Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yes, Android 14 still allows modification of system certificates

g1a55er.net

Post reply on HN
Print view View original

51–60 of 89 posts

Re: Yes, Android 14 still allows modification of system certificates

#51

Post by Dylan16807 »

garciansmith wrote: post #37
downWidOutaFite wrote: post #13

Earlier quoted context omitted.

After wiping all data and losing access to a bunch of features and apps.

You do have to unlock the bootloader to root a device, hence wiping the data, but that doesn't matter if it's the first thing you do when you get the phone. Features though? Maybe I don't realize all the great things I'm missing out on since I've only ever used rooted phones since I got my first Android device many years ago. As for apps, I've only heard of certain games (I don't play games on my phone) and banking a…

Netflix is a big one.

Re: Yes, Android 14 still allows modification of system certificates

#52

Post by ungamedplayer »

jeroenhd wrote: post #19
kelnos wrote: post #11

Earlier quoted context omitted.

"Just" is doing a lot of work there. Getting root isn't always possible or easy, depending on your device manufacturer. And if you do manage to get root, your phone will likely stop passing SafetyNet, and you'll lose access to a bunch of apps that you may care about. SafetyNet can be spoofed in some situations, but not all, and even when spoofing does work, it all seems very brittle to me. Yes, of course, you can do…

In the context of "changes to Android 14", "just" is right. Android has required root access for modifying random apps since before Android 6, and that's only because many apps didn't bother implementing certificate pinning (which was already known advice at that point). Alternatively, you can use ADB + Frida to pull an APK from the device, inject a binary, and inject code at runtime using Javascript or Python. That'…

Do you have any kind of docs on doing this. I want to get some stats from a game I'm playing and think that the server fudges the number to keep whales happy.

Any quality documentation on how to do this would be great.

Re: Yes, Android 14 still allows modification of system certificates

#53

Post by _silicon »

a_t48 wrote: post #32
hackermatic wrote: post #31

Earlier quoted context omitted.

Yup. When I updated my company's secure development requirements, and compared them to others, I was confronted with a lot of choices that would increase security somewhat, but at the expense of user control of their own devices, like refusing to function if the device was jailbroken, or requiring the use of the system keyboard only (which is also an accessibility problem). These are tempting choices, but they go a l…

When I worked on iOS games, I ended up having to ban all jailbroken devices. I didn’t like doing it, but basically - every cheater we found was using a jailbroken phone, the number of non cheaters with jailbroken phones was tiny, and it would have basically taken up all my time to deal with cheaters rather than implement fun features. I’d have just ignored them if it wasn’t for the fact that they made the leaderboard…

“I didn’t like doing it” doesn’t make this any better. It’s just hammering another nail in the coffin of device ownership.

Re: Yes, Android 14 still allows modification of system certificates

#54

Post by [deleted] »

1vuio0pswjnm7 wrote: post #36
kelnos wrote: post #11

Earlier quoted context omitted.

"Just" is doing a lot of work there. Getting root isn't always possible or easy, depending on your device manufacturer. And if you do manage to get root, your phone will likely stop passing SafetyNet, and you'll lose access to a bunch of apps that you may care about. SafetyNet can be spoofed in some situations, but not all, and even when spoofing does work, it all seems very brittle to me. Yes, of course, you can do…

"Yes, of course, you can do this, but let's not pretend there aren't trade offs." Are there some words in the parent comment that "pretend there aren't tradeoffs". Is it that he did not include a warning about "SafetyNet". What would this "pretending" look like. Losing access to "a bunch of apps you may care about" seems to be dependent on an assumption: that the reader cares about certain unnamed apps. Yet we cannot…

[deleted]

Re: Yes, Android 14 still allows modification of system certificates

#55

Post by BlueTemplar »

AshamedCaptain wrote: post #24
downWidOutaFite wrote: post #13

Earlier quoted context omitted.

After wiping all data and losing access to a bunch of features and apps.

Including everything I could possibly ever want an Android device for, like my bank's 2FA program. It's all been slowly cooking for a decade, yet people will still claim "but you can still do it with root, so it's as free as before!" (or some other ridiculously complicated workaround with lots of nasty side-effects)

Exactly, you shouldn't waste your time with Android any more than with iOS at this point (same for banks that only provide 2FA on iOS/Android).

