For example, using Unix and Java command-line tools: SHA256: 76:DB:EF:15:F6:77:26:D4:51:A1:23:59:B8:57:9C:0D:ħA:9F:63:5D:52:6A:A3:74:24:DF:13:16:32:F1:78:10Īn APK may be validated by (1) extracting the certificate from the archive and checking that its fingerprints matches the value above and (2) verifying that the APK is signed with the certificate. Issuer: CN=Psiphon Inc., OU=Psiphon Inc., O=Psiphon Inc.,

Owner: CN=Psiphon Inc., OU=Psiphon Inc., O=Psiphon Inc., We recommend that users turn on the Google Verify Apps feature as documented here.Įach Psiphon for Android client is shipped as an Android APK file ('.apk') that is digitally signed by Psiphon Inc. Psiphon for Windows auto-updates itself, and this process automatically verifies that each update is authentic.ĪLERT: A recently reported vulnerability may cause Android app signature checking to falsely report malicious APKs as valid. certificate public key is displayed in the Certificate dialog Details tab.įor the certificate valid for the period to the SHA1 thumbprint is:Ġ7 89 b3 5f d5 c2 ef 81 42 e6 aa e3 b5 8f ff 14 e4 f1 31 36Ĩ9 fd cd 09 65 f4 dd 89 2b 25 7c 04 d5 b4 14 c7 ac 2b 5f 56ĩb a0 bd 1c e4 ca f6 20 41 0d 46 47 ae 40 b0 7c 83 c7 31 99Ĩ4 c5 13 5b 13 d1 53 96 7e 88 c9 13 86 0e 83 ee ef 48 8e 91Ĩf b7 ef bd 20 a9 20 3a 38 37 08 a2 1e 0a 1d 2e ad 7b ee 6d You can also manually inspect the signature before running the client by invoking the Properties dialog for the file and inspecting the Digital Signatures tab.

Windows automatically checks this signature when you run the client. Each Psiphon for Windows client is a single executable file ('.exe') that is digitally signed by Psiphon Inc. Psiphon for Windows is never distributed as an installable package.

Setting proxy psiphon