The main goal of this write-up was to inform users so they can make responsible choices, not to trash someone else’s work."><metaname=authorcontent="Wonderfall"><linkrel=canonicalhref=https://wonderfall.dev/fdroid-issues><linkcrossorigin=anonymoushref=/assets/css/stylesheet.8b523f1730c922e314350296d83fd666efa16519ca136320a93df674d00b6325.cssintegrity="sha256-i1I/FzDJIuMUNQKW2D/WZu+hZRnKE2MgqT32dNALYyU="rel="preload stylesheet"as=style><scriptdefercrossorigin=anonymoussrc=/assets/js/highlight.f413e19d0714851f6474e7ee9632408e58ac146fbdbe62747134bea2fa3415e0.jsintegrity="sha256-9BPhnQcUhR9kdOfuljJAjlisFG+9vmJ0cTS+ovo0FeA="onload=hljs.initHighlightingOnLoad()></script>
The main goal of this write-up was to inform users so they can make responsible choices, not to trash someone else’s work."><metaproperty="og:type"content="article"><metaproperty="og:url"content="https://privsec.dev/apps/f-droid-security-analysis/"><metaproperty="article:section"content="apps"><metaname=twitter:cardcontent="summary"><metaname=twitter:titlecontent="F-Droid Security Analysis"><metaname=twitter:descriptioncontent="F-DroidisapopularalternativeapprepositoryforAndroid,especiallyknownforitsmainrepositorydedicatedtofreeandopen-sourcesoftware.F-Droidisoftenrecommendedamongsecurityandprivacyenthusiasts,buthowdoesitstackupagainstPlayStoreinpractice?Thiswrite-upwillattempttoemphasizemajorsecurityissueswithF-Droidthatyoushouldconsider.
The main goal of this write-up was to inform users so they can make responsible choices, not to trash someone else’s work."><scripttype=application/ld+json>{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":2,"name":"Applications","item":"https://privsec.dev/apps/"},{"@type":"ListItem","position":3,"name":"F-Droid Security Analysis","item":"https://privsec.dev/apps/f-droid-security-analysis/"}]}</script><scripttype=application/ld+json>{"@context":"https://schema.org","@type":"BlogPosting","headline":"F-DroidSecurityAnalysis","name":"F-DroidSecurityAnalysis","description":"F-DroidisapopularalternativeapprepositoryforAndroid,especiallyknownforitsmainrepositorydedicatedtofreeandopen-sourcesoftware.F-Droidisoftenrecommendedamongsecurityandprivacyenthusiasts,buthowdoesitstackupagainstPlayStoreinpractice?Thiswrite-upwillattempttoemphasizemajorsecurityissueswithF-Droidthatyoushouldconsider.\nBeforewestart,afewthingstokeepinmind:\nThemaingoalofthiswrite-upwastoinformuserssotheycanmakeresponsiblechoices,nottotrashsomeoneelse\u0026rsquo;swork.","keywords":["software","android","security"],"articleBody":"F-DroidisapopularalternativeapprepositoryforAndroid,especiallyknownforitsmainrepositorydedicatedtofreeandopen-sourcesoftware.F-Droidisoftenrecommendedamongsecurityandprivacyenthusiasts,buthowdoesitstackupagainstPlayStoreinpractice?Thiswrite-upwillattempttoemphasizemajorsecurityissueswithF-Droidthatyoushouldconsider.\nBeforewestart,afewthingstokeepinmind:\nThemaingoalofthiswrite-upwastoinformuserssotheycanmakeresponsiblechoices,nottotrashsomeoneelse’swork.Ihaverespectforanyworkdoneinthenameofgoodintentions.Likewise,pleasedon’tmisinterprettheintentionsofthisarticle.Youhaveyourownreasonsforusingopen-sourceorfree/libre/whateversoftwarewhichwon’tbediscussedhere.Adevelopmentmodelshouldn’tbeanexcuseforbadpracticesandshouldn’tlureyouintobelievingthatitcanprovidestrongguaranteesitcannot.Alotofinformationinthisarticleissourcedfromofficialandtrustedsources,butyou’rewelcometodoyourownresearch.Theseanalysesdonotaccountforthreatmodelsandpersonalpreferences.Astheauthorofthisarticle,I’monlyinterestedinfactsandnotideologies.Thisisnotanin-depthsecurityreview,norisitexhaustive.\n1.ThetrustedpartyproblemTounderstandwhythisisaproblem,you’llhavetounderstandabitaboutF-Droid’sarchitecture,thethingsitdoesverydifferentlyfromotherapprepositories,andtheAndroidplatformsecuritymodel(someoftheissueslistedinthisarticlearesomewhatoutofthescopeoftheOSsecuritymodel,butthemajorityis).\nUnlikeotherrepositories,F-Droidsignsalltheappsinthemainrepositorywithitsownsigningkeys(uniqueperapp)attheexceptionoftheveryfewreproduciblebuilds.Asignatureisamathematicalschemethatguaranteestheauthenticityoftheapplicationsyoudownload.Upontheinstallationofanapp,AndroidpinsthesignatureacrosstheentireOS(includinguserprofiles):that’swhatwecallatrust-on-first-usemodelsinceallsubsequentupdatesoftheappmusthavethecorrespondingsignaturetobeinstalled.