Can't you still install a CA certificate through Settings like you always could?
https://stackoverflow.com/a/65319223
Yes, Android 14 still allows modification of system certificates
21–30 of 89 posts
Re: Yes, Android 14 still allows modification of system certificates
#22Looks good. I hate how IOS does, especially with certificate pinning, so I cannot use my ad-block http mitmproxy to block ads in Apps. EDIT: thanks for people clarifying that pinning is done by Apps and not by IOS.
Another note: cert pinning is made very easy by Android as well (just needs a fingerprint in an XML file).
It's a good feature for security (stalkerware remains a huge problem) but it does suck from a reverse engineering standpoint.
Re: Yes, Android 14 still allows modification of system certificates
#23Allowing a user to add system certificates a good thing. The user owns the device.
Everything in the category "the user owns the device" is tricky. For a lot of users, "It's really hard to break" is a value-add. Every capacity the user has to modify permissions is an opportunity for an attacker to compromise a device. You can see an example of this in web browsers these days, where sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in…
How do you make something that isn't trivially turned to oppression without allowing users a trivial escape from the devices protection model?
Isn't installing your own OS on your general purpose computer a trivial out? Shall we likewise disable that ability on all general purpose computers?
Re: Yes, Android 14 still allows modification of system certificates
#24Earlier quoted context omitted.
Every Pixel phone purchased from the Google store
After wiping all data and losing access to a bunch of features and apps.
Including everything I could possibly ever want an Android device for, like my bank's 2FA program.
It's all been slowly cooking for a decade, yet people will still claim "but you can still do it with root, so it's as free as before!" (or some other ridiculously complicated workaround with lots of nasty side-effects)
Re: Yes, Android 14 still allows modification of system certificates
#25Can't you still install a CA certificate through Settings like you always could? https://stackoverflow.com/a/65319223
You can, but that's not the system certificate store.
Android has two certificate stores (the user store and the system store). The user store can be altered through the method you linked. The system store used to be part of the system image (you could always disable certificates, of course) and will now be moved to an APEX location that Google can update (to prevent the Let's Encrypt issue in the future).
To alter the system store, you need root access. At the moment it's just a matter of dropping a file with the right name and encoding at /etc/system/cacerts (through Magisk style overlays, or by modifying the system image) but that will change soon.
Re: Yes, Android 14 still allows modification of system certificates
#26There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture
"Just" is doing a lot of work there. Getting root isn't always possible or easy, depending on your device manufacturer. And if you do manage to get root, your phone will likely stop passing SafetyNet, and you'll lose access to a bunch of apps that you may care about. SafetyNet can be spoofed in some situations, but not all, and even when spoofing does work, it all seems very brittle to me. Yes, of course, you can do…
[deleted]
Re: Yes, Android 14 still allows modification of system certificates
#27Earlier quoted context omitted.
Every Pixel phone purchased from the Google store
After wiping all data and losing access to a bunch of features and apps.
Magisk [0] + safetynet-fix [1] can work around that.
Re: Yes, Android 14 still allows modification of system certificates
#28disable CAs is a thing
or can you add your own for every domain or something?
Re: Yes, Android 14 still allows modification of system certificates
#29Can't you still install a CA certificate through Settings like you always could? https://stackoverflow.com/a/65319223
I've used this to sniff traffic on my phone to great success.
The MITM attacks by manipulating the keys was a godsend
Invaluable debugging tools
We need some new tact, pro-user AND pro-security - those are often seen as in conflict with each other.