8 ms·

Android apps are signed. Can't you verify the signature?

• lucb1e 15d ago
  Can you? I'm pretty sure if I try calling my bank or searching the website to confirm the developer's public key fingerprint, there's not going to be any answer. You have to ask Google's servers to give you the APK and trust what it gives you, either via the front-end called Aurora or the front-end called Play Store
  • microtonal 15d ago
    Privacy Guides is building a database of signing keys with a verifier app: https://github.com/privacyguides/verified-apps-android https://github.com/privacyguides/verified-apps-android https://github.com/privacyguides/verified-apps/ https://github.com/privacyguides/verified-apps/ I think in general trust is established for Play Store apps by downloading the app with the Play Store on a phone with Google Certified Android. Then the app can get the signing key for storage in the database. Then this can be used to verify APKs downloaded outside the play store.
  • Gander5739 15d ago
    Maybe not in practice, but in theory, it works. I don't think there's a better way of handling this without relying on some centralised authority (Google) to validate the authorship of an app, which is hardly desirable.
  • palata 15d ago
    Doesn't AppVerifier allow you to do just that?