Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Changes to Trusted Certificate Authorities in Android Nougat

android-developers.blogspot.com

Post reply on HN
Print view View original

91–100 of 103 posts

Re: Changes to Trusted Certificate Authorities in Android Nougat

#91

Post by 0x0 »

It's strange to see Android take this extremely anti-local-CA stance, while Chrome on the desktop does the exact opposite, even bypassing key pinning if a local CA is in the chain. https://www.chromium.org/Home/chromium-security/security-faq...

Especially so since Android since 5.x already shows a huge obnoxious "Your network may be monitored" if you have installed a local CA.

It's a shame you can't configure certain domains to ONLY trust a specific LOCAL CA system-wide. It would completely eliminate the security problem that is untrustworthy or hacked global CAs, for example for your own/enterprise mail server.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#92

Post by Natanael_L »

spacehunt wrote: post #16
ffernand wrote: post #2

I first learned about this from the tweet https://twitter.com/agl__/status/751184962049576960 This renders tools like mitmproxy un-usable. But really, if it's your device, why can't you see your own traffic? I can understand how this might improve security, but it locks you out of the conversation your own phone is having. Feels like reverse privacy; Not even you can know what you're saying!

You still can, it just involves a bit more work: grab the .apk, decompile it, insert your own network-security-config into the manifest XML, repackage and install onto the device.

Xposed can do the same without modifying the apk file in storage, instead it intercepts the calls and modifies the responses for what the app config would be.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#93

Post by Natanael_L »

userbinator wrote: post #49

...and so it begins... https://news.ycombinator.com/item?id=9078741 https://news.ycombinator.com/item?id=9078762 I am not exactly surprised, but it is very sad to see, because what happens on locked-down mobile platforms, desktops seem to follow sooner or later. You can argue that power users and developers will always find ways around it, but what this does is effectively remove one more little bit of that freedom w…

Root users could use Xposed to inject the settings to trust user added CA:s into selected apps. More work, but power users do retain the same ability (for apps not using NDK for networking).

Re: Changes to Trusted Certificate Authorities in Android Nougat

#94

Post by Natanael_L »

kuschku wrote: post #31
sounds wrote: post #11

Earlier quoted context omitted.

After reading the article, I think what you describe can easily be implemented -- at the _app_ level. The big change is that Android no longer provides an ability to add a CA for all apps on the device ("device global CA"). There is only one "global CA store" now, the one shipped with Android. Device updates can update the CA store, and the article talks about how to get your CA included.

And how can I add the CA of my university, for example, which is required for some university networks? Especially because it has to be in the global store? Or how am I supposed to use my legal right to reverse and understand the functionality and APIs of software I have installed? EDIT (as I can’t create new comments for the next hour): The certificate is not used for HTTPS – but for TLS for IMAP, for example, and f…

Use Xposed as root, inject the settings to trust your own CA

Re: Changes to Trusted Certificate Authorities in Android Nougat

#95

Post by pfg »

0x0 wrote: post #91

It's strange to see Android take this extremely anti-local-CA stance, while Chrome on the desktop does the exact opposite, even bypassing key pinning if a local CA is in the chain. https://www.chromium.org/Home/chromium-security/security-faq... Especially so since Android since 5.x already shows a huge obnoxious "Your network may be monitored" if you have installed a local CA. It's a shame you can't configure certain…

The way I understand it, this only affects apps, not Chrome for Android.

Chrome on desktop follows the HPKP RFC on this matter[1]. Failing pins that chain up to local CAs would break many deployments. On mobile, apps that implement certificate pinning are usually already broken if a MitM proxy is used, so it's a different context and this move improves the situation for apps that haven't moved to cert pinning yet (it's not a full replacement as it only helps with the "malicious local CA" problem).

The implications of an attacker being able to import a CA certificate are different on mobile as well, IMO. On desktop, this usually implies administrative access, in which case anything Chrome could do would be pointless, as the attacker could also just replace/modify binaries, install a keylogger, etc. Android has a more fine-grained permission system, and an attacker who tricks a user into installing a CA certificate would not necessarily be able to do these things, so this would definitely make things harder for them.

[1]: https://tools.ietf.org/html/rfc7469#section-2.6

Re: Changes to Trusted Certificate Authorities in Android Nougat

#96

Post by Natanael_L »

kuschku wrote: post #33
andrewguenther wrote: post #19

Earlier quoted context omitted.

Keep in mind, this specifically affects apps. Not necessarily Chrome, which I would guess is going to use the Trust API to allow them. So unless you have custom apps that access internal domains, then you shouldn't be impacted at all.

And how can I force all apps to accept it? I’ll have to end up rooting every device. This will just mean that even more will be running rooted, reducing security.

Root and Xposed, yes. That's probably going to be the easiest solution.

Root doesn't inherently reduce security - it only adds as much target surface as you chose to add. Adding root services with bugs is dangerous, but one-off tasks with secure code and a secure root manager isn't a problem.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#97

Post by ufmace »

ffernand wrote: post #2

I first learned about this from the tweet https://twitter.com/agl__/status/751184962049576960 This renders tools like mitmproxy un-usable. But really, if it's your device, why can't you see your own traffic? I can understand how this might improve security, but it locks you out of the conversation your own phone is having. Feels like reverse privacy; Not even you can know what you're saying!

There is already kind of a parallel to this - you can't see the raw data that the apps on your phone are storing unless you root the phone. It's all protected under the app's userid that you can't access. The only exception that I know of is for apps built in debug mode.

Re: Changes to Trusted Certificate Authorities in Android Nougat

#100

Post by digi_owl »

userbinator wrote: post #49

...and so it begins... https://news.ycombinator.com/item?id=9078741 https://news.ycombinator.com/item?id=9078762 I am not exactly surprised, but it is very sad to see, because what happens on locked-down mobile platforms, desktops seem to follow sooner or later. You can argue that power users and developers will always find ways around it, but what this does is effectively remove one more little bit of that freedom w…

I wonder if it is just another symptom of a upswell of paternalism that is plaguing IT these days.
Post reply on HN