The anti-f-droid take is uninformed

Privacy Questions
21

Which is a scary thing to use if you care about security or even privacy because you need some level of security to uphold your privacy.

2 Likes
22

It’s not really a question of UI, I’m just saying that Google Play is indeed stricter than F-Droid in some respects. In other respects, the reverse is true as you’ve mentioned.

stricter in what sense though? Define it without an example. It’s stricter because F-Droid has worse searching. I’ll give you that. There are 2.4 M packages on Google Play. There are 4,400 Apps in F-Droid and another 2,800 in the Archive. I’m just not following. F-Droid has old ones, and probably more old ones by percent. But the only problem there is searching.

Of the ones in F-Droid how many of those 4,400 have undisclosed trackers by percent? (0%, or close to it) How many of them in Google Play have undisclosed trackers by percent?

I just don’t understand how we’re using stricter in the context of privacy.

1 Like
23

A significant percentage of these 4,400 apps are abandonware.

Read the privacy policy and/or check the source code of the apps that you’re using.

Higher target API level = more security and privacy, sometimes even more or better functionality.

24

While the OP makes some interesting points, I do think its funny how people can barge in here like the Koolaid man calling our takes uninformed while it may just be that we are informed, but of a difference in opinion :slight_smile:

5 Likes
25

Paid apps maybe (I’d prefer Aurora with compartmentalized gmail)

non-FOSS apps? maybe. I’d still prefer Aurora.

Banking Apps? Definately!

1 Like
26

Im a bit confused: is it OK privacy-wise to use FDroid or not?

27

6 posts were merged into an existing topic: Aurora store not secure?

28

It’s okay.

2 Likes
29

I completely agree with the OP. Sandboxed Google Play is not Silver Bullet. It’s not a magical or sacred thing. Still you are using Google and you must have a G account.
I have a pixel which I don’t use any GAFAM apps or accounts. So, each way has their pros and cons.

Regarding abandonware, we are not talking about average joe searching on Fdroid. Average Joe will not also use Sandboxed GPlay. As long as you know the app you install I don’t see any problem here.

2 Likes
30

What’s the problem with that? You barely need to provide any information to have one.

31

Also, to be on fdroid the app must actually be buildable from source, so “fake open source apps” won’t make it to the repo

1 Like
32

Depending on the country, you may need to provide both your birthdate and a valid phone number to create a new Google account. This is quite a bit of information :wink:.

1 Like
33

Provide fake birthday information.

That is only required when your IP reputation is low. I have created dozens of Google accounts without a phone number using all major VPN providers or just public Wi-Fi.

1 Like
34

I think this depends on the country/language as well. For example, if you try to create a new account using the Google’s website in Korean, it seems to always ask for a phone number. You’re right though that it doesn’t necessarily do that when using the English site.

35

Accept that some people don’t want to agree with google’s privacy policy and simply choose something else even if that comes with a tradeoff.

6 Likes
36

You’ve got to be kidding me. If you are using VPN all the time, you won’t be able to get any Google account. Since we are privacy conscious users, it’s really normal that I don’t want to share my IP address and apps I use, etc.

5 Likes
37

Not to mention that by using Google Play, Google can now track and correlate the apps you install with the rest of your web activity and use that to further profile you. It’s a tradeoff between privacy and security.

2 Likes
40

A significant percentage of these 4,400 apps are abandonware.

Again, if this site was called AntiAbandonware Guide, I would say you have a point. But it’s not called that. Aside from that, I’m not even sure if your assertion is correct. F-Droid scans libraries and they report vulnerabilities they’ve found in dependencies. When those are discovered the app is delisted. Like Simple FileManager (look up issue 656) But other than that, why does anyone care if an app isn’t updated if it’s not known to be insecure?

Read the privacy policy and/or check the source code of the apps that you’re using.

99% of the Apps on Google Play don’t have the source available, and the I don’t want to trust their privacy policy. You’re asking me to trust something inferior to technologically-generated advisories of F-droid.

Higher target API level = more security and privacy, sometimes even more or better functionality.

But there is nothing stopping you from using an app that targets a higher api level. You can upload an app built on any api level to F-droid. I’m not sure what you mean when you say it’s stricter? F-droid and Google Play both allow hosting older less-secure API levels. That’s also just part of Android, developers have to change their app to adapt to the new API level and there is a lag.

But all of this is silly. You’re speaking of theoretical points and using peacock language “stricter”. I’ve given you three concrete examples of the most popular apps with examples of F-Droid making their distribution more private, transparent, and anonymous. And I just gave you another example (SimpleFileManager) of F-Droid identifying vulnerable dependencies that GitHub would not have discovered automatically.

But we’re telling people direct download from GitHub is better in the context of a discussion on privacy.

4 Likes
41

In this thread, I learned that fDroid has more than just building and singing.

Reading on the privacy guides, fdroid was only adding delay for new release and resigning with their own keys.

Here I learned tjat fdroid does much more, like detecting whitelisting external dependencies sources, blocking application with known vulnerability, detecting and preventing external blob / injection of prebuilt application library.

It would be nice to have a little more advantages and disadvantages of fdroid in the page, so that people make their own choice.

Or perhaps this information could be written in fdroid website ? I think I did read it at first, and did not know about that.

If there are some expert of fdroid here, I have a question/comment. Is there a way to easily know the status of a new release ? Like straight in the frontpage of the application.
When people see a release is x days late, they might get frustrated. But if they see a small status

  • new version detected, build scheduled
  • build completed, signing scheduled
  • build error detected
  • build error detected - bad external blob detected
  • bukld… - vulnerability detected
  • … - external library prevent build.
2 Likes
42

That’s incorrect, but I will give you the benefit of the doubt and will ask you to prove your claim.

You don’t have to share your IP, just use a VPN or Tor. If you want to go with the Tor route, then you would first have to create an account using a VPN or a public Wi-Fi, and only them you could use it with Tor.

As for apps, if your app list is something that you consider sensitive, then that’s fair enough. But you should know that any app you install on your device can see your app list.

2 Likes