$ jarsigner -verbose -verify PsiphonAndroid.apk $ unzip -p PsiphonAndroid.apk META-INF/PSIPHON.RSA | keytool -printcert For example, using Unix and Java command-line tools: SHA256: 76:DB:EF:15:F6:77:26:D4:51:A1:23:59:B8:57:9C:0D:ħA:9F:63:5D:52:6A:A3:74:24:DF:13:16:32:F1:78:10Īn APK may be validated by (1) extracting the certificate from the archive and checking that its fingerprints matches the value above and (2) verifying that the APK is signed with the certificate. Issuer: CN=Psiphon Inc., OU=Psiphon Inc., O=Psiphon Inc., Owner: CN=Psiphon Inc., OU=Psiphon Inc., O=Psiphon Inc., We recommend that users turn on the Google Verify Apps feature as documented here.Įach Psiphon for Android client is shipped as an Android APK file ('.apk') that is digitally signed by Psiphon Inc. Psiphon for Windows auto-updates itself, and this process automatically verifies that each update is authentic.ĪLERT: A recently reported vulnerability may cause Android app signature checking to falsely report malicious APKs as valid. certificate public key is displayed in the Certificate dialog Details tab.įor the certificate valid for the period to the SHA1 thumbprint is:ĩb a0 bd 1c e4 ca f6 20 41 0d 46 47 ae 40 b0 7c 83 c7 31 99Ĩ4 c5 13 5b 13 d1 53 96 7e 88 c9 13 86 0e 83 ee ef 48 8e 91Ĩf b7 ef bd 20 a9 20 3a 38 37 08 a2 1e 0a 1d 2e ad 7b ee 6d

You can also manually inspect the signature before running the client by invoking the Properties dialog for the file and inspecting the Digital Signatures tab. Windows automatically checks this signature when you run the client.

Each Psiphon for Windows client is a single executable file ('.exe') that is digitally signed by Psiphon Inc.

Psiphon for Windows is never distributed as an installable package.

Psiphon vpn 3