← Back to context

Comment by Flip-per

11 hours ago

Do you trust the banking app installed from Aurora enough to do your online banking? I don't, and I really wish there would be a decent way to verify that the installed/provided apps are legit. For me this is the biggest downside of using GrapheneOS, which I'm otherwise extremely happy with.

(for me, the whole point of using GrapheneOS is privacy and not sending data to Google, so using the PlayStore is not an option)

6 comments

Flip-per

Reply
Gander5739  11 hours ago

Android apps are signed. Can't you verify the signature?

  • lucb1e  10 hours ago

    Can you?

    I'm pretty sure if I try calling my bank or searching the website to confirm the developer's public key fingerprint, there's not going to be any answer. You have to ask Google's servers to give you the APK and trust what it gives you, either via the front-end called Aurora or the front-end called Play Store

    • Gander5739  10 hours ago

      Maybe not in practice, but in theory, it works. I don't think there's a better way of handling this without relying on some centralised authority (Google) to validate the authorship of an app, which is hardly desirable.