cross-posted from: https://infosec.pub/post/9936059
I would like to collect the scenarios in which people are forced to enter Google’s #walledGarden (that is, to establish and/or maintain an account).
If someone needs a Google service to access something essential like healthcare or education, that’s what I want to hear about. To inspire a list of things that are “essential” I had a look at human rights law to derive this list:
- right to life
- healthcare
- freedom of expression
- freedom of assembly and of association
- right to education
- right to engage in work and access to placement services
- fair and just working conditions
- social security and social assistance
- consumer protection
- right to vote
- right to petition
- right of access to (government) documents
- right to a nationality (passport acquisition)
- right of equal access to public service in his country
Below is what I have encountered personally, which serves as an example of the kind of experiences I want to hear about:
- Google’s Playstore is a gate-keeper to most Android apps in the world and this includes relatively essential apps, such as:
- emergency apps (e.g. that dial 112 in Europe or 911 in the US)
- banking apps
- apps for public services (e.g. public parking)
- others?
- (education) Google docs is used by students in public schools, by force to some extent. Thus gdocs sometimes cannot be escaped in pursuit of education. When groups of students collaborate, sometimes the study groups impose use of gdocs. Some secondary school teachers impose the use of Google accounts for classroom projects.
- (education) A public university’s wi-fi network involved a captive portal and the only way to gain access was to supply credentials for a Google or Facebook account.
I’ve noticed that when creating an account for a public service I often have the option to supply credentials for Google or Facebook to bypass the verification process. In all cases of this kind of registration shortcut being used for public service, there was an alternative Google-free way to open the account. But in the private sector, I’ve seen this style of registration that absolutely required a proxy login via some shitty walled garden (like the university wi-fi). So I wonder if there are any situations where a government (anywhere in the world) requires a Google account in order to get service.
Education is a good one. Fortunately at this stage in my life it’s no longer an issue for me. I cannot think of anything else I would need google for. Never needed Google to dial emergency services as this is available on dumb phones as well as land lines. Public service apps just need an email of phone number, email I host myself.
One thing that should be discussed is major email providers shutting out self-hosters so that they only accept emails originating from one of the big tech companies. You can receive emails, but having them accepted by others is another story. I’m usually not in favor of heavy handed legislation, but this is an area I would have no issue with the feds interfering as this is essentially a way to create a monopoly.
I’ve ditched email for the reason you mention. If I need to email a private sector entity, I might check their MX server and attempt to send a message if the receiving server is not Google or MS. But generally I nix whatever company I would otherwise want to reach. If I need to reach them (e.g. to get support for a product I already own and I’m stuck with), then I use snail mail. Same for public offices. Most government offices use Microsoft for email which is a non-starter for me. If they use MS then they’re getting snail mail from me.
Things I need from the Play Store are:
- Banking App
- Banking TAN App
I downloaded them using the Aurora store and although they complain about missing play services on every startup, they work without them.
Things I don’t need, but use (installed in the same way and run without play services):
- App from my country’s train service
- App from my carsharing service
- Netflix
- Spotify
I could run those in a browser, but I don’t see what the big difference would be. They run without play services.
So luckily, in Germany, you can live without Google. Nothing actually requires it.
What’s TAN?
(edit)
Regarding the train svc, the carsharing, Netflix, etc, I generally draw a line and say all the private sector stuff can be disregarded apart from life essentials like groceries. So in your list, the train service is a good point because that’s a public service which invokes human rights (equal access to public service). Since you mention Germany, I happen to recall some Germans saying that the train app can access tickets and fares that are otherwise unreachable, perhaps in part because some stations have no kiosk.Transaction number. It’s a second factor for authentication of basically everything you want to do while banking online.
Most people use a phone app for it (which doesn’t reliably work on degoogled and rooted phones), but you also have the choice of buying a dedicated TAN generator device, so people without smartphones can use online banking.Re tickets: Many people in Germany use a kind of flatrate of 50€ per month for regional and local public transit, which either comes with a plastic card or an app. Politicians discouraged the card as ‘less modern’ and many people don’t even know about the card. Basically all train stations for interregional trains (InterCity Express (ICE), InterCity (IC) and EuroCity (EC)) have a way to aquire printed tickets.
