Let's compare hashes for apps not in AppVerifier's database!

prompter

thanks to all for sharing the hashes and I can verify the apps in appverifier but the results never stick when going back to the app list after verification, is that expected behavior?

Dumdum

prompter
I believe it is currently just a simple mechanism to check for a successful hash match, but I could be wrong. It would be nice if user submissions could be stored in the app, but I think its intended for users to rely on the official hash database. Maybe that could change in the future?

prompter

Dumdum
okay got it, but yeah, it'd be really nice once implemented

DeletedUser370

Here is verification info I have copied from Appverifier for some of my apps, all installed from Play Store. I believe all of these (maybe except for Zotero) can also be obtained from the apps' websites or GitHub:

Element
im.vector.app
F3:FF:38:D2:E5:A6:38:84:86:4A:4E:0D:45:C5:3B:19:8E:7E:39:C0:50:5B:D9:63:F5:55:D6:53:2D:EA:BF:5F

GitHub
com.github.android
DF:08:C9:F2:D8:09:18:9D:9D:50:64:97:C1:57:45:A7:39:5A:41:53:6E:FB:43:3E:3A:EE:1A:ED:BE:11:B2:61

Standard Notes
com.standardnotes
58:3F:C4:1B:49:0C:38:0B:56:FB:E9:EE:47:38:1E:B4:EF:53:E0:37:19:A5:50:3F:C1:F2:9D:CD:8E:28:90:2A

Wireguard
com.wireguard.android
84:A1:3F:A2:C4:E0:06:4B:0C:11:65:4B:8A:86:57:4B:7A:9B:93:52:A3:83:4C:EE:32:45:5B:06:1C:3D:41:27

Voice
de.ph1b.audiobook
11:A4:CA:EE:0B:A3:EB:5A:35:2D:11:25:AB:D3:29:25:20:9E:89:60:15:A5:D9:CA:0F:D9:F8:2D:AE:20:4F:AA

Openreads
software.mdev.bookstracker
98:15:6C:9C:CB:52:8E:18:2A:58:85:40:CF:6C:16:EC:45:57:7C:FD:B9:B6:85:A5:BB:6F:79:97:03:DE:F3:7D

Zotero
org.zotero.android
37:B6:F1:19:C3:D4:5D:C2:5E:70:69:95:C5:30:F4:44:CF:B2:4C:A6:E7:AF:31:6D:6D:0F:D2:62:47:45:0A:8F

Antennapod
de.danoeh.antennapod
A8:54:1B:7E:6C:69:76:B0:B7:E3:A9:0B:E8:9C:63:A6:66:BE:37:3F:1D:BB:ED:A6:71:AC:2E:17:26:5D:6A:0F

io.ente.photos
37:D4:0B:10:3B:BF:86:43:EB:AE:23:B3:BB:73:F8:65:B4:E9:3A:BF:65:45:EF:37:12:8A:4C:EA:5B:C2:7E:2E

Clark

Can somebody show me how I can get the hash? Do I enter app info or the Github page?

DeletedUser370

Clark For apps you already have installed, simply open Appverifier and select "App list". For APK files you have downloaded, simply open them with Appverifier.

Pacienco

Apologies for dampening the mood, but I don't know if it is a good idea to normalise people sharing an identifying list of the apps they personally use. Of course, it is ultimately up to each person if they want to do this to help others. However if it is going to be a community effort there probably needs to be a way to do it without exposing your current app list.

UserresU

Pacienco when the app verifier says "success" and " this apps verification info matches an entry in the internal database. You don't need to verify normally"
Does this mean the filehash of the apk is verified successfully? Because on the button of the side it say's: "verification status unknown" and "since you haven't providet any verification info i'm unable to determine the verification status"

Both messages on the same page. This is quite confusing me.

DeletedUser370

Pacienco Apologies for dampening the mood, but I don't know if it is a good idea to normalise people sharing an identifying list of the apps they personally use. Of course, it is ultimately up to each person if they want to do this to help others.

I don't understand the concern. Are you worried that this thread is creating some form of peer pressure?

UserresU

bootloader does anybodtly have the official hash for Libre-Tube
(alternative YouTube frontend)

Dumdum

UserresU " this apps verification info matches an entry in the internal database. You don't need to verify normally"

"Verify normally" is referring to the "verification status unknown" on the bottom. The bottom is for manual verification which you don't need to do if the hash is already confirmed in the database.

