Comment by ForHackernews
16 hours ago
Graphene generally seems to feel that running official signed Google adware is more secure than using open source alternatives that might require signature spoofing or having root on your own device.
16 hours ago
Graphene generally seems to feel that running official signed Google adware is more secure than using open source alternatives that might require signature spoofing or having root on your own device.
GrapheneOS's approach is Sandboxed Google Play so the apps don't get special permissions. Without privileged access, Google apps get access to nothing more than what other apps can get access to on Android. So, for example, even if a device has microG installed, an app with a Google library would have virtually the same access as if Sandboxed Google Play was installed. And why would anyone need microG if not to provide compatibility for apps that rely on Play Services, aka apps with Google libraries?
Also, for some reason some people think that microG means deGoogling. That's not at all the case. microG still communicates with Google servers.
microG doesn't meet the project's requirements. If you look at the big picture, microG offers worse app compatibility and is less secure. The cons outweigh the pros by a lot. "Google bad" isn't an argument that works for us. App compatibility is very important.
"Sandboxed" Google Play still gets everything that the other apps in the same profile offer up to it / to Google. I don't understand how you're gaining any privacy as a practical matter. The issue isn't GApps' privileged access to the system, it's that other apps send your data to Google via Google Play Services.
To take some examples, MicroG stubs out the analytics and ads APIs. Your "sandboxed" Play would send that data to the mothership and return with ads.
https://github.com/microg/GmsCore/wiki/Implementation-Status
https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...
> I don't understand how you're gaining any privacy as a practical matter.
Exactly.
Being too focused on "Google bad" means you're not seeing the bigger picture. microG is only a thing to provide app compatibility for apps that rely on Google Play Services. Which apps do you think do that? Apps with Google libraries that often have fallback implementations and can operate without Google Play Services.
So, given those facts, if someone has microG installed, Google still effectively has the same access as a device with Sandboxed Google Play, except microG users are stuck with worse app compatibility and because of signature spoofing it's less secure and code runs in that privileged context.
GrapheneOS focuses on privacy, security, and app compatibility. microG fails at security and app compatibility. Also, there are apparently leaks (that I admit I don't know the details of) regarding location that make it worse for privacy too. There could be more leaks that I don't know about.
The apps that use Google analytics/ads don't need Google Services on the device. The libraries are embedded into the app, and have just as much fingerprinting capabilities as sandboxes Google services.
microG still heavily uses closed source Google services and even downloads executables run with the full privileges of microG. It downloads and runs droidguard with the privileges it has, giving that full access to the privileged access granted to microG.
Each app using Google Play still has the closed source Google Play SDK and libraries built into it in practice. It's extraordinarily rare to replace those libraries with the incomplete and buggy reimplementations from microG. Very close to zero otherwise open source apps are using those. The closed source Google Play SDK and libraries are therefore still part of the loop and have access to what the app can access. Many of the code paths in the Google libraries directly use Google services without requiring Play services including the full versions of the Ads and Analytics libraries.
The vast majority of data obtained by Play services is via the OS integration and permissions. Apps using it for push messaging, logging into accounts and many other features will send the same data to Google services regardless of whether you use it via sandboxed Google Play or microG.
GrapheneOS stubs out and reimplements APIs on the client side. That includes providing a complete implementation of the Google Play services location API not using on Google Play. These features are being expanded over time. They'll also be made available without having Google Play.
The GrapheneOS approach avoids giving an additional global service access to sensitive data from the OS and apps. microG has repeatedly had vulnerabilities leaking sensitive data to apps including location data. The approach of having an extra service sitting between apps and the OS which handles sensitive data means having to add all the same privacy and security checks as Play services which microG doesn't do in practice and it has caused severe privacy leaks. The main location leakage was eventually fixed but it persisted for years and there are still holes in the location service causing privacy issues.
Unlike microG, sandboxed Google Play doesn't get privileged access. That includes the executables (droidguard) downloaded by microG not getting privileged access. GrapheneOS also doesn't give privileged access to other apps such as Android Auto when those are installed as all the main operating systems using microG are doing. That privileged access gives access to highly sensitive data and doesn't require apps explicitly sending data to Google services, which will nearly all still go to Google services with a partial replacement of the middleware on the device.
