Signal and Proton Mail - APK vs Google Play Store

Murcielago

I would like to use GOS in the future and am currently thinking about how to set up the different user profiles.

In one profile -due to some apps- GSF,
Google Play services and
Google Play Store have to be installed.

If I want to install Proton Mail and Signal in the same profile (which I get both in the Playstore and as APK) - does it still provide a privacy gain to install them as APK?

And how does this affect battery life? Proton Mail seems to depend on GSF for Push Notification, Signal could work without if I understand correctly.

N1b

Murcielago in the setup you describe (both apps in one profile with Sandboxed Google Play) it wouldn't make a difference for privacy as the APKs are functionally the same if I'm not mistaken. It would only matter for other apps (like IVPN or Simple Gallery Pro) which have different versions based on the source.

So regarding privacy, it would only make a difference if you don't install any app at all from the Play Store, as that would save you from using a Google account.

If you install Signal after installing Sandboxed Play Services, Signal will automatically detect and use them, otherwise it will fall back on it's own system and require you to disable battery optimization. From my testing this has a small effect (around 2% more battery usage over 24h), but other users on this forum report more battery drain so your mileage may wary.

What you could do to increase privacy by changing your setup:

Don't install Play Services and don't have push notifications on Proton Mail (but you could replace Proton Mail with Tutanota if that works for you, as it can do push notifications without Play Services)
Replace Signal with Molly FOSS to not have the Google bits in the code
Install your apps on different profiles to mitigate fingerprinting and mutual app data sharing (not sure if this would have a big effect on your setup though, probably negligible with most Open Source apps)

Last but not least: Security-wise it's generally recommended to install apps from the Play Store and not from other sources. You asked for privacy, but keep security in mind, too.

Murcielago

What I forgot to mention: If it doesn't have too much of a negative impact on battery life, I would generally prefer APKs - if only to motivate manufacturers to continue offering solutions outside of Google's Play Stores and Apple's App Store.

Murcielago

N1b

Hello, thank you very much for your very helpful, quick and precise answer - that really helped me!

Briefly about my rough setup: I want to work with five user profiles:

Admin (empty - only for installing apps).
Main profile
Invasive (for invasive apps: Google Maps, Social Media, etc.),
Banking
Anonymous (Tor etc.)

The reason for profiles 2,3 and 5 is mainly privacy, the one for profile 1+4 is security.

I've juggled all the apps before, switched to PWA in some cases, etc.

Unfortunately, there are still some apps left over in the end (even if I would implement your pull instead of push approach with Proton, there are unfortunately more apps that are only available in the Play Store) that I can't/won't do without in the main profile (2.).

Constantly switching to a different profile for much-used apps would be too exhausting for me for now (I've only recently started to deal with security and privacy - got away from Gmail, started with 2FA and replaced a lot of things with FOSS) I'd rather take it slow to avoid privacy fatigue at some point. Also, I've never had a custom ROM before - whether my theoretical plan works out that way will probably only be seen in a few months - I'll probably change and tweak a lot there.

From Molly FOSS - I hear for the first time - sounds very exciting, I will definitely read up - thanks for the tip!

Thanks also for the security tip - security (coupled with minimalism) was also very important to me - so I would leave Aurora (I prefer a Burner Google profile instead of the Aurora approach), F-Droid out and try to get all apps via Github (+ updates via Obtanium) or the Play Store.

N1b

Murcielago I'd rather take it slow to avoid privacy fatigue at some point.

This is the best approach, take your time and figure stuff out along the way. Maybe using 5 profiles is already over the top at the current stage of your privacy journey, but if it's working for you, even better. Using GOS alone gives you much more security, privacy and control by default. It's enough for my threat model to use only the owner profile (but two devices, one work device with Play Services and one private device without them).

If you want to do some digging regarding app stores on this forum and elsewhere, you can read up Sandboxed Play Store, Droid-Ify or Neo Store, Obsidian and Accrescent. Aurora Store and F-Droid might serve edge-cases too, they all have their benefits and disadvantages (just avoid outdated apps like Aurora Droid or sketchy third party Play Store knockoffs like Aptoide). Don't get overwhelmed, you're very likely far ahead of 99% of smartphone users already and you have plenty time for the last percent.

Murcielago

N1b
Hey N1b, I wanted to give you some feedback on your recommendation:

Now that I've got a feel for the use of different profiles after a few weeks of daily use I have completely degoogled my main profile. Some apps that required Play services I have packed into other profiles, deleted or replaced with Github alternatives.

I also found a workaround for the only app that I couldn't replace and that relies on GSF push notifications: I additionally installed Protonmail in the admin profile (only created for installation and distribution of apps | the profile always runs in the background anyway and cannot be terminated) and activated "send notifications to current user" - this way I immediately receive a message when there is an new email and can then open Protonmail without having to switch profiles.

Thanks again for your advice!