Downside of using Google apps on GrapheneOS?

A hash is sent to Google but not the message itself (unless it is reported as spam). They may also know your phone number, but that’s not particularly private either.

Contents of SMS messages are sent to your carrier, you should assume both your carrier and the recipient’s carrier has a copy. That is a bit like email, being on Proton won’t do you much good if you send plain text copies to a @someotherprovider.com. You can have all the zero knowledge encryption you like, but will still be a plain text copy out there.

All SMS apps are about as private as each other which is not private at all. The only real benefit of Google messages is that there is the chance of increased privacy with E2EE (meaning only you and recipient have readable copy), if you’re both using Google messages.

Unless you have the option of convincing the other person to use something else, it could be considered an improvement.

I don’t particularly consider the hash an issue, if it means I don’t get a gazillion messages about a package in the mail and some dodgy malicious URL. Google can’t really do anything with the hash but identify the uniqueness of the message, if it means I don’t get spam then I don’t really care.

The data sent to Google is tagged with the handset Android ID, which is linked to the handset’s Google user account and so often to the real identity of the person involved in a phone call or SMS message

In general I don’t really care about this either because I only use SMS with people who already know my “known identity”. It’s also worth noting, even if I use an alternative app (if the other person does not), then the hash will also be obtained by Google anyway.

TLDR just don’t use SMS for anything you care about. Trying to substitute it with one app thinking it is better than another is just theatre.

7 Likes