\nNormally,thedeveloperissupposedtosigntheirownapppriortoitsuploadonadistributionchannel,whetherthatisawebsiteoratraditionalrepository(orboth).Youdon’thavetotrustthesource(usuallyrecommendedbythedeveloper)exceptforthefirstinstallation:futureupdateswillhavetheirauthenticitycryptographicallyguaranteed.TheissuewithF-Droidisthatallappsaresignedbythesameparty(F-Droid)whichisalsonotthedeveloper.You’renowaddinganotherpartyyou’llhavetotrustsinceyoustillhavetotrustthedeveloperanyway,whichisn’tideal:thefewerparties,thebetter.\nOntheotherha
| <span>Originally published at <ahref=https://wonderfall.dev/fdroid-issuestitle=https://wonderfall.dev/fdroid-issuestarget=_blankrel="noopener noreferrer">wonderfall.dev</a></span></div></header><divclass=toc><details><summaryaccesskey=ctitle="(Alt + C)"><spanclass=details>Table of Contents</span></summary><divclass=inner><ul><li><ahref=#1-the-trusted-party-problemaria-label="1. The trusted party problem">1. The trusted party problem</a></li><li><ahref=#2-slow-and-irregular-updatesaria-label="2. Slow and irregular updates">2. Slow and irregular updates</a></li><li><ahref=#3-low-target-api-level-sdk-for-client--appsaria-label="3. Low target API level (SDK) for client &amp; apps">3. Low target API level (SDK) for client & apps</a></li><li><ahref=#4-general-lack-of-good-practicesaria-label="4. General lack of good practices">4. General lack of good practices</a></li><li><ahref=#5-confusing-uxaria-label="5. Confusing UX">5. Confusing UX</a></li><li><ahref=#6-misleading-permissions-approacharia-label="6. Misleading permissions approach">6. Misleading permissions approach</a></li><li><ahref=#conclusion-what-should-you-doaria-label="Conclusion: what should you do?">Conclusion: what should you do?</a></li></ul></div></details></div><divclass=post-content><p>F-Droid is a popular alternative app repository for Android, especially known for its main repository dedicated to free and open-source software. F-Droid is often recommended among security and privacy enthusiasts, but how does it stack up against Play Store in practice? This write-up will attempt to emphasize major security issues with F-Droid that you should consider.</p><p>Before we start, a few things to keep in mind:</p><ul><li>The main goal of this write-up was to inform users so they can make responsible choices, not to trash someone else’s work. I have respect for any work done in the name of good intentions. Likewise, please don’t misinterpret the intentions of this article.</li><li>You have your own reasons for using open-source or free/libre/whatever software which won’t be discussed here. A development model shouldn’t be an excuse for bad practices and shouldn’t lure you into believing that it can provide strong guarantees it cannot.</li><li>A lot of information in this article is sourced from official and trusted sources, but you’re welcome to do your own research.</li><li>These analyses do not account for threat models and personal preferences. As the author of this article, I’m only interested in facts and not ideologies.</li></ul><p><em>This is not an in-depth security review, nor is it exhaustive.</em></p><h2id=1-the-trusted-party-problem>1. The trusted party problem<ahiddenclass=anchoraria-hidden=truehref=#1-the-trusted-party-problem>#</a></h2><p>To understand why this is a problem, you’ll have to understand a bit about F-Droid’s architecture, the things it does very differently from other app repositories, and the <ahref=https://arxiv.org/pdf/1904.05572.pdf>Android platform security model</a> (some of the issues listed in this article are somewhat out of the scope of the OS security model, but the majority is).</p><p>Unlike other repositories, F-Droid signs all the apps in the main repository with <strong>its own signing keys</strong> (unique per app) at the exception of the very few <ahref=https://f-droid.org/en/docs/Reproducible_Builds/>reproducible builds</a>. A signature is a mathematical scheme that guarantees the authenticity of the applications you download. Upon the installation of an app, Android pins the signature across the entire OS (including user profiles): that’s what we call a <em>trust-on-first-use</em> model since all subsequent updates of the app must have the corresponding signature to be installed.</p><p>Normally, the developer is supposed to sign their own app prior to its upload on a distribution channel, whether that is a website or a traditional repository (or both). You don’t have to trust the source (usually recom
