Skip to main content

I've already told you about the additional APK checks now performed in my repo, and that you can find the first summary of explanations in the repo info (apt.izzysoft.de/fdroid/index/i…).

Now the results of those checks on app permissions are being made transparent to you if you expand the permission section for an app. Not seen in the screenshots: on mouseover you now will get a short explanation for each permission.

#IzzySoftRepo

screenshot from the repo info page showing the section that explains the checks performed on the AndroidManifest.xml of APKs
Screenshot of the permissions section for an APK. Sensitive permissions are shown in bold, those not yet verified are highlighted with "chocolate" color so one knows where special care is needed.

Information on IzzyOnDroid's F-Droid compatible repo

how to use this site and its repo, how to get your app listed here, and more.
IzzyOnDroid App Repo
#IzzySoftRepo
in reply to IzzyOnDroid ✅

IzzyOnDroid ✅
IzzyOnDroid ✅
• •
Coming next: Making "App Configuration & Special Access" transparent at the #IzzySoftRepo (for background, again see apt.izzysoft.de/fdroid/index/i…). This will be rolled out this weekend, and once more will not be shown for all apps at once. At the moment, it will only show what has been checked when it came up with a current check, so "warnings" should be very rare. Next step is to record those things automatically to show even the things not yet added to the app's configuration here.
Screenshot from an app's details page showing a part of the packages section (i.e. for a specific release) with a new section labeled "App Configuration & Special Access". It lists 2 "Sensitive Application Flags", 1 of them using normal text with the flag and why it's needed, another highlighted and as reason "The purpose of this flag has not (yet) been cleared". In addition, "Sensitive Intent Filters" shows a single filter accompanied by a proper reason.

Information on IzzyOnDroid's F-Droid compatible repo

how to use this site and its repo, how to get your app listed here, and more.
IzzyOnDroid App Repo
#IzzySoftRepo
in reply to IzzyOnDroid ✅

IzzyOnDroid ✅
IzzyOnDroid ✅
• •

And from now on also includes findings on updates automatically. So expect to see some more "italics chocolate" (with the dark theme at least), as clarification can only happen after a finding 😉

Just rolled out a few minutes ago. Full (re)scan of all APKs will follow at a later time, once the signing block checks have been implemented as well (see gitlab.com/IzzyOnDroid/repo/-/… for details if interested).


additional APK checks (#475) · Issues · IzzyOnDroid / repo · GitLab

A discussion on different topics raised ideas for security improvements, from which it is worth to adopt some additional checks:
GitLab
in reply to IzzyOnDroid ✅

IzzyOnDroid ✅
IzzyOnDroid ✅
• •

All APKs (~2.000) of the #IzzySoftRepo have been rescanned. Expect to see more details on most apps with the next sync. Teaser Image below.

While permissions already have a short description on hover (and link to more), something similar still needs to be implemented for the other sections, though. And of course a proper documentation…

#Android #apps #transparency

screenshot of the package section from a "random app" showing details on one of its APKs, including Android Versions, Signing Block BLOBs, sensitive intent filters, all permissions requested with sensitive permissions highlighted (some of them explained and thus without "warning colors"), malware check results, library scan results
#android #apps #IzzySoftRepo #transparency
in reply to IzzyOnDroid ✅

IzzyOnDroid ✅
IzzyOnDroid ✅
• •

And now you can find some background on the SigningBlock BLOBs on the #IzzySoftRepo info page (apt.izzysoft.de/fdroid/index/i…) as well.

The last task of this „additional APK checks project“ will be to link to the corresponding blocks from where they are reported with an app, so you can find it more easily.

#Android #apps #transparency

screenshot from the IzzyOnDroid repository information showing the section outlining some background of the SignatureBlock checks concerning „SignatureBlock BLOBs“ which might raise concerns

Information on IzzyOnDroid's F-Droid compatible repo

how to use this site and its repo, how to get your app listed here, and more.
IzzyOnDroid App Repo
#android #apps #IzzySoftRepo #transparency
in reply to IzzyOnDroid ✅

IzzyOnDroid ✅
IzzyOnDroid ✅
• •

And there you go. See the little blue ⓘ icons in the screenshot (and on the corresponding app details pages)? Those you can click if you want to know what the corresponding section is about.

This was the last check-box to tick on issue 475, so I just closed that now. It's sub-tasks (following up the findings) will of course be processed further, until done.

Enjoy! :awesome:

screenshot of the details section on an app's release. Each "scan block" now has a little ⓘ icon linking to the background of the corresponding scan, including some details on how to read the findings, too.
⇧