Hi! What would be the best way to limit play serbices to only selected apps. I still need notifications to work from them, but would like to be sure that google can’t access anything else

  • Shimon@slrpnk.netOP
    2·
    5 months ago

    Update: I ended up going with microG. You can install the apps from f-droid and with insular/shelter copy them to a work profile. It seems that apps outside of the work profile can’t acces these services.

    Edit: do NOT install them to non-work profile and then clone them. Instead, they must be installed directly in work profile. My way of doing this was to clone fdroid and install the microG from (work profile) fdroid. If you were to install them to non-work profile, clone them and uninstall the original, your (or at least mine did) phone will be stuck on “phone is starting” after reboot.

    • jet@hackertalks.comEnglish
      1·
      5 months ago

      Great I’m glad you found a solution that works for you. Just be aware Microg is still phone wide, so any app on your phone can talk to Google.

      • Shimon@slrpnk.netOP
        2·
        5 months ago

        Whan I installed messenger on my non-work profile, it kept crashing. On the work profile with microG it works. I think it still at least limits the access

  • cmrss2@aussie.zone
    1·
    5 months ago

    I know in GrapheneOS that the Google Play Services are sandboxed and you can install them in a specific user profile, but I’m not sure if doing that still gives you notifications across those profiles

    Hopefully someone with a little more knowledge of this can help? lol

    • emberpunk@lemmy.mlEnglish
      0·
      5 months ago

      So if I have two profiles, one with and one without play services and the profile with play services is not active, there’s no active pinging and telemetry going on?

      • jet@hackertalks.comEnglish
        2·
        5 months ago

        If the profile with Google services is quiesced like suspending your work profile, then no activity should be seen on the network at all. No keep alive no pings etc

    • Shimon@slrpnk.netOP
      0·
      5 months ago

      That is a great rundown, thanks! How would I install them on a different custom rom? Upon installing their “apps” store, i can’t see the google play services (this might be because I’m currently on stock)

  • Remy Rose@lemmy.oneEnglish
    0·
    5 months ago

    If I’m understanding correctly, this sounds just about exactly how GrapheneOS works by default. All GPlay apps work and have notifications, but are sandboxed.

    • Roopappy@lemmy.mlEnglish
      0·
      5 months ago

      I’m really interested in Graphene and Google privacy, but what does it mean when you say "Sandboxed? Like… I want to use Google Maps, does Google still track me? Maybe only when the app is open, and not when it’s closed?

      • Andromxda 🇺🇦🇵🇸🇹🇼@lemmy.dbzer0.comEnglish
        21·
        5 months ago

        but what does it mean when you say "Sandboxed?

        By default, on a normal Android device, Google Play services are installed as a system application. It means that you can’t remove it, and it can grant itself the permissions it needs. In contrary, regular user apps run in the Android application sandbox. They are installed by the user, have distinct permission controls that are enforced by the operating system and can be uninstalled at any time. Sandboxed Google Play is a compatibility layer created by the GrapheneOS team, which allows you to run Google Play services (which would normally require system privileges) to run as a normal user app in the regular application sandbox.

      • jet@hackertalks.comEnglish
        1·
        5 months ago

        For grapheneos sandboxed means the Google apps are just regular apps, they don’t have privilege, they’re not escalated, they are exactly the same as other apps. Very specifically, it means Google services are only accessible in the user/profile that they are installed in, and not phone wide

        If you use a Google service, or an app that interacts with the Google apps, then Google knows about it. In graphene OS you can choose what apps have access to Google services, by running them in a different profile.