Let's compare hashes for apps not in AppVerifier's database!

gamma7

Google AI edge gallery (github)

com.google.ai.edge.gallery
B3:3F:19:26:A5:4C:12:AB:CD:5B:85:4E:CB:59:16:29:38:55:AB:C2:58:0E:CB:6E:06:6C:14:D9:24:14:13:CE

Gadgetbridge (git repo)

nodomain.freeyourgadget.gadgetbridge
01:CC:E9:31:6F:CB:77:EA:02:C6:DE:A8:1F:DE:9F:31:76:46:92:02:C0:CE:A0:51:4C:0E:03:CB:96:9B:C7:BE

Spotube (github)

oss.krtirtho.spotube
38:DA:7C:14:27:90:C4:46:AF:A3:50:24:D5:8B:DC:FD:57:2B:B7:3F:83:D3:38:18:4D:EA:02:EA:C4:34:47:11

Overlay1404

Gouser Anyone able to provide hashes for:

i2p

i2pd

With a source other than play store like official site

org.purplei2p.i2pd
FC:C3:C7:34:9E:22:6A:77:B3:70:46:BB:00:FD:04:BB:A5:30:32:21:01:F8:62:F3:6D:8C:3D:B0:EB:B6:35:20

net.i2p.android.debug
58:DA:F2:BD:A4:23:82:C5:C2:13:33:2C:23:14:91:17:8A:6E:C3:B9:9B:E6:EC:3C:1F:ED:77:C5:67:D4:06:DD

sources:
https://github.com/i2p/i2p.android.base/releases/tag/i2p-android-2.6.0
https://github.com/PurpleI2P/i2pd-android/releases/tag/2.60.0

Gouser

Overlay1404

The i2p debug build not match the official released version on their website https://i2p.net/en/downloads/ . As of this writing I don't see a Github release for the latest version.

net.i2p.android
22:65:8C:C6:9F:48:D6:3F:63:C3:D6:4E:20:41:C8:17:14:E2:74:9F:3F:6E:54:45:C8:25:29:7A:00:DD:C5:B6

Can someone confirm this hash?

The I2pd hash matches both the package name and signing certificate hash of the release on https://github.com/PurpleI2P/i2pd-android/releases

org.purplei2p.i2pd
FC:C3:C7:34:9E:22:6A:77:B3:70:46:BB:00:FD:04:BB:A5:30:32:21:01:F8:62:F3:6D:8C:3D:B0:EB:B6:35:20

Overlay1404

Gouser

Gouser The i2p debug build not match the official released version on their website https://i2p.net/en/downloads/ . As of this writing I don't see a Github release for the latest version.

net.i2p.android
22:65:8C:C6:9F:48:D6:3F:63:C3:D6:4E:20:41:C8:17:14:E2:74:9F:3F:6E:54:45:C8:25:29:7A:00:DD:C5:B6

It matches when I use that apk.

net.i2p.android
22:65:8C:C6:9F:48:D6:3F:63:C3:D6:4E:20:41:C8:17:14:E2:74:9F:3F:6E:54:45:C8:25:29:7A:00:DD:C5:B6

simple_irritable989

Obsidian (GitHub Release)
md.obsidian
BD:3B:D5:2F:44:27:B5:AB:7F:80:59:D0:71:A3:5E:3D:E9:43:C6:46:54:6D:32:31:3D:A5:F1:CA:C2:54:B7:E4

NewPipe (From NewPipe Site)
org.schabi.newpipe
CB:84:06:9B:D6:81:16:BA:FA:E5:EE:4E:E5:B0:8A:56:7A:A6:D8:98:40:4E:7C:B1:2F:9E:75:6D:F5:CF:5C:AB

Fossify Voice Recorder (GitHub Release)
org.fossify.voicerecorder
AF:FD:B1:24:D3:F4:72:0C:2F:98:DB:CA:9E:AC:BA:05:14:FB:A4:30:6E:20:A2:78:6C:86:1C:3C:0D:6F:F2:92

Immich (GitHub Release)
app.alextran.immich
86:C5:C4:55:DF:AF:49:85:92:3A:8F:35:AD:B3:1D:0C:9E:0B:95:7D:7F:94:C2:D2:AF:6A:24:38:AA:96:00:20

Tasks.org (F-Droid)
org.tasks
A0:38:A0:55:BF:43:B2:65:9C:BA:F8:62:80:8A:FD:5E:44:7D:4D:0E:27:49:A1:03:91:91:00:09:CB:D8:DC:FA

