F-Droid vulnerability allows bypassing certificate pinning

Watermelon

n2gwtl The security of F-Droid repos depends on the security of your F-Droid client app. The official F-Droid client apps come from F-Droid, third-party forks of them still contain code from F-Droid due to forking, and other third-party client apps that aren't forks of the official apps still carry the risk of trusting an unknown third-party client app that god-knows-who created.

GrapheneOS

n2gwtl The official F-Droid repository and Izzy's repository are highly untrustworthy sources of apps which should be avoided. F-Droid itself and the repository system have poor security. The official F-Droid repository has massive usability and security issues with how they do builds and signing. The issue brought up in this thread is pretty close to irrelevant with very little impact and has little to do with the real, severe problems with them.

Watermelon

After this thread was posted, I thought back to why I've started to use F-Droid in the first place. F-Droid, and open source software in general, was never meant for security. The only security benefit of open source software per se is that the users are allowed to not depend on the software author's trustworthiness. Note that this is different from not depending on their trustworthiness, it's being allowed to not depend. One of the beneficial goals of F-Droid was also to gather open source apps that may not be entirely freedom-respecting, and either strip them of the freedom-disrespecting parts and/or mark them appropriately. This was supposed to be for the benefit of freedom, not for security. Furthermore, the idea that F-Droid should responsibly build and distribute the apps they offer, including enabling reproducible builds, is not supposed to be a security benefit of F-Droid, it's a basic responsibility that they willingly don't fulfill.

I like the idea that there's a catalog of freedom and privacy-respecting open source apps and that someone curates based on their quality and security, but while F-Droid does have some high-quality apps, they're neither curated as aforementioned, nor built and distributed responsibly.

There's also the argument that the fact that F-Droid signs the apps using their own keys adds an additional point of failure — I understand the argument but personally I might not have a problem trusting an additional party, if they were acting responsibly. F-Droid clearly doesn't. And the apps they sign themselves hijack the package name, which prevents the ability to have both the original version and the F-Droid version side-by-side, and prevents easily migrating data to leave the F-Droid versions of apps.

So can people please stop saying that they want F-Droid for better security?

ryrona

Watermelon So can people please stop saying that they want F-Droid for better security?

Some people like to think of security and privacy and freedom as three distinct categories, and on the surface it may seem to make a lot of sense. But in practice, they are intertwined. Many on this forum has said one cannot have privacy without security, as if the app one use is not secure and can be hacked, one simply does not have any privacy either, no matter how privacy respecting the app was designed to be. I have argued the opposite holds too, that one cannot have security without privacy, as if your privacy is compromised, your personal security is also compromised.

This really applies to the freedom aspect as well. The probably most politically relevant example right now is in case end-to-end encryption would be outlawed, or client side scanning would be mandated by law. If you don't have freedom, you would lose end-to-end encryption or be forced to have government scan all your private files and messages. Then you no longer have any privacy at all, either, and thus no personal security. But freedom will allow you to modify your system, and re-enable end-to-end encryption and remove client side scanning.

And telemetry and how Apple and stock Google devices have zero privacy is often discussed, and is a major sales point for GrapheneOS. Yet, Linux also have telemetry by default, but it can be easily disabled, by simply uninstalling the telemetry components. Freedom guarantees that. It does seem freedom is necessary for privacy, and privacy is necessary for personal security. It is all intertwined.

I use F-Droid, because I cannot afford having that freedom taken away from me in my threat model. I am an activist for the rights of the oppressed minority I belong to, and loss of freedom and thus privacy and thus personal security would mean I get silenced.

I wished there was an app repository that took all of security, privacy and freedom seriously though.

Watermelon

ryrona They won't start building the apps themselves though, but will just trust the uploader

I think it's only an issue for this usecase:

Watermelon One of the beneficial goals of F-Droid was also to gather open source apps that may not be entirely freedom-respecting, and either strip them of the freedom-disrespecting parts and/or mark them appropriately.

For high quality open source apps I believe it shouldn't be needed.

GrapheneOS

@Artr Your assumptions are completely wrong and there's no need to post assumptions here in the first place. If it takes them half a year to notice WireGuard including a self-update system against their policies, what makes you think they're even looking at the release notes let alone at the actual code? It's simply not what they do. They are not actually reviewing the code in the way you think but rather are doing things based on half-baked scanning and user reports.

F-Droid is a highly untrustworthy group of people consistently involved in cover ups of vulnerabilities and attacks on security researchers including harassment. We advise against using it for even a single app. Get the apps directly from the developers instead and you're avoiding trusting highly untrustworthy people as a middleman who are consistently doing the opposite of protecting you. They aren't going to protect you from a compromise where hidden malicious code is included in practice unless the people doing it completely lack any attempt at stealth which would include them doing similar scans themselves to make sure it's not going to get flagged.

