Goodbye to using Fiddler easily to check out the private HTTP API of any app that does not implement cert pinning
What are the options to inspect this traffic now we can no longer use fiddler?
root + xposed will make quick fix to enable it.
Changes to Trusted Certificate Authorities in Android Nougat
21–30 of 103 posts
Re: Changes to Trusted Certificate Authorities in Android Nougat
#22I think this decision should be inverted - user/admin installed CA's should be trusted by default (but not able to be preloaded, by say a malicious cellphone employee at a store), but the entire public CA list (aka, "people we expressly allow to MITM you") should be run in front of and require approval by the user.
But that's a problem everyone seems comfortable with ignoring...
Re: Changes to Trusted Certificate Authorities in Android Nougat
#23Totally against this. Why not leave the choice to the user instead of Google enforcing this. MITM is good for some purposes, e.g, debugging, enterprise filtering etc. While google collects all my info by default these days, what's wrong to let me install my CA locally myself? Google is becoming an online policeman more and more these days. I now hope Firefox OS or Ubuntu Phone OS prevails. Also I'm hoping there is a…
> Why not leave the choice to the user instead of Google enforcing this.
Because often the choice isn't made by the user.
> MITM is good for some purposes, e.g, debugging
The linked page documents how to enable custom CA certificates for debugging. If you're trying to debug an app that doesn't want to be debugged, you're probably running a custom rooted version of Android anyway.
> enterprise filtering
Which the user should be explicitly aware of if it's happening.
Re: Changes to Trusted Certificate Authorities in Android Nougat
#24And here I was thinking a fun first project would be a socat client with self-signed certs for remote access. The more I want to learn about smart phone development and ecosystem, the more offputting it gets by the year. But yeah, use our PlayApp Store we can better track you in real time. OUR certs are WITHOUT DOUBT TRUSTWORTHY. Sometimes I feel neckbeards will beat us youngbloods to death for the sins we let pass.
I'd say their certs are more trustworthy than 90% of the certs that users would add. This is a pretty no brainer security move on Android's part.
Re: Changes to Trusted Certificate Authorities in Android Nougat
#25Re: Changes to Trusted Certificate Authorities in Android Nougat
#26There are several ad blocking solutions for Android which involve creating a VPN connection which terminates to an app local to the device. This allows the app to filter all traffic for ads including ads inside apps. These solutions depend on installing a user CA certificate in order to filter TLS connections. I wonder how much preventing these type of ad blockers played into this decision.
Re: Changes to Trusted Certificate Authorities in Android Nougat
#27ITT: People who think the average Android user knows how CAs work and has the competence to manage them.
For the majority of users, this is a very good decision.
Re: Changes to Trusted Certificate Authorities in Android Nougat
#28There are several ad blocking solutions for Android which involve creating a VPN connection which terminates to an app local to the device. This allows the app to filter all traffic for ads including ads inside apps. These solutions depend on installing a user CA certificate in order to filter TLS connections. I wonder how much preventing these type of ad blockers played into this decision.
Can you point me to one? Sounds neat.
Re: Changes to Trusted Certificate Authorities in Android Nougat
#29That phone you are holding? It is not your property, you are the commodity being sold. Same is coming to Browsers with EME.
Re: Changes to Trusted Certificate Authorities in Android Nougat
#30ITT: People who think the average Android user knows how CAs work and has the competence to manage them. For the majority of users, this is a very good decision.
And for the rest there should at least be an option in the hidden developer menu. Not make it solely up to the app developers.