</code></pre><p>This is a mere sample of the <ahref=https://android.googlesource.com/platform/system/sepolicy/+/refs/tags/android-12.0.0_r21/private>SELinux exceptions</a> that have to be made on older API levels so that you can understand why it matters.</p><p>It turns out the official F-Droid client doesn’t care much about this since it lags behind quite a bit, <strong><ahref=https://gitlab.com/fdroid/fdroidclient/-/blob/2a8b16683a2dbee16d624a58e7dd3ea1da772fbd/app/build.gradle#L33>targeting the API level 25</a></strong> (Android 7.1) of which some SELinux exceptions were shown above. As a workaround, some users recommended third-party clients such as <ahref=https://f-droid.org/en/packages/nya.kitsunyan.foxydroid/>Foxy Droid</a> or <ahref=https://f-droid.org/en/packages/com.aurora.adroid/>Aurora Droid</a>. While these clients might be technically better, they’re poorly maintained for some, and they also introduce yet another party to the mix. <ahref=https://github.com/Iamlooker/Droid-ify>Droid-ify</a> (recently rebreanded to Neo-Store) seems to be a better option than the official client in most aspects.</p><p>Furthermore, F-Droid <strong>doesn’t enforce a minimum target SDK</strong> for the official repository. Play Store <ahref=https://developer.android.com/google/play/requirements/target-sdk>does that quite aggressively</a> for new apps and app updates:</p><ul><li>Since August 2021, Play Store requires new apps to target at least API level 30.</li><li>Since November 2021, existing apps must at least target API level 30 for updates to be submitted.</li></ul><p>While it may seem bothersome, it’s a necessity to keep the <strong>app ecosystem modern and healthy</strong>. Here, F-Droid sends the wrong message to developers (and even users) because they should care about it, and this is why many of us think it may be even harmful to the FOSS ecosystem. Backward compatibility is often the enemy of security, and while there’s a middle-ground for convenience and obsolescence, it shouldn’t be exaggerated. As a result of this philosophy, the main repository of F-Droid is filled with obsolete apps from another era, just for these apps to be able to run on the more than ten years old Android 4.0 Ice Cream Sandwich. Let’s not make the same mistake as the desktop platforms: instead, complain to your vendors for selling devices with no decent OS/firmware support.</p><p>There is little practical reason for developers not to increase the target SDK version (<code>targetSdkVersion</code>) along with each Android release. This attribute matches the version of the platform an app is targeting, and allows access to modern improvements, rules and features on a modern OS. The app can still ensure backwards compatibility in such a way that it can run on older platforms: the <code>minSdkVersion</code> attribute informs the system about the minimum API level required for the application to run. Setting it too low isn’t practical though, because this requires having a lot of fallback code (most of it is handled by common libraries) and separate code paths.</p><p>At the time of writing:</p><ul><li>Android 9 is the oldest Android version that is <ahref=https://endoflife.date/android>getting security updates</a>.</li><li><ahref=https://developer.android.com/about/dashboards>~80% of the Android devices</a> used in the world are <strong>at least</strong> running 8.0 Oreo.</li></ul><p><em>Overall statistics do not reflect real-world usage of a given app (people using old devices are not necessarily using your app). If anything, it should be viewed as an underestimation.</em></p><h2id=4-general-lack-of-good-practices>4. General lack of good practices<ahiddenclass=anchoraria-hidden=truehref=#4-general-lack-of-good-practices>#</a></h2><p>The F-Droid client allows multiple repositories to coexist within the same app. Many of the issues highlighted above were focused on the main official repository which most of the F-Droid users will use anyway. However, having <strong>other repositories in a
