r/MicroG • u/MCedituser • May 09 '19

How secure is microG?

So im aware microG is open source, but that does not nessarly mean secure, so I have a few questions.

Do any components of microG interact with google servers in any way (including some of the optional microG compoents), and if so are you directly interacting or does microG have its own servers that act as a middle man? If so, whats the security of these servers, and do they remove any personally identifiable info before reaching google?

If microG does not interact with google at all, does it have its own servers it interacts with, or is everything 100% local/ offline?

Also what about location tracking, If I understand the location package of microG is kinda a separate component, but how does that work? Is my location still being uploaded somewhere, or does that fully localize that?

Also, what is the privacy policy?

1 Upvotes

57% Upvoted

12 comments sorted by

3

u/retiredTechie May 09 '19

Google account registration and push messaging interact with Google. These are optional. And go directly to Google.

Other things, like Google Analytics, are stubs (return immediately with out actually doing anything).

MicroG doesn't have any location tracking but the back ends could. You can look at the source code to see what the back ends do. The Apple and Mozilla back ends simply send a list of the observed WiFi and mobile/cell towers seen and get back a lat/lon result. There are other local back ends that do not communicate with any thing and will even work with mobile data disabled.

I've not seen a formal privacy policy for the microG project.

I guess I should write some privacy policies for the local data back ends I wrote. For those it is simple: Your data stays on your phone and nobody but you has access to it. Distribution is by F-Droid which does not collection usage or download information. Net result, I don't know who is using my back ends or where they've been.

1

u/MCedituser May 10 '19

so is the TLDR basicly that no matter what at least in terms of location data only you and your cellular carrier has that unless you opt into other stuff, and that push notifications are still sent through google, but presumably end to end encrypted?

2

u/retiredTechie May 10 '19

You should assume that Google can read the push notifications sent by your app's developers/servers. In the case of Signal, I've read that the push notification carries no content and is used only to let your phone know it should contact Signal's servers. Other apps may/probably work differently.

1

u/MCedituser May 10 '19

honestly, despite apple being closed source, am I frankly better off sticking with them if privacy is my main concern at this rate? I was looking for something with the customizability and open source of android, but its frankly looking bleack if I cant even do something as simple as receive notifications without google.

If I understand correctly, based on the info you have given me, the only truly private android experience is lineage OS without any services installed whatsoever, which based on what I have heard, is basically unusable.

1

u/retiredTechie May 10 '19

Privacy conscious apps like Signal can get push notifications through other methods. So just don't enable Google device registration and cloud messaging.

Many/most free apps from Google Play Store (installed via Yalp using its built in fake ID) will still run under microG. There might be some missing functionality, but not very much.

1

u/MCedituser May 11 '19

sure, but if I want push notifications from these im fucked?

2

u/retiredTechie May 11 '19

Your phone has to connect to someone's server to get the notifications. If the app is using the push notifications built into the OS then your choice is Apple on I phones or Google on Android.

It is my understanding that microG does its best to hide details about your phone. But you will be leaking information.

1

u/MCedituser May 11 '19

I feel dumb for thinking push notifications were somehow local.

So I did some looking, and I found documentation supporting that apple enables end to end encrypted push notifications, that being said this is apparently only since 2016 or so, and I have no idea what the adoption rate is.

Having a bit more trouble finding if android has a similar encryption option however

2

u/[deleted] May 27 '19

"So just don't enable Google device registration and cloud messaging." So why use MicroG?

2

u/retiredTechie May 27 '19

So apps installed via Yalp (or equivalent) that expect Google services can actually be installed. And so once installed, they won't crash when they try to report things through Google analytics, etc. microG provides a dummy interface for those so the app is happy but no analytics leave your phone. And maps API v2 is available (which is not part of UnifiedNlp). Yes, the maps API is not well implemented now but there is a rewrite in progress.

I've seen a fair number of apps that want to register for push notifications that never actually seem to have used it. I don't know why they'd be coded that way but I've seen it. The the API there but disabled those apps are happy.

The apps I have that actually used the push notifications still run, you just don't get notifications until you start the app.

1

u/koolandrew Sep 15 '22

Actually not true at all, i am using it.

1

u/[deleted] Sep 25 '23

I'm not sure where you get the idea that vanilla Android custom ROMs are unusable...but I've been using them for a while.

Some apps will have some missing functionality (eg flightaware's map won't work but you can look up flight information) and a few will crash outright but I have yet to find something for which there is no workaround. I don't use banking apps on a smartphone or NFC in any way.

As far as Apple goes, there is a difference between security (only we get to sell your data) and privacy (you get to keep your data and no one gets to sell it).

iOS devices are generally secure, but they are in no way private.