3 ms·

I've had f-droid OSMand for a long long time, recently I started getting a warning for google's "play protect" when I go to update it though. Very strange.

pwg 4y ago
> Very strange. Not at all. The google mothership wants to keep you within the play store's walled garden. Fdroid allows you to escape the walls, so naturally google complains about that.
flanbiscuit 4y ago
I have an F-Droid question. The only way to download F-Droid (as far as I know) is to download the apk directly from their site: https://f-droid.org/ https://f-droid.org/. This means having to side-load the app. Of course doing that means I would want to do my due diligence and verify the download using the PGP Signature they provide. My question is how do I verify a PGP signature completely on my phone? I do know how to verify it on my laptop, and then I could send it to myself or install it using adb. But I'm hoping there's a way to do this without having to involve a laptop.
- johannes1234321 4y ago
  OpenKeychain is an Android app for doing some basic GPG related work. It can verify signatures (hidden in the "encrypt/decrypt" menu) Also it integrates i.e. with K-9 mail to sign and verify. https://github.com/open-keychain/open-keychain https://github.com/open-keychain/open-keychain
  - flanbiscuit 4y ago
    oh this looks promising, thank you! I'll try this out
- wizeman 4y ago
  If someone replaces the APK on their website with a compromised one, what prevents them from replacing the PGP signature with a signature created by the attacker?
- lalopalota 4y ago
  You're not the only one. There are instructions using termux at the end of the thread. https://forum.f-droid.org/t/help-needed-to-verify-the-f-droid-app-apk/9357/41 https://forum.f-droid.org/t/help-needed-to-verify-the-f-droi...
tuukkah 4y ago
"Warning: This app may track your GPS position" or similar. Not totally unexpected of a maps app.
- Aachen 4y ago
  Imagine Google showed warnings for all the pre-installed Google apps on every phone. Warning: Google Background Services can read your SMSes, sideload apps without your knowledge or consent, request your location, and basically anything else your device is capable of doing (see the control panel in your Google account for what you, and Google, can make this do). Warning: on some devices, Google Maps will nag you to upload WiFi access points every time you open the app. It's opt-in so technically legal! Warning: every website you type in this browser's address bar will be sent to Google. Warning: text you type on this keyboard may be sent to Google for improving text suggestions for everyone. It would be a heck of a lot of pop ups on first boot and the best marketing Apple could ever wish for. Apple is not necessarily better, but they're not being hypocritical by adding warning labels for third party noncommercial open source alternatives (OsmAnd isn't the first one where Google does this, FairEmail has a similar story).

pwg 4y ago

> Very strange. Not at all. The google mothership wants to keep you within the play store's walled garden. Fdroid allows you to escape the walls, so naturally google complains about that.

flanbiscuit 4y ago

I have an F-Droid question. The only way to download F-Droid (as far as I know) is to download the apk directly from their site: https://f-droid.org/ https://f-droid.org/. This means having to side-load the app. Of course doing that means I would want to do my due diligence and verify the download using the PGP Signature they provide. My question is how do I verify a PGP signature completely on my phone? I do know how to verify it on my laptop, and then I could send it to myself or install it using adb. But I'm hoping there's a way to do this without having to involve a laptop.

johannes1234321 4y ago
OpenKeychain is an Android app for doing some basic GPG related work. It can verify signatures (hidden in the "encrypt/decrypt" menu) Also it integrates i.e. with K-9 mail to sign and verify. https://github.com/open-keychain/open-keychain https://github.com/open-keychain/open-keychain
- flanbiscuit 4y ago
  oh this looks promising, thank you! I'll try this out
wizeman 4y ago
If someone replaces the APK on their website with a compromised one, what prevents them from replacing the PGP signature with a signature created by the attacker?
lalopalota 4y ago
You're not the only one. There are instructions using termux at the end of the thread. https://forum.f-droid.org/t/help-needed-to-verify-the-f-droid-app-apk/9357/41 https://forum.f-droid.org/t/help-needed-to-verify-the-f-droi...

tuukkah 4y ago

"Warning: This app may track your GPS position" or similar. Not totally unexpected of a maps app.

Aachen 4y ago
Imagine Google showed warnings for all the pre-installed Google apps on every phone. Warning: Google Background Services can read your SMSes, sideload apps without your knowledge or consent, request your location, and basically anything else your device is capable of doing (see the control panel in your Google account for what you, and Google, can make this do). Warning: on some devices, Google Maps will nag you to upload WiFi access points every time you open the app. It's opt-in so technically legal! Warning: every website you type in this browser's address bar will be sent to Google. Warning: text you type on this keyboard may be sent to Google for improving text suggestions for everyone. It would be a heck of a lot of pop ups on first boot and the best marketing Apple could ever wish for. Apple is not necessarily better, but they're not being hypocritical by adding warning labels for third party noncommercial open source alternatives (OsmAnd isn't the first one where Google does this, FairEmail has a similar story).