How would you avoid potentially dangerous apps in the Play Store

Question

edit: The goal of the question is to create a simple checklist for novice users.

It is not uncommon for news warning about malicious apps that have entered the Play Store to appear fairly regularly.

The common advice is to read reviews and check the app's ratings. However, attackers also do fake reviews and comments.

Question 1: What sort of criteria have stood the test of time to avoid this sort of malware?

• comments can't be trusted.
• rating can't be trusted.

At the moment, time of existance, e.g. 2+ years, is the only one I think is feasible.
Can it be trusted too? And what else is important?

• Yes or No criteria is preferable
  
• False positives are better than missed malware

Question 2: Is there a curated list of trustworthy apps?

Currently, APK Mirror seems to be the best alternative since the apps there are curated by them. But they don't allow paid-apps.

Answer 1

While I mostly agree to Yaksha's answer, I still want to partly oppose it – and of course will include my reasons:

• Instead of using Playstore, stick with F-Droid whenever possible.
  F-Droid only serves open-source apps – so other than what Yaksha wrote about Playstore apps, you can look into the source. But most users won't be that "techy" to really understand it. Which is why the F-Droid team does that for you: they compile from the sources they have checked before (and they have a community supporting them). Plus, they have very strong inclusion criteria an app must meet to be allowed into their repository. So you e.g. won't find apps with proprietary ad or tracking modules there. Plus, so-called AntiFeatures are always pointed out. No way a dev can "hide" that by keeping it out of the app description.
• When you have to use Playstore, cross-check the apps with Exodus.
  Exodus grabs free (non-paid) apps from Play Store and analyses their code to detect trackers. It then points out how many of those it found and which ones. You can even read details on most of those "privacy snoopers" to know what they do. But they can only grab apps which require no payment.
  For paid apps: AppBrain.
  AppBrain offers an alternative front-end to what you find on Playstore – same data actually, and for installing an app you'd even be redirected to Playstore. But they add a bunch of useful information on top by checking the libraries an app contains, and grouping them so you can easily spot ads and analytics. Unfortunately, since summer 2017 free access is limited to 5 apps per day (creating a free account, you can top that up to 10).
• Before installing a new app, cross-check with forums.
  Often, a simple search (using the engine of your choice) gives plenty of useful hints – e.g. latest reports if an app had "conspicuous activity". For example, Cheetah Mobile's "Security" apps caused a big uproar lately as they called up to porn pages in background. With that search you can also find "external reviews" – though most of those usually concentrate more on the features than on security or privacy (a big exception is the German portal MobilSicher which does it just the other way around).

To make those steps easier, when looking for a new app you can use my app listings as a starting point. There you find the apps ordered by ratings – but with useful annotations: number of permissions requested (and details on them), availability on different places (e.g. F-Droid and Playstore), links to reviews, marks on critical libraries used, and more. It's not the full load of apps available worldwide, but a good hand-selected amount (about 14k currently).

Another word: don't rely on so-called "Anti-Virus" apps – they are mostly snake-oil. For references on this statement, please check e.g. Is there really such a thing as an Android virus?, Android antivirus apps are useless — here’s what to do instead and Antivirus software is snake oil!.

And yes, of course use your "common sense" when taking a look at the permissions an app requests: are they really justified by the purpose? Though admitted, that's not as easy as it sounds. While it might be clear a torch doesn't need access to your contacts – could you guess if access to your camera might be justified? Spoiler: indeed, to fire the flashlight it might be needed. When in doubt, compare with other apps offering the same feature set. If one app needs 24 permissions for something another can do with 5, you can be almost sure the difference of 19 is needed by some ad or tracking module. Again, my above mentioned app listings make such comparisons easier. To pick up an earlier example again: if one app was brought up obviously malicious, avoid all other apps from the same dev as well – chances are rather good they have similar issues (so: no Cheetah Mobile, for example).

Answer 2

USER IS THE WEAKEST LINK IN THE SECURITY CHAIN

So, to protect against harmful apps, you must strengthen yourself on how they tend to take advantage of the User's unawareness.

By experience and an open mind to learn about cyber space security, YOU will become the best judge to decide which apps are safe. This will be always better than relying on any curated lists or whatsoever.

You can't really look into the code and guard yourself against the technical glitches(which the Playstore will do by itself). All you can do is it not fall for the stuff that is directed on taking advantage of the user, which are difficult for programs to scan and capture, because it's dependent on YOU.

As a quick guide, you may think of these for taking decision:

• Stick to Playstore. New users(until you know what you are doing) should never download apps from anywhere else, whatever may be the reason. If the reason is so strong that you want to go outside Playstore, then that is a very clear indication that you are going somewhere, not to be gone, and will surely end up with malware.
• Is the app asking for permissions only for what it wants to do? You may find that for the task that the app accomplishes, there's no need to access contacts data, but it still asks for that permission.
• If it is an open source app, that might be a good chance to move forward with it, although nothing can be guaranteed.
• The way the app description is written on the play store. If they are not really explaining the permissions and what they accomplish clearly, but are just trying to attract users, well that may not be a good one.
• The purpose of the app itself: It should be trying to do something that you can believe and not something magical which it claims only it can do.

A lot more...