I realized after the update that it might not be a good idea to just trust google playstore.
Is there a way to verify the update was legit.
The only verification you can do is to check the uploader if it's from "
Electrum Technologies GmbH" before clicking "
update".
But that involves trusting that the said uploader isn't compromised.
If you want a good verification, do as they say to download from the official website and perform signature verification to the "
.apk" file. (
tutorial, req. a PC)
If the verification step is skipped, it's not any better than the former since you'll just be trusting that the website isn't compromised by a hacker.
There are even more paranoid levels beyond this going down to auditing the code and compiling the apk yourself.
But that's only for the most paranoid users or someone who can do it without much effort.
In other words, for an average user, if you don't feel confident downloading wallets like Eectrum from Android/iOS app stores, it's much better to purchase a hardware wallet like Trezor/Bitbox or build your own DIY hardware wallet (Krux).
Even so, it's still necessary to trust the manufacturer; even if the device is open-source, it's necessary to trust both the software and firmware updates.
Most manufacturer software (e.g, Trezor Suite) verifies that the downloaded firmware's signature ID matches the information saved in the database stored in the manufacturer's software (
as is the case with Trezor with Trezor Suite and the device's firmware).
Unfortunately, for those who don't have the skills to inspect the code line by line, a degree of trust is required.
