GrapheneOS actually recommends against using Aurora and instead just using the Play Store, so this shouldn't really hurt users.<p>For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.
Although the nice thing about Aurora Store is it allows you to install apps without a google account linked to your device, keeping Google Play Services signed-out.<p>Somewhere in the FAQ GOS advertises that Play Services can be used without signing in, but they also recommend the official Play Store (which requires signing in) and explicitly don't recommend Aurora (which doesn't).<p>Unless I'm missing something, I don't see how you can functionally use Play Services signed-out when in order to obtain those apps in the first place, you need to sign into a Google Account for Google Play.<p>That's personally what I used Aurora for, plus as an easy way to export APK files.
> Google Account that isn't tied to anything else.<p>At the risk of being a privacy absolutist / fatalist: Google’s entire business model is surveillance. They follow you around and track your habits so you can be influenced. Given that, a Google account is always tied to something else.
I'm under no illusion that google doesn't know I own my multiple accounts. They most certainly do. I usually use the same user agent (with containers) on the same IP, after all.<p>But my goal is to avoid a stranger gaining access to my google services if they manage to unlock a lost device or steal my TV/streaming box that has no lock at all.<p>I wish Google supported a permission system per device. For example on most of my android devices all I really want is to be logged into Youtube and the play store. I most certainly do not want those devices to have access to my contacts, emails, calendar, keep, drive, payment, etc. (I don't personally use all of those things, but you might and that's what a random thief would gain access to.)
Piggybacking on this... I create my fair share of "burner accounts" and almost always they (not just Google) connect it to my true identity. Granted I'm not using VPNs or really trying to hide the connection but it seems trivial for them to associate.
They have required unique phone numbers for accounts I've tried lately, or parent's phone numbers. Facebook is worse though, they are quick to ban an account/phone number.
My experience has been that all the consumer privacy/security tools are varying degrees of “good” at keeping away bad actors, trackers, advertisers, and most third parties, but when it comes to the big dogs, there’s nothing you can really do to stop them. Google, Facebook, etc. just have too many data points already available to them so they can easily build a picture of you. There are simply too many services that have them running around in the background or just straight up depend on them.<p>All you can do is leave their ecosystem as much as you can and accept you will never be fully rid of them
Google's business model is providing you services that are excellent, while also providing advertisers access to your willing eyeballs when you use those services.<p>Yes, the advertising targeting is incredibly invasive, but let's not pretend they aren't providing world class Search, Email, Docs, Maps, Video (YT), etc in exchange.
GrapheneOS (the project) might recommend for or against certain things in relation to their specific objectives, but that doesn't mean all GrapheneOS users have the same objectives or need to comply with the opinions of GrapheneOS.<p>For instance, I use GrapheneOS because it provides better security and privacy out of the box than LineageOS, but I'm also not so paranoid that I'm going to just blindly listen to advice against using F-Droid. What I want out of my Android instance is good security defaults with no bloatware, not to stop the NSA from looking at my travel photos and what HN articles I once looked at. It's okay if my OS is great but not perfect.<p>So yes, I am a GrapheneOS user who is [modestly] hurt by this. Signing in with a dummy account is just another one of those things that will end up being futile in years to come when Google requires iris scans, DNA samples, and anal probes in order to get a new account. Personally, I'd prefer installing whatever software I want on whatever devices I [pretend like] I own, without telemetry or jumping through hoops.
Yes, F-Droid and its apps are great <3 They add so much security by simply not having a lot of tracking code that can be exploited and tries to hook all over your system. And they have reproducible builds which is something the commercial stores don't even bother with. This is really important for security. I don't understand that GrapheneOS advises against them.<p>And yeah the iris scans sound like a scare but only 2 years ago there was a constant line of zombies here in the shopping mall giving their eye scans to altman.<p>The masses really don't care about privacy if you give them a worthless trinket.
I've honestly never understood why F-Droid even still exists. Every time I've tried to use it (as recently as half a year ago) it's still a shitshow and never displays or updates apps correctly. Half the time an app showed up on the website that didn't show up on the phone app. The other half of the time even when I did get something installed, it would just never understand that an update existed and needed to download and update a given app. It's one of the worst pieces of software I've used in a while, and I can tolerate a good bit of jank from FOSS apps.