Artn

GrapheneOS If this was a reply to my post, I withdraw my assumption. It was based on the timing of the first published article and its eventual discussion in Hacker News. After this, F-Droid published the basic version of the client with fewer privileges as a fix to the lower-hanging fruits of the complaints about their security practices. It does not necessarily mean the first article caused the changes. I only (as you corrected) wrongly assumed the chain of events. Despite this, a distribution system that can be compromised easily is not an option.
As for the goals, they have nothing to do with the team or the project; the goals, objectively, are deemed necessary, and (unfortunately) there are no alternatives that can deliver those objectives right now. The most unfortunate, however, is that this topic of discussion has been around for over 3 years and is directed at the people rather than solutions.
I can see how some of their community members' replies target a person and offend them in their blog posts. I hope the discussion here can be more about how an ideal replacement would operate if it were to stick to the above mentioned goals.
A direct APK distribution system is not a replacement.
A distribution system which controls developer keys is not a replacement.
A distribution system that can selectively update apps and libraries of a particular device without user knowledge is not a replacement.
Instead of enumerating the badness of a particular project or the team members, the discussion could be about the goals of an alternative project, which will probably be more helpful in redirecting resources towards better projects.

GrapheneOS

n2gwtl We've been clear the official F-Droid repository is not a trustworthy source of apps and that F-Droid is not a secure or recommended way to obtain apps in general. Apps which are serious about security should provide a better way of obtaining and updating their app such as including a self-update system in the app.

n2gwtl

GrapheneOS I think what's needed is a consortium of the big players in privacy and security - GrapheneOS, signal, simplex, proton, tuta, Mozilla, etc - to come to agreements on what is important for the industry and to release a white paper and certification on best practices. And for the consortium to get behind projects critical for supply chain security and privacy (such as accrescent app store) to finally complete the whole pipeline for the community. It would also help to balance against the Play Integrity API and other issues.

GrapheneOS

Artn The basic client was released much earlier and didn't address security issues beyond updating the target API level.

A distribution system which controls developer keys is not a replacement.

It's possible to require multiple signatures, which is an approach we plan on offering as an optional feature for GrapheneOS updates eventually.

GrapheneOS

n2gwtl Tuta posts a lot of nonsense in their social media, blog, etc. Mozilla does not take security seriously at all and laid off a huge portion of their security people. Neither of those are a good fit for working with us.

Watermelon

ryrona I wished there was an app repository that took all of security, privacy and freedom seriously though.

I've heard that Accrescent is planning to label and add the ability to filter open source apps. So that might be the closest alternative.

ryrona

Watermelon I've heard that Accrescent is planning to label and add the ability to filter open source apps. So that might be the closest alternative.

They won't start building the apps themselves though, but will just trust the uploader the same as if it was a proprietary app. So not really.

ryrona

Watermelon For high quality open source apps I believe it shouldn't be needed.

Unless the app developer is issued with a gag order, as discussed in multiple threads here lately. Also, some reputable open source projects adds things the users' don't want. Organic Maps added an affiliate link (advertisement for a third-party service) to their app, despite being a reputable open source app. F-Droid detected and stopped this and forced them to remove it. And Firefox is a reputable open source web browser that at this point allegedly has very privacy invasive telemetry in their official builds, at least for desktop computers. This is being patched out by basically all Linux app repositories that include Firefox.

oldschool

I have been using grapheneos for a couple of years now, and frankly, despite the increased workload and inconvenience compared to iphone, from whence I came, have loved the increased flexibility and freedom from herding it has offered.

My skills are basic. I'm not in any way an IT professional. I only read this entire post as I was getting ready to install grapheneos to a new phone and couldn't find fdroid, or Aurora, both of which I have been using.

I've read this entire thread, and come to several simple conclusions.

Obtanium, appverifier, these are well beyond my skillset and time, as are individual updates. I will never use these.
That leaves me with the choices of FDroid or Aurora or Sandbox Google playstore.

You can argue threat vectors, malware, etc, but in the end option 1. simply won't happen for me, let alone people with far less skill and interest in freedom than me, like my wife.

What this leads me to is to question if I should even be here. What is the mission of grapheneos? Is to to make it accessible to the average joe for use as a means to escape iPhone and Google, or is it more to cater to those with the skill set to wield it as it is?

Should I head back to iphones?

It is clear as an organization grapheneos is nowhere near having a system that is reasonably secure and easily update-able by the average user.

I was going to try and switch my wife to grapheneos with a sandboxed google playstore as an initial step away from her iPhone. I no longer see that as and attractive option.

Whether or not I stay I guess depends on what the mission is in the sense I mentioned above. If grapheneos is wanting to move in that direction, well, I have stubbornness issues and will stick with it.

But, I have to have something like Aurora or a sandboxed Google playstore. Is there a clear consensus between the two of those which is the lesser of evils?

Or, should I move on?

preloader

oldschool In my opinion, obtainium is fairly easy once you get used to it.

