What's the auditing/vetting process like to get an Android app into the F-Droid repository? To ask it another way, what's to stop an evil developer from uploading a backdoored Android app to the F-Droid repos?
There definitely are dangers around downloading apps from third-party repositories. See this recent example, where an app hosted on a third-party repo stole money from user's PayPal accounts once installed.
As for F-Droid inparticular, their developer documentation doesn't elaborate on how/if they audit submissions. This may be because:
- They don't audit submissions.
- They do audit, but don't want to disclose information about the process as this may make it easier for malicious users to bypass said process.
- They do audit, but haven't published the details as they haven't had time or it's not a priority for them.
The only way to get more information about their audit process is probably to reach out to them and ask, but overall I would advise caution when downloading apps from a third-party repository. It is very much possible for these apps to be backdoored or contain malicious code.
The "Security Module" as per the link below clearly states the following:
Their security precautions:
additional security precautions are taken to make it as hard as possible to exploit this vector.
- included on the HSTS preload list, so major browsers will only ever use HTTPS for all connections to f-droid.org
- a strong TLS/HTTPS configuration
- a strong HTTP Content Security Policy
- PGP-signature on the initial install download link
- automated regular and random auditing that F-Droid.apk has not been tampered with
- F-Droid Limited controls many potential phishing domains like fdroid.org, f-droid.com, and f-dro1d.org.
- website is statically generated to greatly reduce the attack surface
And as for the in-app application:
Protecting against malicious contributor-generated data
The app descriptions are submitted by all sorts of people, and they can also be taken from the app’s source repository. This data is ultimately delivered to the Android client or the user’s browser via f-droid.org.
- Repomaker filters the texts through Mozilla’s bleach and has a good HTTP Content Security Policy.
Answering your question: (Reddit Source)
As others have said, we don't audit every single app that makes it into the store. But we do make sure that everything is free software, and do test/investigate to a certain degree.
There was recently a study made of the amount of malware apps in each app store for Android. I can't find it now, but IIRC it was a pdf and should have been published in the past year. Basically, what it said is that many alternative stores smaller than Google Play were close to having no malware, but only one had absolutely none: F-Droid.
I guess what I'm trying to say is that we're not bulletproof, and we never said we were. Our only promise to the users is that the apks we distribute come from the source that is publicly available, and have been built and distributed by the F-Droid server tools which are also free software. So far, this policy seems to have worked well :)
https://www.reddit.com/r/privacy/comments/3cjj2e/how_secure_is_fdroid/ Reddit, Answering the OP's Question