Let's compare hashes for apps not in AppVerifier's database!

dhhdjbd

peergos.android
2C:5B:61:53:7D:0B:18:C8:E8:58:CC:F3:F4:85:A8:B0:FA:34:50:B6:17:C6:21:1D:18:50:77:78:1F:26:F0:30

Novalissoide

Stayput
Version 0.8.8 versionCode 9
https://apt.izzysoft.de/fdroid/index/apk/org.y20k.stayput/
org.y20k.stayput
61:05:14:5F:84:E5:CB:D6:97:F0:F6:E1:2C:97:77:04:2E:9B:2D:B6:67:A7:FF:0D:A4:12:F6:74:35:31:6D:D8

Novalissoide

Gcam Services Provider, photosonly
https://github.com/lukaspieper/Gcam-Services-Provider/releases/download/v1.6.1/app-photosonly-release.apk
com.google.android.apps.photos
35:7C:24:3C:84:DA:6B:10:B6:B3:4F:CD:CC:AB:B6:C9:F8:39:D8:CF:0F:7D:93:D4:F4:5F:02:13:FE:D6:BC:5E

Murcielago

s1m.hwfido2provider
94:BD:36:BA:46:48:D3:86:97:CD:FC:F3:38:5B:6C:00:88:FF:3D:55:1C:E9:FC:16:05:0E:E0:80:B9:55:3E:C5

https://codeberg.org/s1m/hw-fido2-provider

Winston

Discord
https://apkpure.com/discord-talk-chat-hang-out/com.discord

com.discord
3C:39:D2:3C:F9:36:78:49:A5:C6:99:39:56:47:FE:0E:5B:FE:A5:A1:F1:F4:0D:8C:71:7D:DC:70:F8:BF:A1:13

Novalissoide

Katawa Shoujo: Re-Engineered Version 2.0.4 (1771178129)
https://github.com/fleetingheart/ksre/releases/download/v2.0.4/sh.fhs.ksre-release.apk

66:12:33:AE:9C:60:D2:DE:54:13:16:7C:13:B4:D3:95:10:9E:8F:E3:1B:8E:4F:02:75:FB:A5:65:FC:69:E9:74

Novalissoide

TorVPN
Version 1.5.0Beta-universal. VersionCode 190 GPlay
org.torproject.vpn
77:C3:CA:03:39:B2:10:64:59:48:67:FB:95:23:66:0D:7C:74:B2:60:1C:19:31:25:05:16:D5:F2:B3:4C:F5:E2

zuqaq

OpenKeychain (F-Droid)
org.sufficientlysecure.keychain
28:05:A6:F4:65:AC:B9:23:10:3A:2A:B3:A1:45:E1:A9:7A:74:C4:4A:CF:75:12:50:B5:88:EB:C3:F8:8A:0C:C9

Windscribe (Github)
com.windscribe.vpn
9F:B3:57:CA:2D:7F:0A:CC:7B:31:21:98:55:34:49:0D:0A:A7:0F:5D:C6:1C:A8:EC:59:3F:3D:A1:E9:CD:33:9B

Photok (Github)
dev.leonlatsch.photok
B7:04:A2:D2:D5:8A:37:E9:5A:B2:34:96:C3:9A:81:91:35:B8:7A:03:B9:B3:F4:C1:4D:3F:ED:CC:E9:CC:2C:9A

Mihon (Github)
app.mihon
9A:DD:65:5A:78:E9:6C:4E:C7:A5:3E:F8:9D:CC:B5:57:CB:5D:76:74:89:FA:C5:E7:85:D6:71:A5:A7:5D:4D:A2

Lichess (Github)
org.lichess.mobileV2
5B:62:4B:BF:9D:72:D3:18:EA:4F:9E:E3:E2:DA:EB:A7:72:19:E5:97:11:6C:B5:93:12:30:7A:AD:18:44:94:5E

Nagram (Github)
xyz.nextalone.nagram
88:A8:AF:E3:CC:BE:E0:80:C1:3B:73:83:2A:AB:8C:98:A9:F1:9D:1C:65:F3:BC:FD:50:B8:D0:1C:0B:C8:0E:9E

SimplyTranalate Mobile (F-Droid)
com.simplytranslate_mobile
C1:03:5F:AB:0B:E4:75:EB:9F:C7:0E:92:12:48:0D:22:0B:90:C7:E7:4A:1F:9B:53:B5:CA:23:A6:0A:D2:99:F9

LibreTorrent (Gitlab)
org.proninyaroslav.libretorrent
B0:88:D4:72:A9:80:18:64:5C:DE:EF:8E:93:33:8D:58:B3:F2:38:92:18:7F:DF:63:F7:39:58:38:1E:27:E5:83

mumbo

Retroarch from play store via Aurora store:
D7:A5:EA:B3:09:02:C9:B2:77:5A:F6:FB:4E:AC:2D:29:4A:64:63:4F:B4:7D:D1:38:2B:C3:AC:5B:F6:69:98:2E

This matches the 64 bit version I downloaded afterwards from the retroarch website

Jasper82

NoahRaketic The database was mantained by the developer, but it is no longer maintained, and it will never be updated again.

