I use Google Play Store, Graphene's app store and Accrescent. I feel that the known privacy issues from Google Play are more acceptable to me than the unknown consequences to my privacy due to the looser security from F-Droid.
this post was submitted on 12 Apr 2025
8 points (90.0% liked)
GrapheneOS
445 readers
2 users here now
An unofficial discussion community for anyone interested in GrapheneOS.
Helpful links:
Official Graphene OS Discussion Forum
List of official Matrix channels and other contact sources.
founded 2 years ago
MODERATORS
I like your logic. I'll need to chew on that thought to make sure I agree, but that's a really good point.
Does F-droid have looser security?
Yes.
-
F-Droid signs all builds with its own keys, so you can't readily verify if an app supplied by F-Droid is the same as on other app stores.
-
F-Droid allows a lower target SDK: this is good for users running very old versions of Android, but bad for people who download an app that hasn't been updated in years and has multiple security vulnerabilities.
-
Slow/irregular updates: often it can takes days, weeks or sometimes months for an app update to be available via F-Droid (at least from their official repo). This can have real consequences if you're waiting for an update for a critical security issue.
Here's an example of someone leveraging a supply chain attack against an F-Droid build of an app.
F-Droid is a great project for providing an alternative source of apps to app stores run by companies, and I admire their goals, but from a security standpoint I wouldn't recommend using it unless you have no other source for an app you need.
Thanks for the elaboration!
I have low threat model. I get my apps from droidify and a couple of apps directly from their github pages. Havent bothered to try obtainium, maybe once most of my app isnt in fdroid.
For private space i use aurora. Planning to setup google play store, but havent got around yet. I need to create a fake google acc for that.
I use Obtanium since it's apparently more secure than f-droid. F-droid is still a good place to search for FOSS and privacy-respecting apps. For anything that I can't install through Obtanium, I'll use the Play Store.
Any tips on how to better use Obtanium?
At a glance, it seems to give me what I've always wanted (that is, access to all the switches and levers behind the scenes), but it is a bit overwhelming to start with.
- Install AppVerifier from Accrescent as it integrates with it.
- Add the app to Obtainum and leave options as default
- Check if the app signature matches
- If something goes wrong, check the Obtanium recipes for your app.
The hard part is #3, as a lot of apps don't provide signature hashes. So you night not have confirmation the apk wasn't compromised. Then you have to decide whether you take a leap of faith, try your luck at another app store or give up the app.
I'm still learning how to use it as well, but the basic methodology is to lookup the github page for the app you want to install and add the app to Obtanium using that github link. This is where f-droid comes in handy for finding github pages. Default settings are usually good enough if you don't know what they do.
I've been told that its unnecessary to use the App Verifier to check apps installed through github, but you can still do it if the SHA signature is available on their github.