How to explain why Accrescent over F-Droid?

leo

I was too slow to edit my post, so I have to make a new one.

Which store is best depends on each user's threat model. If the threat is that an app developer could insert a backdoor in their own app, F-Droid is better. If the threat is that the F-Droid team could insert a backdoor in an app, or that an app could contain a vulnerability that may be exploited if the app is not updated for one week, Accrescent is better.

If a user is willing to verify that an APK is signed by its developer using an app such as AppVerifier, and doesn't care about 0-day exploits, all the apps that have reproducible builds on F-Droid are totally acceptable. Unfortunately, that's only around 5 to 10 percent of the apps on the official F-Droid repo (the rest are built and signed by F-Droid).

Sbpr

How does Accrescent compare to using developer F-Droid repos? For example, Molly from their F-Droid repo compared to Molly on Accrescent. I keep seeing that the official F-Droid repo should be avoided, but what about other repos?

What about izzyondroid and Obtainium?

One thing I did just notice is that the version of Aves Gallery I recently installed from Accrescent was out of date compared to what was available on the IzzyonDroid F-Droid repo.

I'm also unsure which version of apps I'm getting when I use Accrescent since they provide limited amount of info compared to F-Droid and Play Store. For example, there are multiple versions of Aves Gallery and Molly, each with different features.

leo

Sbpr

As far as I can tell, after the 1.20 redesign of the F-Droid client, the only functional difference between Accrescent and a custom F-Droid repo may be the app signing key pinning by Accrescent, although it might not matter to you depending on your threat model.

leo

Sbpr What about izzyondroid and Obtainium?

Like Accrescent, the IzzyOnDroid F-Droid repo distributes builds directly from developers. The repo also implements app signing key pinning and other security measures. If I'm not mistaken, this makes using the IzzyOnDroid repo equally secure as using Accrescent (please correct me if I'm wrong).

Obtainium is not a repo per se, although they have started a crowdsourced list of app configurations in the last months. Apart from apps in that list, apps installed via Obtainium are not curated (they are not scanned for malware, etc.). If your threat model considers developers compromising their own apps as a threat, that makes Obtainium less secure than Accrescent, and less secure than the F-Droid official and IzzyOnDroid repositories. However, if your threat model considers compromised F-Droid repos as a higher threat, it would be more secure for you to install an app via Obtainium. Accrescent would in theory resist a compromised repo, unless the Accrescent client was also compromised to remove app signing key pinning.

missing-root

Does anyone know why Obtainium doesnt support background updates? This is really annoying, especially on big apps.

Many noob users / uninterested people just dont update their apps manually. I do, and I find it satisfying and check release notes, but others dont.

Murcielago

missing-root

If I'm not mistaken, there is an option for background updates in Obtainium.

It can be activated in the app under settings> Enable Background Updates. Background Update Checking Interval can be set with the slider above. Unfortunately this doesn't seem to work with all apps.

fid02

https://x.com/GrapheneOS/status/1803185925112934533

F-Droid has far too many security and trust issues for us to recommend it. The vast majority of apps in the official F-Droid repository are built on their sketchy infrastructure and signed with their own keys. We're concerned about a future mass compromise of F-Droid users.

leo

fid02

Yeah, 91% of the apps in the main F-Droid repository don't have reproducible builds, and are signed by F-Droid keys instead of the app developer's keys. This means that somebody with access to the F-Droid infrastructure could update these apps with malicious code without the developers and users noticing.

GrapheneOS

leo F-Droid's repository metadata is poorly designed and the security is poor. The security of anything built around an ecosystem of insecure scripts, clients, builds, etc. is highly questionable.

unless the Accrescent client was also compromised to remove app signing key pinning

No, the OS package manager is what implements the baseline pinning and downgrade protection. That's why having an app repository like F-Droid with poorly secured builds and keys by untrustworthy people is such a terrible idea. It means even already installed apps can be compromised.

missing-root

Murcielago yeah that doesnt work

boldsuck

oxidant8751 that both F-droid and Aurora Store are insecure due to a variety of reasons

When reading F-droid articles you should always pay attention to what is meant. Mostly the F-Droid app and F-Droid main archive.¹ There are many F-droid clients that are better. & in each client you can use the repositories you want.
E.g. Molly, SimpleX, Cake Wallet, Monerujo, Tor (Browser, Orbot)

¹There have been many improvements in the last few months.

GrapheneOS

boldsuck

¹There have been many improvements in the last few months.

There have also been continued regressions in security and trust.

GrapheneOS

AlphaElwedritsch We're not going to be switching to using it from our own App Store. It's included to provide a way to get developer builds of apps for developers submitting their apps to Accrescent. We don't plan to provide the same service to app developers since Accrescent has it covered and multiple options would be counterproductive.

leo

GrapheneOS F-Droid's repository metadata is poorly designed and the security is poor.

Thanks, I didn't know about this.

unless the Accrescent client was also compromised to remove app signing key pinning

No, the OS package manager is what implements the baseline pinning and downgrade protection.

Sorry for my ambiguous message. I was referring to the fact that the Accrescent client verifies an app's signature even before the first install, compared to baseline pinning from the Android OS which only verifies an app's signature during app updates. If I understand this correctly, this prevents a scenario where a compromised Accrescent server could deliver malicious apps to people who are installing them for the first time with the Accrescent client. A malicious actor would therefore need to compromise the Accrescent client as well. Again, please correct me if I'm wrong, I am not at all an expert in this topic.

By the way, thanks a lot for making GrapheneOS and staying in touch with the community. I learnt a lot from the beautiful GrapheneOS documentation and from your posts on the forum!

Scott

GrapheneOS leo F-Droid's repository metadata is poorly designed and the security is poor. The security of anything built around an ecosystem of insecure scripts, clients, builds, etc. is highly questionable.

I donated to both GOS and F-Droid the same day. This was an error from me? They can use my donation to improve security?

Manna

Scott

hey can use my donation to improve security?

Security isn't bad because of a lack of resources, it's mainly an ideological issue.
They consider that what is generally defined as good security practice only applies to closed-source proprietary, and that open-source services don't need it.
There's a complete disinterest about security.

[deleted]

Scott If i were you, id double the amount for GrapheneOS and forget about donating to to F-Droid.

Scott

Manna Security isn't bad because of a lack of resources, it's mainly an ideological issue.

I may really be a bit stupid. But I still haven't understood why F-Droid security is so bad. They do the same thing as Debian, just for Android. Can you explain it simply?

matchboxbananasynergy

missing-root Obtainium absolutely does automatic updates. If you're getting apps with a low targetSdk, then the unattended API won't work for them, but Obtainium updates apps for me all the time.

missing-root

matchboxbananasynergy strange. The low SDK apps are where I need to press on the "update" android package manager popup manually, right?

I am not talking about that, it doesnt work on its own, in the background.

It even tells me that Obtainium needs to be in the foreground to do that, which is not the definition of automatic updates

matchboxbananasynergy

missing-root Perhaps you can talk to Obtainium's developer for more info, or maybe they have docs up. I remember getting automatic updates to work for Obtainium was an ordeal due to the app being written in Flutter, but it's been done for a while.

For me, without touching Obtainium, I get a notification telling me "AppName may have been updated to version 0.0.1" or something similar. The may have been updated bit in the notification is there for a reason, but I forget the details.