Any actual reason why I shouldn't install sandboxed Google Play Services?

bayerelm

I'm about to buy a Pixel and flash GOS on it. I've been reading quite a lot on the official website and on this forum, and I'm still unsure what to do regarding sandboxed google play services. I'm really on the fence, because the only app that would benefit from GPS in my main profile is ProtonMail (for push notifications). I kinda don't want to install GPS, but I also kinda want notifications to work for ProtonMail.

The thing is, I don't really understand what I would actually be sacrificing by installing sandboxed GPS. Privacy-wise, are there any actual reasons why I shouldn't install sandboxed GPS in the owner profile? I'm pretty use I would barely use the Play Store (maybe even not at all) as most of the apps I want in the owner profile are open source and I'd rather install them via an RSS reader, and even if I do use the Play Store, I would create a burner Google account. No other Google apps would be on this profile and in general, I don't think I'd have any apps wanting to communicate to Google on the profile either.

I keep seeing people recommending to avoid installing Google Play Services if one can, but what is the actual "risk" of doing so in this situation? What could Google realistically gather on me and what's happening in the profile?

Sorry if this looks a bit like a rant, truth is I'm a bit lost lol. Thanks a lot in advance to anyone helping me understand this whole GPS situation better.

[deleted]

bayerelm What could Google realistically gather on me

Well, this is the thing, that you don't know what actually gets collected. In that case wouldn't it be better if nothing gets collected, rather than "God knows what"?

dregrinfuces

bayerelm I don't know specifics. But according to:

[https://grapheneos.org/features#sandboxed-google-play](https://)

it looks like Google Play and its apps get nothing other than what you specifically allow them to get:

GrapheneOS has a compatibility layer providing the option to install and use the official releases of Google Play in the standard app sandbox. Google Play receives absolutely no special access or privileges on GrapheneOS as opposed to bypassing the app sandbox and receiving a massive amount of highly privileged access. Instead, the compatibility layer teaches it how to work within the full app sandbox. It also isn't used as a backend for the OS services as it would be elsewhere since GrapheneOS doesn't use Google Play even when it's installed.

Since the Google Play apps are simply regular apps on GrapheneOS, you install them within a specific user or work profile and they're only available within that profile. Only apps within the same profile can use it and they need to explicitly choose to use it. It works the same way as any other app and has no special capabilities. As with any other app, it can't access data of other apps and requires explicit user consent to gain access to profile data or the standard permissions. Apps within the same profile can communicate with mutual consent and it's no different for sandboxed Google Play.

Sandboxed Google Play is close to being fully functional and provides near complete compatibility with the app ecosystem depending on Google Play. Only a small subset of privileged functionality which we haven't yet ported to different approaches with our compatibility layer is unavailable. Some functionality is inherently privileged and can't be provided as part of the compatibility layer.

The vast majority of Play services functionality works perfectly including dynamically downloaded / updated modules (dynamite modules) and functionality provided by modular app components such as Google Play Games. By default, location requests are rerouted to a reimplementation of the Play geolocation service provided by GrapheneOS. You can disable rerouting and use the standard Play services geolocation service instead if you want the Google network location service and related features.

Our compatibility layer includes full support for the Play Store. Play Store services are fully available including in-app purchases, Play Asset Delivery, Play Feature Delivery and app / content license checks. It can install, update and uninstall apps with the standard approach requiring that the user authorizes it as an app source and consents to each action. It will use the standard Android 12+ unattended update feature to do automatic updates for apps where it was the last installer.

See the usage guide section on sandboxed Google Play for instructions.

csis01

bayerelm the only app that would benefit from GPS in my main profile is ProtonMail (for push notifications)

Find a better email service that uses standard protocols (IMAP), and use an email client that supports pushing messages over IMAP (fairemail [preferred], k9mail, etc.)

bayerelm

[deleted] Sure, that's also my train of thought. But if I do install Google Play Services in order to get notifications, I'd rather not be all paranoid about what it entails, hence this post.

dregrinfuces it looks like Google Play and its apps get nothing other than what you specifically allow them to get

That's also how I understand it, except for mutual consent communication between Google apps and other apps. If I understand that correctly, it would mean that if a given app wants to communicate to any of the three Google Play Service apps, it will be able to. The content of that communication is blurry to me; is there any way to know what they can exchange?

