Hacker News Reader

Comment by onethought | Hacker News Reader

Is there a standard that could verify an apk against a certificate? ... or an I just describing building an alternative play store?

View on HN

This is a (mostly) solved problem in linux. Your package manager has a central repo, but also can have 3rd party repos added. You'd add the matrix repo and it would automatically update it with everything else. It means everything still gets updated and verified against the keyring.

Fdroid supports 3rd party repos.

Android's has an app signing system which isn't dependent on Google Play. Updates to a given app have to be signed with the same certificate as previous versions.

Signal, for instance, does this: https://signal.org/android/apk/

Signal doesn't. They give you a hash not a signature. I.e. if you have control iver their site, you can push a malicious signal application and change the hash.

This is false. The Signal APK is signed with the same signature as the APK on Google Play. If the signature was different then Android would not allow me to overwrite/update my Google Play Signal installation with the APK that I just downloaded from that site.

On Android, APKs are almost always signed by default (even if they're only self-signed).

You can use fdroid which builds everything and signs it with their own keys.

Where do you get the certificate from? If you get the APK and certificate from the same source, there's no security benefit of verifying the certificate on top of having a proper TLS connection.

If you update the application, Android will check that the certificate of the current version matches the one from the update before allowing you to install it.

Reply on news.ycombinator.com