Tempus (GitHub Release)
com.eddyizm.degoogled.tempus
B7:85:01:B9:34:D0:4E:0A:CA:8D:94:AF:D6:72:6A:4D:1D:CE:65:79:7F:1D:41:71:0F:64:3C:29:00:EB:1D:1D

OpenTracks (F-Droid)
de.dennisguse.opentracks.playstore
87:2C:78:45:63:77:3B:3D:76:9E:C3:4C:EA:C4:E3:8F:1A:2F:15:EF:8E:D4:4A:61:21:4C:6D:9D:11:C8:8A:9B

Termux (GitHub Release)
com.termux
B6:DA:01:48:0E:EF:D5:FB:F2:CD:37:71:B8:D1:02:1E:C7:91:30:4B:DD:6C:4B:F4:1D:3F:AA:BA:D4:8E:E5:E1

WireGuard (From WireGuard Site)
com.wireguard.android
84:A1:3F:A2:C4:E0:06:4B:0C:11:65:4B:8A:86:57:4B:7A:9B:93:52:A3:83:4C:EE:32:45:5B:06:1C:3D:41:27

subwoofer

Filen.io?

Novaliss

subwoofer Filen.IO
io.filen.app
2C:90:DF:59:1A:39:E0:8A:AD:E9:4F:72:80:D1:92:D3:34:47:F0:1E:1E:12:75:19:82:B8:AE:C3:F9:0F:AD:AB

From Google Play Store

IcyScroll

Paralino, e2ee live location sharing, direct download.

The hash is published on the website and here. I didn't find it on any independent platform, so I'll mirror it here:

app.paralino.android
7C:36:87:CA:81:BC:A2:0C:32:09:5E:CE:AD:18:29:09:DC:50:87:03:6A:37:F0:77:2B:2D:9E:5D:85:91:41:DC

simple_irritable989

It looks like Privacy Guides is making their own AppVerifier database. They're accepting app submissions if you all want to contribute

Overlay1404

simple_irritable989 considering how hard it is to actually search this thread I would encourage people who are planning to post on this thread to also contribute the info to the privacy guides database.

GraphPaper

Passchain (Accrescent)

s1m.hwfido2provider
94:BD:36:BA:46:48:D3:86:97:CD:FC:F3:38:5B:6C:00:88:FF:3D:55:1C:E9:FC:16:05:0E:E0:80:B9:55:3E:C5

MSX2GOS

HMRC (GPlaystore)

uk.gov.hmrc.ptcalc
0B:75:D3:CA:1D:D1:2D:D9:AD:16:ED:80:E9:C5:B3:7B:D4:79:72:A8:7A:9D:DF:24:96:F6:F1:EC:9A:46:B1:DE

GraphPaper

Trale and Transcribro. Both from Accrescent

Trale

de.quantumphysique.trale
A2:6E:7B:1B:C1:9F:7F:11:81:C0:F1:5C:96:BF:B9:5E:99:9D:FD:28:4F:E0:5F:96:7D:60:45:E1:6C:41:14:38

Transcribro

dev.soupslurpr.transcribro
7D:BC:FB:FA:A1:35:B4:4E:6E:93:91:02:25:DC:B1:4E:05:82:91:DA:8C:2D:36:22:73:49:49:B7:1A:B3:BE:64

GraphPaper

Mailfence (Google Play Store)

com.contactoffice.mailfence
97:FE:5D:AA:04:8D:40:D3:CC:F0:A1:09:8F:47:FC:99:D1:A0:36:FA:BA:AF:B9:80:1F:51:E5:63:69:59:14:38

Also matches the hash published on their website:

https://kb.mailfence.com/kb/mailfence-app/

Carrousel7956

Privacyguides has released a pre-release for their AppVerifier fork with their database built in. It also makes it really easy to submit missing apps by just clicking Submit on Github and it will pre-fill a commit to submit your App info.

https://github.com/privacyguides/verified-apps-android/releases
https://discuss.privacyguides.net/t/verified-apps-app-for-android-pre-release/38348

xxx

Carrousel7956 with their database built in

Nice. It works as expected.

