Well, the page is correct. That's the safest way.

I don't know how to verify the SHA fingerprint without Googling (I know how it works, just don't do it often to know the exact openssl or equivalent command).

If I'm downloading the APK directly on the phone, there's a lot that's not under Signal's control that could happen.

What if I'm directly under attack, and I'm trying to move to Signal? The attacker could MITM the connection and intercept the download.

I think that's a fair warning to show a user, because indeed most users will likely want to install apps through Play Store, that'll reduce/remove supply chain risks. Users who know enough about APKs would be able to verify the hash, or build it themselves.

Even if I download the APK, I still have to accept a similar warning when installing it on my phone.

Google Play, for all its failings, IS the safest way to get an APK right now.

F-Droid for as much as I love the open platform, does not provide any security guarantees about what you're downloading. It is a volunteer run project and does not have the extensive security policies and practices that Google has. From https://f-droid.org/en/about/

> Although every effort is made to ensure that everything in the repository is safe to install, you use it AT YOUR OWN RISK.

Likewise downloading and side-loading it from their website, requires you to disable some security guarantees by doing things like enabling developer mode.

> If the app developer tells me it's dangerous and I shouldn't do it, can you even expect users to do this?

If you care about reproducible builds and avoiding trusting Google, you're already in the class of not-most-users.

Signal seems to have usually taken a pragmatic stance of defaults mattering.

Afaicr, that was the argument for linking to phone numbers (it allowed for more lazy users to use it) and encryption by default (few turn on opt-in-encryption).

And it seems accurate to say 'for most users, who don't know what they're doing and don't want to play personal-IT-department, using the Google Play store is more safe and secure.'

Do you disagree? The main issue I see with sideloads is that you don’t get automatic updates. I’d do that for an app I built myself, but not if the app is in the Play Store.

With Signal you actually do. The APK gotten from their website isn't the same from GPlay. It has an auto updater (will prompt you with a notif when a new version comes out, which you can click to install), and doesn't come with a FCM push notification system.

You know what you're doing, so you can ignore those errors. Seems like a much better alternative to endorsement of apk downloads directly from websites for non tech-literate users.

You're moving the goalposts now. Your comment was factually incorrect on a very basic point, own it and move on.