SilverCat38 Obtainium only? Direct apk?
Obtanium and “direct APK” are the same thing. Obtanium just automates downloading and installing direct APKs. I recommend against using Obtainium to install new apps, I could only suggest it for updating installed apps. To install new apps that aren't published on a secure app store (like Accrescent) or semi-secure app store (like Google Play Store), download and install the APK using Vanadium from an official website/repo provided by the app developer. If you do this, the first time you update the app using something like Obtainium you'd have to explicitly confirm the update to the OS, but afterwards the OS would let Obtainium do it automatically.
gMan that's a question i can't really answer - i think that, if you're able to analyze the code, and are willing to do so for each update, then obtaining apps directly from the developer may be the better solution, especially if you tend to not install a large number of apps
Checking source code to find malicious backdoors would require checking and understanding it so thoroughly that it's practically impossible to do for any app with even a modest amount of code, let alone every update of it or more than one app. You could audit the code to find honest security mistakes, but aomething that someone intentionally spent effort to hide is out of the question. And it's insane to spend so much time reading source code.
gMan i know GOS and some others here have made what sounds like a reasonable case for using the Play Store via GOS's app, but that doesn't resonate with me given that the Play Store is a huge target for malicious hackers, not to mention all the adware which i also consider to be malware
You're not supposed to blindly trust any app store. Accrescent being a secure app store isn't meant to be a guarantee that all apps offered on Accrescent are 100% free of backdoors. The review process when an app/update is accepted into an app store, and the user-provided reviews and ratings and other info on the app store listing, all help to let you determine if the app is safe to download.
gMan F-Droid, on the other hand, apparently has been free of (known) malware, besides the occasional adware crap, but there are what seem to be very serious concerns regarding their security and app signing practices which seems to result in a single point of failure; if F-Droid is compromised, so are all its users
The problem isn't just F-Droid being a central point of failure, the problem is this together with them having security issues and dismissing them and doing dangerous things. While I don't believe they do it out of malice, they're at the very least incompetent, and I can't trust them for security, and I'd rather trust Google Play's review processes with dedicated employees to catch malware than them.
Another problem is F-Droid taking the same package names as the legitimate apps, preventing easy export of your data from F-Droid's unofficial builds.
lackofhumor Why is this working? Because over time the developers gained our trust, so much that I suspect (almost) none of us actually go and see the diff of every update.
The built-in App Store is special in that it helps deliver partial system updates for better security without producing a full OS update. And the only non-GrapheneOS apps on it are identical authentic mirrors, not unofficial builds signed by the GrapheneOS team. But yes, we still need to trust them.
lackofhumor In my understanging, it's pretty much the equivalent of installing them with Obtainium
Don't install new apps using neither Obtainium nor a custom repo in F-Droid. Use either a secure app store (e.g. Accrescent), a semi-secure app store (e.g. Google Play Store), or an official source (e.g. the app's official website opened in Vanadium) for the initial installation, then feel free to update it with Obtainium/custom repo/whatever else that you trust (app signatures aren't foolproof, you still want to trust where you update apps from).
lackofhumor For example the official Guardian Project repo contains all the apps developed by the same team.
The Guardian Project F-Droid repo hosts apps signed with the same signing certificate as their builds on Google Play Store, meaning that Google has access to the private signing key. How do I know? Because I installed their apps from F-Droid, but switched to updating them through Google Play Store.
Note that both Tor Browser for Android and Orbot have security issues. Tor Browser has slow updates on Android, and Orbot has known exploitable vulnerabilities as pointed out by the official GrapheneOS account here on the forum.
Eumenia The Issue with nearly all sources other then the official F-Droid repository, is that we need to put blind trust into the maintainers to compile only from source without making any malicious changes.
I don't get the thinking here. Why should I care whether an app developer that created malware for me publishes the malware's source code when I don't and can't meticulously check the source code anyway?
Eumenia With apps from the F-Droid repo, anyone can check if the binaries that are distributed by F-Droid, correspond to the public source code.
Therefore F-Droid is accountable for their binaries in a transparent way.
Firstly, accountability is good, but doesn't prevent malware. Secondly, I believe (don't quote me on this please, I'm not sure) that it was found out that F-Droid has a security vulnerability that any arbitrary APK can be accepted into being served by the F-Droid server even if it doesn't match the claimed source code. So if you don't build the source code and verify the reproducibility yourself, you have no confirmation at all that the built APK that F-Droid gives you corresponds to the source code as they say.
Eumenia If the developer themself provide a reproducible build without hard none-FOSS dependencies, then F-Droid will distribute this developer/maintainer's signed binary.
Their is nothing preventing a maintainer from just providing reproducible builds that then would be distributed by F-Droid without changes to the signature
That's good, but then what's the point of using F-Droid? Especially if what I said above is true.