Also, I'm tempted to download Gcam on my owner profile (I'll have to test the GOS stock camera first to know if it's enough for me or not) but again, I'm weary of what this might mean privacy-wise. I know I can revoke network permissions from Gcam, but it will definitely communicate to Google Play Service via mutual consent, and the bundled GPS apps will have network permissions.
Again, I'm not sure I understand what Google can gather through these indirect routes.

KeithLaster

I, too, was a bit confused when I started researching this topic. On the one hand, I don't want to install Google Play services and allow Google to collect data about my activities. On the other hand, there are a few apps that I really want to use and they require Google Play services. So I was also wondering, what do I really lose by installing an isolated Google Play? From a privacy standpoint, I think our main concern is that Google will collect data about our actions and app usage. However, if you only use isolated Google Play to install the apps you need, the risk of losing sensitive information is reduced. On the other hand, I can't say exactly what data Google might collect about a profile owner using isolated Google Play. My guess is that they would have access to information about what apps are installed and what updates have occurred, but I'm not sure they would have access to other sensitive information. Bottom line, I think that using an isolated Google Play will depend on what apps you want to use and how you intend to use your profile. If you plan on using Google Burner and installing apps through an RSS reader, you may be able to get by without Google Play Isolated.

bayerelm

KeithLaster Google couldn't have any access to apps that weren't installed via the play store though, right? Of course Google would know what I downloaded on the Play Store, but I expect that they wouldn't know anything about the other apps installed via rss. Maybe I'm wrong though?

KeithLaster If you plan on using Google Burner and installing apps through an RSS reader, you may be able to get by without Google Play Isolated.

I would still need sandboxed Google play services installed for notifications to work (for ProtonMail and Proton Calendar, I'm pretty sure these two are the only ones that require sandboxed Google services among the apps I'd install on the owner profile). If I'm right about my plan, I'm also even pretty sure that I would not even need to log in to any Google account anywhere. Hence why I'm making this post, I feel like there is no way Google could gather anything sensitive about me this way, but again, I'm not sure I understand the ins and outs here.

Graphene1 The mutual consent sounds to me like any google code within other apps can communicate with other google apps i.e. Play Services (which will have internet access for notifications)

That's also how I understand it. If that's the case, I don't think the potential harm is too high in my case, I'm 90% sure the apps I'd install on the owner profile wouldn't have anything in them that wants to communicate with Google.

Graphene1 Or we are just extremely paranoid and by simply not logging into a google account is enough lol.

At the end of the day, I feel like that's the bottom line to this issue really. I honestly don't see what Google could collect on me with sandboxed GPS if I'm not logged in, or logged in a throwaway account.

Graphene1 I don't have google play installed snd just check proton once a day.

I might try that first and see how much of an inconvenience I find this. Again, I'm pretty sure that's literally the only thing I'd need Google play services for.

Thanks everyone who participated here so far, it's really helping. I hope that the discussion can go on, hopefully somebody out there understands the issue better and can shed some light for all of us. :)

Graphene1

I don't think anyone knows - unless you install everything from F-Droid many apps will contain google code anyway.

The mutual consent sounds to me like any google code within other apps can communicate with other google apps i.e. Play Services (which will have internet access for notifications) I'm speculating here not trying to spread any misinformation. The question is do other apps collect data (even without internet access) then send that info to other apps that have internet access and contain google code to the send to the mother ship.

I think there needs to be clarification on mutual consent communication and what's actually communicated between apps and if possible a block cross app tracking option if that's realistic/ possible (if it's even needed) similar to iOS.

Or we are just extremely paranoid and by simply not logging into a google account is enough lol.

I don't have google play installed snd just check proton once a day. Not a huge deal for me.

