Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

F-Droid: how it weakens Android's security model

wonderfall.dev

Post reply on HN
Print view View original

41–50 of 69 posts

Re: F-Droid: how it weakens Android's security model

#41

Post by Wonderfall »

upofadown wrote: post #21

The article links to "The PGP Problem" in an attempt to suggest that GPG signatures are bad somehow. Here are my comments on "The PGP Problem": * https://articles.59.ca/doku.php?id=pgpfan:tpp The article also claims that Debian has moved away from GPG signatures. This is not true. This all seems like a pointless distraction from the point that article is attempting to make...

There is literally a link in the article that takes you to the Debian website: https://wiki.debian.org/Teams/Apt/Spec/AptSign

I might rephrase that since they didn't technically moved away from OpenGPG (yet). It was a proposal at the time.

Re: F-Droid: how it weakens Android's security model

#42

Post by Wonderfall »

dTal wrote: post #6

>The issue with F-Droid is that all apps are signed by the same party (F-Droid) which is also not the developer. You’re now adding another party you’ll have to trust since you still have to trust the developer anyway This is fallacious for several reason. Firstly, no I do not "have to trust the developer anyway" - I can always not install the app . I'm not starting with an app, adding my trust of the developer, and a…

I fail to see how it's fallacious since you're confirming my point.

> I'm not starting with an app, adding my trust of the developer, and adding my trust of F-Droid

You are. You seem to believe they actually read the whole source code when it's not the case: all they do is running their own scripts to scrap known trackers and the like (and again, I must say badness enumeration is a flawed approach), this is far from a stringent process and this would be a very weak approach in any threat model to rely on that.

You still have to trust the app developer, and you'd be much better off trusting the strong guarantees provided by the Android app sandbox anyway. Seems like there's a major disagreement here when it comes to our approach to privacy.

> Thirdly, Android's default app store, Google Play, also trusts a third party by default - Google, who insist on running a tracking rootkit on your computer, which is so much more egregiously invasive than trusting any one app that it renders any comparison with F-Droid moot.

Play App Signing is mentioned in the article.

Re: F-Droid: how it weakens Android's security model

#43

Post by jmnicolas »

ChrisClark wrote: post #13
jmnicolas wrote: post #4

Earlier quoted context omitted.

My adversary is Big tech trying to control what I see, buy, experience, even think. I started to Tweet about a week ago. Most of my tweets get no traction, but if I speak about Ukraine suddenly I get a lot of views. To me it's the proof that Tweeter is controlling what we're thinking about.

Yeah, it's not like there is any major news about the Ukraine right now that millions of people are searching for. ;)

Are they searching for it or Tweeter is force feeding it to them?

Re: F-Droid: how it weakens Android's security model

#44

Post by southerntofu »

upofadown wrote: post #21

The article links to "The PGP Problem" in an attempt to suggest that GPG signatures are bad somehow. Here are my comments on "The PGP Problem": * https://articles.59.ca/doku.php?id=pgpfan:tpp The article also claims that Debian has moved away from GPG signatures. This is not true. This all seems like a pointless distraction from the point that article is attempting to make...

Thanks for this article, it makes very good points. In particular, about the UX of GPG, i've found Sequoia to be a very good alternative: https://sequoia-pgp.org/

Re: F-Droid: how it weakens Android's security model

#45

Post by southerntofu »

jmnicolas wrote: post #43
ChrisClark wrote: post #13

Earlier quoted context omitted.

Yeah, it's not like there is any major news about the Ukraine right now that millions of people are searching for. ;)

Are they searching for it or Tweeter is force feeding it to them?

For sure more people (and bots) are searching for it. It's also quite possible some people following you (or the people who retweet you) are more interested about this hot topic: you could probably write a dozen tweet about monads and not get any interest, then post a single tweet about Julian Assange or Kim Kardashian and suddenly feel like the entire planet is talking to you.

It's quite possible the Twitter algorithms are being nasty (i'm personally strongly against AI deciding what to show and how to order it in a timeline), but it's definitely not the only factor at play.

Re: F-Droid: how it weakens Android's security model

#46

Post by southerntofu »

selfhoster11 wrote: post #27
lucb1e wrote: post #5

> [devs] have to maintain a slightly different version of their codebase that should comply with F-Droid’s requirements Perhaps that's because I've got half a foot in the foss community and you don't hear a lot of "fml why is f-droid so strict about not using secret code", but to me it seems much more often that people complain about Google's policies than about F-Droid's. Especially since F-Droid's > “quality contro…

The main problem with downloading APKs from the GitHub releases page, is that it doesn't come with a low-friction way of distributing updates. This is especially important for unofficial client apps like NewPipe, which basically become bricked at a moment's notice, and updating within a day or two is important to maintain continuity of service. Not to mention that an app may be hosted on a different platform, perhaps…

That's a very good point! Although, would it not be trivial to setup a 3rd-party F-Droid-compatible repo that just distributes CI/CD artifacts (eg. Github releases) by subscribing to a RSS feed? I personally wouldn't do it for the reasons you mentioned, but it could certainly be useful for some people.

