4 ms·
> By moving the signing to F-Droid, you have to completely trust them. Which you do anyway if you use Google Play Services. ...
by yarou 10y ago
> By moving the signing to F-Droid, you have to completely trust them.
Which you do anyway if you use Google Play Services.
...
- maxerickson 10y agoA user that is prepared to access the apk can verify the signature of the app they have on their device. (So the compromise of F-Droid that results in a signed, compromised binary can't happen on Google Play, the apk is signed before it is sent to the store)
- neerdowell 10y agoWhat does Play Services have to do with anything? APKs downloaded from the Play Store are signed by a key the developer holds and validated by Android's PackageManagerService which is open source.