Comment by cf100clunk
15 hours ago
MicroG is possible to run on GrapheneOS but isn't recommended since GOS has a sandboxing solution for running Google Play apps:
15 hours ago
MicroG is possible to run on GrapheneOS but isn't recommended since GOS has a sandboxing solution for running Google Play apps:
Graphene generally seems to feel that running official signed Google adware is more secure than using open source alternatives that might require signature spoofing or having root on your own device.
GrapheneOS's approach is Sandboxed Google Play so the apps don't get special permissions. Without privileged access, Google apps get access to nothing more than what other apps can get access to on Android. So, for example, even if a device has microG installed, an app with a Google library would have virtually the same access as if Sandboxed Google Play was installed. And why would anyone need microG if not to provide compatibility for apps that rely on Play Services, aka apps with Google libraries?
Also, for some reason some people think that microG means deGoogling. That's not at all the case. microG still communicates with Google servers.
microG doesn't meet the project's requirements. If you look at the big picture, microG offers worse app compatibility and is less secure. The cons outweigh the pros by a lot. "Google bad" isn't an argument that works for us. App compatibility is very important.
"Sandboxed" Google Play still gets everything that the other apps in the same profile offer up to it / to Google. I don't understand how you're gaining any privacy as a practical matter. The issue isn't GApps' privileged access to the system, it's that other apps send your data to Google via Google Play Services.
To take some examples, MicroG stubs out the analytics and ads APIs. Your "sandboxed" Play would send that data to the mothership and return with ads.
https://github.com/microg/GmsCore/wiki/Implementation-Status
https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...
8 replies →
MicroG is a good compromise between deGoogling and having things work. GrapheneOS is not.
At the end of the day, I need a functional smartphone that can run the apps needed for daily life. MicroG offers that while reducing my exposure to Google.
6 replies →
microG still heavily uses closed source Google services and even downloads executables run with the full privileges of microG. It downloads and runs droidguard with the privileges it has, giving that full access to the privileged access granted to microG.
Each app using Google Play still has the closed source Google Play SDK and libraries built into it in practice. It's extraordinarily rare to replace those libraries with the incomplete and buggy reimplementations from microG. Very close to zero otherwise open source apps are using those. The closed source Google Play SDK and libraries are therefore still part of the loop and have access to what the app can access. Many of the code paths in the Google libraries directly use Google services without requiring Play services including the full versions of the Ads and Analytics libraries.
The vast majority of data obtained by Play services is via the OS integration and permissions. Apps using it for push messaging, logging into accounts and many other features will send the same data to Google services regardless of whether you use it via sandboxed Google Play or microG.
GrapheneOS stubs out and reimplements APIs on the client side. That includes providing a complete implementation of the Google Play services location API not using on Google Play. These features are being expanded over time. They'll also be made available without having Google Play.
The GrapheneOS approach avoids giving an additional global service access to sensitive data from the OS and apps. microG has repeatedly had vulnerabilities leaking sensitive data to apps including location data. The approach of having an extra service sitting between apps and the OS which handles sensitive data means having to add all the same privacy and security checks as Play services which microG doesn't do in practice and it has caused severe privacy leaks. The main location leakage was eventually fixed but it persisted for years and there are still holes in the location service causing privacy issues.
Unlike microG, sandboxed Google Play doesn't get privileged access. That includes the executables (droidguard) downloaded by microG not getting privileged access. GrapheneOS also doesn't give privileged access to other apps such as Android Auto when those are installed as all the main operating systems using microG are doing. That privileged access gives access to highly sensitive data and doesn't require apps explicitly sending data to Google services, which will nearly all still go to Google services with a partial replacement of the middleware on the device.
Running google code sandboxed is far more secure than running google code with privileged access. MicroG downloads and runs google code in a privileged context and has had many privacy and security issues like leaking location to apps that dont have the location permission.
> MicroG downloads and runs google code in a privileged context
> many privacy and security issues
> leaking location to apps that dont have the location permission.
Could you share some details on these three points?
11 replies →
Okay, so lemme break this down real simple
(Correction from prior statement)
GmsCompat is a layer that runs the official google play services and store in the app sandbox which also strips it of all privileges and teaches it to function with only the bare minimum.
The app itself is sandboxed
But it is taught to run without the app panicking
The app sandbox is an OS feature: https://source.android.com/docs/security/app-sandbox.
de-Googleling is unfortunately not a priority for GrapheneOS.
GrapheneOS doesn't include Google Play (Services) on fresh install, user's explicitly can opt-in. It seems to be the only AOSP based OS that doesn't make any connections to Google by default [1], and is therefore the only true de-googled AOSP OS.
1: https://eylenburg.github.io/android_comparison.htm
It's not a priority but GrapheneOS does better at deGoogling than other OSes, including adding features to the OS so people have fewer reasons to install Sandboxed Google Play. One big example is Network Location, so now users don't have to grant Google Play Services location permissions.
Sandboxed Google Play is never preinstalled, so people who wish to deGoogle can do so. And I'm sure GrapheneOS users who don't want to use Google devices will be happy to get a supported Motorola in the future.
Right. They prefer to spend their time and energy proactively reacting to and debating every comment that mentions GrapheneOS on socials instead of focusing on real issues.
1 reply →
GrapheneOS is incredibly focused on security. Privacy is clearly a second thought to them.
GrapheneOS is a privacy project and heavily improves it with important privacy protections including Contact Scopes, Storage Scopes, secure paste and much more. It preserves all of the standard privacy and security of AOSP while greatly improving upon both.
GrapheneOS doesn't connect to Google servers by default and avoids integrating any privileged access for either Google apps or partial replacements for those. The main operating systems integrating microG included always granted privileged access for microG, Google Play executables downloaded by microG (droidguard) which run with the privileged access it's granted and other Google apps including Android Auto.
The operating systems you believe are privacy projects greatly reduce both privacy and security compared to AOSP through not keeping up with standard patches, not providing important standard privacy/security protections and adding problematic services.
Lagging behind the already inadequate standard privacy/security updates by months and even years isn't compatible with providing reasonable protection for user privacy. Only a subset of the issues Google classifies as High or Critical severity are backported to the older releases of Android those are usually based on. Taking many months to move to newer releases is much more problematic than it appears. The backports to those older releases also get applied with a substantial delay. Firmware and drivers are usually not kept properly updated even when those are regularly released such as for Pixels. Many standard privacy and security protections are missing or disabled. An assorted of third party services are added too.
That's very false. GrapheneOS is primarily a privacy OS that also focuses on security to provide strong privacy.
Sandboxed Google Play has no privileged permissions, which means that those apps have the same permissions as any other apps you can install on Android, meaning the same restrictions.
All that plus the fact that Sandboxed Google Play is a better approach because it offers better app compatibility and is more secure. microG doesn't meet the project's standards.
4 replies →
GrapheneOS is and always has been a privacy first project.
4 replies →