F-Droid: A security-conscious repository for Free and Open Source Software (FOSS) applications for Android

ARTICLE – F-Droid is an app store and repository for verified Free and Open Source Software (FOSS) applications for Android (F-Droid Docs page). I first heard about F-Droid from a CNET article in early August. According to CNET, “… 200 Android apps were found infected with malware [on Google Play] in March, followed by July’s discovery of 1,000-plus Android apps harvesting data even after you deny permissions …”. So, in the interest of security and privacy, perhaps places like F-Droid are a nice alternative to Google Play.

F-Droid is a non-profit volunteer open-source project (it is developed and run by the community) and was started by Ciaran Gultnieks in 2010 (F-Droid About page). Since the apps on F-Droid are open-source, it allows anyone to comb through an app’s code to see if there is any questionable activity going on. There are only about 2600 apps available through F-Droid according to CNET, so this may not have much of what you’re looking for. However, if you are curious about F-Droid and want to check out its security, you can peruse their Security Model and view their latest Security Audit Results.

If you want to try F-Droid, you’ll have to download the app from f-droid.org as it is not available through Google Play.

I downloaded the app from my phone’s Chrome browser. When I tapped on the “Download F-Droid” button on the f-droid.org website, I was prompted by my phone that “This type of file can harm your device. Do you want to keep FDroid.apk anyway? Cancel or Ok”. I tapped on “Ok”. Once the APK file was downloaded, I tapped on “Open” next to the downloaded file.

My phone then warned me that “For your security, your phone is not allowed to install unknown apps from this source [Chrome]. Cancel or Settings”. I tapped on “Settings”. I was taken to the “Install unknown apps” screen for Chrome where I toggled on the “Allow from this source” setting, then tapped on the back arrow at the top left of the screen. I was then asked “Do you want to install this application? It does not require any special access. Cancel or Install.” I tapped on “Install”. Once installed, it took a few seconds to update its repositories, then I was able to browse F-Droid for open source apps.

Here is what F-Droid looks like when looking at the Catagories tab.

When I installed my first app, I was prompted by my phone about installing unknown apps from F-Droid. I then had to go to the “Install unknown apps” settings and toggle on “Allow from this source” (in Android 9.0: phone settings > Apps & notifications > Advanced > Special app access > Install unknown apps > F-Droid).

Because the people working on F-Droid are security and privacy-conscious, it piqued my interest, so I thought perhaps it may pique yours if you didn’t already know about it. If you are interested, go to f-droid.org to download it and give it a try!