Publish app on a secure app store.

graphene1over commented 2 days ago

Describe your suggested feature

Currently the only way to obtain the app is through sideloading or fdroid. This is a security risk due to being unable to verify the legitimacy of the app and fdroid's major security flaws.

Currently there are two secure app stores, Accrescent, which is currently in whitelist-only alpha and Gplay, both of which employ certificate pinning and verify the downloads to mitigate MITM attacks.

Other details

No response

Acknowledgements

[X] I have searched the existing issues and this is a new ticket, NOT a duplicate or related to another open issue.
[X] I have written a short but informative title.
[X] I will fill out all of the requested information in this form.

graphene1over commented 2 days ago

Alternatively publishing the signing certificate hash separately to distrust the site would be an option, which would make it possible to use AppVerifier to verify the app's legitimacy. However this is a suboptimal solution.

Bnyro commented 2 days ago

Neither of them is planned due to additional efforts that would be needed. There's currently a lack of time and contributors, and I don't have interest in making the release workflow more complicated.

you-apps / ClockYou