Huawei store on BraX3. Lesser or Greater Privacy Concern?

General topics
1

I was curious what the public thinks about this… Lesser or Greater privacy concern?

Backstory

  • I was looking for a particular app for my devices. I have a Fairphone 4 and BraX3 (beta)
  • This app is a PAID app, so it can only be downloaded after purchase from Google Play
  • This app has a couple of In-app purchase options which I also need

So while researching this, and understanding MicroG a bit more with relation to Google accounts, apps purchased via Google Play are easy to install/transfer via the Aurora store. But in-app purchases, however, are another thing.

MicroG doesn’t seem to be able to sync in app purchases (I have tested this already, without success). There are threads and threads about this topic, and it seems to comes down to the way in-app purchases are categorized (consumable and non-consumable I think it was), and tracked by Google.

So I reached out to the Dev of the app, and asked if there were any alternative purchase options. The Dev told me that while they have no direct path to purchase, they do have a purchase option by installing the Huawei Store. The Dev sent me the link, and I installed the store.

The Huawei store seems to do everything via in-app purchase. It seems you can install any app, but to actually use an app that requires purchase, you purchase from within the app. Immediately upon choosing to purchase, you are presented with a screen to download the file HMS Core apk.

HMS Core is the package that essentially connects the device to Huawei, and facilitates/tracks purchases. It will ask you to either login, or create a new account, so that you can complete your purchase. The benefit of this over Google Play purchases is that the purchase, and all other in-app purchases will easily transfer to other devices.

So here is my quandary.

“Is the Huawei store a Lesser or Greater privacy issue than Google/Aurora, when it comes to purchased apps, in-app purchases, and the ability to transfer all of those purchases?”

On one hand, for de-google users, it makes purchasing apps and transferring those to other devices much easier. But, Huawei also has a certain reputation, being affiliated with China, and I don’t know exactly what HMS Core is really doing on the backside. But then there is Iode Blocker, so I can at least see/block some communications.

Maybe someone with more experience on this can chime in (Rob Braxman)…

3 Likes
2

I’m not sure about the huawei store, but I can tell you about google play and aurora: if you log onto google on a laptop, you can buy the app. From your brax phone, add the google account in microG. Then from aurora store, you can find the app and it will let you install it. The app itself may require using a google account saved in microG, so don’t delete it just yet. Other apps may refuse to work, as the native google services are not included or may have problems with in-app purchases, so try it out within 48h so you can get a refund if it doesn’t work as you want. That said, you can configure shelter to use those apps inside of a separate profile as I don’t want google on your main profile.

3

I would avoid Huawei at all costs if possible. They are forced to share data with the CCP. Installing anything Huawei on a privacy respectnig device will undercut the benefits of having a privacy respecting device. It’s roughly akin to removing all spy devices from your home and then installing an Alexa or Echo device inside; defeats the purpose.

2 Likes
4

So if you can, explain why? I would like to hear your input, and any details you have to support your position. I could see what you described if I had an accual device with HMS as a system app. But that is also why I opened the topic.

At the surface, it looks to me like this:

  • the app is not a system app, so its only entitled to the permissions I provide.
  • the iode blocker sees all the traffic, and can block its communications.
  • the data they would have access to would be my burner phone number and CC info. Essentially the same info that Google would have of mine via MicroG.
1 Like
5

Unfortunately, without doing an assessment on the HMS Core app, including a dynamic analysis of its behavior and a static code analysis, I couldn’t give you any specifics. I understand your mitigations and they sound reasonable. However, if there are any RCEs in the HMS core app that can be levereaged, and the CCP is definitely the type of entity that requires companies to install these hidden “features”, then any controls placed on the application from a permissions perspective may be able to be subverted. I do not know if the network traffic monitoring is able to be subverted. This would depend on where the network monitor is sniffing traffic. Does this happen on the baseband (i wouldn’t think so) or is it happening at a higher level. If at a higher level, then it is technically subvert-able. I know my answer doesn’t provide anything concrete. Sorry, I wish I could be more helpful. I just havent dug into that app.

1 Like