4 ms·
Yup — and this is the same Google who have conspired to prevent you from installing your own SSL certs, so that you can see what data that module is sending to
by eadmund 9y ago
Yup — and this is the same Google who have conspired to prevent you from installing your own SSL certs, so that you can see what data that module is sending to them.
- chrisper 9y agoIf you have root, can you not install SSL certificates?
- dasil003 9y agoI am totally ignorant of Android, but they could be pinning, and do so in such a way that it fails silently without sending data. As root you could probably detect this but you'd really have to know what you were looking for.
- userbinator 9y agoAs root you could probably detect this but you'd really have to know what you were looking for. I can think of two relatively easy and probably-not-secure (you were asking for freedom, not security...) ways to not only detect but also bypass this: - Hook certificate verification APIs to always return true. - Scan for certificates embedded in the binary and overwrite them dynamically. This will work if the app decides to use its own crypto but standard certificate formats.
- zeveb 9y agoAnd if you have root, then your device fails to attest. Who owns your device: Google or you? This is about control.
- amckinlay 9y agoYou don't have root, that was a typo, sorry. I cannot go back and edit the post.
- kuschku 9y agoSpecifically: User-installed TLS certificates are now in a separate keystore from system CAs, users can not disable system CAs, and apps can choose which keystore to trust, but the default is that user CAs are not trusted unless apps explicitly opt-in. This is extremely user-hostile.