It's the only place I can be pretty sure a "flashlight app" is actually a flashlight app and not going to ask me for extraneous permissions. It's great.

Oh yeah after ditching Swiftkey I was looking for a new keyboard on my phone.

So rare to see apps without asking for permissions these days. Don't see that with Gplay.

Did you find a Swype-ish replacement on F-Droid? Gesture typing is the one thing I miss about running stock Android.

I'm using AnySoftKeyboard now.

Data mining and machine learning just doesn't sit well with me even though it can't directly be traced back to a individual. At the end of the day all of it will be used for one thing: selling more services and products to me. Convenience comes with a price.

There's some progress happening for this in AnySoftKeyboard: https://github.com/AnySoftKeyboard/AnySoftKeyboard/issues/26...

Are you opposed to Google Keyboard/Gboard? It's had gesture typing for a while, and not too long ago added some nice gestures which use the spacebar to control cursor position and backspace key to delete one or more words at a time rather than character-by-character.

Its gesture-interpretation algorithm has gotten absolutely terrible for me recently, to the point that I frequently have to type out whole messages letter by letter because it will keep spitting out really strange guesses when I gesture. (It used to work a lot better, and when I revert to old versions they work great.)

Is there something wrong with SwiftKey? That'd mean so much work for me as I'm using extensively.

It's pretty clearly key-logging and on top of that they've had poor security in the past which is not great when they're key-logging everything you type.

Personally I can't say I took the high ground though I just blocked swiftkey with a firewall and figure that's good enough for me.

pretty clearly? Got a source or anything to back that up?

I researched a bit and apparently they had a bug which made the cloud sync leak the personal data of others: https://www.theverge.com/platform/amp/2016/7/29/12326152/swi...

Cloud sync is opt in and I don't know why anyone in their right mind would enable it...

That being said, using a closed source application packed with features (also known as "attack surface") as your main input method clearly isn't ideal.

Well, I do cloud-sync but it's super helpful. I don't know if SK would be SK without cloud-sync.

How else does it know what to predict without logging what keys you press?

yeah and that's why i block it assess to internet using afwall+

Terrible example. You do realize recent Android versions have a native flashlight app?

Yeah, nowadays they do, but it was the first example that came to mind because I definitely used F-Droid for this purpose back before they did.

To pile on to the no non-sense, it also means it doesn't try to do social networking and share my information publicly by default.

"Yalp Store" allows you to install apps from google store without google account.

Not sure if that's really relevant to the quality of the apps themselves.

Since everything (at least by default) through F-Droid is FOSS, there is a significant lack of ads and other misfeatures. Apps that depend on an account with a non-free third-party service are clearly marked as such. Most apps aren't foolishly tied at the hip to Google Play Services. Malware is non-existent.

I know of many such stores. Usually they are proxies: They download the app from the Google store, you download it from the proxy. The question is, how do you know they haven't inserted malware? It seems like a very obvious vector for attack. You could authenticate signatures or hashes, but where do you find the authoritative signature/hash?

For those interested in taking a shot at using these services, here are a couple of the more credible ones I've run into in the last couple years (I haven't used them in at least 6 months, so possibly their status has changed). Use at your own risk!:

- APK Downloader: By someone on XDA-forums, a leading Android dev community. It comes in several versions and forks by other XDA members, and for several platforms. I don't have time to sort them out now, sorry. Beware of malware-infected hosted implementations.

http://codekiem.com/2014/08/07/official-apk-downloader-v2-do... / http://forum.xda-developers.com/showthread.php?t=1515021

http://forum.xda-developers.com/showthread.php?t=1809458

https://github.com/Lekensteyn/apk-downloader

- Racoon: Desktop OS client for Play Store (along with its Github and XDA links)

http://raccoon.onyxbits.de / https://github.com/onyxbits/Raccoon / https://forum.xda-developers.com/showthread.php?t=2772436

Yalp is a FOSS Android app available from F-droid. The Yalp app on your phone talks directly to the Google Play servers.

Thanks. That helps!

For those who want to know more; here's what I found:

https://github.com/yeriomin/YalpStore - The readme is a great place to start.

On F-Droid: https://f-droid.org/packages/com.github.yeriomin.yalpstore/

EDIT: It looks great!

Yalp downloads directly from Google Play using included "fake" credentials (you can also supply your own).

> Yalp downloads directly from Google Play ...

How do you know? Why do you trust it?

Because it's a FOSS application, and you can read the source and verify that the Yalp app is indeed talking directly to Google Play servers?

I think what OP meant was having to make an account inside the app