</code></pre><p>To be fair, they’ve thought several times about adding certificate pinning to their client <ahref=https://gitlab.com/fdroid/fdroidclient/-/issues/105>at least for the default repositories</a>. <ahref=https://gitlab.com/fdroid/fdroidclient/-/blob/1.14-alpha4/app/src/main/java/org/fdroid/fdroid/FDroidCertPins.java>Relics of preliminary work</a> can even be found in their current codebase, but it’s unfortunate that they haven’t been able to find <ahref=https://github.com/f-droid/fdroidclient/commit/7f78b46664981b9b73cadbfdda6391f6fe939c77>any working implementation</a> so far. Given the overly complex nature of F-Droid, that’s largely understandable.</p><p>F-Droid also has a problem regarding the adoption of <strong><ahref=https://source.android.com/security/apksigning>new signature schemes</a></strong> as they <ahref=https://forum.f-droid.org/t/why-f-droid-is-still-using-apk-signature-scheme-v1/10602>held out on the v1 signature scheme</a> (which was <ahref=https://www.xda-developers.com/janus-vulnerability-android-apps/>horrible</a> and deprecated since 2017) until they were forced by Android 11 requirements to support the newer v2/v3 schemes (v2 was introduced in Android 7.0). Quite frankly, this is straight-up bad, and <strong>signing APKs with GPG</strong> is no better considering <ahref=https://latacora.micro.blog/2019/07/16/the-pgp-problem.html>how bad PGP and its reference implementation GPG are</a> (even Debian <ahref=https://wiki.debian.org/Teams/Apt/Spec/AptSign>is trying to move away from it</a>). Ideally, F-Droid should fully move on to newer signature schemes, and should completely phase out the legacy signature schemes which are still being used for some apps and metadata.</p><h2id=5-confusing-ux>5. Confusing UX<ahiddenclass=anchoraria-hidden=truehref=#5-confusing-ux>#</a></h2><p>It is worth mentioning that their website has (for some reason) always been hosting an <ahref=https://forum.f-droid.org/t/why-does-the-f-droid-website-nearly-always-host-an-outdated-f-droid-apk/6234>outdated APK of F-Droid</a>, and this is still the case today, leading to many users wondering why they can’t install F-Droid on their secondary user profile (due to the downgrade prevention enforced by Android). “Stability” seems to be the main reason mentioned on their part, which doesn’t make sense: either your version isn’t ready to be published in a stable channel, or it is and new users should be able to access it easily.</p><p>F-Droid should enforce the approach of prefixing the package name of their alternate builds with <code>org.f-droid</code> for instance (or add a <code>.fdroid</code> suffix as some already have). Building and signing while <strong>reusing the package name</strong> (<ahref=https://developer.android.com/studio/build/configure-app-module>application ID</a>) is bad practice as it causes <strong>signature verification errors</strong> when some users try to update/install these apps from other sources, even directly from the developer. That is again due to the security model of Android which enforces a signature check when installing app updates (or installing them again in a secondary user profile). Note that this is going to be an issue with Play App Signing as well, and developers are encouraged to follow this approach should they intend to distribute their apps through different distribution channels.</p><p>This results in a confusing user experience where it’s hard to keep track of who signs each app, and from which repository the app should be downloaded or updated.</p><h2id=6-misleading-permissions-approach>6. Misleading permissions approach<ahiddenclass=anchoraria-hidden=truehref=#6-misleading-permissions-approach>#</a></h2><p>F-Droid shows a list of the <ahref=https://developer.android.com/reference/android/Manifest.permission>low-level permissions</a> for each app: these low-level permissions are usually grouped in the standard high-level permissions (Location, Microphone, Camera, etc.) and special toggles (n
