As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read something like
Are you sure you want to allow <large block of code filling my screen>.
Immediately, the Redphone and Signal apps (both apps are for secure communication) started updating.
As a precaution, I restarted, uninstalled them, then reinstalled them from the Play store. After a while, they automatically "updated" again. This could be a coincidence, but it smells fishy to me.
Is there any way to verify the hash an app on Android? Could I have approved some adversary’s certificate or something? I run Cyanogenmod, if that matters.
I'm an activist and regularly attend protests but I never do anything exciting, so as far as threat models go I have no reason to believe anyone would give a hoot about my conversations. So it's probably nothing, but I'd like to have the peace of mind.
I'm sorry if this is answered already. I searched unsuccessfully, but it may be that I don't know the correct keywords to use.