@network_is_reliable@mastodon.social
2025-01-28 09:17 UTC
@lberrymage@infosec.exchange @normplum@fosstodon.org @celenity@infosec.exchange @accrescent@infosec.exchange
> Accrescent does require domain ownership verification for all new apps now so that you can verify the app ID is published by its respective developer
Thanks for clarification. But it's absolutely not obvious from UI perspective.
> It is also possible to verify that an app's signing key matches the developer's and is thus cannot be modified by someone else.
Is there any secure way to do it without app installation?
Replies (1)
-
@lberrymage@infosec.exchange 2025-01-28 20:48
@network_is_reliable@mastodon.social @normplum@fosstodon.org @celenity@infosec.exchange @accrescent@infosec.exchange Yes. One can download the app's APKs as well as the repository metadata and verify that the signing certificate fingerprints match using apksigner. This is effectively what Accrescent does itself, but it's possible to do outside of Accrescent.