Google Play sign-in or not

MikeAustin

This question has been asked several times but I was unclear about the answers.
I have two GOS phones. On the first phone, I signed-in to Google Play to install all my apps because I had paid for many of them. On the second phone, I have only used Aurora and have never signed-in to Google Play. Google Play Services still run, of course.
I now have to use free versions of my apps (with a very few exceptions) that are limited in scope and full of ads. I cannot use Microsoft Word, although Excel works fine. I may be able to get round the Word issue by loading an old apk.
My question is, am I making a rod for my own back by refusing to sign-in to Google Play? Am I getting any security or privacy advantages at all?

DeletedUser1111

https://discuss.grapheneos.org/d/8255-aurora-does-not-install-apps/8
https://discuss.grapheneos.org/d/16105-michael-bazzel-recommends-f-droid-and-aurora-store-insecure/18

Hande

I think there is little to no benefit in using Aurora store for "privacy" and it comes with some real downsides.
If you're running Google services and apps normally you're likely fingerprinted anyway. You could consider making a new Google account for your second phone.

To the question, in my opinion, yes - you're only making it harder on yourself (and less secure) by using Aurora.

MikeAustin

Hande Thanks, that's useful to know. I managed to load an old Word apk from apkarchive.org that works. Again, my wish to avoid a Google Play sign-in may cause yet more issues than it cures.
Given that I need to continue using the same apps and I cannot find suitable replacements elsewhere, then I might as well sign-in as with my first phone.

Kamika242

MikeAustin I now have to use free versions of my apps (with a very few exceptions) that are limited in scope and full of ads.

Look for alternatives or if there are ways to pay aside from Playstore. I did this for many apps like Threema, Cryptomator or FolderSync and so I'm not bound to the Playstore using these apps on an alternative OS. Yes, for some apps I paid twice and the licences from Playstore are gone, since I've cancelled my Google account, but it's worth it. Some developers may transfer your subscriptions from Playstore to another licensing model, if you friendly ask them.

MikeAustin

I have a further question relating to Google Play Store sign-in. I have another device running bog standard Android 13 that uses my login to Google Play Store. It uses mostly the same apps. Were I now to sign in to Google Play Store on my GrapheneOS phone, would privacy and/or security be compromised because of the other device?

Cellobright

MikeAustin No, GrapheneOS sandboxes Google Play Services and Google Play Store through an untrusted app SELinux profile, and many unwanted and/or insecure features (such as remote app downloading where you log in to your Google account somewhere else and elect to download an app to your GrapheneOS device, Google pushing its own apps that would alter device and OS functionality and more) are disabled or confined by default. For example:

All first-time app installations require a confirmation. This does not apply to updates, where because Android utilizes certificate pinning where every app update file is checked to ensure that the app is signed by the developer with apksigner (developer.android.com documents this) and we can trust the developer (otherwise we would not use that developer's app), it does not require confirmation. Works best against Google pushing their own invasive system modification apps and the remote installation feature.
Google Play Store and Google Play Services do not have immunity and all app permissions granted and only have rudimentary ones: "Network" and "Sensors" which can be added on demand, meaning contact sync is off by default and Google does not have special permissions to unilaterally extract all phone configuration, change it, track what are you doing, nor enforce the 1-day confirmation required to "sideload" (install) an APK file.
Both cannot draw over your screen without consent, and the OS will prompt "Google Play Services wants to show you a notification" or similar worded notification to see what it intended to display like "No location access" when you turn off Location.

And many others. Not a risk, but can be annoyance whenever Google Play Store decides to push an app you did not want or pressed install on your GrapheneOS phone and show "User confirmation required."

MikeAustin

Cellobright Thanks. I was aware that the sandboxed apps provided privacy/security. I therefore presume that my Android device will pick up nothing about my GrapheneOS phone via my shared Google Play ID. That is, my Google Play ID on GrapheneOS is 'contained' in a similar way to sandboxing.

de0u

MikeAustin I don't think so! In particular, if on the one device you purchase an app I'm pretty sure it will show up as paid on the other. "Sandboxed Google Play" means that on GrapheneOS Play runs in the regular app sandbox, and doesn't have the ability to do things like wipe your device. It does not mean that Google Play has been transformed into something that stops information shared with Play from flowing to and from the mother ship.