5 ms·
Is there a standard that could verify an apk against a certificate? ... or an I just describing building an alternative play store?
by onethought 6y ago
Is there a standard that could verify an apk against a certificate? ... or an I just describing building an alternative play store?
- young_unixer 6y agoSignal, for instance, does this: https://signal.org/android/apk/ https://signal.org/android/apk/
- sp1rit 6y agoSignal doesn't. They give you a hash not a signature. I.e. if you have control iver their site, you can push a malicious signal application and change the hash.
- Sephr 6y agoThis is false. The Signal APK is signed with the same signature as the APK on Google Play. If the signature was different then Android would not allow me to overwrite/update my Google Play Signal installation with the APK that I just downloaded from that site. On Android, APKs are almost always signed by default (even if they're only self-signed).
- AWildC182 6y agoThis is a (mostly) solved problem in linux. Your package manager has a central repo, but also can have 3rd party repos added. You'd add the matrix repo and it would automatically update it with everything else. It means everything still gets updated and verified against the keyring.
- colordrops 6y agoFdroid supports 3rd party repos.
- JJJollyjim 6y agoAndroid's has an app signing system which isn't dependent on Google Play. Updates to a given app have to be signed with the same certificate as previous versions.
- canofbars 6y agoYou can use fdroid which builds everything and signs it with their own keys.
- hiq 6y agoWhere do you get the certificate from? If you get the APK and certificate from the same source, there's no security benefit of verifying the certificate on top of having a proper TLS connection. If you update the application, Android will check that the certificate of the current version matches the one from the update before allowing you to install it.