Hacker News Reader

Comment by codethief | Hacker News Reader

MicroG is a fantastic project! I wouldn't know what to do without it! (×)

For anyone who wants a really easy way to install and use LineageOS with MicroG, consider going for the MicroG-infused version of LineageOS: https://lineage.microg.org/ It's basically pure LineageOS with a small patch that allows MicroG to spoof the Google services' signatures. The ROM supports all the devices regularly supported by LineageOS and even gets weekly OTA updates, too.

(×) In case you agree, consider donating to the project: https://salt.bountysource.com/teams/microg (or, if you want a specific issue to be solved, you can put a bounty on it, too: https://bountysource.com/teams/microg )

View on HN

There's also the main Bountysource page: https://www.bountysource.com/teams/microg for donating to specific issues. If you're not ready to use this yet because it doesn't work well with X app, there's probably an issue tracking something that would make it work which you can donate to!

Thank you, I added the link to my original post!

Does the patch allow the spoofing of Google packages only, or are signature checks disabled for all apps?

Signature spoof require specific permission and it's only available for system apps. So there is no way any app can abuse it unless you specifically allow it.

From the FAQ on the page I linked to above:

> Why do we need a custom build of LineageOS to have microG? Can't I install microG on the official LineageOS?

> MicroG requires a patch called "signature spoofing", which allows the microG's apps to spoof themselves as Google Apps. LineageOS' developers refused (multiple times) to include the patch, forcing us to fork their project.

> Wait, on their FAQ page I see that they don't want to include the patch for security reasons. Is this ROM unsafe?

> No. LineageOS' developers decided not to include this patch for various reasons. The signature spoofing could be an unsafe feature only if the user blindly gives any permission to any app, as this permission can't be obtained automatically by the apps. Moreover, to further strengthen the security of our ROM, we modified the signature spoofing permission so that only system privileged apps can obtain it, and no security threat is posed to our users.

It allows spoofing for any apps the user gives the spoofing permission to.

I'm getting tempted to go the LineageOS with MicroG route on my Pocophone (need to confirm it works first).

Does this mean I can use the Play store and apps such as Spotify without much issue?

I don't believe you can install the play store itself, but Spotify should work. You would have to manually side load it, or install the yalp store which will manage fetching and updating play store apps for you.

Yalp store has default credentials for Play, and it has difficulty loading "split" APKs. I have Chrome installed, and I use Yalp's manual download to get updates for it, then trigger the updates from my downloads folder. If I were using Webview instead, this wouldn't be required.

LineageOS really should find a way of making Webview available for people who do not load Play/gapps - MicroG is the only way to run an up to date webview if gapps is not present.

There are also two versions of the "Aurora Store" in F-Droid. These require your Google account at startup, and they supposedly handle the split APKs.

Yalp does warn that using your own credentials is a violation of Google's terms of service. Because of this, I have never given these credentials to Aurora.

Aurora does not require using your own credentials; there's an "anonymous" button on the login page. It does support split APKs, and has completely replaced Yalp for my uses.

https://gitlab.com/AuroraOSS/AuroraStore/

I'm not following. What does WebView have to do with MicroG / Gapps? I'm asking in particular because:

1. WebView comes pre-installed on LineageOS, irrespective of whether you install Gapps

2. WebView can be downloaded separately from the Play Store

I also keep thinking about doing this on my Pocophone (F1) but how do I know what works and what doesn't? I really like the face unlock feature and I don't want to lose the good camera. It's not immediately obvious from their website what state everything is in.

Typing this on my Poco F1, 6 may ROM and now upgrading to 13 may version. Battery is great (2,5 days), it is very stable and the speed is also good. Yesterday I've tested navigation by downloading Google Maps. Couldn't find places by typing. When I enabled advanced location via WiFi and Bluetooth it worked. Installed in November lineage manually with MicroG and had problems with finding location. Not anymore. I also use Aurora store for the few apps that I'd like to use from play store such as banking. The sick thing about this combination is that it supports in app purchases as well.

Do you also get this annoying thing where the fingerprint sensor stops working sometimes and touch is too sensitive? The LineageOS beta worked great, the official version is buggy for me and is really annoying.

Unfortunately yes, I thought that I didn't set up my fingerprint the right way. Hopefully that will be fixed.

You could also use the Yalp Store (Play written in reverse) to grab the APK without having the play store installed.

https://f-droid.org/app/com.github.yeriomin.yalpstore

Yalp is currently abandoned, try using Aurora Store instead: https://f-droid.org/app/com.aurora.store

I didn't know that, thanks!

> Does this mean I can use the Play store and apps such as Spotify without much issue?

Yes! (I used to have the Play Store installed on my phone with MicroG and it worked just as you would expect. As for Spotify, I use it on a daily basis.)

UPDATE: I should point out that I have since replaced the Play Store with Yalp/Aurora Store because the Play Store still needs to be installed as system-privileged app which I didn't like.

What's the difference between using this and sideloading Gapps on LOS? Will I still be able to use Maps, for example? I'm not sure what the benefit is.

Benefit is avoiding hitting Google servers and services.

Running Gapps on your device (in particular, the Google Services Framework) means that Google will basically have root access to your phone. MicroG prevents that while still allowing you to run certain Google apps like Maps, use Google Cloud Messaging and so on.

There's also /e/ - another, more opinionated Android distro also using MicroG (and LineageOS...)[1], along with freemium Nextcloud hosting. I threw it on an old Nexus 5, seems interesting, if a little still-in-alpha.

1: https://e.foundation/e-solutions/

Apparently they're rather shady.

https://ewwlo.xyz/evil

https://infosec-handbook.eu/blog/e-foundation-first-look/

I don't think it's fair to categorize them as 'shady', at least yet. Most of the issues described could be attributed to the fact they are very early stage and just wanted to release something working quick. I realize that's not always the best approach, though. Time will tell if they are a standup organization or not, I suppose.

The very reason for /e/ to exist is expressly to provide users with privacy...so some of the shortcuts they took are inexcusable (using APKs from APKPure, leaking personal data, etc).

So "shady" might not be the right term..."untrustworthy" might be a better one, until they prove otherwise.

Pardon my lack of knowledge, but what is wrong with APKs from APKPure?

It's a third party.

To be sure of the integrity of a binary and what it does, one must build it from source code that one has verified.

Making strong claims about privacy and then bundling pre-built binaries found on the internet (no matter what the site) does not inspire confidence in me about the team or its supposed dedication to privacy.

.XYZ domains ARE shady.

Totally https://abc.xyz

Reply on news.ycombinator.com