3 ms·
Yes, you have to trust F-Droid to sign apps. But that doesn't weaken the security model — since August2021, (new) Android devs can't sign their own apps anymor
by kuschku 5y ago
Yes, you have to trust F-Droid to sign apps.
But that doesn't weaken the security model — since August2021, (new) Android devs can't sign their own apps anymore, Google holds the keys instead.
The security model already assumes a third party is signing the apps.
- chasil 5y agoWhat surprises me about this article is that not one word is spoken of other appstores. A lot of bragging takes place about Play, but is silent on Amazon's appstore or any of the Chinese alternatives.
- Wonderfall 5y agoAuthor here. You're wrong, as I spent several paragraphs explaining how Play App Signing works and how it's being enforced for new app bundles. The Huawei app repository has a similar approach to Play Store, and to my knowledge Amazon app repository has always been doing this (and even more nasty stuff: https://developer.amazon.com/docs/app-submission/understanding-submission.html#code_wrapper https://developer.amazon.com/docs/app-submission/understandi...).