Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Changes to Trusted Certificate Authorities in Android Nougat

android-developers.blogspot.com

Post reply on HN
Print view View original

11–20 of 103 posts

Re: Changes to Trusted Certificate Authorities in Android Nougat

#11

Post by sounds »

deftnerd wrote: post #3

I would rather see the OS let people load the cert but then require the user enter their PIN, password, or unlock drawing. Then the cert can be signed by the PIN/etc and trusted. This would allow certs to be added, but prevent them from being silently side-loaded by an admin or malware. Changing your PIN would invalidate the cert but you could just be prompted to resign them.

After reading the article, I think what you describe can easily be implemented -- at the _app_ level.

The big change is that Android no longer provides an ability to add a CA for all apps on the device ("device global CA"). There is only one "global CA store" now, the one shipped with Android.

Device updates can update the CA store, and the article talks about how to get your CA included.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#14

Post by ffernand »

spikengineer wrote: post #4
ffernand wrote: post #2

I first learned about this from the tweet https://twitter.com/agl__/status/751184962049576960 This renders tools like mitmproxy un-usable. But really, if it's your device, why can't you see your own traffic? I can understand how this might improve security, but it locks you out of the conversation your own phone is having. Feels like reverse privacy; Not even you can know what you're saying!

I believe Android is taking this approach because of hawkish network appliances vendors selling all too powerful gear to enterprises and these enterprises don't care about what to decrypt and what not and causing too many weaknesses on the way. I belive MITM decryption for enterprises is a flawed way of identifying intrusions and doesn't stop or hinder any intrusions. It only provides a false sense of security. Intru…

I can't really say if Google is taking this approach to secure a device from heavy handed enterprise admins; but if true, it's gone too far by allowing only the app from having private conversations with the api and not allowing the user to see what's being sent over the wire.

This isn't exactly new, we do after all, have certificate pinning. But now, this certificate pinning is done at the OS level by DEFAULT, un-trusting all certs except the ones that Google deems fit.

We know that there have been un-trustworthy Certificate Authorities that all our machines have trusted until its been deemed unworthy by our vendors... and eventually expunged! But this change explicitly un-trusts us, the users of our own phones -- in the name of security.

User deftnerd (https://news.ycombinator.com/item?id=12061342) had an excellent suggestion that the trusting of user added certs can be relegated to the TPM module (via password, passcode, fingerprint, etc..) -- not by the heavy handed approach of simply blocking us out of our own phones conversation.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#15

Post by gergles »

deftnerd wrote: post #3

I would rather see the OS let people load the cert but then require the user enter their PIN, password, or unlock drawing. Then the cert can be signed by the PIN/etc and trusted. This would allow certs to be added, but prevent them from being silently side-loaded by an admin or malware. Changing your PIN would invalidate the cert but you could just be prompted to resign them.

That is already the requirement if you have a lock set up for your device, except for the last part about changing the lock code removing all the user-added certs.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#16

Post by spacehunt »

ffernand wrote: post #2

I first learned about this from the tweet https://twitter.com/agl__/status/751184962049576960 This renders tools like mitmproxy un-usable. But really, if it's your device, why can't you see your own traffic? I can understand how this might improve security, but it locks you out of the conversation your own phone is having. Feels like reverse privacy; Not even you can know what you're saying!

You still can, it just involves a bit more work: grab the .apk, decompile it, insert your own network-security-config into the manifest XML, repackage and install onto the device.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#17

Post by tssva »

spikengineer wrote: post #4
ffernand wrote: post #2

I first learned about this from the tweet https://twitter.com/agl__/status/751184962049576960 This renders tools like mitmproxy un-usable. But really, if it's your device, why can't you see your own traffic? I can understand how this might improve security, but it locks you out of the conversation your own phone is having. Feels like reverse privacy; Not even you can know what you're saying!

I believe Android is taking this approach because of hawkish network appliances vendors selling all too powerful gear to enterprises and these enterprises don't care about what to decrypt and what not and causing too many weaknesses on the way. I belive MITM decryption for enterprises is a flawed way of identifying intrusions and doesn't stop or hinder any intrusions. It only provides a false sense of security. Intru…

In my experience enterprise MITM decrypt is not usually deployed to identify or stop intrusions. It is deployed to enforce compliance with corporate usage rules and as part of a data loss prevention solution. Quite often these are both necessary to meet regulatory requirements.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#18

Post by ausjke »

Totally against this. Why not leave the choice to the user instead of Google enforcing this. MITM is good for some purposes, e.g, debugging, enterprise filtering etc.

While google collects all my info by default these days, what's wrong to let me install my CA locally myself? Google is becoming an online policeman more and more these days.

I now hope Firefox OS or Ubuntu Phone OS prevails. Also I'm hoping there is a strong google search competitor soon. I no longer favor Google, though it's difficult to find an alternative at this point.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#19

Post by andrewguenther »

ingenium wrote: post #6

This is a pretty annoying move for anyone who has their own CA they use to sign internal domains. I wonder if they will also have Chrome not trust them...

Keep in mind, this specifically affects apps. Not necessarily Chrome, which I would guess is going to use the Trust API to allow them. So unless you have custom apps that access internal domains, then you shouldn't be impacted at all.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#20

Post by wtbob »

This is just terrible news. Android's treatment of user-added certificates is already terribly broken (why does it warn me that my network connexions may be monitored when I install my own certificate, when Android already trusts e.g. Symantec?), and this makes it worse.

What they should have done was gone the other direction entirely. If I — the owner of the phone — choose to trust a certificate authority, then every app should obey me, without complaint or warning. It's my phone, not Google's.

Post reply on HN