Some free applications on Google Play are limited to the United States so the rest of the world has to use dodgy sites to get them. However the security of such sites are questionable as the apps might be modified and contain some kind of malware.
Is there a way to get the SHA or MD5 hash of the apk file from the play store so it can be compared with the downloaded one to make sure that it's safe?
-
2Related: How can I verify the authenticity of an apk file I downloaded?– eldarerathisNov 8, 2012 at 17:07
-
I don't think there md5/sha5 sum would be a good idea. However all apk's are signed by the developer so if you have another app from the same author compare the signatures and check the .apk sig itself. EDIT: see eldarerathis' link above– ce4Nov 8, 2012 at 17:11
-
the other app from developer is limited to so we can't download and compare– mikeNov 8, 2012 at 18:10
-
sha-3 sum is a very good idea because you can't clone it faster than 1000 years and you can simple compare hash of what you downloaded with what google play say on app page. it can't be easier and safer.– mikeNov 8, 2012 at 18:16
-
1I know what SHA3 is. I was asking about the figure of "1000 years". I'm not talking about cloning (what is that anyway?) but making another apk that has the same checksum as the original. It certainly doesn't require 1000 years given adequate processing power.– user13391Nov 8, 2012 at 19:41
|
Show 6 more comments
3 Answers
The Guardian Project's free and open-source app Checkey does much of what you're looking to do.
via F-Droid:
"Checkey is a utility for getting information about the APKs that are installed on your device. Starting with a list of all of the apps that you have installed on your device, it will show you the APK signature with a single touch, and provides links to virustotal.com and androidobservatory.org to easily access the profiles of that APK. It will also let you export the signing certificate and generate ApkSignaturePin pin files for use with the TrustedIntents library."
No it isn't. It would be also possible to make the modified package have the same md5 as the original, so this wouldn't be too secure.
One solution is to remove your SIM card and use a VPN app like TunnelBear VPN to circumvent regional restrictions or an alternative market like Amazon App Store or GetJar.
-
no dear VPN won't work with new google store. and MD5 was example. SHA-512 or SHA-3 is completely secure with today computing power ... its sad google don't do that. i think just this can prevent millions of cell phones and tablet don't get infected with trojan horses– mikeNov 8, 2012 at 16:11
-
Why do you say that VPN doesn't work? I'm using it, and it works. Google is a corporation not a non-profit. It has a financial interest in users downloading apps from the Play Store. So Google doesn't gain anything from adding hashes. Use a VPN like I said above. It works. (Also most people don't know what checksums or hashes are. )– user13391Nov 8, 2012 at 16:29
-
for paid maybe but for free apps VPN won't work. google store check your sim card number and understand your real country ...– mikeNov 8, 2012 at 16:37
-
1@mike Your operators code to be exact. So how do you circumvent that? There are several market enabler apps, or just take out the sim card.– user13391Nov 8, 2012 at 16:57
-
1"all the people are idiot" Yes. Among other things, more people are technologically illiterate than literate. android.stackexchange.com/questions/12538/… There're also people who don't have internet on their phone, don't have a Google account, don't have Play Store.– user13391Nov 8, 2012 at 19:38
The only way is if you first download it then find its MD5 or SHA1 hash.
Or, use the site http://apps.evozi.com/apk-downloader/ but you have to use the full qualified name of the app.
-
The website seems to be legitimate, make sure to disclose any affiliation with the site. Mar 14, 2016 at 14:44
-
4This doesn't make any sense to me. If I can already download the app from Play Store then the question would not exist at first place. Why would I bother with a checksum since the problem wouldn't exist anymore. And using checksum of an apk downloaded from a third-party site as a base checksum to compare with makes the whole point of verification, moot.– Firelord ♦Mar 14, 2016 at 17:22
-
Looks like a useful site, but agreed with Firelord that it is virtually worthless as a method of file verification. Mar 14, 2016 at 21:42
-
Thank you, your answer answers the root problem, how to circumvent country restrictions on the play store.– MaikoIDApr 5, 2022 at 14:00