Let's compare hashes for apps not in AppVerifier's database!

schweizer

de0u I by no mans want to infringe you as a person. I jist point out that there are two approaches to deliver apps to users:

decentralised approach, every app developer puts his .apk file on a server. The task of quality assurance is completely delegated to the user. Every app developer that wants money must provide it's own payment process.
centralised approach such as PlayStore where a trusted agency is responsible for deferring malicious apps. The secure store provides a payment process.

The two approaches are incompatible. I am fine with either as long as the centralised agent does not continue to spy on users after the apps are sold.

And I wanted to point out this discussion is not solved. The majority of appdevelopers are not willing to provide apks and payment processes. And Google as the central intermediary is not willing to provide privacy.

de0u

schweizer In the EU there are three approaches for Apple devices, with the third one being "federated app stores"? And actually it's possible, some of the time for some apps, for end users to build them from source, so perhaps arguably a fourth option?

schweizer The two approaches are incompatible.

On a single Android device it is completely possible to have apps obtained via a mixture of the approaches.

schweizer I wanted to point out this discussion is not solved.

I suspect the author of AppVerifier was indicating that the problem the author designed AppVerifier to solve has been solved. In particular, there is a chain of trust from a GrapheneOS installation, through the App Store app and the Accrescent app, to an app that runs on devices and can be used to read and compare app author signatures.

schweizer The majority of appdevelopers are not willing to provide apks and payment processes. And Google as the central intermediary is not willing to provide privacy.

It's indeed a problem, and various people are trying various things. The EU has their ideas; the Accrescent author has an idea; from time to time lobbying the developer of some specific app has results.

Meanwhile, the laws in many jurisdictions place limits on privacy when money changes hands.

privacyisconsent

Are there no longer any plans to include AppVerifier's capabilities in GrapheneOS itself? Rather than as a separate app?

de0u

privacyisconsent Are there no longer any plans to include AppVerifier's capabilities in GrapheneOS itself? Rather than as a separate app?

Is it possible to provide a link to a previous official announcement of a plan to do that?

privacyisconsent

de0u

This is what I believe I was recalling https://x.com/GrapheneOS/status/1837928314478198816 (https://xcancel.com/GrapheneOS/status/1837928314478198816#m), however I do not know what counts as an official announcement.

de0u

privacyisconsent Thanks for posting the links!

That post might mean many things. It would not be super-hard for the package installer to display the signing hash (#211). Maintaining a database (#989) would be a substantially more ambitious project.

Please note that, while it is fine to use reaction emoji to express support for issues on GitHub, posting "I want this also!" or "Is there any update?" will just get the issue locked or deleted.

privacyisconsent

de0u Please note that, while it is fine to use reaction emoji to express support for issues on GitHub, posting "I want this also!" or "Is there any update?" will just get the issue locked or deleted.

OK.

ope_ape_a

PipePipe (Github)
nfinityLoop1309.NewPipeEnhanced
DE:C7:34:29:CE:25:63:27:5F:5E:D1:98:25:E4:46:52:B3:2B:36:3A:46:F3:8B:DF:F9:AD:6D:CD:E4:84:2D:88

Find My Device (FMD) F-Droid
de.nulide.findmydevice
87:A6:C1:36:F5:49:9D:B2:55:C9:3F:4D:38:4C:B1:A5:D3:14:F6:90:8F:2B:F1:97:E0:EC:07:ED:58:BB:58:72

Murcielago

Syncthing-Android
com.github.catfriend1.syncthingandroid
D3:74:B8:DE:50:57:01:31:43:C7:D1:51:5A:01:55:98:C2:DF:40:3B:E8:16:0C:AE:01:A5:8C:22:7E:6E:86:AA

DeletedUser323

Murcielago Same here! From GitHub via Obtainium.
com.github.catfriend1.syncthingandroid
D3:74:B8:DE:50:57:01:31:43:C7:D1:51:5A:01:55:98:C2:DF:40:3B:E8:16:0C:AE:01:A5:8C:22:7E:6E:86:AA

Open_Source_Enjoyer

bootloader Many GOS users who are not using Google Play store, FDroid and Aurora, using AppVerifier for checking the integrity of their downloaded apks

Does AppVerrifer only works to check files for apps, so .apk files, or can it also check apps that a installed from a store?

