Changes to Trusted Certificate Authorities in Android Nougat

Post by tszming » Sat, Jul 09, 2016, 4:05 PM UTC

nolok wrote: post #55

tszming wrote: post #52

Earlier quoted context omitted.

I joked to a friend that if Google invented a time machine, the first thing they would do is travel back to remove the extension support in Chrome before it was launched - the ad blockers.

Chrome didn't support the proper method for ad blockers at launch (it could hide content but not stop the requests, if I remember it well), and they purposely added those in months after launch, clearly for the benefit of adblocking extensions writers who where complaining. So, I don't think so.

Post by Nullabillity » Sat, Jul 09, 2016, 4:46 PM UTC

xg15 wrote: post #61

ffernand wrote: post #14

Earlier quoted context omitted.

I can't really say if Google is taking this approach to secure a device from heavy handed enterprise admins; but if true, it's gone too far by allowing only the app from having private conversations with the api and not allowing the user to see what's being sent over the wire. This isn't exactly new, we do after all, have certificate pinning. But now, this certificate pinning is done at the OS level by DEFAULT, un-tr…

This may be a conspiracy theory, but how probable is that this move is instead actually motivated by app developers that want to make reverse-engeneering harder? There have been cases in the past were hidden APIs were discovered that e.g. Twitter or WhatsApp were reserving for their own apps. (Not to mention privacy leaks). This will certainly become harder with the new change.

Post by ausjke » Sat, Jul 09, 2016, 4:49 PM UTC

mataug wrote: post #12

I feel this is a great win in terms of security for the average consumer. Sure VPN connections within organizations may get affected but the've got a workaround for that and I'm sure IT at orgs where they have an internal CA can figure it out.

Post by Nullabillity » Sat, Jul 09, 2016, 4:53 PM UTC

tssva wrote: post #17

spikengineer wrote: post #4

Earlier quoted context omitted.

I believe Android is taking this approach because of hawkish network appliances vendors selling all too powerful gear to enterprises and these enterprises don't care about what to decrypt and what not and causing too many weaknesses on the way. I belive MITM decryption for enterprises is a flawed way of identifying intrusions and doesn't stop or hinder any intrusions. It only provides a false sense of security. Intru…

In my experience enterprise MITM decrypt is not usually deployed to identify or stop intrusions. It is deployed to enforce compliance with corporate usage rules and as part of a data loss prevention solution. Quite often these are both necessary to meet regulatory requirements.

Post by Piskvorrr » Sat, Jul 09, 2016, 4:57 PM UTC

x1798DE wrote: post #39

kuschku wrote: post #31

Earlier quoted context omitted.

And how can I add the CA of my university, for example, which is required for some university networks? Especially because it has to be in the global store? Or how am I supposed to use my legal right to reverse and understand the functionality and APIs of software I have installed? EDIT (as I can’t create new comments for the next hour): The certificate is not used for HTTPS – but for TLS for IMAP, for example, and f…

Accepting a university cert seems like a terrible idea. I would look into a mobile hotspot or, even better, transferring to a different university. https://security.stackexchange.com/questions/104576/my-colle...