Ammako

DeletedUser370 I'm surprised that a privacy-conscious person like yourself wouldn't intuitively understand what could be at stake here tbh

thure

Source: F-Droid Repository

eu.siacs.conversations
C7:5A:BE:78:59:36:43:AE:7C:AC:52:73:27:CD:21:93:48:2D:B0:67:40:4A:88:B8:C1:3F:7A:07:01:94:61:87

com.vonglasow.michael.satstat
D6:E4:F7:05:F5:45:1A:E7:2B:85:DC:E8:C6:14:E8:D9:1C:3B:D8:4C:0E:5E:3A:E9:55:4B:54:38:E5:94:55:83

at.bitfire.davdroid
8B:48:E6:76:A6:86:49:67:79:17:83:C1:D8:D0:FC:0D:D6:D2:CE:33:E1:FB:36:78:77:93:EC:D0:86:D4:47:07

org.kde.kdeconnect_tp
79:B5:00:31:48:67:46:DF:FB:C7:46:F4:8F:B0:EB:62:FC:7B:B0:AE:7B:97:6E:7D:65:07:B2:C0:78:84:0D:92

org.fossify.calendar
AF:FD:B1:24:D3:F4:72:0C:2F:98:DB:CA:9E:AC:BA:05:14:FB:A4:30:6E:20:A2:78:6C:86:1C:3C:0D:6F:F2:92

de.westnordost.streetcomplete
7B:DA:B5:77:0B:DB:DC:7A:38:00:24:30:A0:B5:6A:DF:63:1F:14:45:BA:47:8B:A2:A8:FB:16:8D:5C:08:75:13

it.niedermann.owncloud.notes
3E:80:F3:2D:F2:C8:9E:4C:DD:3A:32:F1:00:21:78:D8:D4:F2:1B:9D:A8:9F:8A:DD:6A:BA:E2:9F:D3:C9:5C:0B

com.nextcloud.client
57:09:57:6F:9D:6C:6A:76:87:DD:5D:56:B2:69:D1:FA:5E:37:97:02:B9:1B:C8:3F:39:FD:7B:7C:59:7C:1B:83

DeletedUser370

Ammako I'm surprised that a privacy-conscious person like yourself wouldn't intuitively understand what could be at stake here tbh

This post makes this whole thread sound somehow threatening, while at the same time being unconstructively vague. And why are you making this about me instead of reasoning about what is "at stake"?

People on this forum are every day sharing publicly which apps they are using, but this thread is somehow unique? It's not intuitively clear why that is. If you think that the verification info from Appverifier is a personal identifier, you are simply wrong.

If people find this thread problematic, that is something they should discuss with a moderator. They all have contact info in their bios. That seems a more constructive approach than making vague comments about me as a person.

other8026

Concerning some of the recent comments, people have the right to privacy, but they're also free to share private information about themselves if they choose to. If community members want to share, I don't think it's productive to alienate them for doing anything that isn't 100% private by other community members' standards.

Yes, sharing a list of apps may give away some private details about a person, such as the country they're living in if they share a hash for a bank app, for example. But I would hope that anyone sharing such information is aware of what they're doing.

There is a limit to how long posts can be edited or deleted. If someone here has second thoughts and wants something removed, they can contact a moderator privately and we can help with that.

I personally don't have a problem with community members sharing hashes in this thread, but I hope that community members keep in mind that they should install apps from secure app stores. The official recommendation is to use Accrescent if possible, and Google Play Store for other apps. Using F-Droid isn't recommended, but if you choose to use F-Droid anyway and share hashes for apps downloaded with F-Droid, please make that clear to reduce confusion since the majority of apps on F-Droid are signed by them.

DeletedUser88

Can anyone confirm if they have the same hash for Ente Auth (downloaded from Github):

io.ente.auth.independent
BA:8B:F0:32:98:62:70:05:ED:DF:F6:B1:D6:0B:3B:FA:A1:4E:E8:BD:C7:61:4F:FB:3B:B1:1C:58:8D:9E:3A:D7

Dumdum

DeletedUser88
I just verified 5 different APKs, each matched your hash.

Tl4W4rEtsV7HsB81Or8U

Does anyone have the rethinkdns app hash? I can only find it on apkmirror.

IcyScroll

Tl4W4rEtsV7HsB81Or8U

Got it from Github a few months back. Didn't verify it in any way, though.

com.celzero.bravedns
1F:32:D4:32:E8:1A:1D:C5:C0:0A:AF:EB:0C:66:36:CD:78:19:96:5D:17:44:20:E5:9D:B9:67:5D:FF:7A:88:E9

Tl4W4rEtsV7HsB81Or8U

IcyScroll Thanks that's what I have. Also, the apk from the play store has the same signing key as github so that is 100% correct.

cdflasdkesalkjfkdfkjsdajfd Yes that's the repo. It is highly recommended to install through Accrescent (even just for the initial install, you can uninstall Accrescent afterwards) since that guarantees it hasn't been tampered with due to chain of trust with the grapheneos App Store.

nullable As said above it is the hash of the signing key, version doesn't matter. As long as a secure hashing algorithm is used (which AppVerifier uses) it is guaranteed that the input bytes (the signing key) match. Non secure hashing algorithms can output the same hash for different inputs.

ignoramous

rdns dev here

IcyScroll Got it from Github a few months back. Didn't verify it in any way, though.

What are these hashes? Of the public app signing (RSA) key? If so, I can generate and advertise one on our website/github readme.

cdflasdkesalkjfkdfkjsdajfd

Is this App verifier?: https://github.com/soupslurpr/AppVerifier

Dumdum

cdflasdkesalkjfkdfkjsdajfd
Yes. You can install AppVerifier via Accrescent (available from the GOS app store)

Eagle_Owl

cdflasdkesalkjfkdfkjsdajfd
Yes, that's the correct source for this great app.

« Previous Page Next Page »