Difference between Privacy Guides Verified Apps and AppVerifier BG?

We recommend continuing to use the original AppVerifier for general-purpose signing key verification. There are also some forks such as AppVerifierBG which add additional features like a locally-stored personal database, database exports, and more.

and

From the verified apps thread

They’re parallel efforts to tackle the same community issue: verification of downloaded apps on android

Both are forks of AppVerifier. This tool has been used & endorsed by the privacy community for some years to authenticate app installs on android. Unfortunately, AppVerifier is/was becoming abandonware - the original developer no longer wished to update its internal database, and while the app does allow users to paste in singular hashes, it does not support whole external databases

@jonah pitched a PG-maintained database on May 22, and began polling the community for submissions on May 25. PG released a beta app on 4 June, positioning itself as a means to easily compare the PG database against your installed apps

Meanwhile, @RoundSalmon4 forked the AppVerifier repo on May 27, and began developing a drop-in AppVerifier replacement that would allow additional database sources. They joined PG when one of our threads produced some feedback for their implementation

So now there are two solutions to the app verification problem, both seemingly products of discussions on PG (nice):

PG Implementation: maintained by jonah/PG. Intended to verify apps against the PG database only, and to provide an easy means to update the separate PG Database

AppVerifierBG: maintained by RoundSalmon4. Intended as a drop-in replacement for AppVerifier. Supports a broader range of databases & hash sources

Maybe they’ll be competing tools & we’ll reap the benefits of free-market competition. Maybe they’ll join forces & merge projects. Who knows.

Wonderful breakdown of the situation.

I would just add that initially I had only wanted to add some features upstream [1] [2] which is why my branch isn’t called main or master. It was just the product of merging branches I had created individually for upstream PRs.


I personally don’t see our apps as being in any sort of competition. While the tools offer something similar, our scope is different. Verified Apps is designed to be maximally trustworthy through simplicity whereas my app is more focused on providing additional tools and options, since database verification alone is limited.

I also try and contribute as much as I can to the Privacy Guides side of things, whether its via hash submissions or my own ideas for how the process could expand.


My hope is that others in the privacy and security community are inspired by the Privacy Guides team’s efforts and contribute to Verified Apps or create their own niche databases so that coverage of trusted verified databases can grow.

I’ll add a third option to my cheeky list: both tools mature independently to serve different user needs :grinning_face_with_smiling_eyes:

Off-topic: shoutout

Massive shoutout to you for joining PG & participating in these discussions with the user base. In my mind, this is exactly what the forum should be used for - to bring together the privsec community, discuss our issues, develop our toolchest, & build our collective power against the forces that wish to degrade our privacy