Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt comes up with workaround for abandonware Android devices

arstechnica.com

Post reply on HN
Print view View original

61–70 of 132 posts

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#61

Post by DiabloD3 »

progval wrote: post #44
DiabloD3 wrote: post #31

Earlier quoted context omitted.

I, too, found that an interesting phrase. The way I see it, there are three major consumer operating systems; four if you think iOS and OSX should be considered separately. Out of those three/four, only one tries to keep devices working and up to date as long as possible... iOS/OSX allows central updating, but drops phones older than 5 years, and desktop/laptops from 5-7 years depending on the product series; users c…

> but Google cannot force OEMs to continue supporting a phone within a reasonable timeframe Couldn't Google could pressure them to do it, by making this a legal requirement for a Google Play license for their devices?

Could, in the literal sense? Yes.

Could they do it without alienating their hardware partners? No.

Does Android require the Google Play store or any other Google services or non-AOSP code? No. Many Android devices ship entirely without Google stuff, including no Google Play store.

Could they do it even if they didn't care about alienating their hardware partners? Yes, if they also intend on being fined into the ground by the US and EU.

Their hardware partners, the OEMs, is what makes Android suck for Android users. It doesn't have to suck: OnePlus doesn't, and Google's own Pixel series isn't bad either. Avoid Samsung like the plague, LG and HTC also have questionable practices wrt ROM sanity and long term support.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#62

Post by quesera »

move-on-by wrote: post #60
pyb wrote: post #47

"The new cross-sign will expire in early 2024, and hopefully versions of Android from 2016 and earlier will be dead by then." Hard disagree. In this day and age, a device or OS that is merely 8 years old should be able to function! Is the issue limited to Lets Encrypt? If so its usage should be discouraged.

I just got some combo smoke and carbon monoxide detectors that say replace every 7 years, so perhaps 8 years isn’t that bad?

Received wisdom:

Don't buy combination smoke & CO detectors.

Smoke rises, so detectors are best placed on or near the ceiling. CO sinks, so detectors are best placed a few feet above the ground.

Considering the importance of early notification of either condition, these requirements appear irreconcilable.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#63

Post by ComputerGuru »

Expiration of certs is one thing, but expiration of cross-signatures in chains is another. If you trust the infra for root certs, it makes no sense to ever expire cross-signings as long as you have a signed timestamp to prove the signing happened before the (cross-)signing cert expired.

For example, Microsoft recognizes authenticode-signed binaries even if the signing certificate is long since expired if the signature includes an optional timestamp from an also recognized root cert (usually digicert or Symantec née Verisign) because you can verify the binary hasn’t since changed (because it includes the sha-x in the signature and the timestamp verifies that the signing took place before the certificate expired). It’s quite clever and provides a very good solution for running decades old apps from now defunct software houses that once took pains to sign their releases.

A certificate itself is such a “binary” that really is just testifying that the at x date, y party trusted z (unless a revocation was subsequently issued or the algorithm used is no longer considered secure).

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#64

Post by dade_ »

Android tablets are probably part of the problem. I still use my Sony Z3 Compact tablet. It is thin, waterproof, supports a SIM and SD card. I have never found a good replacement, though I'd like to. I mostly use it for reading ebooks and Pocket and RSS feeds so it handles the tasks well, but no upgrades, eventually it will need a new battery and now I see root certs are built in guaranteed obsolescence (like on the iPod touch). Unfortunately I can't find any high quality Android tablets as manufacturers have relegated Android tablets to the price sensitive consumer demographic. And iPad mini isn't waterproof.

It also works well with older Bluetooth BLE devices that won't connect with my newer Android phones.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#65

Post by kibwen »

pyb wrote: post #47

"The new cross-sign will expire in early 2024, and hopefully versions of Android from 2016 and earlier will be dead by then." Hard disagree. In this day and age, a device or OS that is merely 8 years old should be able to function! Is the issue limited to Lets Encrypt? If so its usage should be discouraged.

> In this day and age, a device or OS that is merely 8 years old should be able to function!

There's no need to worry about this. If the scheme in the OP works, then the same trick can be used indefinitely until such time as the Android versions in question become completely marginal, be it 4, 40, or 400 years from now.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#66

Post by mschuster91 »

Jonnax wrote: post #33
mschuster91 wrote: post #21

Earlier quoted context omitted.

> To which trusted source can I initiate a remote update? Probably you can get some sort of AOSP build running on it, and patch it yourself to get at least somewhat up-to-date components.

Generally these devices use the ancient kernel that they shipped with with the current userland. This is because the device drivers are compiled for that kernel version with no open source alternative. So whilst it might be running a newer version of Android. It isn't like installing Ubuntu 20.04 on a 10 year old laptop.

Honestly, Google should require as part of the Play Store certification that vendors ship their goddamn drivers in a quality that is acceptable to upstream Linux, or at least get them to staging quality.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#67

Post by 1-6 »

dade_ wrote: post #64

Android tablets are probably part of the problem. I still use my Sony Z3 Compact tablet. It is thin, waterproof, supports a SIM and SD card. I have never found a good replacement, though I'd like to. I mostly use it for reading ebooks and Pocket and RSS feeds so it handles the tasks well, but no upgrades, eventually it will need a new battery and now I see root certs are built in guaranteed obsolescence (like on the…

Glad you've stated this because going forward, software generally gets deprecated more often than maintained (I'm sure there are a few rare cases). Our hardware is very intertwined with software, so we toss out perfectly good hardware because it isn't running the latest firmware. Can manufacturers allow late-stage open source rom conversions on smart devices and allow the community to keep supporting legacy systems?

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#68

Post by speedyapoc »

Encountered a similar issue with an app of mine that implemented certificate pinning. Still a large iOS 9 user base using a version of the app which contains a soon expiring list of pinned certificates. Unfortunately likely have to drop support for those users entirely.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#69

Post by _0w8t »

usr1106 wrote: post #3

I have always wondered a bit what is the purpose of expiration dates. For certificates or GPG keys alike. Once they expire it often enough creates some problems. Either because renewal has just been forgotten or because there are some technical issues, like in the Let's Encrypt / Android case. If you have a security incident you can't wait for the expiration date anyway, you need to revoke. And hopefully users have a…

Yet consider if root certificates would expire in max 1 year. That by itself long time ago forced if not the phone vendors but at least app developers to deal with the need to update the root certificate DB. And the LetsEncrypt issue would not exist.

Re: Let’s Encrypt comes up with workaround for abandonware Android devices

#70

Post by jefftk »

Original Source, from Let's Encrypt: https://letsencrypt.org/2020/12/21/extending-android-compati...

"IdenTrust has agreed to issue a 3-year cross-sign for our ISRG Root X1 from their DST Root CA X3. The new cross-sign will be somewhat novel because it extends beyond the expiration of DST Root CA X3. This solution works because Android intentionally does not enforce the expiration dates of certificates used as trust anchors."

Thread from when this was originally posted: https://news.ycombinator.com/item?id=25495927

Post reply on HN