Let's compare hashes for apps not in AppVerifier's database!

Novaliss

Fortuneo, from Sandboxed Google Play
com.fortuneo.android
F6:24:A8:BC:C1:86:E5:3D:EE:80:A2:07:D7:08:3A:0D:2E:A7:2C:2A:27:F9:9A:81:36:57:77:BF:A3:79:94:A4

Novaliss

Universal Installer, from https://github.com/pass-with-high-score/universal-installer/releases
app.pwhs.universalinstaller
40:E1:D8:6C:62:28:80:9E:07:85:7A:62:ED:CF:72:95:2F:EA:66:4E:71:53:17:92:01:50:B9:37:EF:75:F5:DE

JustBeginnez

ch.protonvpn.android.reproducible
DC:C9:43:9E:C1:A6:C6:A8:D0:20:3F:34:23:EE:42:BC:C8:B9:70:62:8E:53:CB:73:A0:39:3F:39:8D:D5:B8:53

Novaliss

JustBeginnez From which source is this?

hxhdjdndn

de.blinkt.openvpn https://f-droid.org/packages/de.blinkt.openvpn
4C:D3:30:FE:65:93:E2:E6:4B:1E:1F:A3:83:F0:C6:D7:38:92:18:4F:C1:CD:1A:90:9E:71:D5:58:D8:62:E2:12

popcorn

Does anyone have Obscura VPN from GitHub?

AKRAKU

Hi! I couldn't find the hash for com.networscanner.app anywere. I've downloaded it from the github page and installed through Obtanium. This is the hash I see through AV

com.networkscanner.app
CF:89:91:3C:18:DC:8E:F3:0C:88:F0:95:7C:C4:92:EA:EA:04:20:20:44:FD:D4:26:0D:9C:CB:CA:97:9E:0F:FA

If you can confirm it I proceed with the installation.

Thx

Novaliss

AKRAKU Please provide a precise link to the app. Too many result when searching for Networkscanner.app.

Also, @GrapheneOS this reference has a typo, which is easily missed. Could maybe an admin correct this, so users don't search using this app name? (I did it, before realising it).

AKRAKU com.networscanner.app

zuqaq

popcorn
Obscura VPN (Github)

https://github.com/Sovereign-Engineering/obscuravpn-client/releases/download/v%2F1.177/obscura-1.177.apk (Direct Link)

https://github.com/Sovereign-Engineering/obscuravpn-client (Github Repo)

net.obscura.vpnclientapp
2D:1D:7F:E6:B5:73:FE:D0:49:C8:03:6A:D1:7D:FF:18:A2:BB:D0:7C:97:13:D7:93:07:B2:DF:B2:D4:B1:4D:64

AKRAKU

Novaliss sorry you're right I did miss it. Here's the link https://github.com/usamaiqb/network-scanner
I opened an issue and the developer actually showed that the sha256 hash was into the asset section, it doesn't match though

JustBeginnez

Novaliss

I got this app from this link.

https://github.com/ProtonVPN/android-app/releases/download/5.20.21.0/ProtonVPN-5.20.21.0.605202100.-fdroid-reproducible-release.apk

ch.protonvpn.android.reproducible
DC:C9:43:9E:C1:A6:C6:A8:D0:20:3F:34:23:EE:42:BC:C8:B9:70:62:8E:53:CB:73:A0:39:3F:39:8D:D5:B8:53

AKRAKU

AKRAKU @Novaliss Dev has replied, but its reply is kinda confusing to me

CF:89:91:3C:18:DC:8E:F3:0C:88:F0:95:7C:C4:92:EA:EA:04:20:20:44:FD:D4:26:0D:9C:CB:CA:97:9E:0F:FA value is the SHA-256 fingerprint of the signing certificate, rather than the SHA-256 hash of the APK file

What's the difference? Why he published the SHA-256 of the APK rather than the SHA-256 of the fingerprint of the signing certificate, or both of them?

Novaliss

AKRAKU Why he published the SHA-256 of the APK rather than the SHA-256 of the fingerprint of the signing certificate,

I've seen this being done before, for a few apps. But this is my results for checking on three different sources for the app;
version 1.1.8, com.networkscanner.app, versionCode 13

Github
com.networkscanner.app
CF:89:91:3C:18:DC:8E:F3:0C:88:F0:95:7C:C4:92:EA:EA:04:20:20:44:FD:D4:26:0D:9C:CB:CA:97:9E:0F:FA

Sandboxed Google Play
com.networkscanner.app
CF:89:91:3C:18:DC:8E:F3:0C:88:F0:95:7C:C4:92:EA:EA:04:20:20:44:FD:D4:26:0D:9C:CB:CA:97:9E:0F:FA

Fdroid
com.networkscanner.app
CF:89:91:3C:18:DC:8E:F3:0C:88:F0:95:7C:C4:92:EA:EA:04:20:20:44:FD:D4:26:0D:9C:CB:CA:97:9E:0F:FA

Identical hashes of the signing.

Novaliss

AKRAKU What's the difference?

What we do like in this thread, is hashing the signing cert to compare, and this checked out for all sources in this case.

What some developers do is hash the whole installation file. The three extracted installation files I got for this app, differed completely when testing hashing the whole files, even though their signing fully corresponded. This might have utility for the developer in some way, but since any differences in the various sources file packaging, compression etc, alters the whole file-hash, it isn't what we want to check.🕵🏾‍♂️

AKRAKU

Novaliss thank you for the whole explanation, now it's clear to me. I will repost your reply onto the issue I've opened so the developer has evidence of what's happening here and maybe he'll publish both hashes for the next version, this way it would be better since the app is on the Obtanium webside index. You are great Novaliss, your replies are always fast and very informative, thank you!

Novaliss

AKRAKU Thank you. 🫡

popcorn

Anyone have MeshCore from https://files.liamcottle.net/MeshCore/v1.49.0/?

Novaliss

popcorn
com.liamcottle.meshcore.android
F9:36:C9:3F:DD:6F:57:F1:CD:F2:A7:1B:E6:16:4A:03:F2:4E:89:62:10:83:F1:74:08:32:CE:50:93:62:B4:7B

The one from https://files.liamcottle.net/MeshCore/v1.49.0/
has a hashed signing, and package naming identical to the one from Google Play.

popcorn

Novaliss thank you so much.

any chance you could also do MeshCore Open (https://github.com/zjs81/meshcore-open/releases/download/PRE-BETA-9.5.1/meshcore-9.5.0+16-release.apk)

Novaliss

popcorn
com.meshcore.meshcore_open
D9:99:86:BE:89:2A:0C:69:0C:00:E3:03:64:95:21:29:04:07:8D:EF:7F:6E:D8:9A:2C:30:9A:37:5E:A3:C5:D0

« Previous Page Next Page »