News for hackers. Stuff that matters.

A comment on Grand jury subpoena for Signal user data, Central District of California. Parent comment

Re:Grand jury subpoena for Signal user data, Central Distric... by dane-pgp on Wednesday April 28, 2021 @10:32AM (#26969802)
It would be nice if Android let you check the hash of the APK against a Binary Transparency log hosted by a third party. Google have even written extensively about this idea:

https://transparency.dev/application/add-tamper-checking-to-...

[ Parent | on HN ]
Re:Grand jury subpoena for Signal user data, Central Distric... by psanford on Wednesday April 28, 2021 @11:02AM (#26970171)
Android does verify that any new versions of an APK are signed with the same signing key as previously installed versions. So you would have to compromise the signing key held by the developer in order to push an evil APK.
[ Parent | on HN ]