As with the latest update to Google Play one now longer sees the full list of permissions requested by an app on install/update1, I feel my privacy invaded. Even worse, an app could sneak in additional permissions with an update, and without the user knowing2,3.
So I'm looking towards alternatives.
I know we've got What are the alternative Android app markets?, but a) that's more or less a listing of other markets (without giving backgrounds)4, and b) it's not even mentioning Aptoide.
I don't want another app that has to run in background permanently to "check license validity", so things like the Amazon Appstore or AndroidPIT are out. AppBrain is just another front-end to Google Play – so nice as it is, it doesn't solve the issue, as for app installs and updates it just has to re-direct to Google Play – which I'm rather about to "flee".
Aptoide on the other end is said to serve more than 120.000 apps currently. As the name suggests, it uses APT style repositories, which I'm used to from Linux (Debian and derivates). It even lets you have your own private repo to share apps between devices (or with friends). All apps are offered for free, so no need for a "license server". But how safe is it for the end-user? I've googled (and ducked) for hours, but could not find any source on this. Instead I found a lot of links of the type "get paid apps for free", "black market", and other piracy-oriented stuff – which is definitely not what I'm after. I'm more than open to pay for good apps5, so "getting them for free" is not the intention behind my question. Like F-Droid, Aptoide has multiple repositories – but I couldn't figure out whether there's a "trust-able" main repository like with F-Droid.
There is related information available in the package description (e.g. this one) indicating safety measures such as malware scan, signature validation, and third-party-validation. But as the corresponding web page shows, this information seems to be at least partly relying on user feedback (which could be faked/manipulated), or is not even presented to the user (the package info e.g. names 3 scanners used to check, I cannot find this info on the web page). While I might be able to look things up via package info, I cannot ask e.g. my 70+ years old parents to do so. On this page, Aptoide also points out how to see results of their security measures, and explicitly states:
Aptoide Anti-Malware platform analyses applications in run-time and disables potential threats across all stores.
(Emphasis mine) – which suggests a malware protection comparable to that of Google Play (how does that go together with those "black market rumors"? Maybe they just don't remove offending apps, but only mark them instead?).
Is there a way to safely use Aptoide as source for apps? If so, how?6 If not, why not?
Bonus points for an "idiot proof" way which could be recommended to less experienced users.
1 I know it would be possible opening the Google Play Store web page of the app, scroll through it, and click the corresponding link when found – but you can't call that user-friendly, or expect users doing this on every update.
2 e.g. on first install it requested the "unsuspecting"
READ_PHONE_STATE with the usual justification. With an update, it could request
PROCESS_OUTGOING_CALLS, and others – and the Play app would not bring that up, as they belong to the "same group".
3 To figure "new permissions", one had to compare those of the installed version with those of the present one. Have fun!
4 I've just edited two answers and added some details on AppBrain and F-Droid to fill those gaps
5 I've bought a lot of apps on Google Play (or donated to the dev directly), and e.g. F-Droid has donation buttons on each app's page to make this possible
6 I could imagine by knowing (and restricting your use to) "safe Aptoide repositories" this could be achieved. But as I wrote, I couldn't figure out which ones to consider "safe". The Aptoide article on Wikipedia suggests there's a "default repo" on install, and more repos need to be added manually; so it might be sticking to that first one is safe.