That sounds like a good option for regular users and locals. Can that card be bought anonymous non-residents using cash? It would seem to eliminate a lot cases of non-phone users getting screwed but I guess there would still be tourist cases where the 50€ is unjustified. Like if someone is just passing through and needs to change airports (though I guess those are also not the cases where someone would be forced to use a phone app).
Practically only Germans can subscribe, as an address and a bank account is required for the ticket.
I use a LineageOS phone with nanogapps which can run a TAN app but I use a hardware TAN generator instead which is far more secure.
My tablet is pure LineageOS without any Google services.
Banking apps are not a “need”, as long as you can do internet banking over their web instance. At least that’s my case with all 4 financial institutions I use.
My bank requires a second factor for everything done over the web instance. That second factor is either an app or a hardware token generator you have to buy seperately.
That does make sense. The one Bank that requires a hardware token provided by them gave it to me for free. The other 3 accept that I use my FIDO keys.
I don’t have a personal Google account and can’t think of any times I’ve felt like I needed one. I’ve had some for work but only accessed from work computers so figure those are the company’s accounts rather than mine.
Don’t need Google account to access my bank. How does that work exactly? My bank has its own login setup, in no way reliant on a Google account. If your bank requires a Google account, get another bank.
Never needed an app to dial 911…the whole point of 911/999 is that it’s easy to remember, easy to dial. Also, I haven’t dialed 911 in 25 years, but I’m pretty sure opening the dialer and pressing 3 buttons isn’t too difficult. Also, I don’t see how having a Google account is required to dial 911 (or use an app? ) to do so.
The places where I see a major problems are education, where Google and Microsoft have entrenched these systems. Of all the places I see an opportunity for Open Source and Linux to have a major impact, it’s there. I’d happily work for an org with goals to get OSS and Linux into schools as the base infrastructure (but also with Windows, OSX, iOS as part of everyone’s curriculum).
I’ve also never seen a public service require Google or Facebook credentials. I’ve seen some companies/services use them for “user convenience”, and even those typically offer other sign-on/verification processes. But never a public service (power/water/DMV/dtate/county, etc). If I did run into this, oh, I’d be raising a stink with some regulators, representatives, and reporters. Fuck that.
I have exactly one service I use my Google account for - Tailscale - and that’s because I’ve been too lazy to switch to another method until I move it to production (think the offer a third party SSO or a hardware key).
Don’t need Google account to access my bank. How does that work exactly?
Like most banks, a bank pushed an app exclusively via Google Playstore or Apple’s store. At the same time, that bank shut down their website and closed their walk-in over-the-counter service. Customers then had 3 choices to access their account: join Google’s walled garden, join Apple’s walled garden, or make an appointment for every single transaction which incurs fees. Alternatively, the Android app can be obtained using an app called Aurora and violate Google’s ToS by using a shared account to download the app.
I think that particular bank started making their app available in Huawei’s app store, so there is an alternative walled garden for Android users in that case. But Huawei is an uncommon option as more and more banks trend in the direction of forced-Google-patronage.
Never needed an app to dial 911…the whole point of 911/999 is that it’s easy to remember, easy to dial. Also, I haven’t dialed 911 in 25 years, but I’m pretty sure opening the dialer and pressing 3 buttons isn’t too difficult. Also, I don’t see how having a Google account is required to dial 911 (or use an app? ) to do so.
A 911 app was hypothetical but a 112 app certainly exists. You populate the app with important details like name and address. The app is capable of both voice and text (SMS) and IIRC can also connect via wi-fi if there is no GSM signal. If you can’t speak for some reason (choking, throat cut or you’re hiding from an intruder and must be silent) the app transmits all the data you configured plus whatever you can type.
update
Someone in a crossposted thread said it’s not just Playstore that marries people to Google but also an API library for financial transactions:
