Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yes, Android 14 still allows modification of system certificates

g1a55er.net

Post reply on HN
Print view View original

41–50 of 89 posts

Re: Yes, Android 14 still allows modification of system certificates

#41

Post by inetknght »

shadowgovt wrote: post #14
inetknght wrote: post #2

Allowing a user to add system certificates a good thing. The user owns the device.

Everything in the category "the user owns the device" is tricky. For a lot of users, "It's really hard to break" is a value-add. Every capacity the user has to modify permissions is an opportunity for an attacker to compromise a device. You can see an example of this in web browsers these days, where sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in…

> For a lot of users, "It's really hard to break" is a value-add.

"It's really hard to break" should not be conducive to the dumbing down of the populace. Enabling power users is therefore more desirable.

And importantly, the two do not have to be mutually exclusive.

Re: Yes, Android 14 still allows modification of system certificates

#42

Post by twleo »

WirelessGigabit wrote: post #33
twleo wrote: post #5

Looks good. I hate how IOS does, especially with certificate pinning, so I cannot use my ad-block http mitmproxy to block ads in Apps. EDIT: thanks for people clarifying that pinning is done by Apps and not by IOS.

Would you mind sharing your setup?

https://github.com/epitron/mitm-adblock

or

https://github.com/barre/privaxy

Re: Yes, Android 14 still allows modification of system certificates

#43

Post by _ea1k »

AshamedCaptain wrote: post #24
downWidOutaFite wrote: post #13

Earlier quoted context omitted.

After wiping all data and losing access to a bunch of features and apps.

Including everything I could possibly ever want an Android device for, like my bank's 2FA program. It's all been slowly cooking for a decade, yet people will still claim "but you can still do it with root, so it's as free as before!" (or some other ridiculously complicated workaround with lots of nasty side-effects)

As much as I want to agree with you, I can't blame Google here. Corporate security departments have bought into the idea that mobile is different and you can't trust the user with root.

Google has little choice but to provide them with the tools to detect root access.

Re: Yes, Android 14 still allows modification of system certificates

#44

Post by shadowgovt »

amalcon wrote: post #35
shadowgovt wrote: post #14

Earlier quoted context omitted.

Everything in the category "the user owns the device" is tricky. For a lot of users, "It's really hard to break" is a value-add. Every capacity the user has to modify permissions is an opportunity for an attacker to compromise a device. You can see an example of this in web browsers these days, where sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in…

"Easily, but there's a big scary warning that the person asking you to do this might be trying to hack you" is still "easily". That obviously seems more consumer friendly than either extreme.

Those warnings only go so far against a talented social engineer.

Re: Yes, Android 14 still allows modification of system certificates

#45

Post by shadowgovt »

michaelmrose wrote: post #23
shadowgovt wrote: post #14

Earlier quoted context omitted.

Everything in the category "the user owns the device" is tricky. For a lot of users, "It's really hard to break" is a value-add. Every capacity the user has to modify permissions is an opportunity for an attacker to compromise a device. You can see an example of this in web browsers these days, where sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in…

How do you make something that isn't trivially turned to oppression without allowing users a trivial escape from the devices protection model? Isn't installing your own OS on your general purpose computer a trivial out? Shall we likewise disable that ability on all general purpose computers?

Sometimes oppression could come from a central authority, and sometimes it can come from a rampant criminal element taking advantage of exploitable human behavior.

We have to balance defending against both.

> Shall we likewise disable that ability

Not on all computers, no. But I should have the option of buying my grandmother one which is very, very hard for someone to convince her to give them admin rights.

Re: Yes, Android 14 still allows modification of system certificates

#46

Post by ori_b »

_ea1k wrote: post #43
AshamedCaptain wrote: post #24

Earlier quoted context omitted.

Including everything I could possibly ever want an Android device for, like my bank's 2FA program. It's all been slowly cooking for a decade, yet people will still claim "but you can still do it with root, so it's as free as before!" (or some other ridiculously complicated workaround with lots of nasty side-effects)

As much as I want to agree with you, I can't blame Google here. Corporate security departments have bought into the idea that mobile is different and you can't trust the user with root. Google has little choice but to provide them with the tools to detect root access.

Why? If Google didn't implement it, what would they do?

Re: Yes, Android 14 still allows modification of system certificates

#47

Post by ori_b »

michaelmrose wrote: post #23
shadowgovt wrote: post #14

Earlier quoted context omitted.

Everything in the category "the user owns the device" is tricky. For a lot of users, "It's really hard to break" is a value-add. Every capacity the user has to modify permissions is an opportunity for an attacker to compromise a device. You can see an example of this in web browsers these days, where sites have to `log` a big scary "Don't paste anything someone tells you to paste into here" message into the built-in…

How do you make something that isn't trivially turned to oppression without allowing users a trivial escape from the devices protection model? Isn't installing your own OS on your general purpose computer a trivial out? Shall we likewise disable that ability on all general purpose computers?

> Shall we likewise disable that ability on all general purpose computers?

It's being worked on with web attestation.

Re: Yes, Android 14 still allows modification of system certificates

#48

Post by Dylan16807 »

1vuio0pswjnm7 wrote: post #36
kelnos wrote: post #11

Earlier quoted context omitted.

"Just" is doing a lot of work there. Getting root isn't always possible or easy, depending on your device manufacturer. And if you do manage to get root, your phone will likely stop passing SafetyNet, and you'll lose access to a bunch of apps that you may care about. SafetyNet can be spoofed in some situations, but not all, and even when spoofing does work, it all seems very brittle to me. Yes, of course, you can do…

"Yes, of course, you can do this, but let's not pretend there aren't trade offs." Are there some words in the parent comment that "pretend there aren't tradeoffs". Is it that he did not include a warning about "SafetyNet". What would this "pretending" look like. Losing access to "a bunch of apps you may care about" seems to be dependent on an assumption: that the reader cares about certain unnamed apps. Yet we cannot…

> Are there some words in the parent comment that "pretend there aren't tradeoffs"

Yes. They quoted it! "you just need root". Especially the word just. That kind of phrasing implies that it's not flat-out impossible on many devices and that it doesn't break major functionality.

"I know users that don't use that feature" is praising with faint damnation.

Re: Yes, Android 14 still allows modification of system certificates

#49

Post by userbinator »

__MatrixMan__ wrote: post #17
inetknght wrote: post #2

Allowing a user to add system certificates a good thing. The user owns the device.

I agree with your first sentence. The second seems to get less and less true all the time.

The former is a necessary condition of the latter.

Re: Yes, Android 14 still allows modification of system certificates

#50

Post by Dylan16807 »

mintplant wrote: post #27
downWidOutaFite wrote: post #13

Earlier quoted context omitted.

After wiping all data and losing access to a bunch of features and apps.

Magisk [0] + safetynet-fix [1] can work around that. [0] https://github.com/topjohnwu/Magisk [1] https://github.com/Displax/safetynet-fix

It's quite doubtful it will keep working.
Post reply on HN