Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yes, Android 14 still allows modification of system certificates

g1a55er.net

Post reply on HN
Print view View original

31–40 of 89 posts

Re: Yes, Android 14 still allows modification of system certificates

#31

Post by hackermatic »

AshamedCaptain wrote: post #24
downWidOutaFite wrote: post #13

Earlier quoted context omitted.

After wiping all data and losing access to a bunch of features and apps.

Including everything I could possibly ever want an Android device for, like my bank's 2FA program. It's all been slowly cooking for a decade, yet people will still claim "but you can still do it with root, so it's as free as before!" (or some other ridiculously complicated workaround with lots of nasty side-effects)

Yup. When I updated my company's secure development requirements, and compared them to others, I was confronted with a lot of choices that would increase security somewhat, but at the expense of user control of their own devices, like refusing to function if the device was jailbroken, or requiring the use of the system keyboard only (which is also an accessibility problem).

These are tempting choices, but they go a lot further than, for example, requiring only modern TLS ciphersuites to be used to communicate with my servers. They dictate the state of your entire device, and no one app or company should have that power, unless you work for the company and they issue you the device -- but even then, modern MDM/MAM can and should sandbox company apps from the rest of the device.

Re: Yes, Android 14 still allows modification of system certificates

#32

Post by a_t48 »

hackermatic wrote: post #31
AshamedCaptain wrote: post #24

Earlier quoted context omitted.

Including everything I could possibly ever want an Android device for, like my bank's 2FA program. It's all been slowly cooking for a decade, yet people will still claim "but you can still do it with root, so it's as free as before!" (or some other ridiculously complicated workaround with lots of nasty side-effects)

Yup. When I updated my company's secure development requirements, and compared them to others, I was confronted with a lot of choices that would increase security somewhat, but at the expense of user control of their own devices, like refusing to function if the device was jailbroken, or requiring the use of the system keyboard only (which is also an accessibility problem). These are tempting choices, but they go a l…

When I worked on iOS games, I ended up having to ban all jailbroken devices. I didn’t like doing it, but basically - every cheater we found was using a jailbroken phone, the number of non cheaters with jailbroken phones was tiny, and it would have basically taken up all my time to deal with cheaters rather than implement fun features. I’d have just ignored them if it wasn’t for the fact that they made the leaderboards look really fake.

Re: Yes, Android 14 still allows modification of system certificates

#33

Post by WirelessGigabit »

twleo wrote: post #5

Looks good. I hate how IOS does, especially with certificate pinning, so I cannot use my ad-block http mitmproxy to block ads in Apps. EDIT: thanks for people clarifying that pinning is done by Apps and not by IOS.

Would you mind sharing your setup?

Re: Yes, Android 14 still allows modification of system certificates

#34

Post by 1vuio0pswjnm7 »

maven29 wrote: post #4

There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture

https://github.com/gojue/ecapture/releases/expanded_assets/v...

Anyone know why there is an aarch64 nocore but not an x86_64 nocore.

Re: Yes, Android 14 still allows modification of system certificates

#35

Post by amalcon »

shadowgovt wrote: post #14
inetknght wrote: post #2

Allowing a user to add system certificates a good thing. The user owns the device.

Everything in the category "the user owns the device" is tricky. For a lot of users, "It's really hard to break" is a value-add. Every capacity the user has to modify permissions is an opportunity for an attacker to compromise a device. You can see an example of this in web browsers these days, where sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in…

"Easily, but there's a big scary warning that the person asking you to do this might be trying to hack you" is still "easily". That obviously seems more consumer friendly than either extreme.

Re: Yes, Android 14 still allows modification of system certificates

#36

Post by 1vuio0pswjnm7 »

kelnos wrote: post #11
maven29 wrote: post #4

There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture

"Just" is doing a lot of work there. Getting root isn't always possible or easy, depending on your device manufacturer. And if you do manage to get root, your phone will likely stop passing SafetyNet, and you'll lose access to a bunch of apps that you may care about. SafetyNet can be spoofed in some situations, but not all, and even when spoofing does work, it all seems very brittle to me. Yes, of course, you can do…

"Yes, of course, you can do this, but let's not pretend there aren't trade offs."

