diff --git a/FAQ.md b/FAQ.md index 1f397f56c0..e3a07c494f 100644 --- a/FAQ.md +++ b/FAQ.md @@ -4775,6 +4775,7 @@ the F-Droid build, but **only if** the version number of the F-Droid build is th F-Droid builds irregularly, which can be problematic if there is an important update. Therefore you are advised to switch to the GitHub release. +F-Droid isn't as secure as you might think anyway, [see here](https://privsec.dev/posts/android/f-droid-security-issues/). Note that developers have no control over F-Droid builds and the F-Droid infrastructure (apps, forums, etc.). diff --git a/index.html b/index.html index 3a595af1cf..1b4b6ebc64 100644 --- a/index.html +++ b/index.html @@ -2451,7 +2451,7 @@ $NotDisplayed

🌎 Google Translate

You likely came here because you are using a third party build of FairEmail.

There is only support on the latest Play store version, the latest GitHub release and the F-Droid build, but only if the version number of the F-Droid build is the same as the version number of the latest GitHub release.

-

F-Droid builds irregularly, which can be problematic if there is an important update. Therefore you are advised to switch to the GitHub release.

+

F-Droid builds irregularly, which can be problematic if there is an important update. Therefore you are advised to switch to the GitHub release. F-Droid isn’t as secure as you might think anyway, see here.

Note that developers have no control over F-Droid builds and the F-Droid infrastructure (apps, forums, etc.).

OAuth access is available only for Play Store and Github releases because email providers permitted the use of OAuth for these releases only. The responsible for a release, for the F-Droid build this is the F-Droid organization, needs to ask for OAuth permissions, which mostly involves signing a contract with binding terms and conditions, often with the clause that the use of OAuth is exclusive.

Note that you’ll need to uninstall the F-Droid build first before you can install a GitHub release because Android refuses to install (“App was not installed”) the same app with a different signature for security reasons.