Comment by mzajc
12 hours ago
> It downloads and runs droidguard with the privileges it has, giving that full access to the privileged access granted to microG.
Wow, no kidding! I checked the source code and sure enough, it downloads the DroidGuard APK from Google[0], and loads a class from it[1], (seemingly?) without any kind of sandboxing or separation. I believe I'm safe because I don't have the Play Integrity API enabled, but I really wish the UI was more explicit about this, because the info text only says
> microG GmsCore contains a free implementation of SafetyNet, but the official server requires SafetyNet requests to be signed using the proprietary DroidGuard system.
[0]: https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...
[1]: https://github.com/microg/GmsCore/blob/32bc8954ff872d0e1a05d...
It runs the Google Play executable code it downloads with the full permissions and privileges available to microG. Since microG is normally integrated with the Location permission along with a bunch of privileged access unavailable to regular apps, that can be accessed by the code it's running. The executable it's downloading is highly obfuscated and regularly changed because it exists to try to detect and defeat tampering via obfuscation and anti-tampering techniques. It heavily uses the privileged access available to it. This is enabled by default on /e/ in addition to the many other Google connections it adds by default both via microG which are not present in AOSP.