F-Droid 1.0 released

Re:F-Droid 1.0 released by forapurpose on Thursday October 19, 2017 @05:28PM (#15511696)

I know of many such stores. Usually they are proxies: They download the app from the Google store, you download it from the proxy. The question is, how do you know they haven't inserted malware? It seems like a very obvious vector for attack. You could authenticate signatures or hashes, but where do you find the authoritative signature/hash?

For those interested in taking a shot at using these services, here are a couple of the more credible ones I've run into in the last couple years (I haven't used them in at least 6 months, so possibly their status has changed). Use at your own risk!:

- APK Downloader: By someone on XDA-forums, a leading Android dev community. It comes in several versions and forks by other XDA members, and for several platforms. I don't have time to sort them out now, sorry. Beware of malware-infected hosted implementations.

http://codekiem.com/2014/08/07/official-apk-downloader-v2-do... / http://forum.xda-developers.com/showthread.php?t=1515021

http://forum.xda-developers.com/showthread.php?t=1809458

https://github.com/Lekensteyn/apk-downloader

- Racoon: Desktop OS client for Play Store (along with its Github and XDA links)

http://raccoon.onyxbits.de / https://github.com/onyxbits/Raccoon / https://forum.xda-developers.com/showthread.php?t=2772436

[ Parent | on HN ]

Re:F-Droid 1.0 released by LukeShu on Thursday October 19, 2017 @06:54PM (#15512236)

Yalp is a FOSS Android app available from F-droid. The Yalp app on your phone talks directly to the Google Play servers.

[ Parent | on HN ]

Re:F-Droid 1.0 released by forapurpose on Thursday October 19, 2017 @08:09PM (#15512621)

Thanks. That helps!

For those who want to know more; here's what I found:

https://github.com/yeriomin/YalpStore - The readme is a great place to start.

On F-Droid: https://f-droid.org/packages/com.github.yeriomin.yalpstore/

EDIT: It looks great!

[ Parent | on HN ]

Re:F-Droid 1.0 released by _1tan on Thursday October 19, 2017 @06:06PM (#15511936)

Yalp downloads directly from Google Play using included "fake" credentials (you can also supply your own).

[ Parent | on HN ]

Re:F-Droid 1.0 released by forapurpose on Thursday October 19, 2017 @06:45PM (#15512174)

> Yalp downloads directly from Google Play ...

How do you know? Why do you trust it?

[ Parent | on HN ]

Re:F-Droid 1.0 released by LukeShu on Thursday October 19, 2017 @06:52PM (#15512228)

Because it's a FOSS application, and you can read the source and verify that the Yalp app is indeed talking directly to Google Play servers?

[ Parent | on HN ]