Then someone should Form it, add the option to add custom databases and then institutions like GrapheneOS could build their on databases

dhhdjbd

Jasper82 i am not sure but i think there was never ment to be a full database,

users should get the key from the developers / publisher and use these to verify the app, and best case find a second source to cross verify (like this thread)

having a databse like this will just result in users only relying on the database, reducing their security. at the same time it is a monumental task that grapheneOs will not do. So anyone could be the database provider.

edit: for some apps the developer wont provide info like this, for these it is even more important to look for sources yourself

NoahRaketic

Jasper82 The important things is that it is not the intended way to use the app. What you're suggesting would be a monumental amount of work for a feature that is not a long term solution. You're underestimating how much time it takes for the developer to collect these certificate hashes and overestimating the amount of time the GrapheneOS team has on its hands.

The real solution is to use an app store, and avoid sideloading altogether.

Murcielago

InterProfileSharing

digital.ventral.ips
03:24:3D:0C:0D:44:B6:E0:B4:1E:3C:B2:45:B1:DC:26:9B:E4:C3:FF:E1:77:F8:43:FC:00:5B:C4:EA:0C:74:26

Matches the Hash published on Github, installed from Accrescent.

Novalissoide

Wouldn't it be a clarifying move to remove the internal database from Appverifier? It would make it easier for new users to understand how the verification is supposed to work.

NoahRaketic

Novalissoide Wouldn't it be a clarifying move to remove the internal database from Appverifier?

Yes, that sounds like a good idea to avoid confusion.

Novalissoide I made a feature request at Soupslurpr for a second version of Appverifier that would be identical to the present, but with no internal database.

Perhaps also it could be disabled by default, with a specific setting to re-enable the legacy internal database, with a warning that it's not the intended use and isn't being updated. That sounds cleaner than a separate app.

Novalissoide

I made a feature request at Soupslurpr for a second version of Appverifier that would be identical to the present, but with no internal database. I suspect this would be easier for users to understand. I could be mistaken though, let me know if I'm in the wrong.

Novalissoide

NoahRaketic cleaner than a separate app

It does indeed. My proposal was a second stripped down release for two reasons,
It came across to me as being a less labourious thing to develop, and
I wasn't super sure about being as rational as the idea appeared at a glance...😉

And the hypotethical app should prevent the mistake that I've seen users do, namely tapping 'Copy Verification Info', then tap 'Verify from clipboard'

As of present state, the 'reward' a user gets from doing this is

MATCH
Both the package name and signing certificate hash match
with the expected values
SUCCESS

Novalissoide

NoahRaketic
Apparently this is planned for when Accrescent comes out of current development phases.
https://github.com/soupslurpr/AppVerifier/issues/229#issuecomment-3998309978

NoahRaketic

Novalissoide Well, I think when it comes to preventing user error, app stores are the true long-term solution. I'm not sure how else it would be feasible to prevent such mistakes.

Not to mention, it's very common for users to get certificate hashes from untrustworthy sources, like the same GitHub repo as the APK.

Novalissoide

Chromium browser, Version 147.0.7713.0
taken from
https://www.googleapis.com/download/storage/v1/b/chromium-browser-snapshots/o/Android_Arm64%2F1592163%2Fchrome-android.zip?generation=1772390404109488&alt=media

org.chromium.chrome
32:A2:FC:74:D7:31:10:58:59:E5:A8:5D:F1:6D:95:F1:02:D8:5B:22:09:9B:80:64:C5:D8:91:5C:61:DA:D1:E0

gamma7

Translator

dev.davidv.translator
2B:38:06:E7:45:D8:09:01:8A:51:BE:58:D0:63:5F:FC:74:CC:97:33:43:94:07:AB:1E:D0:42:4A:4D:B3:E1:FB

