[Android Apps and Games] emandt:
A standalone App like mine has no possibility to intercept many critical data and has not any role regarding others payments, check credentials, and other critical actions.

Most of users knows about the power of "Root Permissions" to potentially do anything on the phone, so if a user choose to install this App it should cross his/her fingers and trust the author, or choose to not install it. But installing an App that requires Root is commonly known that it leaves the phone in the developer's hands. There is no any hidden feature or unknown/omitted thing.

Another case is (remaining in my SPenCommand App example) the not well known SELinux feature: my Apps requires that SELinux is set to Disabled or Permissive and if its current status is founded as "Enforcing"

a BIG POPUP is showed to inform the user about the security hole it could be created lowering that permission.

This popup says: "SPenCommand has found that your ROM uses high SELinux Permissions which blocks direct reading of S-Pen. Lower the SELinux Permissions could harm your Android allowing other malicious Apps to execute their code.\n\nWould you like to lower SELinux Permissons enought to run SPenCommand with Full ROOT Access?"

I think this is enough to warn an user about the risk.

So a developer/author should inform the user about the possible of stole, intercept and send data

expecially when many critical informations are NORMALLY passing by this App

.

A normal user doesn't known the data is passed from an App to PlayService and from it to Google's WebServers, so they could think that changing stock PlayService Core will give only benefits of less storage occupied, less CPU and RAM used and maybe less network traffic...but nothing is said about username, passwords, payment informations, gps position, etc that are passing through it

Move the discussion on my App does not seem to have helped much since I've already warned the user about implications that this involves.

(Un)fortunately not. A single standalone App cannot incercept all the data is passing through PlayService. A rooted App can intercept key presses, it can sniff network packets but it is a very heavy and complicated work. In all the cases these Apps shows their permissions and the user could imagine what type of data this App can get. A complete different thing is this MicroG project: for it is not required any special permission because Google Apps will interrogate it, so it needs only to expose functions that will be used from these GApps.

So a normal App should expone its critical permissions like NETWORK_MANAGER and INPUT_MANAGER and the user could imagine that this App will get key presses and network data, instead MicroG receives usernames, passwords, gps positions and many critical data without special permissions.

I think it's a complete different way to work.

I think you missed basic informations about Android development.

Official Android Dev site (https://developer.android.com/google/play/billing/index.html) says: "In-app Billing is a Google Play service that lets you sell digital content from inside your applications. You can use the service to sell a wide range of content, including downloadable content such as media files or photos, virtual content such as game levels or potions, premium services and features, and more."

Even LVL (License Verification Library) uses PlayService to check if an App is bought or not, so this MicroG could answer always "YES" like the fake PlayStore we talked few messages above. But I'm sure most of you will agree with this "great" feature :good:

Yeah, I can not compete with you :angel:

Do you think you will give courses for us nOObs about general development and PlayService? I will subscribe even if you will ask for money, I'm sure you have many and many knowledge to share to us poor novice programmers :cowboy:

First I would like to say THX to you for your fully well explained answer :good:

Now I answer you.

So if something is not done/warned by others (even if they are wrong) we could consider their omission like a GOOD thing? I hope not...

I was supposing that a special, big and critical project like this could had warnings about risks.

Your project "hiddenly" (I choosed this word because GApps are sending data to MicroG, so no special permissions are required to "catch" them but MicroG receives them directly) takes data but the end-user doesn't know it.

The point is not if the data is stored in any way, but it's more simple: those data passes through MicroG in clear and it can be potentially do anything with them.

I'm not worried about current source code's rows, but in a future it will less easy to insert bad code.

The OpenSource nature doesn't means nothing because (for example) the Stranglehold security bug was present for YEARS even if the source code was open.

I would only say that end-users should be well informed.

Writing a simple RED Line talking about "not aware of possible consequences" doesn't means nothing to the common user. He could think about Root permissions, keylogging and stole contact, that are very far away the reality.

Outside of this my opinion the project is great, I've done many "wrappings" around WebServices in my experience expecially for Windows and done this work was a pleasure.

However good luck with this project, but I have no issues with stock PlayStore (no battery drain or other problems...and I've tried to use my device without GApps in an MIUI ROM: battery stats was near the same) and I prefer to stay in a known zone like the Google one.

(sorry for my quite bad English, I hope you can understand what I wrote)