5 replies →
MicroG is a good compromise between deGoogling and having things work. GrapheneOS is not.
At the end of the day, I need a functional smartphone that can run the apps needed for daily life. MicroG offers that while reducing my exposure to Google.
MicroG is a sloppy and ineffective reimplementation of google services that does not meet GrapheneOSs privacy, security, and usability requirements. MicroG does not make you degoogled and is not a compromise between being degoogled and making apps work. GrapheneOS, with or without google services, has far better app compatibility.
If you need a functional smartphone that runs the apps you need while reducing exposure to google, GrapheneOS is the best option for that by far.
That's very false. GrapheneOS is a better choice for deGoogling than alternatives.
Sandboxed Google Play isn't installed by default, so our users don't have to use it if they don't want to.
Sandboxed Google Play doesn't have privileged permissions and has no more permissions than other user-installed apps. This means that they have the same restrictions as other user-installed apps.
4 replies →
microG still heavily uses closed source Google services and even downloads executables run with the full privileges of microG. It downloads and runs droidguard with the privileges it has, giving that full access to the privileged access granted to microG.
Each app using Google Play still has the closed source Google Play SDK and libraries built into it in practice. It's extraordinarily rare to replace those libraries with the incomplete and buggy reimplementations from microG. Very close to zero otherwise open source apps are using those. The closed source Google Play SDK and libraries are therefore still part of the loop and have access to what the app can access. Many of the code paths in the Google libraries directly use Google services without requiring Play services including the full versions of the Ads and Analytics libraries.
The vast majority of data obtained by Play services is via the OS integration and permissions. Apps using it for push messaging, logging into accounts and many other features will send the same data to Google services regardless of whether you use it via sandboxed Google Play or microG.
GrapheneOS stubs out and reimplements APIs on the client side. That includes providing a complete implementation of the Google Play services location API not using on Google Play. These features are being expanded over time. They'll also be made available without having Google Play.
The GrapheneOS approach avoids giving an additional global service access to sensitive data from the OS and apps. microG has repeatedly had vulnerabilities leaking sensitive data to apps including location data. The approach of having an extra service sitting between apps and the OS which handles sensitive data means having to add all the same privacy and security checks as Play services which microG doesn't do in practice and it has caused severe privacy leaks. The main location leakage was eventually fixed but it persisted for years and there are still holes in the location service causing privacy issues.
Unlike microG, sandboxed Google Play doesn't get privileged access. That includes the executables (droidguard) downloaded by microG not getting privileged access. GrapheneOS also doesn't give privileged access to other apps such as Android Auto when those are installed as all the main operating systems using microG are doing. That privileged access gives access to highly sensitive data and doesn't require apps explicitly sending data to Google services, which will nearly all still go to Google services with a partial replacement of the middleware on the device.
Running google code sandboxed is far more secure than running google code with privileged access. MicroG downloads and runs google code in a privileged context and has had many privacy and security issues like leaking location to apps that dont have the location permission.
> MicroG downloads and runs google code in a privileged context
> many privacy and security issues
> leaking location to apps that dont have the location permission.
Could you share some details on these three points?
I started to try to answer your question, but I found that the GrapheneOS account gave an answer. Here are quotes:
> microG still heavily uses closed source Google services and even downloads executables run with the full privileges of microG. It downloads and runs droidguard with the privileges it has, giving that full access to the privileged access granted to microG.
> microG has repeatedly had vulnerabilities leaking sensitive data to apps including location data. The approach of having an extra service sitting between apps and the OS which handles sensitive data means having to add all the same privacy and security checks as Play services which microG doesn't do in practice and it has caused severe privacy leaks. The main location leakage was eventually fixed but it persisted for years and there are still holes in the location service causing privacy issues.
