3 ms·
If the only person with the signing key is the author, then any user could verify the signature outside of Android, could they not? Instead, even outside of An
by aesh2Xa1 5y ago
If the only person with the signing key is the author, then any user could verify the signature outside of Android, could they not?
Instead, even outside of Android, we simply cannot know.
- a-dub 5y agothey could push an update that makes it appear like the author signed version is on the device, but in reality a different version is run. they control the keys to the software delivery channel and the operating system. large parts of this are closed source. users and developers trust them and that's just how it is. that said, it's not pretty and i hope it's just a backwards compatibility stopgap as discussed upthread.
- jayd16 5y agoIf you're allowed to verify outside of Android, the author could simply post hashes.
- nodamage 5y agoExcept verifying outside of Android tells you nothing about whether the application as installed on an actual device has been tampered with, so you don't really gain any security from this.