so good to completely avoid google, i tried it for long time.
but the inconvenience of complete degoogling is not worth my threat model.

BalooRJ

Thanks for this heads-up...gives me just the reason to ditch the last few apps I have from Google Play. My bank account app is the last one standing.

freedom_warrior

BalooRJ I always chuckle when I see big tech trying to "force" me to comply and use their apps with built-in trackers. I will do whatever I want, and there's nothing they can do to stop me. Foss4Life