KeePassDX free vs libre?

DeletedUser34

Which would be the best in terms of security and privacy? As far as I know: The Free Version is compiled and signed by the developers, and sent to the Play Store. And the libre Version have no proprietary code, and is not linked to any closed services. But it is automatically signed and compiled from the GitHub repository by F-Droid.

So I'm not sure, which to choose.

Stephan-P

DeletedUser34 there is no difference in usage. Each version offers all functionality available.

doublefree

SerenityNow their wiki also says "In both cases, this versions are available on Github and signed by the creator of the app."

DeletedUser34 If you use the Play Store you get the free version. If you use Obtainium, use the libre version (because of FOSS) unless you need the free version (see Stephan-P ).

SerenityNow

Their Github page says:

'The Free version, for everyday use, is the basic version at the Google Play Store. It is compiled and signed by the developers, and sent to the Play Store to be cataloged by Google.

The Libre version is the version provided to have no proprietary code, and is not linked to any closed services. The app is automatically signed and compiled from the GitHub repository by F-Droid. It is possible to unlock the themes with a procedure.'

DeletedUser34

SerenityNow You did just repeat what I did say...

DeletedUser34

Stephan-P But they are signed differently and their code is proprietary or not. The Question I meant here is if I should accept F-Droid signing it for no proprietary code or if I should accept proprietary code for the Developers signing it?

SerenityNow

DeletedUser34 Right. I should read fully and with more concentration.

doublefree

DeletedUser34 use the libre version from GitHub, you get FOSS with developer signed apk and fast updates.

DeletedUser34

doublefree Thank you, then I will download the libre Version, as you said. I saw that IzzyOnDroid Repo only has the free Version, I guess I will suggest them to make the libre Version available too.

Kong

This is noob question so be patient, please.

I am thinking about downloading free version, not the libre one.

Free version in built on F-Droid servers as I understand. F-Droid project is not regarded as secure one.

GooglePlay version does not contain trackers, and they are built by developer directly.

What do you think about this?

1qkv9ddu3so2irvz

Kong I am thinking about downloading free version, not the libre one.

Why?

Kong

1qkv9ddu3so2irvz sorry, I can not edit the last post so I am pasting edited one here:

This is noob question so be patient, please.

I am thinking about downloading free version, not the libre one.

Libre version in built on F-Droid servers as I understand. F-Droid project is not regarded as secure one.

GooglePlay version does not contain trackers, and they are built by developer directly.

What do you think about this?

I hope now, my reasons are more clear. :-)

wagg3r

Kong Its possible to get the libre version directly from the dev at https://github.com/Kunzisoft/KeePassDX if you want to avoid both F-Droid and the Play Store. You can check the signature of the download with the AppVerifier app available in Accrescent. Install and update it using Obtainium. Just an option...

1qkv9ddu3so2irvz

Now it makes more sense ;-)

Kong

wagg3r
That's why I am suspicious:

The Libre version is the version provided to have no proprietary code, and is not linked to any closed services. The app is automatically signed and compiled from the GitHub repository by F-Droid. It is possible to unlock the themes with a procedure.

So as I understand libre version is built on F-Droid.

wagg3r

Kong That's not how I understand it.

Updating the project takes 1-5 days for F-Droid to analyze all available repositories, build sources and deploy the generated APK. So F-Droid is slower for deployment, but is run by volunteers and guaranteed to be a clean APK. :) Unfortunately, since an F-Droid update, the repos cannot be automatically built and causes a version delay. It is recommended to use Obtainium if you want the latest Libre version from Github.

The Libre app on GitHub is available prior to being available on F-Droid as they compile their own version from the repo.

1qkv9ddu3so2irvz

Is it possible to see what target SDK an app is built for? Wouldn't that solve whether or not the libre version is built explicitly for fdroid or not?

wagg3r

1qkv9ddu3so2irvz The security concerns with F-Droid are, I think, down to the fact that they build their own APKs from the source code. The APKs on GitHub are built by the dev themselves so that particular security issue is moot.

Stephan-P

To put it more explicitly:

The apps provided through F-Droid are rebuilt by F-Droid (and some knowledgeable people consider this a security concern)
The apps made available at KeePassDX' GitHub are built by the KeePassDX team (upon whom we put our faith 😉)