What exactly am I giving up using Google Play Services in a sandbox?

shibshibaba

Hello, hello. After years of custom roms, then changing to iPhone in order to share less data with Google and hating everything about it I was so happy to find GrapheneOS, which seems to suit my usecase very well! Thanks to everyone, especially to the people coding, but also to everyone in the community for keeping it alive! <3

Now, the thing is: My plan is to use Google Play Services (GPS), as I most likely will use apps not working without it and I understand it is necessary for push notifications as well? However, reading upon it, watching Youtube-Videos and so on, I am still not sure if I understood correctly, what data exactly Google would get from me with GPS enabled? Is there any type of overview? I was hoping for a table/explanation, but I don't think that exists. So its hard for me to asses whether using GrapheneOS with GPS even makes sense or it just makes me feel good while still letting down my pants for google... What i was hoping for, would have looked something like this:

Scenario "Comfort" (GPS enabled, unrestricted internet access but no sensor data)

Protection from Google receiving: unrestricted access to everything on the phone (incl. phone calls, sms, sensor data, ...?)
Google still receives:
- Generally: still my location? Phone Number? My (possibly anonymous) Google Account?
- Depending on the Apps using GPS: Encrypted(?) Metadata?, possibly identifiable information/pseudonyms etc.?,
- Wheny buying something on the App Store: my payment information?

Thank you so much for any information on this. Hope the question is not to broad / unanswerable - if you need more information, let me know!

Phead

If you want to make sure Google does not get any kind of data from you avoid Google stuff (play store, other services, web search).

But first, I recommend to take a step back and think about your goals. I assume you want to improve your overall privacy and security and have no specific threat model in mind. If that sounds about right, you could start by using only webservices instead of apps. Develop a new mindset and question your own decisions - do you really need app A or B? GrapheneOS gives you the option to avoid as much google as you are convenient with but in the end your privacy depends on your choices. If you choose to use Google Maps then sure, Google will get your GPS data. If you buy stuff on the play store then you Google will get your data, too. There are many alternatives out there so, again, it depends on your decisions and goals. It is certainly a wise decision to minimize the amount data google (and others) can collect about you but I think it's a little too one-dimensional to put google on the throne of evil. So, if you like using Google maps and your threat model allows for it, go ahead an use it in a dedicated user Profile isolated from your other apps. Even if Google gets your gps data, it's only available to them when you log into that Profile and open the app.

In the end the best way to protect you privacy from Google (and many other threats) is to question your own behavior and minimize the attack surface. Install apps because you need them - not because it's convenient. Use alternatives to google if you can live with some minor downsides, if any. Isolate privacy intrusive apps in dedicated profiles. GOS gives you great control over what apps can and cannot do to your device so make use of it - deny access when not in use or not needed.

shibshibaba

Hejhej! Thank you very much for your reply!

I assume you want to improve your overall privacy and security and have no specific threat model in mind.

That is absolutely right :) I'm trying to find a good level between data minimalism & privacy on the one hand and comfort on the other. I don't see Google as the sole evil, but am skeptical about one singular entity having too much information. My focus on Google in the question, however, is based on "ungoogling" android (next to the added security) being my main driver for looking into GrapheneOS in the first place. Hence if I undo most of that advantage by using Apps relying on Google Play Services, I'm not sure if maybe I should just stay with Apple or Stock Anrdoid.

minimize the attack surface. Install apps because you need them - not because it's convenient

I'm trying to install apps consciously and will try (again) not to install Google Maps at all, but from what I read the chances are high one of my apps (bikesharing/banking/proton mail) will need at least GPS. And for me and my needs I think installing the Play Store might make sense too.

However, as I said, its hard for me to evaluate that, since I still don't really understand, what data I "volunteer" by using GPS and the Google Play store. It might be way less than I think.

