The issue with F-Droid is that all apps are signed by the same party (F-Droid) which is also not the developer. You don’t have to trust the source (usually recommended by the developer) except for the first installation: future updates will have their authenticity cryptographically guaranteed. Normally, the developer is supposed to sign their own app prior to its upload on a distribution channel, whether that is a website or a traditional repository (or both). Upon the installation of an app, Android pins the signature across the entire OS (including user profiles): that’s what we call a trust-on-first-use model since all subsequent updates of the app must have the corresponding signature to be installed. A signature is a mathematical scheme that guarantees the authenticity of the applications you download. Unlike other repositories, F-Droid signs all the apps in the main repository with its own signing keys (unique per app) at the exception of the very few reproducible builds. To understand why this is a problem, you’ll have to understand a bit about F-Droid’s architecture, the things it does very differently from other app repositories, and the Android platform security model (some of the issues listed in this article are somewhat out of the scope of the OS security model, but the majority is). This is not an in-depth security review, nor is it exhaustive. As the author of this article, I’m only interested in facts and not ideologies. These analyses do not account for threat models and personal preferences.A lot of information in this article is sourced from official and trusted sources, but you’re welcome to do your own research.A development model shouldn’t be an excuse for bad practices and shouldn’t lure you into believing that it can provide strong guarantees it cannot. You have your own reasons for using open-source or free/libre/whatever software which won’t be discussed here.Likewise, please don’t misinterpret the intentions of this article. I have respect for any work done in the name of good intentions. The main goal of this write-up was to inform users so they can make responsible choices, not to trash someone else’s work.F-Droid is often recommended among security and privacy enthusiasts, but how does it stack up against Play Store in practice? This write-up will attempt to emphasize major security issues with F-Droid that you should consider.īefore we start, a few things to keep in mind: F-Droid is a popular alternative app repository for Android, especially known for its main repository dedicated to free and open-source software.

Aurora droid apk