Fupira

Open_Source_Enjoyer It can also check and show the signatures of apps installed by a store.
After opening AppVerifier you'd use the button "App List" and can find all installed apps there.

The database isn't that big, so it's mostly helpful for crosschecking.

beard

org.fossify.calendar
AF:FD:B1:24:D3:F4:72:0C:2F:98:DB:CA:9E:AC:BA:05:14:FB:A4:30:6E:20:A2:78:6C:86:1C:3C:0D:6F:F2:92

dev.imranr.obtainium
B3:53:60:1F:6A:1D:5F:D6:60:3A:E2:F5:0B:E8:0C:F3:01:36:7B:86:B6:AB:8B:1F:66:24:3D:A9:6C:D5:73:62

im.molly.app
6A:A8:0F:DF:4A:8C:C1:37:37:CF:B4:34:FC:0C:DE:48:6F:09:CF:8F:CD:A2:1A:67:BE:A5:EE:1C:A2:70:08:86

org.sufficientlysecure.keychain
28:05:A6:F4:65:AC:B9:23:10:3A:2A:B3:A1:45:E1:A9:7A:74:C4:4A:CF:75:12:50:B5:88:EB:C3:F8:8A:0C:C9

com.bobek.compass
A9:97:05:30:D9:46:E6:93:30:2E:DE:EF:D8:74:15:49:27:2B:C6:0B:BC:ED:EF:28:E3:A6:86:37:1B:B6:3C:D9

com.bobek.compass
E0:AD:31:17:08:45:F1:3A:B0:F7:E4:66:52:AD:B1:D2:DE:08:F0:97:F8:3B:D7:9D:4A:DF:2B:AA:DE:6C:D2:DA

net.thunderbird.android
B6:52:47:79:B3:DB:BC:5A:C1:7A:5A:C2:71:DD:B2:9D:CF:BF:72:35:78:C2:38:E0:3C:3C:21:78:11:35:6D:D1

at.bitfire.davdroid
B3:9E:7B:77:EC:85:34:83:64:6B:21:B4:A3:E3:CA:54:0B:A0:94:EF:8D:AA:18:E8:7E:0B:E1:FA:46:38:D3:21

app.accrescent.client
06:7A:40:C4:19:3A:AD:51:AC:87:F9:DD:FD:EB:B1:5E:24:A1:85:0B:AB:FA:48:21:C2:8C:5C:25:C3:FD:C0:71

is.xyz.mpv
FA:E7:F9:D0:23:85:CC:24:D9:6E:88:43:66:03:E2:3E:A6:AE:C7:64:9A:D1:25:0A:BB:B4:83:7D:AA:B8:2F:FF

com.x8bit.bitwarden
DE:6E:C9:14:31:55:79:95:29:7B:F3:E6:5B:C8:03:49:BC:60:3A:04:70:81:60:61:8C:86:BC:99:94:17:1C:90

com.kin.easynotes
FC:E8:7D:A9:7F:79:13:01:DF:39:0B:FA:47:E8:16:85:19:11:67:CA:B5:DB:D5:55:DB:82:87:54:1F:78:6E:28

net.bible.android.activity
8B:F5:16:8A:01:94:4D:62:A4:A4:C7:B6:52:F4:73:81:84:00:0D:57:A4:8C:52:89:5A:C6:CB:83:1C:48:CF:30

com.maltaisn.notes.sync
2F:57:9D:5E:09:89:55:94:B1:EF:C5:64:58:DD:2B:AE:F9:00:B0:A0:9E:6C:7E:8A:F6:48:83:44:A9:22:A7:D0

app.organicmaps
B9:C7:AE:79:A5:A9:02:70:DF:08:A1:32:E5:36:B9:C6:66:F5:BE:F1:F5:9B:30:4F:CE:CF:86:87:86:5E:4B:5B

app.organicmaps
E2:16:FC:38:6C:32:7E:C8:8D:05:60:26:F1:DE:A2:7B:E2:BC:3F:9D:7E:E9:56:E4:36:1C:4B:64:EC:45:9F:E9

