Sign here please!
summary
Explains how Android app identity really works: certificate chains, why losing a signing key nukes updates, and that the debug keystore uses the common password "android" so builds clash. Shows concrete tools and APIs: keytool, jarsigner, zipalign, KeyStore/KeyChain usage and the StrongBox hardware option. Notes Google Play app signing lets Google rotate or revoke keys but opting in is irreversible for existing apps. Flags a surprising adoption gap: new secure APIs hit only about 1.1% of devices.
AI-written summary · about
chapters (34)
- 0:00Introduction
- 1:13What is a certificate
- 2:59Asymmetric cryptography
- 3:27Algorithm
- 4:19Private Key
- 4:52Public Key
- 6:13Digital Signature
- 8:27Certificate Authorities
- 13:19GeoTrust
- 16:59subversion
- 19:09Android doesnt trust
- 20:45Android signatures
- 21:47Debug keystore
- 22:04Create keystore
- 23:04Choose signer
- 23:19Zipline
- 24:08Decision
- 24:48Expectations
- 25:18My personal experience
- 28:30Google Play App Signing
- 29:32Signing New Apps
- 30:49Pros and Cons
- 31:15Android
- 31:31Keystore
- 31:52UML diagram
- 33:20Utility methods
- 33:36Key chain or keystore
- 34:17Code
- 35:12Signature
- 35:31Verify
- 35:51Hardware back storage
- 36:27State of Android
- 37:08Key Rotation
- 38:27Security Availability