Are there some words in the parent comment that "pretend there aren't tradeoffs". Is it that he did not include a warning about "SafetyNet". What would this "pretending" look like.

Losing access to "a bunch of apps you may care about" seems to be dependent on an assumption: that the reader cares about certain unnamed apps. Yet we cannot even name these apps. We cannot know what apps a user cares about unless the user tells us. I know Android users that do not use any apps that rely on SafetyNet.

Nor do we know what device manufacturer the reader may be dealing with. It might be one where it's relatively easy to the computer owner to have root privileges.

Perhaps we can refrain from making assumptions about readers.

Re: Yes, Android 14 still allows modification of system certificates

#37

Post by garciansmith »

downWidOutaFite wrote: post #13
modeless wrote: post #10

Earlier quoted context omitted.

Every Pixel phone purchased from the Google store

After wiping all data and losing access to a bunch of features and apps.

You do have to unlock the bootloader to root a device, hence wiping the data, but that doesn't matter if it's the first thing you do when you get the phone.

Features though? Maybe I don't realize all the great things I'm missing out on since I've only ever used rooted phones since I got my first Android device many years ago.

As for apps, I've only heard of certain games (I don't play games on my phone) and banking apps (thankfully mine doesn't care, though I'd rather use a desktop web interface for financial stuff).

Re: Yes, Android 14 still allows modification of system certificates

#38

Post by Spivak »

shadowgovt wrote: post #14
inetknght wrote: post #2

Allowing a user to add system certificates a good thing. The user owns the device.

Everything in the category "the user owns the device" is tricky. For a lot of users, "It's really hard to break" is a value-add. Every capacity the user has to modify permissions is an opportunity for an attacker to compromise a device. You can see an example of this in web browsers these days, where sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in…

I don't think you deserve the downvotes, this is exactly right and is incredibly frustrating. Programmers, and increasingly folks who don't consider themselves to be writing malware, have no concept of a thing that should never be done by an application and only by the end user. If it's possible to do I should be allowed to do it! If they didn't want me doing it they should have stopped me! The amount of guides on the internet not targeted toward developers that teach users to go through the "create an application" flow and grant some random app access to their account in a more privileged way than would be allowed by the app itself is embarrassing for our industry. "Just add this configuration profile!", "Just paste in your API key."

The moment you allow users to add custom root certs ad blocker apps are going to ask users to add one for "advanced" network level ad blocking. You can't win with this crap. Nobody considers themselves a "not advanced" user so no amount of warning will ever work. Have you ever tried doing something, saw some warning that said this was for advanced users in your way to do the thing, and stopped? Me neither.

Re: Yes, Android 14 still allows modification of system certificates

#39

Post by loa_in_ »

shadowgovt wrote: post #14
inetknght wrote: post #2

Allowing a user to add system certificates a good thing. The user owns the device.

Everything in the category "the user owns the device" is tricky. For a lot of users, "It's really hard to break" is a value-add. Every capacity the user has to modify permissions is an opportunity for an attacker to compromise a device. You can see an example of this in web browsers these days, where sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in…

> sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in developer tools because no matter how many safety features get added to the browser security model, the dev tools can bypass them.

That doesn't seem all that much work. Hardening things like that should be a dedicated job, but of course it doesn't "create value" so it's mostly left to rot until it's a source of bad PR.

Re: Yes, Android 14 still allows modification of system certificates

#40

Post by matheusmoreira »

kelnos wrote: post #11
maven29 wrote: post #4

There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture

"Just" is doing a lot of work there. Getting root isn't always possible or easy, depending on your device manufacturer. And if you do manage to get root, your phone will likely stop passing SafetyNet, and you'll lose access to a bunch of apps that you may care about. SafetyNet can be spoofed in some situations, but not all, and even when spoofing does work, it all seems very brittle to me. Yes, of course, you can do…

Yeah. Android has become as hostile as Apple devices due to hardware remote attestation. Might as well buy an iPhone at this point. Only reason I didn't is I discovered the existence of Termux which turned into something of an Android killer app for me. Who knows what Google's gonna kill next though? Termux is already incompatible with the official store due to system call restrictions. Maybe it'll be straight up impossible to run it in a future version of Android.
Post reply on HN