Tell me more ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.
up vote 5 down vote favorite

Some free applications on Google Play are limited to the United States so the rest of the world has to use dodgy sites to get them. However the security of such sites are questionable as the apps might be modified and contain some kind of malware.
Is there a way to get the SHA or MD5 hash of the apk file from the play store so it can be compared with the downloaded one to make sure that it's safe?

share|improve this question
1  
I don't think there md5/sha5 sum would be a good idea. However all apk's are signed by the developer so if you have another app from the same author compare the signatures and check the .apk sig itself. EDIT: see eldarerathis' link above – ce4 Nov 8 '12 at 17:11
the other app from developer is limited to so we can't download and compare – mike Nov 8 '12 at 18:10
sha-3 sum is a very good idea because you can't clone it faster than 1000 years and you can simple compare hash of what you downloaded with what google play say on app page. it can't be easier and safer. – mike Nov 8 '12 at 18:16
1  
I know what SHA3 is. I was asking about the figure of "1000 years". I'm not talking about cloning (what is that anyway?) but making another apk that has the same checksum as the original. It certainly doesn't require 1000 years given adequate processing power. – Richard Borcsik Nov 8 '12 at 19:41
show 4 more comments

1 Answer

up vote 1 down vote

No it isn't. It would be also possible to make the modified package have the same md5 as the original, so this wouldn't be too secure.
One solution is to remove your SIM card and use a VPN app like TunnelBear VPN to circumvent regional restrictions or an alternative market like Amazon App Store or GetJar.

share|improve this answer
no dear VPN won't work with new google store. and MD5 was example. SHA-512 or SHA-3 is completely secure with today computing power ... its sad google don't do that. i think just this can prevent millions of cell phones and tablet don't get infected with trojan horses – mike Nov 8 '12 at 16:11
Why do you say that VPN doesn't work? I'm using it, and it works. Google is a corporation not a non-profit. It has a financial interest in users downloading apps from the Play Store. So Google doesn't gain anything from adding hashes. Use a VPN like I said above. It works. (Also most people don't know what checksums or hashes are. ) – Richard Borcsik Nov 8 '12 at 16:29
for paid maybe but for free apps VPN won't work. google store check your sim card number and understand your real country ... – mike Nov 8 '12 at 16:37
@mike Your operators code to be exact. So how do you circumvent that? There are several market enabler apps, or just take out the sim card. – Richard Borcsik Nov 8 '12 at 16:57
i think you are in USA or UK. well outside there its not easy as you think. it not working, somehow it understand and not allow to download. i tried anything. the only way is to root phone and try market unlocker which is not safe. its a shame google don't do that as its very simple. millions of people have no way to understand apps which download from torrent are safe or not – mike Nov 8 '12 at 18:06
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.