> never displays or updates apps correctly. Half the time an app showed up on the website that didn't show up on the phone app. The other half of the time even when I did get something installed, it would just never understand that an update existed and needed to download and update a given app<p>You probably "just" need to pull down while on the "Latest" or "Updates" tab, to update your repository (it will show a small banner at the top while it's doing that). It's incremental, so it may take a while if it has been some time since you last did it (and auto-updates are disabled).<p>The way F-Droid works is that it downloads the whole index and then the catalog, version checks, etc, all runs locally, quite similarly to some package repositories actually.<p>I am not claiming its intuitive, but I think that part works fine once you understand how it works.
The last time it wouldn't update an app, I could see in the app store and on the website that my app had a new version, but no matter what I did, I could not make it update the app. I don't know what I was doing "wrong", but I think if I couldn't figure it out or make it happen, there's something very wrong with either the app or how it's "supposed" to work. Neither of which is an acceptable user experience for me.
Have you tried Neo Store for accessing F-Droid and other repositories? In particular, I use the IzzyOnDroid F-Droid and Guardian Project repos.
I have not, but honestly, at this point, I just don't really care anymore. I can only try and be rebuffed by a product so many times.
> Every time I've tried to use it (as recently as half a year ago) it's still a shitshow and never displays or updates apps correctly. Half the time an app showed up on the website that didn't show up on the phone app.<p>Sounds like an accurate recreation of the Play Store experience to me.
This is not me simping for Google, I would honestly prefer literally anyone else with an acceptable app store experience, but I can honestly say I've never had that experience with the Play Store. If there's an update, it updates. If there's an app, it appears in search. On the rare occasion an app doesn't appear and I go to the Play Store website looking for it, the reason the app didn't show up is because it's listed as incompatible with my device (usually Android version too low or too high).
> a Google Account that isn't tied to anything else.<p>Isn't that pretty much impossible? You need a phone number for verification, which effectively ties it to that phone number.
> > a Google Account that isn't tied to anything else.<p>> Isn't that pretty much impossible? You need a phone number for verification, which effectively ties it to that phone number.<p>I just want to follow-up on this because some people claim this is not correct because they have managed to create accounts without phone numbers.<p>Indeed, I think to this day, under special circumstances (like e.g. on reasonably recent Android devices) you might be able to setup a Google account without phone number.<p>The trick is, that in the general case, you can not keep this account online indefinitely.<p>I once worked out a trick to get it going and I was feeling safe because I had setup 2FA and backup codes (see <a href="https://masysma.net/37/google_how_to_create_an_account_without_telephone_number.xhtml" rel="nofollow">https://masysma.net/37/google_how_to_create_an_account_witho...</a>).<p>First thing to note: This way of account creation does not seem to work anymore.<p>Second thing to note: After <i>once</i> logging in from a different country, trying to login again REQUIRES me to provide a phone number after successfully giving username/password/2FA code. No way to use the recovery code instead...<p>Also, given that this account was never before connected to a phone of any kind, by definition, the addition of a phone number cannot provide additional security confirmation (it's data that simply wasn't present before and any "personal" phone number could potentially do -- of course I haven't tried, because that's the point of not linking a phone number).<p>I think this way it is finally proven that they only do this to harvest the data/phone numbers and any claim of enhanced security is void.<p>I write this after having lost the second account to the phone number required screen despite being in possession of all the credentials which were ever assigned to that account...
You can create an account with no phone number during Android device setup.<p>You can also just get a burner phone number for a few bucks.
> You can also just get a burner phone number for a few bucks.<p>But you have to keep paying the monthly cost, if you loose access to a phone number in your Google account it's game over for any account recovery or "let's verify it's you" it might decide to throw your way.
Accounts created on stock Pixels don’t require phone numbers.
Sometimes you just can't.<p>For example, the banking app I have refuses to be installed from the Play Store on GrapheneOS due to "not-certified" device, but works perfectly fine when installed by Aurora.<p>The check seems to be purely store-based and never enforced later.
This is exactly why I switched to Aurora. I couldn't even install Balatro from the Play Store.
I have similar problems installing region locked apps as someone who's fairly frequently in different regions.
Do you trust the banking app installed from Aurora enough to do your online banking?
I don't, and I really wish there would be a decent way to verify that the installed/provided apps are legit. For me this is the biggest downside of using GrapheneOS, which I'm otherwise extremely happy with.<p>(for me, the whole point of using GrapheneOS is privacy and not sending data to Google, so using the PlayStore is not an option)
It seems wise to have at least one alternative mobile phone app store. Even if it isn't very good. If the government can tell Google to do trivial things like, for example, change the name of bodies (plural now) of water, it can turn off your app updates, trapping you on insecure versions indefinitely. This probably matters more if you live outside of the US, but if I had a plan B for an app store on my phone, I would certainly at least evaluate it.
