Safely install apps on GrapheneOS?

whew-zee

Hi all,

Very excited to have just gotten my new phone for Christmas, and immediately installed GrapheneOS! I'm really happy with it so far.

Now, I'm going about setting up all my apps. I've noticed some apps (ex. the Discover Banking App) are only available through the Google Play store, as opposed to F-Droid or Aurora. This is frustrating because I'm trying hard to degoogle.

Is it safe to just download and install the APK files for these apps directly? Are APK websites legit? Seems a little shady to me.

Dumdum

whew-zee I've noticed some apps (ex. the Discover Banking App) are only available through the Google Play store, as opposed to F-Droid or Aurora.

I was able to open this "Discover" banking app (this one?) in Aurora. What problem are you having with it?

[deleted]

Aurora is a safe way to install any play store app

protonuser2

Yep go for it on aurora.

Always use aurora for apps where security is the #1 priority (banking apps)

mmmm

protonuser2 maybe you mean privacy, but it’s an extra layer unnecessarily added when you can already quite securely use the play store on gos. I very much doubt the aurora store is a more secure way to obtain apps from the play store than the play store itself. It’s more private perhaps.

treequell

Installing an app from Aurora Store is less secure than installing from Google Play Store. Aurora Store doesn't verify Play Store metadata signatures proving apps were downloaded from the Play Store and only uses standard WebPKI to secure the connections. It's similar to downloading via websites.

protonuser2

mmmm no I don't mean privacy. I meant security is higher on aurora compared to F-Droid.

Any thing from Aurora is generally more secure since coming from play store it going through more google security audits to get on play store, whereas F-droid is a little unsecure.

But you're correct- I meant aurora is more secure when comparing to f droid. I totally left play store out of my train of thought there.

mmmm

protonuser2 in that case then I don’t know. Fdroid clearly has its own issues which need to be determined by your own threat model. Security wise though, I doubt there is anything better than the app stores of Google and Apple. But each come with privacy invasive and gatekeeping issues of their own.

treequell

You can use a throwaway Google account in Google Play Store. Using Aurora Store with their "anonymous" account doesn't provide any additional privacy.

It's worth considering using Obtainium https://github.com/ImranR98/Obtainium to avoid trust in third parties to the extent possible, but it lacks a way to secure initial install. GrapheneOS plans to provide a pinning database.

https://accrescent.app is a new app store which follows better security and other practices but is still very small. Our recommendation is to use Accrescent for the apps it covers. It secures the initial app install but uses developer signed releases.

Source: https://x.com/GrapheneOS/status/1733645808354918497

whew-zee

Thank you all! This was super helpful.