gamma7

Any Soft Keyboard
https://github.com/AnySoftKeyboard/AnySoftKeyboard

com.menny.android.anysoftkeyboard
B8:26:54:7A:A5:79:D3:0B:CA:8F:B4:91:A3:1A:54:C0:1D:1B:42:06:4F:AD:29:98:59:9A:58:11:EC:71:D3:B0

Ring droid
https://github.com/althafvly/ringdroid

com.ringdroid
51:A8:FE:10:A2:F6:2D:5A:C2:2F:7D:16:87:C9:BC:A0:1E:D6:0B:22:5D:15:D3:FA:63:9C:6D:C3:AF:82:CF:F2

DAVx⁵
https://github.com/bitfireAT/davx5-ose/

at.bitfire.davdroid
B3:9E:7B:77:EC:85:34:83:64:6B:21:B4:A3:E3:CA:54:0B:A0:94:EF:8D:AA:18:E8:7E:0B:E1:FA:46:38:D3:21

Gadgetbridge (codeberg)
https://codeberg.org/Freeyourgadget/Gadgetbridge

nodomain.freeyourgadget.gadgetbridge
01:CC:E9:31:6F:CB:77:EA:02:C6:DE:A8:1F:DE:9F:31:76:46:92:02:C0:CE:A0:51:4C:0E:03:CB:96:9B:C7:BE

Iyox Wormhole
https://github.com/iyox-studios/iyox-Wormhole

com.iyox.wormhole
B7:0F:08:59:F9:BB:DE:82:0C:B3:DF:38:1F:C1:3B:65:BF:03:D8:A2:17:17:51:A7:5E:C1:59:48:19:42:42:4C

gamma7

Squawker
https://github.com/j-fbriere/squawker

org.ca.squawker
39:FB:AE:AF:F1:D5:C7:76:73:8F:28:01:EF:26:02:F6:30:5C:7D:8A:C4:D2:F1:E3:9E:E6:E2:36:89:39:95:E3

AB Download Manager
https://github.com/amir1376/ab-download-manager

com.abdownloadmanager
89:5D:EC:A5:E0:35:3C:AC:C4:42:C8:60:4C:FD:6E:27:5D:04:27:6E:2D:02:E3:E1:53:60:FF:DF:D0:2E:CE:F2

JustBeginnez

com.google.android.apps.recorder
26:EC:42:C1:C3:F7:8B:73:D2:90:42:B0:6C:7D:9B:23:49:E0:91:1A:E5:10:F1:AD:CE:74:5F:9C:69:98:56:F9
AD:57:4F:AA:ED:A5:56:3E:67:78:E7:4C:A4:A0:94:AB:7F:75:9A:B0:87:9C:B4:2E:85:21:5A:D4:EB:3E:B4:E8

com.microsoft.office.word
B9:25:13:6F:3E:A7:C0:A1:95:16:90:A1:AB:31:39:10:DA:81:F4:09:94:A8:53:42:EC:62:28:88:F1:28:70:51
1F:B4:DE:76:0F:40:F3:0E:66:D3:08:51:8A:1B:D9:D1:4E:F1:41:1B:FF:A9:D6:76:28:76:B6:02:66:1D:54:ED

com.microsoft.office.powerpoint
B9:25:13:6F:3E:A7:C0:A1:95:16:90:A1:AB:31:39:10:DA:81:F4:09:94:A8:53:42:EC:62:28:88:F1:28:70:51
1F:B4:DE:76:0F:40:F3:0E:66:D3:08:51:8A:1B:D9:D1:4E:F1:41:1B:FF:A9:D6:76:28:76:B6:02:66:1D:54:ED

ClickClickDrone

Novaliss This thread is growing hard to search

It is probably about time to create a GitHub Pages repository and host the hashes on, instead of having this unorganised thread.

I am genuinely open to helping out with that if wanted; just DM me on Matrix and we could go on from there.

DeletedUser928 What problem are these geniuses trying to "solve"? genuinely curious.

It is useful for getting a "second opinion", especially when a developer hasn't published a signature hash. However, I do agree serious caution should be exercised before using these.

It also prevents attacks where an app was modified for a specific person, because everyone else would not have that specific hash for that app.

Novaliss

ClickClickDrone time to create a GitHub Pages repository and host the hashes

I tried this a couple of months ago, but didn't complete due to couldn't put the time into it. There's at least one project scraping this thread,

https://github.com/RoundSalmon4/AppVerifierBG/releases

but I don't think they preserve our install source entries, just grabbing the signing hashes.

« Previous Page Next Page »