If you do not want to use it, I am guessing that the project would recommend using the sandboxed Google Play store for your apps, for security reasons.

However, you are free to disregard the advice and use whatever you want.

GrapheneOS also has Accrescent, which you can install from the "App Store" application. The selection is small but good.

Someone from grapheneOS team is probably better suited for addressing your questions about mission/accessibility to the average user.

GrapheneOS very strongly recommends using sandboxed Google Play over the Aurora Store / MicroG. Again, you are free to disregard the advice and do whatever you want.

de0u

oldschool What is the mission of grapheneos? Is to to make it accessible to the average joe for use as a means to escape iPhone and Google, or is it more to cater to those with the skill set to wield it as it is?

GrapheneOS (like iOS, or Google's OS for Pixels) is not targeted at any single demographic. And it is possible for people with different goals and different threat models to use GrapheneOS in different ways (this is also true of iOS, or Google's OS for Pixels).

GrapheneOS makes fewer choices for the user than other mobile operating systems. There isn't a preinstalled set of apps for mail, financial transactions, etc. Unlike iOS and Google's Pixel OS, there isn't one app store everybody is expected/required to use.

oldschool It is clear as an organization grapheneos is nowhere near having a system that is reasonably secure and easily update-able by the average user.

Out of the box GrapheneOS is very secure, and literally updates itself.

Apple chooses a set of apps for you and updates those apps. Google chooses a set of apps for you and updates those apps. In both cases the apps chosen by the large company include benefits for the large company. The same could be said about the apps Samsung chooses, Huawei chooses, etc. There are even companies that sell "secure Android" phones that include apps that include benefits for (you guessed it) the small company selling the "secure Android" phone.

oldschool But, I have to have something like Aurora or a sandboxed Google playstore. Is there a clear consensus between the two of those which is the lesser of evils?

If you are an "average Joe who wants to escape Google", but you must have an app store full of apps that are designed to frequently check in with Google (which apps from Google's store are designed to do, even if they are installed via Aurora), there may be a conflict there.

What about Google do you hope to escape?

wizoatk

oldschool What is the mission of grapheneos?

Security and privacy, designed for everyone.

It is clear as an organization grapheneos is nowhere near having a system that is reasonably secure and easily update-able by the average user.

It's not clear why you think using Play Service and Play Store isn't a reasonable option.

DeletedUser370

oldschool What is the mission of grapheneos?

https://grapheneos.social/@GrapheneOS/114838245320838800

oldschool

First, thank you for all of the replies.

I should clarify, I use and essentially require calendaring and email, neither of which I can even find on the latest install nor with accresent, and truthfully would opt for something else if I could not also get weather (radar for safe travel), music app that sorts by folder, netguard, libreoffice, and the ability to cherry pick a select few apps only found on aurora or google play.

Even this, by average phone user standards, is quite limited. My wife uses far more apps. This is what I meant by secure AND easily update-able, because grapheneOS doesn't even have basic apps that most would consider a necessity for modern life.

Frankly, I would prefer that GrapheneOS create their own standard apps, then just sandbox google play until such time as accresent can somehow miraculously curate the number of apps say on Aurora. This, to me, seems the most reasonable and doable path forward.

This meaning that grapheneos would need to develop a fairly robust calendar, email (maybe bring in FairEmail?), and weather app at the least. I have not yet tried Organic Mpas. I currently use organic maps, which I strongly suspect is more accurate than organic maps, but even with it isn't uncommon i have to go to maps.google.com and give it access to my location to get to the right exact spot.

There are levels I hope to escape from Google, starting from any private data I can keep from them all the way to I'm totally free of them. Any incremental improvement is an improvement, and I'm grateful to the people here making that happen.

DeletedUser370

oldschool On the bundling of more apps into the OS: https://grapheneos.org/faq#bundled-apps

preloader

oldschool

oldschool I have not yet tried Organic Mpas. I currently use organic maps, which I strongly suspect is more accurate than organic maps

Sorry, I do not understand what you mean.

For email, an app recommendation would depend on what email service you use. If you use gmail, you might as well use the gmail app from sandboxed google play store. For calendar, I am sure you can find plenty of options, but I cannot tell you which one is adequate for whatever you want to do.

For weather, I would recommend breezy-weather at https://github.com/breezy-weather/breezy-weather/blob/main/INSTALL.md, but it is not available in the google play store. It is available through obtainium, but you do not want to use obtainium. It is available through f-droid, and the operating system does not prohibit you from using f-droid, but it is not recommended. So if you do not want to use obtainium, just use some weather app offered in sandboxed google play store.

I am sorry that obtainium does not appeal to you. But other than Accrescent and the Google Play Store, it is the best option available right now (and for the foreseeable future). I promise you that it is not hard to use. Maybe you can ask someone in real life to help you and your wife set it up?

« Previous Page