The government didnt ask google, they changed the name on the Geographic Names Information System (GNIS), which is the official legal mapping source which other companies like Google etc use. Hence the change filtered down through software from the top official channel.
Right, the government pulled a lever, and google complied within days. If the FTC declares app stores can't provide security updates without government license, that is another lever they can pull, and google will comply.<p>Wether or not the most recent example is the best example, doesn't matter. What matters is when the government says "jump" in legalese, google's lawyers say "how high?"
Name changes happen all the time and I would expect Google to match what the government sources use locally. The fact that the government is capricious is no reason for me to desire Google to become an alternative naming center.
GrapheneOS is focused on absolute security. For those of us on more privacy-oriented ROMs with MicroG, we're very happy with Aurora.
The main reason for me to use GrapheneOS would be to sever the umbilical cord to google.<p>I don't really see the point of using GrapheneOS instead of Stock Android if I then have to use the play store.
Better security, for once. You get (security) updates <i>a lot</i> faster with GrapheneOS.<p>Also on GrapheneOS, Play Services and Play Store come unprivileged, sandboxed like any other app. So Google is not an admin on your phone, which I would argue is one step towards "severing the umbilical cord".<p>Moreover, GrapheneOS doesn't have any issue with apps sideloading.<p>And more. There are many reasons to use GrapheneOS.
Having to have a account is absolutely a downgrade and privacy-hostile.
A Google account is a personal identifier, it is linked to your person. Therefor trying to untie it from anything else is futile.<p>Google states: Using a false name or incorrect information when creating a Google account is against Google's Terms of Service.
<i>...with a Google Account that isn't tied to anything else</i><p>That isn't completely possible these days. Last I checked they want an existing email address and/or a cellphone number for verification. I guess "not tied to anything else" is proportional to how much you trust them to delete either of these bits of info after they are used, and not associate them with other accounts you might have used them with in the past/future.
Doesn’t Google make it very hard to create an account tied to nothing (no phone or alt email)?
If you create it on a stock Pixel device the phone requirement gets dropped.
It's the SomethingAwful model: go to the store and find the cheapest Android phone from some prepaid company for :tenbux: then use it to set up your Google account during out-of-box-setup while on the store's free public WiFi (since Google OOBE allows free account creation without a number or existing email), then toss the phone in a drawer afterwards.<p>"Hope ya got ten bucks!"<p>(I got a random 5G Moto phone for ~$10 on clearance and it was an absolute shitter of a phone full of garbage packed in malware, but after cleaning and debloating as much as I can, it's at least a nifty toy to poke at Termux or something.)
> you can sign into the Play Store with a Google Account that isn't tied to anything else.<p>The problem with this is that increasingly Google is insisting on having a phone number to create a Google account. Further, they are aggressively deleting old accounts that appear to be dormant.<p>The good old days of creating a Google account with just an email seem to be swiftly becoming a thing of the past.
I recently had to set up a new Android device for work. Since I keep all my personal accounts separate from my work accounts, I needed to create a new Google account on that phone. I ended up paying $8 for a month of the cheapest service I could find just to get a phone number so I could create that account.
Yes but Aurora isn't only for GrapheneOS.<p>I use it on a phone with (unfortunately) regular google play services. If I sign into the play store, that same account will be used for all other google services on the phone too. I'm not going to do that. I just don't want a google account (nor an apple one for that matter)
>For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else.<p>Like my personal phone?)<p>Installing Google Play service is in itself a privacy downgrade.
> GrapheneOS actually recommends against using Aurora and instead just using the Play Store, so this shouldn't really hurt users.<p>Interesting, I never tried Aurora on Graphene. For me the combination of Play Store and F-Droid worked really well so far.
GrapheneOS is defending against different things I guess. My personal threat model is protecting myself from the tentacles of these behemoth tech companies. To that end, GrapheneOS approach of "just install google play" is not good enough for me. I fail to see the privacy advantages compared to e.g. MicroG".
i don't even have google play serices installed, let alone the play store...
It DOES still hurt.<p>For example the eBay app. Does not allow installing from the play store on grapheneos.
There are apps I cannot install via the Play Store in GrapheneOS, only via Aurora store.
"For extra privacy, you can sign into the Play Store with a Google Account that isn't tied to anything else."<p>lol. lamo, even.