News for hackers. Stuff that matters.

A comment on F-Droid: how it weakens Android's security model. Parent comment

Re:F-Droid: how it weakens Android's security model by orthecreedence on Thursday February 24, 2022 @05:04PM (#30460922)
Yes, last I checked, Google signs the app with your private key, which they force you to give them. In other words, they have the ability to make any changes to your app and re-sign it at their whim. Anyone concerned about the security of their shit should only install apps directly signed directly by the developer, using a private key only the developer possesses.

It's a shame these platforms go to such great lengths to force distribution through their "safe" channels.

[ Parent | on HN ]
Re:F-Droid: how it weakens Android's security model by h4waii on Thursday February 24, 2022 @05:28PM (#30461214)
Playing devil's advocate, given the choice between trusting a random developer to keep their keys private or Google to keep their keys private, I'd probably side with Google.

Yeah that doesn't help with coercion or government letters, but neither would being a solo dev, both parties will comply.

[ Parent | on HN ]
Re:F-Droid: how it weakens Android's security model by zauguin on Thursday February 24, 2022 @05:44PM (#30461389)
Except the developers can still have access to the key, they just have to share it with Google. This not only violates the old advice: "Never share your private key!", it also gives you the worst of both worlds: You have to trust both the random developer and Google to keep the keys private.
[ Parent | on HN ]
Re:F-Droid: how it weakens Android's security model by wccrawford on Thursday February 24, 2022 @05:38PM (#30461319)
I don't think the concern is with Google keeping the keys secure. I think the concern is with Google being able to rewrite the app however they want and sign it without the developer even knowing.
[ Parent | on HN ]
Re:F-Droid: how it weakens Android's security model by ris on Thursday February 24, 2022 @06:05PM (#30461581)
What Google does with their keys is known only to Google. Google also have various commercial pressures which can compromise their behaviour (on that note, have we even managed to stop Certificate Authorities selling carte-blanche certificates to middleware-box vendors yet?)

A team-maintained package repository on the other hand operates through transparency.

[ Parent | on HN ]