rkr.simplekeyboard.inputmethod
12:F0:75:0B:F1:60:74:69:76:4F:8A:CF:0D:B6:7A:E1:CE:F3:A6:A5:E1:F0:97:50:4E:64:2E:6E:DB:D1:0E:4E

com.youneedabudget.evergreen.app
1A:9D:B5:68:EE:A7:A3:C7:AD:C6:46:21:11:FE:1A:51:8A:AC:C5:DF:8A:47:A6:C3:EB:BC:4F:63:8A:5C:CB:1C

it.fast4x.rimusic
A1:BA:8B:D7:4A:F8:F9:2C:B3:71:9A:07:21:13:A2:18:CF:AE:C0:2B:CE:2B:73:6A:28:0E:31:D8:CD:11:80:8C

dhhdjbd

beard com.x8bit.bitwarden
DE:6E:C9:14:31:55:79:95:29:7B:F3:E6:5B:C8:03:49:BC:60:3A:04:70:81:60:61:8C:86:BC:99:94:17:1C:90

I have
com.x8bit.bitwarden
24:E0:6C:04:C2:08:04:8F:19:F1:C9:93:B4:DD:A4:43:0E:A8:B0:6D:B8:37:5E:A0:E3:7B:83:46:96:B9:AC:3A

(and it says database verified)
? (I have the github version, do you have the fdroid version maybe?)

beard

beard For YNAB users out there, at the time of writing this, the APK on https://youneedabudget-com-ynab.en.uptodown.com/android/download matches the signature from the Play Store.

beard

Sbpr No real need for organization... Ctrl+F should do the trick. :-)

dhhdjbd

dhhdjbd
https://discuss.privacyguides.net/t/bitwarden-android-app-signing-key-mistake/17246

this should confirm one is the fdroid and one the github

beard

dhhdjbd Yes, I have the f-droid version, but downloaded from github.

Hsjhhedg

ch.shiftcrypto.bitboxapp GitHub version, which may be different from the Play Store version.
67:E9:05:08:F7:49:BE:9D:CF:B1:83:33:92:BA:99:EE:BF:89:37:B1:BA:DD:F3:05:63:1C:E2:D9:FB:A5:0B:D7

For some reason they insist on only using GPG verification, whereas Blockstream Green lists the apk certificate fingerprint.

gvprtskvni

Can someone who has either Fossify Gallery, Metro music player, NotallyX, the open source DeepL Translator app, Open Video Editor or Fcitx5 keyboard share their hashes? I get the following:

org.fossify.gallery
AF:FD:B1:24:D3:F4:72:0C:2F:98:DB:CA:9E:AC:BA:05:14:FB:A4:30:6E:20:A2:78:6C:86:1C:3C:0D:6F:F2:92

io.github.muntashirakon.Music
E2:40:9F:8C:F2:C1:6F:2A:4E:79:74:A2:F0:F5:BE:44:E1:D3:92:EC:55:76:19:B9:04:F7:4E:F6:00:E1:06:AA

com.philkes.notallyx
D2:14:B6:05:7B:79:F8:25:09:DD:CD:1E:35:19:65:B3:C6:EC:C4:B2:A3:89:6E:5C:DF:88:5A:70:A0:B6:1D:FD

com.example.deeplviewer
9D:4A:B3:C7:FD:F9:F6:E9:EE:1C:2A:4E:62:EE:80:7D:0E:74:39:01:F4:8C:B9:93:AB:D0:FA:06:A2:00:3F:49

io.github.devhyper.openvideoeditor
84:DF:64:4C:C5:DB:D4:EA:50:60:2B:9F:23:E4:FB:F3:B2:2E:E5:CD:21:82:43:7B:EF:72:C7:C7:99:F1:2D:B6

org.fcitx.fcitx5.android
E4:DB:1E:9E:DF:F1:36:29:D0:7D:E4:BB:F8:16:5F:E9:BD:85:57:AB:55:09:26:72:DA:8E:40:DB:E4:84:EC:D7

gvprtskvni

gvprtskvni The Fossify Gallery and Fcitx5 ones are correct as confirmed by the developers.

IcyScroll

gvprtskvni Can confirm NotallyX and Open Video Editor are the same for my installations.

« Previous Page Next Page »