Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Changes to Trusted Certificate Authorities in Android Nougat

android-developers.blogspot.com

Post reply on HN
Print view View original

41–50 of 103 posts

Re: Changes to Trusted Certificate Authorities in Android Nougat

#41

Post by chii »

zdw wrote: post #22

I think this decision should be inverted - user/admin installed CA's should be trusted by default (but not able to be preloaded, by say a malicious cellphone employee at a store), but the entire public CA list (aka, "people we expressly allow to MITM you") should be run in front of and require approval by the user. But that's a problem everyone seems comfortable with ignoring...

a user would not be able to tell whether they can trust a public CA (they probably have nfi what it is).

A user installed CA is more likely done by an automated mean (such as a jail break, or malware) than the user themselves. This choice means they can at least stop some malware/crapware. Yes, the legitimate users with self installed CA got screwed over, but in google's eyes, those people are going to put up with it, because they've already invested in the android platform (and won't switch to iphone).

Re: Changes to Trusted Certificate Authorities in Android Nougat

#42

Post by ausjke »

JoshTriplett wrote: post #23
ausjke wrote: post #18

Totally against this. Why not leave the choice to the user instead of Google enforcing this. MITM is good for some purposes, e.g, debugging, enterprise filtering etc. While google collects all my info by default these days, what's wrong to let me install my CA locally myself? Google is becoming an online policeman more and more these days. I now hope Firefox OS or Ubuntu Phone OS prevails. Also I'm hoping there is a…

> Why not leave the choice to the user instead of Google enforcing this. Because often the choice isn't made by the user. > MITM is good for some purposes, e.g, debugging The linked page documents how to enable custom CA certificates for debugging. If you're trying to debug an app that doesn't want to be debugged, you're probably running a custom rooted version of Android anyway. > enterprise filtering Which the user…

1. Then make some password-protect mechanism instead of taking that choice away. That's the key issue, that Google is trying to make decisions for its users because Google may think it knows better.

2. OK thanks.

3. That is a corporate policy issue, it can state all corporate network is monitored and it installed a local CA etc. Without a local CA all https sites will pop up warnings and it leads to more problems. By the way corporate normally tunnels a safe list of https sites without doing any MITM, such as banks, well known "good" websites etc.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#44

Post by tssva »

shazow wrote: post #28
tssva wrote: post #26

There are several ad blocking solutions for Android which involve creating a VPN connection which terminates to an app local to the device. This allows the app to filter all traffic for ads including ads inside apps. These solutions depend on installing a user CA certificate in order to filter TLS connections. I wonder how much preventing these type of ad blockers played into this decision.

Can you point me to one? Sounds neat.

Google doesn't allow these apps in the play store due to the ability to block ads in apps. Several can be found in the Amazon app store. Adclear and Adguard are 2 examples. By utilizing the local VPN to redirect traffic for filtering these apps are able to work without requiring root access as other ad blocking solutions on Android do.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#45

Post by varenc »

x1798DE wrote: post #39
kuschku wrote: post #31

Earlier quoted context omitted.

And how can I add the CA of my university, for example, which is required for some university networks? Especially because it has to be in the global store? Or how am I supposed to use my legal right to reverse and understand the functionality and APIs of software I have installed? EDIT (as I can’t create new comments for the next hour): The certificate is not used for HTTPS – but for TLS for IMAP, for example, and f…

Accepting a university cert seems like a terrible idea. I would look into a mobile hotspot or, even better, transferring to a different university. https://security.stackexchange.com/questions/104576/my-colle...

MIT has its own CA 0_o

ca.mit.edu

Re: Changes to Trusted Certificate Authorities in Android Nougat

#46

Post by ausjke »

ffernand wrote: post #36
andrewguenther wrote: post #24

Earlier quoted context omitted.

I'd say their certs are more trustworthy than 90% of the certs that users would add. This is a pretty no brainer security move on Android's part.

> their certs are more trustworthy than 90% of the certs that users would add. Why? Why wouldn't I trust my own cert more than any Google trusted certs. I'm sure the majority of CA's are responsible entities, but I trust my certs more, because I control them!

Exactly! I will absolutely not buy Android N(owned many Android devices so far). Google collects all users activities by default while don't let me trust my own CA, how ironic. I guess Google thinks only itself is trust-able and it has the right to baby seat whoever uses its devices, in the name of protecting its users...No Thanks Big Brother.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#47

Post by revelation »

tssva wrote: post #44
shazow wrote: post #28

Earlier quoted context omitted.

Can you point me to one? Sounds neat.

Google doesn't allow these apps in the play store due to the ability to block ads in apps. Several can be found in the Amazon app store. Adclear and Adguard are 2 examples. By utilizing the local VPN to redirect traffic for filtering these apps are able to work without requiring root access as other ad blocking solutions on Android do.

You can't have ad blocking apps on the Play (god that ridiculous name) store?

Re: Changes to Trusted Certificate Authorities in Android Nougat

#48

Post by johncolanduoni »

kuschku wrote: post #35
andrewguenther wrote: post #25

Earlier quoted context omitted.

If you're trying to debug your own app, there are ways to turn this off for debugging.

And if you want to use your legal right to reverse the functionality and APIs of other apps?

If your device isn't rooted, modify the APK to opt-in and don't share it with anyone.

If your device is rooted, just add your cert to the system store.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#49

Post by userbinator »

...and so it begins...

https://news.ycombinator.com/item?id=9078741

https://news.ycombinator.com/item?id=9078762

I am not exactly surprised, but it is very sad to see, because what happens on locked-down mobile platforms, desktops seem to follow sooner or later. You can argue that power users and developers will always find ways around it, but what this does is effectively remove one more little bit of that freedom which lets users discover what their devices are actually doing, and I think that is a very bad thing in the long term.

Much of my knowledge about how computers work in various ways has been gained through exploring creatively and inspecting what things do. I use a MITM proxy on my PC that blocks ads, tracking, and rewrites webpages to my preference. I learned a lot of HTTP, HTML, and CSS just from doing that. But maybe that is exactly what those in power do not want --- users who can think and investigate things for themselves --- because such users are not easy to control.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#50

Post by blastrat »

andrewguenther wrote: post #19
ingenium wrote: post #6

This is a pretty annoying move for anyone who has their own CA they use to sign internal domains. I wonder if they will also have Chrome not trust them...

Keep in mind, this specifically affects apps. Not necessarily Chrome, which I would guess is going to use the Trust API to allow them. So unless you have custom apps that access internal domains, then you shouldn't be impacted at all.

if you have custom apps, this announcement tell you how set your apps to trust your own CA certs.
Post reply on HN