Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

F-Droid: how it weakens Android's security model

wonderfall.dev

Post reply on HN
Print view View original

11–20 of 69 posts

Re: F-Droid: how it weakens Android's security model

#11

Post by GuB-42 »

_joel wrote: post #3

Given the amount of malware in the play store, I'm not sure about this...

It is addressed in the article.

The point is that F-Droid weakens Android's security model, in other words, F-Droid requires more trust on your part. I think it is reasonable to trust the somewhat niche open source community more than the most popular and therefore the most attacked app store. You may also not want to feed Google, but it doesn't change the fact that F-Droid is technically less secure. The article's debatable suggestion is to get your favorite open source apps you trust from the Play Store to get the best of both worlds.

The article is interesting because most of the points are actually fixable by F-Droid. So it is good to see from a "how to improve F-Droid" angle than "F-Droid sucks".

Re: F-Droid: how it weakens Android's security model

#12

Post by LukeShu »

prophesi wrote: post #7

Not to discredit the article, but it would be nice to know from the get-go that it's written by a contributor to GrapheneOS and gives a plug to their upcoming App Repository at the end.

I'm not saying that the author has never contributed a PR (there'd be a lot of repos for me to look through), but AFAICT the author is just a user/fan of GrapheneOS, not a contributor to GrapheneOS itself or to the GraphenOS App Repository.

Re: F-Droid: how it weakens Android's security model

#13

Post by ChrisClark »

jmnicolas wrote: post #4
Friday_ wrote: post #2

"There's no such thing as a system being secure, only being secure against a particular adversary."

My adversary is Big tech trying to control what I see, buy, experience, even think. I started to Tweet about a week ago. Most of my tweets get no traction, but if I speak about Ukraine suddenly I get a lot of views. To me it's the proof that Tweeter is controlling what we're thinking about.

Yeah, it's not like there is any major news about the Ukraine right now that millions of people are searching for. ;)

Re: F-Droid: how it weakens Android's security model

#16

Post by david_allison »

hlbjhblbljib wrote: post #8
dTal wrote: post #6

>The issue with F-Droid is that all apps are signed by the same party (F-Droid) which is also not the developer. You’re now adding another party you’ll have to trust since you still have to trust the developer anyway This is fallacious for several reason. Firstly, no I do not "have to trust the developer anyway" - I can always not install the app . I'm not starting with an app, adding my trust of the developer, and a…

Doesn't google do exactly the same thing with the app store anyway?

As of August 2021, new apps must use Android App Bundles. Older apps can still be distributed without providing the key to Google.

[0] https://developer.android.com/guide/app-bundle

[1] https://developer.android.com/guide/app-bundle/faq#app-signi...

Re: F-Droid: how it weakens Android's security model

#17

Post by prophesi »

LukeShu wrote: post #12
prophesi wrote: post #7

Not to discredit the article, but it would be nice to know from the get-go that it's written by a contributor to GrapheneOS and gives a plug to their upcoming App Repository at the end.

I'm not saying that the author has never contributed a PR (there'd be a lot of repos for me to look through), but AFAICT the author is just a user/fan of GrapheneOS, not a contributor to GrapheneOS itself or to the GraphenOS App Repository.

After reading the article, I clicked the link to their Github and saw a @GrapheneOS tab in their contribution graph. But taking a second look, I see that they haven't contributed to any of their repos in quite some time.

Re: F-Droid: how it weakens Android's security model

#18

Post by lucb1e »

> [in] a third-party Play Store client called Aurora Store [...] I’d recommend against using the shared “anonymous” accounts feature: you should make your own throwaway account with minimal information.

Why is that? I've been using the anonymous accounts because I figured sharing an account gives a lot less info to google, and we're downloading the apks directly from Google servers in the end. Is there something I should know?

Re: F-Droid: how it weakens Android's security model

#19

Post by orthecreedence »

hlbjhblbljib wrote: post #8
dTal wrote: post #6

>The issue with F-Droid is that all apps are signed by the same party (F-Droid) which is also not the developer. You’re now adding another party you’ll have to trust since you still have to trust the developer anyway This is fallacious for several reason. Firstly, no I do not "have to trust the developer anyway" - I can always not install the app . I'm not starting with an app, adding my trust of the developer, and a…

Doesn't google do exactly the same thing with the app store anyway?

Yes, last I checked, Google signs the app with your private key, which they force you to give them. In other words, they have the ability to make any changes to your app and re-sign it at their whim. Anyone concerned about the security of their shit should only install apps directly signed directly by the developer, using a private key only the developer possesses.

It's a shame these platforms go to such great lengths to force distribution through their "safe" channels.

Re: F-Droid: how it weakens Android's security model

#20

Post by lucb1e »

hlbjhblbljib wrote: post #10

> 3. Low target API level (SDK) for client & apps Yeah well Google fucked up and removed a lot of important API stuff that supported tools. So I'll continue to use termux from F-Droid. Otherwise I might as well not have a phone.

If you trust Microsoft/GitHub more than F-Droid, you could also grab it from there: https://github.com/termux/termux-app#github (you'll have to take care of your own update mechanism though)

Not that I'd recommend it personally, but f-droid isn't the only option. Kind of the beauty of open source :). So often apps (e.g. from the government for corona) are only available if you first agree to the Google TOS and privacy policy. Which, of course, most people already did anyway, but the point here is that you don't need to if there's just a build from the devs somewhere, or a build environment you can replicate without too much trouble.

Post reply on HN