And while for years the alternatives have been almost nonexistent, we do have at least two now : PinePhone and Librem 5.

Re: Yes, Android 14 still allows modification of system certificates

#56

Post by a_t48 »

_silicon wrote: post #53
a_t48 wrote: post #32

Earlier quoted context omitted.

When I worked on iOS games, I ended up having to ban all jailbroken devices. I didn’t like doing it, but basically - every cheater we found was using a jailbroken phone, the number of non cheaters with jailbroken phones was tiny, and it would have basically taken up all my time to deal with cheaters rather than implement fun features. I’d have just ignored them if it wasn’t for the fact that they made the leaderboard…

“I didn’t like doing it” doesn’t make this any better. It’s just hammering another nail in the coffin of device ownership.

Please, our mediocre AA gatcha game did nothing to you nor the overall jailbreaking ecosystem. Don’t you think that’s being a bit dramatic?

Re: Yes, Android 14 still allows modification of system certificates

#57

Post by netheril96 »

jeroenhd wrote: post #25
assassinator42 wrote: post #21

Can't you still install a CA certificate through Settings like you always could? https://stackoverflow.com/a/65319223

You can, but that's not the system certificate store. Android has two certificate stores (the user store and the system store). The user store can be altered through the method you linked. The system store used to be part of the system image (you could always disable certificates, of course) and will now be moved to an APEX location that Google can update (to prevent the Let's Encrypt issue in the future). To alter t…

What's the practical difference between system store and user store? Do some apps or system operations only trust the system store and not the user store?

Not rhetorical questions.

Re: Yes, Android 14 still allows modification of system certificates

#58

Post by aqfamnzc »

jeroenhd wrote: post #25
assassinator42 wrote: post #21

Can't you still install a CA certificate through Settings like you always could? https://stackoverflow.com/a/65319223

You can, but that's not the system certificate store. Android has two certificate stores (the user store and the system store). The user store can be altered through the method you linked. The system store used to be part of the system image (you could always disable certificates, of course) and will now be moved to an APEX location that Google can update (to prevent the Let's Encrypt issue in the future). To alter t…

Can you expand more on the Let's Encrypt issue? What do you mean by that?

Re: Yes, Android 14 still allows modification of system certificates

#59

Post by mvnuweucxqokii »

netheril96 wrote: post #57
jeroenhd wrote: post #25

Earlier quoted context omitted.

You can, but that's not the system certificate store. Android has two certificate stores (the user store and the system store). The user store can be altered through the method you linked. The system store used to be part of the system image (you could always disable certificates, of course) and will now be moved to an APEX location that Google can update (to prevent the Let's Encrypt issue in the future). To alter t…

What's the practical difference between system store and user store? Do some apps or system operations only trust the system store and not the user store? Not rhetorical questions.

I don't know the difference between the user and system store, but I do know that apps can choose not to trust certs installed by the user and instead only trust their own that they bring with them. Was frustrated to find this when I was trying to MITM an app to see what it was up to on the wire.

Re: Yes, Android 14 still allows modification of system certificates

#60

Post by simondotau »

inetknght wrote: post #41
shadowgovt wrote: post #14

Earlier quoted context omitted.

Everything in the category "the user owns the device" is tricky. For a lot of users, "It's really hard to break" is a value-add. Every capacity the user has to modify permissions is an opportunity for an attacker to compromise a device. You can see an example of this in web browsers these days, where sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in…

> For a lot of users, "It's really hard to break" is a value-add. "It's really hard to break" should not be conducive to the dumbing down of the populace. Enabling power users is therefore more desirable. And importantly, the two do not have to be mutually exclusive.

I agree with you in theory, but in practice half the population are never going to become security experts and it's impractical to force them to learn through necessity. If a hacker can get root on your smartphone, they can probably get access to your bank account (and the 2FA), your email, your private/intimate photos, your medical issues, your sexual secrets, and so on. A smartphone is far higher stakes than anything else which has come before it.

To be clear, I think our right to have a smartphone we control is an absolute. It's extremely important. I would march on the street to protect that right. But I'm equally protective of my right to have a smartphone I cannot control no matter what button I press. I'm glad for devices like the iPhone where the manufacturer works damn hard to make sure that it's always under the manufacturer's control.

Post reply on HN