</code></pre><p>Also, as written above: the OS pins the app signature (for all profiles) upon installation, and enforces signature check for app updates. In practice, this means the source doesn’t matter as much after the initial installation.</p><p>For most people, I’d recommend just <strong>sticking with Play Store</strong>. Play Store isn’t quite flawless, but emphasises the adoption of modern security standards which in turn encourages better privacy practices; as strange as it may sound, Google is not always doing bad things in that regard.</p><p><em>Note: this article obviously can’t address all the flaws related to Play Store itself. Again, the main topic of this article is about F-Droid and should not be seen as an exhaustive comparison between different app repositories.</em></p><blockquote><p>Should I really care?</p></blockquote><p><strong>It’s up to your threat model</strong>, and of course your personal preferences. Most likely, your phone won’t turn into a nuclear weapon if you install F-Droid on it - and this is far from the point that this article is trying to make. Still, I believe the information presented will be valuable for anyone who values a <strong>practical approach to privacy</strong> (rather than an ideological one). Such an approach is partially described below.</p><blockquote><p>But there is more malware in Play Store! How can you say that it’s more secure?</p></blockquote><p>As explained above, it doesn’t matter as you shouldn’t really rely on any quality control to be the sole guarantee that a software is free of malicious or exploitable code. Play Store and even the Apple App Store may have a considerable amount of malware because a full reverse-engineering of any uploaded app isn’t feasible realistically. However, they fulfill their role quite well, and that is all that is expected of them.</p><blockquote><p>With Play App Signing being effectively enforced for new apps, isn’t Play Store as “flawed” as F-Droid?</p></blockquote><p>I’ve seen this comment repeatedly, and it would be dismissing all the other points made in this article. Also, I strongly suggest that you carefully read the sections related to Play App Signing, and preferably the official documentation on this matter. It’s not a black and white question and there are many more nuances to it.</p><blockquote><p>Aren’t open-source apps more secure? Doesn’t it make F-Droid safer?</p></blockquote><p>You can still find and get your open-source apps elsewhere. And no, open-source apps <ahref=https://seirdy.one/2022/02/02/floss-security.html>aren’t necessarily more private or secure</a>. Instead, you should rely on the strong security and privacy guarantees provided by a modern operating system with <strong>a robust sandboxing/permission model</strong>, namely modern Android, GrapheneOS and iOS. Pay close attention to the permissions you grant, and avoid legacy apps as they could require invasive permissions to run.</p><p>When it comes to <em>trackers</em> (this really comes up a lot), you shouldn’t believe in the flawed idea that you can enumerate all of them. The <em>enumerating badness</em> approach is <ahref=https://www.ranum.com/security/computer_security/editorials/dumb/>known to be flawed in the security field</a>, and the same applies to privacy. You shouldn’t believe that a random script can detect every single line of code that can be used for data exfiltration. Data exfiltration can be properly prevented in the first place by the permission model, which again <strong>denies access to sensitive data by default</strong>: this is a simple, yet rigorous and effective approach.</p><p>No app should be unnecessarily entrusted with any kind of permission. It is only if you deem it necessary that you should allow access to a type of data, and this access should be as fine-grained as possible. That’s the way the Android platform works (regular apps run in the explicit <code>untrusted_app</code> domain) and co