I also regularly try to explain to people why microG doesn't make sense. It's more of a big picture thing so it's hard to explain briefly. Consider why people would even install microG. It's only helpful for people who have apps that rely on Google Play Services. Those libraries can have fallback implementations and run even without Google Play Services or microG
Sandboxed Google Play is installed as a regular app. It has the same restrictions as other user-installed apps. If apps have Google libraries that don't need Google Play Services or microG are installed with regular apps, they effectively have the same access as Sandboxed Google Play. If those same apps are installed on a device with microG, Google effectively has the same access, big picture.
GrapheneOS's priorities are privacy, security, and app compatibility. There are issues with microG as far as privacy goes, as already noted. It requires privileged permissions to even work properly, and even microG admits that its reimplementations of Google Play Services features are incomplete, so it's worse in terms of app compatibility too.
2 replies →
They'll just flag you for asking.
7 replies →
Okay, so lemme break this down real simple
(Correction from prior statement)
GmsCompat is a layer that runs the official google play services and store in the app sandbox which also strips it of all privileges and teaches it to function with only the bare minimum.
The app itself is sandboxed
But it is taught to run without the app panicking
The app sandbox is an OS feature: https://source.android.com/docs/security/app-sandbox.
de-Googleling is unfortunately not a priority for GrapheneOS.
GrapheneOS doesn't include Google Play (Services) on fresh install, user's explicitly can opt-in. It seems to be the only AOSP based OS that doesn't make any connections to Google by default [1], and is therefore the only true de-googled AOSP OS.
1: https://eylenburg.github.io/android_comparison.htm
It's not a priority but GrapheneOS does better at deGoogling than other OSes, including adding features to the OS so people have fewer reasons to install Sandboxed Google Play. One big example is Network Location, so now users don't have to grant Google Play Services location permissions.
Sandboxed Google Play is never preinstalled, so people who wish to deGoogle can do so. And I'm sure GrapheneOS users who don't want to use Google devices will be happy to get a supported Motorola in the future.
Right. They prefer to spend their time and energy proactively reacting to and debating every comment that mentions GrapheneOS on socials instead of focusing on real issues.
The point of GrapheneOS is privacy, period, not something as narrow as simply deGoogling.
GrapheneOS isn't a single person. One or two of us responding to misinformation on socials doesn't mean work isn't getting done. Unfortunately there are people who spend a lot of their own time making new accounts and attacking GrapheneOS instead of doing something more productive with their own time.
GrapheneOS is incredibly focused on security. Privacy is clearly a second thought to them.
GrapheneOS is a privacy project and heavily improves it with important privacy protections including Contact Scopes, Storage Scopes, secure paste and much more. It preserves all of the standard privacy and security of AOSP while greatly improving upon both.
GrapheneOS doesn't connect to Google servers by default and avoids integrating any privileged access for either Google apps or partial replacements for those. The main operating systems integrating microG included always granted privileged access for microG, Google Play executables downloaded by microG (droidguard) which run with the privileged access it's granted and other Google apps including Android Auto.
The operating systems you believe are privacy projects greatly reduce both privacy and security compared to AOSP through not keeping up with standard patches, not providing important standard privacy/security protections and adding problematic services.
Lagging behind the already inadequate standard privacy/security updates by months and even years isn't compatible with providing reasonable protection for user privacy. Only a subset of the issues Google classifies as High or Critical severity are backported to the older releases of Android those are usually based on. Taking many months to move to newer releases is much more problematic than it appears. The backports to those older releases also get applied with a substantial delay. Firmware and drivers are usually not kept properly updated even when those are regularly released such as for Pixels. Many standard privacy and security protections are missing or disabled. An assorted of third party services are added too.
That's very false. GrapheneOS is primarily a privacy OS that also focuses on security to provide strong privacy.
Sandboxed Google Play has no privileged permissions, which means that those apps have the same permissions as any other apps you can install on Android, meaning the same restrictions.
All that plus the fact that Sandboxed Google Play is a better approach because it offers better app compatibility and is more secure. microG doesn't meet the project's standards.
GrapheneOS will have extreme difficulty being taken seriously while they are "you need to buy Google hardware to run this" project. This is why GrapheneOS has a tiny userbase.
3 replies →
GrapheneOS is and always has been a privacy first project.
If it was privacy first it would ship with microG by default.
3 replies →