2 ms·

Do you trust the banking app installed from Aurora enough to do your online banking? I don't, and I really wish there would be a decent way to verify that the i

Do you trust the banking app installed from Aurora enough to do your online banking? I don't, and I really wish there would be a decent way to verify that the installed/provided apps are legit. For me this is the biggest downside of using GrapheneOS, which I'm otherwise extremely happy with. (for me, the whole point of using GrapheneOS is privacy and not sending data to Google, so using the PlayStore is not an option)

panja 1mo ago
Doesn't Aurora download the packages directly from Google?
- dooglius 1mo ago
  Presumably the parent does not want to have to trust Aurora to do that
Gander5739 1mo ago
Android apps are signed. Can't you verify the signature?
- lucb1e 1mo ago
  Can you? I'm pretty sure if I try calling my bank or searching the website to confirm the developer's public key fingerprint, there's not going to be any answer. You have to ask Google's servers to give you the APK and trust what it gives you, either via the front-end called Aurora or the front-end called Play Store
  - Gander5739 1mo ago
    Maybe not in practice, but in theory, it works. I don't think there's a better way of handling this without relying on some centralised authority (Google) to validate the authorship of an app, which is hardly desirable.
  - palata 1mo ago
    Doesn't AppVerifier allow you to do just that?
  - microtonal 1mo ago
    Privacy Guides is building a database of signing keys with a verifier app: https://github.com/privacyguides/verified-apps-android https://github.com/privacyguides/verified-apps-android https://github.com/privacyguides/verified-apps/ https://github.com/privacyguides/verified-apps/ I think in general trust is established for Play Store apps by downloading the app with the Play Store on a phone with Google Certified Android. Then the app can get the signing key for storage in the database. Then this can be used to verify APKs downloaded outside the play store.

panja 1mo ago

Doesn't Aurora download the packages directly from Google?

dooglius 1mo ago
Presumably the parent does not want to have to trust Aurora to do that

Gander5739 1mo ago

Android apps are signed. Can't you verify the signature?

lucb1e 1mo ago
Can you? I'm pretty sure if I try calling my bank or searching the website to confirm the developer's public key fingerprint, there's not going to be any answer. You have to ask Google's servers to give you the APK and trust what it gives you, either via the front-end called Aurora or the front-end called Play Store
- Gander5739 1mo ago
  Maybe not in practice, but in theory, it works. I don't think there's a better way of handling this without relying on some centralised authority (Google) to validate the authorship of an app, which is hardly desirable.
- palata 1mo ago
  Doesn't AppVerifier allow you to do just that?
- microtonal 1mo ago
  Privacy Guides is building a database of signing keys with a verifier app: https://github.com/privacyguides/verified-apps-android https://github.com/privacyguides/verified-apps-android https://github.com/privacyguides/verified-apps/ https://github.com/privacyguides/verified-apps/ I think in general trust is established for Play Store apps by downloading the app with the Play Store on a phone with Google Certified Android. Then the app can get the signing key for storage in the database. Then this can be used to verify APKs downloaded outside the play store.