Sorry if it sounds a dumb question but I always thought using the official playstore that comes pre-installed is the safest so everything related to F-Droid is new to me. Did anyone had apprehension on installing F-Droid when you had bare to none knowledge how it works? I like to be cautious and on the page it has a Instructions to verify the download page and it only tells how to check from Linux but not from Android, what am I missing here?
They just didn’t document how to do it on Android.
Using Play is probably the least safe way to install apps, which has been recently shown to have plenty of malicious apps.
Edit: They documented what it typically looks like on Linux. To document how to do it elsewhere would require recommending an app to do it with.
Would you trust that recommendation?
Could you get away with using something like Termux?
I’ve never heard of it, is it safe to use? I’ll see if I can find the .apk from F-Droid
Asking “is it safe to use” is pointless. No one can say an app is “safe”, just that they’ve never seen an issue.
I’d argue Termux isn’t safe, because if you’re rooted you can break the OS. And I use Termux every day.
“Safe” is determined by your use-case and what you do. I’d even argue there’s no such thing as “safe”, just a risk level which you are comfortable with.
To be honest, I didn’t verify the signature when I installed it. The download is over TLS (HTTPS) so you know you have a secure connection with the F-Droid server during the download. But because of the tiny chance the F-Droid website was hacked at the time you download it, you should verify the signature.
Stock Android does not have tools to do that verification. Just verify it from the desktop and then send it to your Android device.
But I don’t see how verifying the apk signature would help if your concern is that “you have bare to none knowledge how it works”. The only thing that would fix that would be if you actually learn how it works.
Luckily, unlike other stores that are closed source and actively and purposefully hide from you what they do, F-Droid is open source, so anyone can go to the repo holding their source code and learn how it works, or build their own themselves, as long as they wanna spend that much effort.
I will be totally honest, I’ve never verified the signature, primarily for the same reason as other people. It has HTTPS connection, and I would highly doubt that the website had been hacked while I was trying to download it. However, that really is a terrible excuse, and I really should do better in the future. But honestly, I don’t know how to verify signatures myself.
How do you know the signature hasn’t been compromised?
I think it is a big rabbit hole I don’t have time to think about