Spotifuck v1.6.66 – Spotify Web Player (dual mode: works with or without a certificate)
Requirements: Android 5.0+, recent version of Android System WebView (v121+)
Overview: Spotifuck is a wrapper for Spotify’s free web player, open.spotify.com, that lets you use it on your phone as if it were a desktop. This is possible through a webview modified to resemble PC browser. This version can operate in two modes: via classic browsing, as in the past, or with the new MITM proxy, which requires the installation of a cerificate.

Premise:

This version includes substantial bug fixes and a few new featuresi —so much so that it could have been version 1.7— but I couldn’t pass up version 1.6.6 and Satan, so it will be 1.6.66, which is also why it’s redder than usual.

– Installation Instructions –

As anticipated in the overview, the most important feature is that I’ve implemented the well-known patch for native fetching via `httpUrlConnection`, so now you can choose in the settings whether to use this classic mode without a certificate or the new MITM proxy, which requires the installation of a certificate.

The downside of the first option is that not all requests are filtered, so it can easily be patched and broken by Spotify. The second option, on the other hand, is much better at hiding itself, but has the disadvantage of being slightly slower to load. In any case, you can switch to switch to proxy mode if the classic one gets patched.

-If you’re upgrading from a version <=1.6.4, you must uninstall the old version before installing this one!
-If you’re upgrading from 1.6.5b, it will retain the old certificate and start in proxy mode by default, which is indicated by a key icon in the status bar.
-If you’re installing from scratch, the default will be the classic mode.

-If you decide to use proxy mode, the first time the app is run, a CA certificate will be generated and saved in the Downloads folder. You’ll need to install it by going to:

Settings > Security & Privacy > Encryption & Credentials > Install a Certificate > CA Certificate.

Once it’s installed, you’ll need to confirm within the app, and browsing will start as usual.

– Regarding the security aspects of the MITM proxy TL;DR –
As explained in detail in the discussion of the previous version, the MITM proxy implementation was already secure in and of itself. The private key used to sign the certificates and the corresponding certificate to be installed are created upon first launch, and the key stored only within the application’s secure private space. The proxy is bound only to localhost (127.0.0.1), so it is not even accessible from the outside. In the unlikely event that another malicious app were installed and managed to guess the port by connecting to the proxy, the worst it could do would be to browse the requested sites without the WebView’s identification headers, stripped by the proxy.
Despite this, I’ve implemented two new layers of security to ensure 100% protection:
1. The first and most important is the authentication now required by the proxy server. In this case as well, the password is generated at every startup and remains only in memory, and the only app that knows it is Spotifuck itself, so this completely blocks the possibility even for local apps (you can verify this yourself by connecting to the server via adb shell and nc, and issuing a CONNECT yoursite.com:443 command).
2. The second level is unnecessary at this point, but I implemented it for the sake of completeness: it’s the filter for “signable” domains using a whitelist.
I chose to take a conservative approach to this feature and have it start in “allow all” mode by default, because if new domains are requested —which happens often, especially with podcasts— they would disrupt the app’s operation.
Anyway, if you want, you can pull your own whitelist before starting the service by placing it in the folder (create it if it doesn’t exist) `/sdcard/data/Android/it.deviato.spotifuck/files/`, naming it `domainswhitelist.txt`. Include only base domains, no subdomains. Comments starting with # are allowed.
I’ve pre-compiled a list of the domains captured during my runs so you can use it as a starting point; you can download it here: `https://pastebin.com/wBdE860H`
As before, I am also posting the source code for the `CertificateAuthority` class and the relevant portion of `MitmProxyServer`:
As before, I am also publishing the source code for the `certificateauthority` class and the relevant portion of `proxymitm` for both features: `https://pastebin.com/JRiLujsi`

What’s New:
★ Restored the classic functionality without a certificate; option to choose between proxy and non-proxy modes in the settings
★ Added two additional security layers for MITM proxy
★ Removed all animations, resulting in a significant improvement in performance while browsing
★ Added an option for full-screen mode, which allows you to switch between “hide only the status bar” and “full screen”
★ Added a new alternative theme with colors suited for “dark theme” mode
★ Fixed CPU hog issue on player homepage by opmitizing its content
★ Fixed the bug of Play/Pause button in notifications/widgets not working on all phones
★ Fixed the green dot on the “Now Play” button and improved detection of open/closed side panel state
★ Fixed a race condition causing multiple proxy instantiation, as well as other bugs and fatal exceptions, and a webview repaint issue in proxy mode
– UI Fixes –
★ Improved base theme and created a new alternative one for “dark theme” mode
★ Improved play buttons for tracklist/artist/playlist pages, made larger, more accessible, and consistent with the other play buttons
★ “Close Library” button made larger and more accessible
★ Removed video links from song titles in controls
★ Removed all shortcut hints on search and other places resulting in more space for the search form
★ Added an indicator for proxy mode with a key icon

[color=green]Features:
● No Audio Ads
● Android Auto Support
● Media Notifications with controls

⚠️ If you plan to use Android Auto, please disable or uninstall the official Spotify app first, because it enters in a race condition to take player control!

This app has no advertisements

More Info:
N/A

Download Instructions:
https://ouo.io/HgKNxz