Repository navigation
Clean-room Google Find Hub client in the app, without a server #257
Description
#244 adds Google Find Hub through a self-hosted service (googlefind-service), built on GoogleFindMyTools. That works, but each user has to run Docker behind a reverse proxy and keep their Google master token on that server. This issue is for doing the same thing on the phone.
The Apple side has done this twice. Anisette came off remote servers by loading Apple's own Android ADI libraries in the app. The iCloud export was written clean-room as documented here, which is the model for this issue.
Why the service exists today:
- GoogleFindMyTools is GPL-3.0 and this app is MIT. Bundling it would make the APK GPL. An on-device version has to be written from the protocol's observed behaviour and Google's published FMDN spec, never from GoogleFindMyTools' source.
- Its sign-in and key retrieval drive a desktop Chrome through Selenium.
What it does, and how each part could work on a phone (unverified):
| Step | Desktop tool | On the phone |
|---|---|---|
| Sign-in | Chrome at accounts.google.com/EmbeddedSetup, read the oauth_token cookie, exchange it for a master token |
WebView + CookieManager, then the same exchange. Google may block sign-in in some embedded browsers |
| E2EE owner key | Chrome on the security-domain page with an injected window.mm stub |
WebView with addJavascriptInterface(…, "mm"), the interface the page expects |
| Location results | Locate via the Nova API, answer over FCM as com.google.android.apps.adm |
The phone's Play Services cannot deliver another app's pushes, so the app needs its own FCM check-in and MCS connection, opened only during a refresh |
| DIY tags | Re-upload EIDs daily, since Google forgets them after about 4 days | WorkManager |
| Decryption | Python crypto libraries | Java or BouncyCastle |
Constraints from this repository:
- The master token gives access to the whole Google account. Store it the way the Apple session is stored, never in plain text.
- Whatever device identity the client registers as is what the user sees in their Google account. Keep it one stable identity per install (compare rule 11 in AGENTS.md for the Apple side).
- Keep Google Find Hub as a second location network #244's opt-in service working until this replaces it.
Drafted by Claude Code, reviewed by @parawanderer
Activity