Building the most private app store

 Posted on June 2, 2016  |  Hans-Christoph Steiner

App stores can work well without any tracking at all Attackers are increasingly seeing app stores as a prime attack vector, whether it is aimed at the masses like XCodeGhost or very targeted like in FBI vs Apple. When we install software from an app store, we are placing a lot of trust in a lot of different parties involved in getting the source code from the original developer delivered to our device in a useful form. [Read More]
Android  anonymity  bazaar  debian  encryption  F-Droid  fdroid  identity  mobile  open source  privacy  reproducible builds  security  tor 

How to Migrate Your Android App’s Signing Key

 Posted on December 29, 2015  |  Abel Luck

It is time to update to a stronger signing key for your Android app! The old default RSA 1024-bit key is weak and officially deprecated. What? The Android OS requires that every application installed be signed by a digital key. The purpose behind this signature is to identify the author of the application, allow this author and this author alone to make updates to the app, as well as provide a mechanism to establish inter-application trust. [Read More]
Android  bazaar  encryption  F-Droid  fdroid  howto  identity  rsa  security  signing key  TrustedIntents 

First Reproducible Builds Summit

 Posted on December 9, 2015  |  Hans-Christoph Steiner

I was just in Athens for the “Reproducible Builds Summit“, an Aspiration-run meeting focused on the issues of getting all software builds to be reproducible. This means that anyone starting with the same source code can build the exact same binary, bit-for-bit. At first glance, it sounds like this horrible, arcane detail, which it is really. But it provides tons on real benefits that can save lots of time. And in terms of programming, it can actually be quite fun, like doing a puzzle or sudoku, since there is a very clear point where you have “won”. [Read More]
Android  bazaar  F-Droid  fdroid  F-Droid  fdroid  reproducible builds 

First Reproducible Builds Summit

 Posted on December 9, 2015  |  Hans-Christoph Steiner

I was just in Athens for the “Reproducible Builds Summit“, an Aspiration-run meeting focused on the issues of getting all software builds to be reproducible. This means that anyone starting with the same source code can build the exact same binary, bit-for-bit. At first glance, it sounds like this horrible, arcane detail, which it is really. But it provides tons on real benefits that can save lots of time. And in terms of programming, it can actually be quite fun, like doing a puzzle or sudoku, since there is a very clear point where you have “won”. [Read More]
Android  bazaar  F-Droid  fdroid  F-Droid  fdroid  reproducible builds 

Building a trustworthy app store that respects privacy

 Posted on June 2, 2015  |  Hans-Christoph Steiner

One core piece of our approach is thinking about very high risk situations, like Ai Weiwei or Edward Snowden, then making the tools for operating under that pressure as easy to use as possible. That means that we might occasionally come across as a little paranoid. It is important to dive into the depths of what might be possible. That is an essential step in evaluating what the risks and defenses are, and how to prioritize them. [Read More]
Android  bazaar  cafebazaar  cnnic  distribution  F-Droid  fdroid  google play  master key  mimarket  pinning  privacy  security  xiaomi 

Complete, reproducible app distribution achieved!

 Posted on February 11, 2015  |  Hans-Christoph Steiner

With F-Droid, we have been working towards getting a complete app distribution channel that is able to reproducibly build each Android app from source. while this may sound like a mundane detail, it does provide lots of tangible benefits. First, it means that anyone can verify that the app that they are using is 100% built from the source code, with nothing else added. That verifies that the app is indeed 100% free, open source software. [Read More]
Android  bazaar  checkey  distribution  F-Droid  fdroid  lildebi  prototype  reproducible builds  security 

Question: central server, federated, or p2p? Answer: all!

 Posted on September 18, 2014  |  Hans-Christoph Steiner

There are many ideas of core architectures for providing digital services, each with their own advantages and disadvantages. I break it down along the lines of central servers, federated servers, and peer-to-peer, serverless systems. a central service with clients connecting to it Most big internet companies operate in effect as a central server (even though they are implemented differently). There is only facebook.com, there are no other services that can inter-operate with facebook. [Read More]
bazaar  bluetooth  distribution  F-Droid  fdroid  nfc  p2p  wifi 

New Official Guardian Project app repo for FDroid!

 Posted on June 30, 2014  |  Hans-Christoph Steiner

We now have an official FDroid app repository that is available via three separate methods, to guarantee access to a trusted distribution channel throughout the world! To start with, you must have FDroid installed. Right now, I recommend using the latest test release since it has support for Tor and .onion addresses (earlier versions should work for non-onion addresses): https://f-droid.org/repo/org.fdroid.fdroid_710.apk In order to add this repo to your FDroid config, you can either click directly on these links on your devices and FDroid will recognize them, or you can click on them on your desktop, and you will be presented with a QR Code to scan. [Read More]
Android  bazaar  distribution  F-Droid  fdroid  security 

Automatic, private distribution of our test builds

 Posted on June 6, 2014  |  Hans-Christoph Steiner

One thing we are very lucky to have is a good community of people willing to test out unfinished builds of our software. That is a very valuable contribution to the process of developing usable, secure apps. So we want to make this process as easy as possible while keeping it as secure and private as possible. To that end, we have set up an FDroid repository of apps generated from the test builds that our build server generates automatically every time we publish new code. [Read More]
Android  bazaar  distribution  F-Droid  fdroid  orbot  privacy  prototype  tor 

Turn Your Device Into an App Store

 Posted on November 18, 2013  |  cpu

As we’ve touched upon in previous blog posts  the Google Play model of application distribution has some disadvantages. Google does not make the Play store universally available, instead limiting availability to a subset of countries. Using the Play store to install apps necessitates both sharing personal information with Google and enabling Google to remotely remove apps from your device (colloquially referred to as having a ‘kill switch’). Using the Play store also requires a functional data connection (wifi or otherwise) to allow apps to be downloaded. [Read More]
Android  bazaar  distribution  F-Droid  fdroid  open source  privacy 

Setting up your own app store with F-Droid

 Posted on November 5, 2013  |  Hans-Christoph Steiner

(_This blog post as now been cooked into an updated HOWTO_) The Google Play Store for Android is not available in all parts of the world, US law restricts its use in certain countries like Iran, and many countries block access to the Play Store, like China. Also, the Google Play Store tracks all user actions, reporting back to Google what apps have been installed and also run on the phone. [Read More]
Android  bazaar  debian  distribution  F-Droid  fdroid  free software  howto  mobile  open source  privacy  ubuntu 

Our new F-Droid App Repository (out of date!)

 Posted on March 15, 2012  |  n8fr8

Update: this blog post has been changed to reference our new FDroid repository at https://guardianproject.info/fdroid. If you are still using the old one originally described here which has the URL https://guardianproject.info/repo, you should switch to the new repo as soon as possible! For all of you out there looking for a safe way to find and download apps outside of the Play Store (aka Android Market) or random, sketchy third-party app stores and file sharing sites, then your wait is over: [Read More]
Android  F-Droid  fdroid  security