Best Way to Install Apps

adelina

What is the best way to install apps on GrapheneOS? From my understanding the F-Droid app has some security problems. However, using third-party repo signing keys are controlled by the developers. Is that correct?

From a security standpoint the Google Play Store should be the best option, right?

Aurora Store is only valuable if I don't want to install any Google Play Services, right?

What about side loading the application? From my understanding this is fine after a manual certification check with apksigner. How do I verify certificates? I think the best approach would be to copy past the cert hash into a browser and see if it is mentioned on trusted sources like the developer website or social media site. Is that the best approach of verifying an app?

Are there other ways to install apps on GrapheneOS?

1) Apps app (perfect, limited)
2) Google Play Store (secure, not private)
3) F-Droid (security issues, privacy friendly, third party repos are developer controlled)
4) Aurora (only for accessing apps without Google Play Service installation)
5) Sideloading (secure and private if the app is verified with apksigner before first installation)

Additionally, is it correct that after the first app install a malicious different signed app would be ignored because GrapheneOS sticks to the TOFU trust model?

Is Obtanium a good choice to keep track about updates of a sideloaded app?

unwat

adelina
Yes. It seems everyone agrees that installing via Play Store is the safest, if not private. Personally, I go with the first available options out of this list:

Play Store (I don't mind them knowing what apps I use, just care about their access to my phone data)
F-Droid apps from external repositories, this way I know the developer signed them
Direct from Github releases, if they have pre-built apks available. I use a feed reader to keep track of releases using .atom at the end of releases, like https://github.com/GrapheneOS/platform_manifest/releases.atom
F-Droid

Doing it this way I found that I have very few apps that rely on F-Droid's repository. These apps, for the most part, don't have internet access. Obviously, each app is sandboxed, so I'm not to worried about it.

I don't verify apps' keys/hashes. I just take special care to download from a reliable source, like their github or their website. I stay away from shady apk downloader sites. Maybe someone else on here has another way they verify apps.

adelina Additionally, is it correct that after the first app install a malicious different signed app would be ignored because GrapheneOS sticks to the TOFU trust model?

Yes

adelina Is Obtanium a good choice to keep track about updates of a sideloaded app?

Wow. I never saw this before. It looks way better than using my feed reader. I'm going to have to check it out. But, yes, doing it this way is a common suggestion by people in the GOS community.

abcZ

adelina gplay is NOT secure. Anybody can upload basically whatever they like to there and you really have no idea what those programs actually do.

adelina

abcZ That's true, but I'm not talking about the App Store content here, I'm talking about the app itself. But good that you point that out!