Libreoffice Viewer (F-droid build)

org.documentfoundation.libreoffice
AF:71:BA:34:4C:AB:25:9F:A6:25:F0:79:FF:52:0F:51:1D:17:A3:72:BB:2E:8F:A2:75:32:79:1B:D5:FE:A8:CB

Xed editor

com.rk.xededitor
8A:D6:B5:93:B0:77:2C:96:F9:D0:5E:92:3B:61:0F:16:AE:D2:79:2C:66:4F:0C:D9:1F:0D:FD:62:70:98:34:6F

Unitto calculator

com.sadellie.unitto
B2:D9:93:8C:97:FA:77:DF:78:14:2C:31:1D:23:4A:AE:9E:70:6F:10:CC:BA:16:7F:2A:2A:3E:33:52:8C:1D:CF

YTDLnis

com.deniscerri.ytdl
26:36:45:CB:52:72:EB:29:07:59:FE:1F:59:14:9A:E2:4D:F6:CE:17:1E:9F:66:66:EE:AD:98:1D:3F:C6:4C:95

Urik

com.urik.keyboard
1C:11:6F:87:9C:3B:87:25:31:B4:65:30:78:C9:A7:BD:67:8C:F0:4D:32:96:AE:CA:5D:2A:C5:F3:81:07:0E:80

Audile

com.mrsep.musicrecognizer
A5:A1:DC:1D:78:D7:F0:3A:95:36:51:B2:7D:3A:07:C2:5E:3A:F0:13:27:F4:5C:DF:86:19:A2:23:B7:03:57:D0

ImageToolbox (foss)

ru.tech.imageresizershrinker
20:D7:68:9D:E0:87:4F:00:01:5E:A3:E3:1F:A0:67:C1:5C:03:45:7D:36:2D:41:D5:E7:93:DB:3A:86:4F:A5:34

Linkora

com.sakethh.linkora
F3:EF:D4:DA:30:E2:90:11:35:3B:0D:A5:0A:E9:E3:A3:A7:4E:FB:95:6A:DF:A8:CF:2B:F6:B7:E8:DF:6F:3D:30

GeoShare

page.ooooo.geoshare
1B:27:B1:7A:9D:F0:53:21:A9:3A:47:DF:31:ED:0D:66:45:EB:E5:5D:0E:89:90:81:57:D7:1C:10:32:D1:7C:10

OsmAnd+ (Fdroid build)

net.osmand.plus
38:29:4E:AA:C9:5C:3B:B5:A9:94:69:2C:D7:75:8F:8B:CD:BF:FB:40:81:9A:F6:E8:06:EB:7F:E4:82:32:4D:CD

EasyNotes (Accrescent)

me.easyapps.easynotes
79:E8:5C:E8:1D:F2:F4:F2:25:C2:2F:EA:0B:2D:19:50:B3:68:62:7E:47:5F:B7:2B:73:85:D2:50:31:3B:F7:C1

SherpaTTS

org.woheller69.ttsengine
ED:93:4E:C7:1B:86:A3:72:BC:2E:5D:9F:9E:FD:FB:B5:2A:11:B8:97:C0:00:BA:E6:A3:3A:C5:9F:79:88:C6:B5

TTS Util

com.danefinlay.ttsutil
23:AD:7A:69:53:F6:E6:AB:74:25:1F:53:4E:0D:E8:1E:7B:EB:18:F8:37:C7:AA:65:E7:F3:5B:D7:0F:77:8B:3D

PocketPal

com.pocketpalai
F5:5A:CA:CB:10:15:5B:EA:11:6E:1D:BA:48:7C:F2:BF:B8:BC:E2:B6:54:39:BC:62:BC:23:70:A6:B2:23:96:14

Photomath

com.microblink.photomath
60:64:BC:C9:5B:B6:ED:52:01:C3:4E:96:AF:45:4A:6C:36:52:56:89:89:18:F5:40:BE:4B:D1:7E:7D:24:A5:F1

ExifEraser (Accrescent)

com.none.tom.exiferaser
D9:10:86:7C:E2:CF:3D:CD:37:DB:51:85:3E:BE:F8:63:3F:D8:3A:14:2B:26:42:27:4E:D0:68:15:2F:F1:22:01

ChatterUI

com.Vali98.ChatterUI
1B:4B:4A:C9:9A:24:CB:95:69:BD:BC:37:CF:BD:E9:16:A4:F5:38:DE:55:C1:F8:02:FA:19:BC:99:E3:3B:7E:3B

Novalissoide

gamma7 If you've got the time, could you add the source of the installs?

« Previous Page Next Page »