Hello,
I downloaded SchildiChat to access matrix as their UI is more conveniant than Element. Exodus and TC slim however found "Google Admob" within the app.
As you can see on the screenshot. I asked developers about it, and they told me there's no trackers on the app.
Who's right, who's wrong ?
Thanks
The version from their F-Droid repo, SchildiChat[f], has no Google libraries. The version from the playstore includes proprietary blobs to support Firebase Cloud Messaging (Google notifications system). Exodus may be misidentifying this as "Google Admob", which is not present in the app.
You can install ClassyShark3xodus,
which can de-compile apps and scan them for trackers on the fly to figure it out yourself.
Do let us know the results :)
Its a bit confusing because F-Droid ship the schildichat version with Google trackers without saying it. One have to add the schildi repo to F-droid and download the FOSS version: https://s2.spiritcroc.de/fdroid/repo/?fingerprint=6612ade7e93174a589cf5ba26ed3ab28231a789640546c8f30375ef045bc9242
https://gitlab.com/fdroid/fdroiddata/-/issues/3717
Opened an issue about it
Closed this issue, false positives from exodus.
I can confirm that schildichat from f-droid contains 2 Google trackers after analysis :
603 tested signatures on 67125 classes (40361329)
Google AdMob Sentry
*Google AdMob 9com.google.ads.
*Sentry 698io.sentry.
file:///data/app/~~Opb2slJC07NYLm9e2C2ikw%3D%3D/de.spiritcroc.riotx-uWSIGBd1PzyWdDEl86q5NA%3D%3D/base.apk
MD5sum: 55da2edbc904165755632ae132f30ed5 SHA1sum: ed27b82c54dd62315c6a46935af66e4666549a3d SHA256sum: de365d9e2d8e3fa08b1501a0079a95cd0b37fee6186dbd9eba2a4c22d7268473
CN=FDroid,OU=FDroid,O=fdroid.org,L=ORG,ST=ORG,C=UK
SHA256withRSA
CERTIFICATE fingerprints: md5: c78350850dd5f3421f36d7cfbe0927bc sha1: 63ec0e3261dc3be0469bc68955bf58c0684ba52d sha256: 5d473a5169ef71aedcbca1da511210bab4aaff278c5ef785760df882954b1a99
Use Obtanium or Zapstore to get the non-Google and non-F-Droid .apk, as those contain trackers for the notification system to work.
Well according to the Dev this might be false positives. Adding to the confusion. And indeed they are. The sources code don't have them.
all 20 comments