0

I'm playing with my first Android device.

First thing I discovered is that Google Play isn't installed. If I search for an APK for Google Play Store, the results are from third parties such as apkmirror.com rather than from Google itself.

This seems to be the norm. When I discovered how many permissions Google Play wants for itself, I declined and experimented with looking for APK files individually.

Same story, APKs seem to be available through myriad third-party websites, none of which I trust not to repackage an apk with malicious code.

This device is just for experimentation, so I've been installing things anyway just to see what happens. I'm amazed that there seems to be no indication whatsoever that app developers are publishing cryptographic signatures or SHA hashes or offering any sort of authoritative statement that an apk is authentic.

Generally speaking, if I google apk site:foo.com I get no results, or only a link to get the app through a store.

Why don't developers release the raw APK files or any means to verify the APKs available through third-parties?

Improve this question
5
  • I think this is because an APK file basically is just a renamed zip file of the app. Publishing the APK thus would mean in a way making your app open source.
    – invalid_id
    Nov 18, 2016 at 9:50
  • @invalid_id: You are totally wrong: Publishing an APK is not equivalent to open source. It is simply allowing it everyone to download fro free.
    – Robert
    Nov 18, 2016 at 13:17
  • @Robert I know it's not equivalent, that's why I said "in a way". As one of the answers below states, the code can be reverse-engineered. So it's not actually open-source, but more "accessable-source".
    – invalid_id
    Nov 18, 2016 at 13:20
  • @invalid_id: For reverse engineering you can use any other source for an APK e.g. a PlayStore enabled device. Therefore publishing it on a website or not does not make any difference.
    – Robert
    Nov 18, 2016 at 13:29
  • @Robert I didn't know the PlayStore also provides the APK.
    – invalid_id
    Nov 18, 2016 at 13:31

3 Answers 3

Reset to default
1

If you'd install apps from the developers website directly, you had to trust each of the developers personally that their apps do not contain any malware etc. That's why there are "app markets" (see our tag-wiki for details). Choosing wisely, the user then just needs to trust that market to do the necessary checks. Most of them have such checks in place:

  • Google Play Store has e.g. its "bouncer"
  • F-Droid compiles the apps from the resp. sources, which it checks beforehand
  • Aptoide uses several sources to validate packages (e.g. VirusTotal, comparing signatures, and more).

Besides (and the last item implicitly mentions this), developers provide means to check the validity of their .apk files: they sign them with their certificates. Only the dev has the "private key", and validity can be checked using the "public key" – or simply the key's finger-print. Which is what e.g. Aptoide includes in its "malware check": It compares if the finger-print matches with what .apk files of the same dev from other sources (mainly Google Play Store) shows.

As your device doesn't ship with Playstore (and I fully agree its permission hunger is excessive), I would recommend you using F-Droid. Their repository isn't nearly as big as Googles, but the security measures are good. And you can use additional repositories with their app to cover a larger pool. I definitely and strongly discourage using .apk files you found "somewhere in the wild" unless you know exactly what you do (i.e. either you can trust the source, or know how to check the .apk for yourself to establish trust).

Improve this answer
1

The answer "why" is very simple: Developers are humans and humans are lazy. Or from a business side it is the maximum "outcome" (app is available from a high-available site and the download capacity is very high) with a minimum of invest. Google Play Store does a god job for 99.999% of all Android users.

Publishing it on a separate webpage costs additional effort. You need a nicely designed web-page and you have to keep everything in sync.

Google hosts the file for you, Google provides and automatic update system and furthermore you can sell your app for money.

BTW: If you know what you are doing it is not impossible to download apps from Google Play Store without having Google Play Services installed. There are a some scripts (Python and others) available for downloading APKs from Play Store.

Improve this answer
0

The separately available APK can be redistributed over multiple devices and also reverse-engineered. While most of the developers would not care about re-distribution of they apps that are free anyway, they do not want you just to change the icon and then re-upload app to the Play Store as your own.

Open source apps that allow you to distribute the modified version are most often part of the F-Droid project. You can download the APKs there no problem.

Also, developers usually do think that anybody would be interested in installing they APKs directly. You need to tweak device settings to allow this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .