4

Scenario: a developer crates an android application using Android Studio and shares th APK file over the internet.

What data (if any) about the developer can be found inside the APK file? Host operating system, hostname, user name, key fingerprints..? Is it possible to remove every reference (if any) to the application developer without breaking the APK file?

  • 2
    Move the source to a computer of not your own, and create the APK on that. Thus, if any metadata gets assigned to the package, it wont be yours. – Rápli András Feb 6 '17 at 3:51
  • @RápliAndrás well that's possible, but I would like to know what can be found about the computer on which the apk is built (even if the computer is not the developer's main macnine). Thanks – sguerrini97 Feb 23 '17 at 12:22
1

You can get Developer ID, name, location, organization from the certificate. Thou developer id or details may change in the play store, the original cert are always in use especially if the developer is providing and update to their apk.

Developer changing details in the play store does not change their original certificate.

APK Signing GUI

Android requires that all APKs be digitally signed with a certificate before they can be installed.

A public-key certificate, also known as a digital certificate or an identity certificate, contains the public key of a public/private key pair, as well as some other metadata identifying the owner of the key. The owner of the certificate holds the corresponding private key.

More information regarding the certificate details can be found at android developer site

  • So there's NOTHING else apart from the certificate? Creating a new keystore with random data or shipping the unsinged apk (I know the user will have to sign it in order to install it) would make the developer anonymous? – sguerrini97 Feb 23 '17 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.