3 ms·

APKs from the google play store are signed by the developer. Apkpure would not be able to change the APKs without resigning the file, something that would be tr

APKs from the google play store are signed by the developer. Apkpure would not be able to change the APKs without resigning the file, something that would be trivially detectable against an authentic APK.

saagarjha 3y ago
Where would you get one of those up compare against?
- esperent 3y ago
  There's browser extensions for Chrome and Firefox that let you get the APK, and probably other ways too if you search.
dhx 3y ago
This is no longer true as of 2021. You as a Google Play user with very limited exception (see next paragraph) have no assurance whether you've received the mobile application bundle (.aad) the developer intended you to have, nor are you receiving the same application bundle everyone else in the world receives. Signatures controlled by Google are now used to sign the application bundle sent to each device[2]. It's not quite as bad (yet) as the Apple situation, but not far off. For a security conscious developer such as Signal who publish an APK (.apk) and signatures publicly[2], a user with a rooted device could theoretically unpack the official application bundle received from the Google Play Store and check the executable code and resources match those in the publicly available APK. Or just not use the Google Play Store and obtain your applications directly from the developer or an intermediary you place more trust in. [1] https://developer.android.com/studio/publish/app-signing https://developer.android.com/studio/publish/app-signing [2] https://signal.org/android/apk/ https://signal.org/android/apk/
- wolrah 3y ago
  It's no longer true that APKs are signed by the developer, but it is still true that it is signed in such a way that a third party APK mirror site could not tamper with the file without being detectable. Google could have tampered with the file before the mirror site got it, but you can verify that whatever a mirror site is offering was signed by them.

saagarjha 3y ago

Where would you get one of those up compare against?

esperent 3y ago
There's browser extensions for Chrome and Firefox that let you get the APK, and probably other ways too if you search.

dhx 3y ago

This is no longer true as of 2021. You as a Google Play user with very limited exception (see next paragraph) have no assurance whether you've received the mobile application bundle (.aad) the developer intended you to have, nor are you receiving the same application bundle everyone else in the world receives. Signatures controlled by Google are now used to sign the application bundle sent to each device[2]. It's not quite as bad (yet) as the Apple situation, but not far off. For a security conscious developer such as Signal who publish an APK (.apk) and signatures publicly[2], a user with a rooted device could theoretically unpack the official application bundle received from the Google Play Store and check the executable code and resources match those in the publicly available APK. Or just not use the Google Play Store and obtain your applications directly from the developer or an intermediary you place more trust in. [1] https://developer.android.com/studio/publish/app-signing https://developer.android.com/studio/publish/app-signing [2] https://signal.org/android/apk/ https://signal.org/android/apk/

wolrah 3y ago
It's no longer true that APKs are signed by the developer, but it is still true that it is signed in such a way that a third party APK mirror site could not tamper with the file without being detectable. Google could have tampered with the file before the mirror site got it, but you can verify that whatever a mirror site is offering was signed by them.