Using for example the push services, I imagine a lot of data being available to Google. Just to pick one example: For Proton Mail maybe my Account info, some metadata on emails I receive notifications for? For the play store I imagine Google being informed about all the apps I have installed, maybe again, including account information, cross-app-ids, usage behaviour for the apps installed by it? But maybe its way less data? I just have found a statement in another recent post that the google services "can't gather any more than any other app, so things like sim country code, list of installed apps, device model."
https://discuss.grapheneos.org/d/8984-do-i-have-a-sound-plan-for-a-new-grapheneos-install/6

If thats all, I would not think about installing GrapheneOS with enabled Google Services at all (for my use case) :)

Phead

Well, proton mail for example is available as APK from their download page - no play store required. In fact, many FOSS apps are available as APK downloads from GitHub. You could also use Aurora which enables you to use the play store without login. I am not familiar with it, though.

But again, using alternative play stores adds another party you have to choose to trust in order to use their services - your decision. At least, when using the play store, you can be quite sure about what you download.

While I understand and admire the general goals of ungoogling ones lifes, I also believe it's important to understand what your actuals goals are. When you surf the internet without VPN you leave trails - your IP, MAC address, fingerprinting, and other techniques. Your phone setup becomes less important when you use the same IP (in terms of volunteering data).

GrapheneOS sandboxes apps and gives you control over what apps are allowed to do. You can disable network to all google apps and basically block them from "calling home". It's impossible on stock android. I do not know what data becomes available when using push services, but I faintly remember a discussion which concluded that no actual data is available. As far as I remember it's more like a ping - look, something's going on in app A. But there are way more qualified people here to answer that part of your question.

You are of course right - when you use the play store google is informed about what apps you use. You can circumvent that by using APKs, other app stores or do not install apps which is usually less convenient. It Android gives you the option to use user profiles. So you can split your apps up into different profiles and isolate them from each other if you are concerned.

Another advice is to read the GOS website carefully. Most of the rhings it does (and does not) is explained there.

As a last thought, GrapheneOS is based on Android which is developed by google. While drastically reducing your apps to the ones you really need is a good approach to reduce the amount of data that can be collected about you, it's not a bad thing to use Google Services if you have to. Your privacy improves by taking many small steps, not just by staying away from google apps. In fact the iPhone is pretty communicative and talks to its mother ship way more frequently than you would expect - and you have far less controll over it.

shibshibaba

Thank you so much for your reply, that helps a lot :) Re Proton Mail: I read somewhere that it relies on GSF, but might be wrong/not up to date. I did read through the available information but it is still a little opaque to me. But yeah - I'll just give it a try and maybe get a better understanding of whats going on along the way! However, if that is even possible, a table of some sort or some more specific information about what installing google play services means, might be helpful for other newbies like me. At the moment the FAQ only talks briefly and abstractly about that point:

Sandboxed Google Play
(...) It also isn't used as a backend for the OS services as it would be elsewhere since GrapheneOS doesn't use Google Play even when it's installed. (...) As with any other app, it can't access data of other apps and requires explicit user consent to gain access to profile data or the standard permissions. Apps within the same profile can communicate with mutual consent and it's no different for sandboxed Google Play.

p338k

Proton Mail and Calendar do indeed use GSF for notifications.

shibshibaba

Case in point: a lot of recent posts circle around the same topic (How do I use Google Services & Play Store on Graphene OS and how does that affect my privacy?), eg. https://discuss.grapheneos.org/d/8998-how-is-grapheneos-more-secure-than-calyxos/11

Phead

shibshibaba

The point I was trying to make is the following: once you decide to use the play store, you will give some data to google. It's far less than on stock Android due to sandboxing and no privilege escalation just like any other app but of course Google will collect data about you. Obviously that's understandable because you download stuff from their servers, use their services and so on. If you do not want that, don't use it. At all.

Again, it's important to clearly focus on what you want to achieve. If you want to avoid google altogether, you're going to have a hard time since many, many, many websites use stuff coming from google. You can block most of it but at some point websites just break. You can use VPN and ad-blocking on DNS level which allows you to block certain domains some apps are trying to connect to. By using GrapheneOS' storage scopes and strict permissions plus user profiles you thusly minimize the amount of data apps can collect about you while having a convenient smartphone experience. But if you want to reduce it to the absolut minimum possible, don't use any Google at all.