Re: F-Droid: how it weakens Android's security model

#47

Post by kuschku »

rahimnathwani wrote: post #31
selfhoster11 wrote: post #25

Earlier quoted context omitted.

Yup. Raising the target SDK means that more phones become ewaste, not because of their hardware becoming outdated, but because their software will never receive an update.

Raising the minimum SDK level might do this. This is separate from the target SDK level.

Raising the target SDK just turns a general computing device into a glorified webbrowser, because you lose access to the filesystem, the ability to run background daemons, and the ability to run compilers.

These should be permissions, not disabled wholesale.

Re: F-Droid: how it weakens Android's security model

#48

Post by kuschku »

southerntofu wrote: post #46
selfhoster11 wrote: post #27

Earlier quoted context omitted.

The main problem with downloading APKs from the GitHub releases page, is that it doesn't come with a low-friction way of distributing updates. This is especially important for unofficial client apps like NewPipe, which basically become bricked at a moment's notice, and updating within a day or two is important to maintain continuity of service. Not to mention that an app may be hosted on a different platform, perhaps…

That's a very good point! Although, would it not be trivial to setup a 3rd-party F-Droid-compatible repo that just distributes CI/CD artifacts (eg. Github releases) by subscribing to a RSS feed? I personally wouldn't do it for the reasons you mentioned, but it could certainly be useful for some people.

It's easily possible, and many people already do it. e.g. Quasseldroid is available via https://repo.kuschku.de/fdroid/repo/?fingerprint=A0CBC2C29E3... a custom repo generated from the same CI builds that also get pushed to Google Play.

Re: F-Droid: how it weakens Android's security model

#49

Post by southerntofu »

kuschku wrote: post #48
southerntofu wrote: post #46

Earlier quoted context omitted.

That's a very good point! Although, would it not be trivial to setup a 3rd-party F-Droid-compatible repo that just distributes CI/CD artifacts (eg. Github releases) by subscribing to a RSS feed? I personally wouldn't do it for the reasons you mentioned, but it could certainly be useful for some people.

It's easily possible, and many people already do it. e.g. Quasseldroid is available via https://repo.kuschku.de/fdroid/repo/?fingerprint=A0CBC2C29E3... a custom repo generated from the same CI builds that also get pushed to Google Play.

Ah yes, but this requires adding one repo per app. I meant having a "single" (though selfhostable) Fdroid gateway to CI artifacts so i could just add "cidroid.org" repository to my Fdroid then choose for each application if i want it from F-droid repo or from fresher CIDroid.

Re: F-Droid: how it weakens Android's security model

#50

Post by Wonderfall »

lucb1e wrote: post #5

> [devs] have to maintain a slightly different version of their codebase that should comply with F-Droid’s requirements Perhaps that's because I've got half a foot in the foss community and you don't hear a lot of "fml why is f-droid so strict about not using secret code", but to me it seems much more often that people complain about Google's policies than about F-Droid's. Especially since F-Droid's > “quality contro…

> because there are no restrictions on things that just work with root, donation links for open source open geo data contribution platforms[1], roll your own payment scheme without giving anyone a cut, put ads in it if you like...

Respectfully, that was not my point. The point was that having access to the source code fundamentally doesn't mean much. You can read more about why there since I don't want to open this debate again: https://seirdy.one/2022/02/02/floss-security.html

> As does every web browser, but somehow banking on websites seems to very rarely be intercepted?

Banking apps exist, and are required as a modern 2FA. Since 2021, strong 2FA is a requirement in the EU for banking operations. Mail clients also do this. DANE would be the ideal approach on web browsers. This might be up to a more general debate that doesn't belong here though.

> Wouldn't it be nice if you could actually see what this app sends to Google about you?

It's perfectly nice, and mitming is a great tool to ensure Google (and others) doesn't lie about what data they send.

> Previously you'd add a cert to your OS and you'd be good to go.

Now, this argument is rather moot though, since it's still doable. Not sure that the higher technical barrier would matter much, and most users will benefit from having certificate pinning anyway. Google is not doing this to prevent researchers to do their work. Nothing is permanently a blackbox anyhow.

> Hah, the author just spent ~2800 words criticizing the liberal inclusion policy, missing api target enforcement, outdated (now slightly misleading) permission listings, lagging signature scheme update, and then concludes with "just download the apk from github because it has an Atom feed"! If only f-droid knew that this was the requirement for an endorsement by OP :D (jk)

This is a bit exaggerated. I'm merely stating this is an alternative for "tech nerds", since Android enforces signature verification for app updates, so you once you ensured the authenticity, the source doesn't matter as much. This should be done with apksigner by the way, not tools like OpenGPG.

I didn't feel the need to expand on this.

> It depends.... how much does security matter to you? Is this to the exclusion of all other values?

I rephrased this conclusion, since it was indeed a bit binary for my taste.

This article wasn't meant to be openly shared on public platforms. This was bound to happen, but obviously I was not trying to make an article that should reach everyone. This is fine though, thanks for your comment.

Post reply on HN