Post by @lberrymage@infosec.exchange

2025-01-28 08:26 UTC

@network_is_reliable@mastodon.social @normplum@fosstodon.org @celenity@infosec.exchange @accrescent@infosec.exchange For what it's worth, Accrescent does require domain ownership verification for all new apps now so that you can verify the app ID is published by its respective developer. It is also possible to verify that an app's signing key matches the developer's and is thus cannot be modified by someone else. However, I do acknowledge that it's not very transparent in the UI where an app came from or who submitted it, and that's something we hope to change eventually. We also intend to have more strict and clear policies about impersonation.

Replies (2)

@network_is_reliable@mastodon.social 2025-01-28 09:17

@lberrymage@infosec.exchange @normplum@fosstodon.org @celenity@infosec.exchange @accrescent@infosec.exchange > Accrescent does require domain ownership verification for all new apps now so that you can verify the app ID is published by its respective developer Thanks for clarification. But it's absolutely not obvious from UI perspective. > It is also possible to verify that an app's signing key matches the developer's and is thus cannot be modified by someone else. Is there any secure way to do it without app installation?

Open ##3251253
@network_is_reliable@mastodon.social 2025-01-28 10:36

@lberrymage@infosec.exchange @normplum@fosstodon.org @celenity@infosec.exchange @accrescent@infosec.exchange > Accrescent does require domain ownership verification for all new apps now so that you can verify the app ID is published by its respective developer. More I think about it, less I like it. Does it mean that developer of com.exampleapp really controls the domain exampleapp.com? I don't think so. You just put trust to another entity. But developer may not be aware of Accrescent at all. He just hosts his repo on github with such package name.

Open ##3251255