Yes, Android 14 still allows modification of system certificates

Post by shadowgovt » Sun, Sep 17, 2023, 12:40 AM UTC

michaelmrose wrote: post #79

shadowgovt wrote: post #74

Earlier quoted context omitted.

> Elsewhere in this thread, people are saying that you can’t protect people from themselves… but Apple seem to be doing a good job of it Precisely my point. I think there are benefits to both locked-down devices and open devices, and both are desirable. If Android is transitioning towards more constrained-by-default, (a) that's smart given it's working so well for their largest competition, and (b) it opens the field…

> it opens the field wider for the truly open-stack phones to gain users. Win-win. Microsoft couldn't break into this market for billions of dollars. Open phones breaking in because android becomes more locked down is a complete fantasy. What do you do when oppressive governments insist that your now constrained environment implement some of their suggestions with the alternative to compliance being your local yokels…

Post by shadowgovt » Sun, Sep 17, 2023, 5:50 AM UTC

michaelmrose wrote: post #78

shadowgovt wrote: post #70

Earlier quoted context omitted.

I think that really overstates the risk scenario. If we're going to descend into hyperbole, let's turn it around... If a free and open device is so important, won't some smart hacker always come along to build one? I'd rather my grandmother have an easy life and trust that Neo will be around to save the technorati eventually than make life easier on people who already know how to hack things they want to behave diffe…

> If a free and open device is so important, won't some smart hacker always come along to build one? This just isn't how the universe works at all. We both grew up in the era roughly analogous to the early era of flight with 100 bad designs competing for most incompetent and are now moving into the an era of commercial jets and here you are arguing that planes wont make a difference in war. If you build an ecosystem…

Post by JimDabell » Wed, Sep 20, 2023, 3:24 PM UTC

JimDabell wrote: post #65

paulmd wrote: post #63

Earlier quoted context omitted.

Apple honestly did a pretty good job. You can sideload your own code with a free developer account, but you have to jump through some minor hoops to get “developer” mode set on your account (I went through this to get the tvOS 17 beta). And the app signing expires in 7 days, so it’s really painful for a normal user who isn’t actually developing and testing an app to use like that for a long term thing. If you want mo…

> Apple honestly did a pretty good job. They did. Over here, there are regular news articles and warnings from the government as yet more Android users get conned into installing fake banking app APKs that let attackers steal all their money. It’s always the same news article and the same warning – only Android users affected. Elsewhere in this thread, people are saying that you can’t protect people from themselves……

Post by jeroenhd » Thu, Sep 21, 2023, 3:43 PM UTC

worthless-trash wrote: post #86

jeroenhd wrote: post #72

Earlier quoted context omitted.

https://httptoolkit.com/blog/frida-certificate-pinning/ has a detailed blog on it. Frida receives updates all the time, so the exact commands and scripts don't always work with the latest version, but you can start there. As a concept, Frida works by running a gadget on the phone (as root, or as part of an app) and a client on another device (or the same device, I suppose, if you're using a terminal emulator on Andro…

I've now confirmed that if you pay money for the game, you -automatically- get exactly 12% more damage than someone who hasn't, and it appears to drop 1% a day over time. Not much I can do with that data, other than sleep in comfort knowing that its the case.

Post by JimDabell » Fri, Sep 29, 2023, 11:30 AM UTC

JimDabell wrote: post #88

JimDabell wrote: post #85

Earlier quoted context omitted.

> Over here, there are regular news articles and warnings from the government as yet more Android users get conned into installing fake banking app APKs that let attackers steal all their money. It’s always the same news article and the same warning – only Android users affected. Like clockwork, here’s today’s article: > The victims would then contact the “sellers” via the platforms or messaging app WhatsApp. Followi…

Like clockwork, here’s today’s article: > DBS, UOB become latest banks to restrict access if unverified apps are found on customers' phones > They are the latest banks in Singapore to do so – after OCBC and Citibank – amid a spate of malware scams targeting users of Android devices. > DBS said on Tuesday (Sep 26) that its new anti-malware tool for Android phones seeks to prevent scammers from fraudulently logging int…