Is there any privacy benifit in downloading apps from outside the Google Play Store on stock Android, via things like Obtainium or Aurora Store? Since Google Play Services has privileged access to the device, it can still see installed apps.
Is there any point in using Obtainium for downloading open source apps on stock Android if I stay signed into a Google account for the Play Store for apps that don’t distribute releases on their GitHub/GitLab?
Some apps have different versions of their apps that strip out or replace proprietary elements and potential trackers.
For example, Aves Gallery uses Google Maps to show your photos on a map whereas their “Libre” version use OpenStreetMaps. Helpful developers will explain the differences in their versions on their website, GitHub, etc.
There’s also the censorship aspect. If Google removes an app from the play store, you can still get it elsewhere.
Lastly, (if I’m wrong, someone please correct me), I believe Google has the technical capability of secretly tampering with a developer’s app before releasing it to users on the Play Store, especially for apps that use Play App Signing.
What the original questions really points at: Google knowing what apps you have installed (and they need to know that because you’re fetching updates from them).
What I think is the long-time improvement is to stop downloading any non-essential apps from Google Play, but on F-Droid instead. My only apps I use that come from Google nowadays are not considered personal data:
Everything else I get from the F-Droid app
Aurora store is not perfect because you still download from Google’s servers, and the F-Droid page also clearly lists an anti-feature that your list of apps is sent to the server, which could uniquely fingerprint you (along with your phone model). Always using it with a VPN has the small chance you will not be fingerprinted, but it might not last long.
A decent benefit is that Aurora Store is fully open source and so it doesn’t track the way you use it (navigation, phone sensor data, what parts you linger on etc).
This is seems like a decent reason to use it (and I also can’t think of a downside). You’re not directly using their proprietary trackware interface to download apps and preview app. If you’re relying on Google apps in some way, it’s always my recommended way for the privacy-interested to interface with the Google Play app repository, even if the apps you install are also tracked because of the Gplay Services.
I’d rather not get my apps from F-Droid if I can get them from sources like Obtainium instead, mainly because of the security implications like F-Droid acting as a middleman, delayed updates, etc.
I’m currently enrolled in Google’s Advanced Protection Program for the security but I’m not at risk of targeted attacks. I’m evaluating whether unenrolling from the program is worth the potential (if any) privacy benifits of using alternative stores like Obtainium on stock Android, though I will probably still keep the Play Store and be signed into a Google account. I also prefer not to use Aurora Store since it adds an extra middleman alongside Google and doesn’t solve anything on the security side of things.
Please more info about “Advanced Protection Program”