Graphene1

Graphene1 to add, maybe preventing cross app communication would break google play dependant notifications deeming installing Google Play pointless for this use case. Again speculation, I don't know what I'm talking about.

de0u

Graphene1 I think there needs to be clarification on mutual consent communication and what's actually communicated between apps and if possible a block cross app tracking option if that's realistic/ possible (if it's even needed) similar to iOS.

https://github.com/GrapheneOS/os-issue-tracker/issues/156

de0u

bayerelm Google couldn't have any access to apps that weren't installed via the play store though, right?

"Have access" is not precise.

Apps don't generally ave access to each other's files (even in the same profile). But apps in a profile (all of them) can communicate via IPC. And I believe they all have access to the same network metadata (e.g., VPN endpoint addresses) and profile UUID. Note that I am not an expert. There are probably other nuances.

dazinism

bayerelm

Google couldn't have any access to apps that weren't installed via the play store though, right?

Play Services likely does some communication with any app that includes various Google libraries for analytics, crash reporting, advertising etc.. Many apps available from sources other than the Play Store contain Google libraries.
https://firebase.google.com/docs/android/android-play-services

Apps with many of these Google libraries and network will just communicate directly with Google if the device doesn't have Play Services. Technically the Google libraries in such apps could also communicate with each other, but Im not sure that they do. The libraries also inherit the permissions of the app they operate within.

There are many companies other than Google that offer software development kits (SDK) to make it easier for app developers to add various functionality (crash reporting, analytics etc.) to their apps. Some of these SDKs are also designed to suck up as much data as possible about the user which is then offered for sale (AFAIK Google dont sell user data, just use it to sell targeted ads)

Can check out the libraries included in your apps using https://github.com/LibChecker/LibChecker

bayerelm

csis01 The number of services I use that rely on PM makes this solution a bit too inconvenient for me tbh...

Toomanyuserprofiles

csis01 regarding protonmail in android: they havnt got the same anti tracker-pixel implementation in the app that IOS and web app have, so there's a privacy benefit to not using protonmail app. Can't say if 3rd party clients like k-9 offer that feature.

[deleted]

dazinism thank you mate, this app is a treasure.

bayerelm

dazinism
But this means that apps with Google libraries will communicate with Google anyways, regardless of whether or not I have sandboxed Google play services installed, right?
In that case, wouldn't it be reasonable to argue that installing google play services doesn't do that much more harm?

[deleted]

bayerelm That only would be the case if all of your apps contained google libraries, but a lot of them don't. That doesn't mean that apps that don't contain them can't be potentially harmful. So at the end of the day you should go only with apps that are well reviewed and documented. By installing sandboxed google you are opening your device to a whole new world of app compatibility that greatly increases potential attack surface. Each such app will only do what you will allow it to do, but if you do allow it, it will most certainly attempt to do it. And through IPC it gets even more complex since disallowing something to an app (such as network) but allowing something else does not stop that app from collecting and passing on snippets of data to other "friendly" apps.

Every now and then I remember the A Good American
https://www.youtube.com/watch?v=666wsDcoNrU
and that it often isn't exactly about what we do but who with and under what circumstances.

dazinism

bayerelm But this means that apps with Google libraries will communicate with Google anyways, regardless of whether or not I have sandboxed Google play services installed, right?

Not if they dont have network, unless they are doing it via another app with Google libraries (technically possible, not sure if this actually happens)

In that case, wouldn't it be reasonable to argue that installing google play services doesn't do that much more harm?

Privacy wise, I think the main issue would be them being able to see the IP address you are connecting from, particularly if you dont run them through a VPN and have given them battery exemption so they can run all the time.

I also think theres wider societal concerns with everyone using Play Store (need to install Store for Services to work properly) for app downloads. If you have Play Store its convenient to use it and it does have good security. It does however gives tremendous power to Google. They get to control what apps can be distributed (generally this tends to be good - they do block a lot of malicious apps) what apps are pushed/promoted to people.

Their move to holding the signing keys of all new apps is a major technical security concern. Im not aware of any cases of them doing so - but it does open up the possibility for them to push malicious builds of apps at targeted individuals via Play Store. Even via Aurora Store, though then they likely wouldnt have quite the same level of information about the person downloading the app.