Five checks to run before tapping install on a developer site that is not Google Play.
Reading time: 9 min read
Check one: the URL matches the developer site
Open the developer site in a new tab and verify the URL against the one listed on the games library entry. A reader who trusts the URL bar without checking is the most common source of typosquat installs. The URL bar in a mobile browser is short and the typosquat is usually one character different from the developer site URL. A reader who copies the URL from the games library entry into the browser address bar is making the cheapest verification step.
Editor note. Editor note on the URL check: the URL is the single most common source of typosquat installs on mobile. The games library lists the developer site URL on each entry; a reader who skips the URL check is installing an unverified package.
Check one: the URL matches the developer site.
Check two: the changelog line is dated
The changelog line should carry a date. A dated changelog line is the single most useful signal that the developer is still publishing builds. An undated changelog line is a signal that the developer has stopped publishing builds. The games library lists the changelog line for each build on the entry; a reader who skips the date check is missing the freshness signal.
Editor note. Editor note on the changelog date: a dated changelog line is the cheapest freshness signal. A reader who reads the date before tapping install changes a routine into a decision.
Check two: the changelog line is dated.
Check three: the support email is reachable
Send a test message to the support email listed on the developer site. A reader who sends a test message and gets a response within one business day is verifying the developer identity. A reader who sends a test message and gets no response is verifying the developer is unreachable. Both results are useful signals. The games library lists the support email on each entry; a reader who skips the email check is missing the developer-identity signal.
Editor note. Editor note on the email check: the test message is the cheapest developer-identity signal. A reader who gets a response within one business day has verified the channel; a reader who gets no response has verified the absence.
Check three: the support email is reachable.
Check four: the APK size matches the developer site listing
The APK size should be within ten percent of the size listed on the developer site. A reader who downloads an APK that is significantly smaller or larger than the developer site listing is downloading an unexpected build. The size difference is usually a sign of a typosquat mirror or a bundled malware payload. The games library lists the APK size on each entry; a reader who skips the size check is missing the integrity signal.
Editor note. Editor note on the APK size check: a ten-percent tolerance covers compression differences across mirrors. A reader who downloads an APK that is more than ten percent smaller or larger than the developer site listing is installing an unexpected build.
Check four: the APK size matches the developer site listing.
Check five: the APK signature matches the developer signature
The APK signature should match the developer signature on the developer site. A reader who verifies the signature is verifying that the APK has not been re-signed by a typosquat mirror. The signature verification is the most expensive check; the APK install guide covers the verification steps in detail. The games library lists the developer signature on each entry where the developer has published one.
Editor note. Editor note on the signature check: the signature is the most expensive of the five checks, but it is the only one that proves the APK has not been re-signed. A reader who skips the signature check is trusting the mirror.
Check five: the APK signature matches the developer signature.
Confirm the source on the games library entry
After running the five checks, confirm the developer site URL on the games library entry. The apps library lists the entries we have already opened on the developer site; an entry not on the list is a candidate for the contact submission. A reader who installs an app whose source they have not verified is installing an opaque surface.
Editor note. Editor note on the games library check: the games library is a starting point, not a finishing point. A reader who runs the five checks against the games library entry is verifying both the developer site and the games library listing.
Confirm the source on the games library entry.
What the APK signature proves
The APK signature proves that the APK has been signed by the developer who holds the signing certificate. A reader who verifies the signature is verifying that the APK has not been re-signed by a typosquat mirror. The signature does not prove that the developer is trustworthy; the developer site check is the trust signal. Together the signature and the developer site check cover the full pre-install verification work.
What the APK signature proves.
What the mirror comparison proves
A mirror comparison proves that the APK file on the developer site is the same as the APK file on the mirror. A reader who downloads the APK from two mirrors and checks the SHA-256 hash of each download is verifying that the mirrors have not been tampered with. The mirror comparison is the cheapest way to detect a typosquat mirror.
What the mirror comparison proves.
What the email-contact verification proves
The email-contact verification proves that the developer is reachable. A reader who sends a test message and gets a response within one business day is verifying the developer identity. The email-contact verification is the cheapest way to detect a typosquat developer who has registered a similar-looking email address.
What the email-contact verification proves.
Common pitfalls on assessing a download source
Three pitfalls show up often in reader mail. The first is trusting the URL bar without checking the developer site URL: a typosquat mirror is usually one character different from the developer site URL, and a reader who trusts the URL bar without checking is installing an unverified package. The second is treating the email-contact verification as a proof of trustworthiness: the email-contact verification proves the developer is reachable, not that the developer is trustworthy. The third is trusting the APK signature without checking the developer site: the APK signature proves the APK has not been re-signed, not that the developer is who they claim to be. A reader who treats these three pitfalls as a single workflow is reading the surfaces as coupled when they are independent. The apps library lists the entries we have already opened on the developer site; an entry not on the list is a candidate for the contact submission.
Common pitfalls on assessing a download source.
A short checklist for the next download
Before tapping install on a Yono-style app from outside Google Play, run the following short checklist on the download source. Confirm the developer site URL matches the games library entry. Confirm the changelog line carries a date and a version string. Confirm the APK size is within ten percent of the size listed on the entry. Confirm the support email is reachable by sending a test message. Confirm the APK signature matches the developer signature on the entry. The five checks cover the source-assessment work in five steps. The five steps take about fifteen minutes on a stable connection. The fifteen minutes is the cheapest way to verify the source, the version and the developer. Together the five steps and the fifteen minutes protect the reader from the most common reader pitfalls on Yono-style apps in this game type. The apps library lists the entries we have already opened on the developer site; an entry not on the list is a candidate for the contact submission.
A short checklist for the next download.
When an APK signature is enough on its own
An APK signature is enough on its own when the developer publishes a stable signing certificate and the certificate has been in use for at least three versions. In that case the reader can verify the signature against the certificate the reader downloaded from the developer site on a previous install. The games library surfaces the signing certificate on each entry where the developer publishes one; where the developer publishes a rotating certificate, the games library surfaces the rotation cadence. An APK signature is not enough on its own when the developer publishes a rotating certificate that the reader has not seen before. In that case the reader has to verify the new certificate against the developer's published rotation cadence; without a cadence, the new certificate is a number without a meaning. A reader who trusts a signature without a certificate is trusting the signature algorithm without verifying the developer identity. The games library surfaces the certificate rotation cadence on each entry where the developer publishes one, so a reader who reads the entry has both the signature and the cadence in front of them. Together the signature and the cadence cover the source-verification work; the reader does not need to open the developer site separately if the entry already carries both. The apps library lists the entries we have already opened on the developer site; an entry not on the list is a candidate for the contact submission.
