3 ms·

That seems superior anyway - you could keep blocking domains even when you're on the go.

kuschku 9y ago
Can I? On Android, apps now can decide if they want to accept user-installed CAs, or not. So if an app is hostile (say, all the Google apps), then I have no way to intercept their traffic anymore.
- pas 9y ago
  You can decide to install the app or not. And you can put your CA into the system CA store if you have root. (You can make an Android image, so technically the requirement is unlocked - unlockable - bootloader.)
  - kuschku 9y ago
    Unlocking the bootloader makes the device permanently fail the strictest SafetyNet category. Apps can and will refuse to run in that situation. Modifying /system will make every SafetyNet check fail, as result Netflix, Snapchat, Google Play Movies, and most banking apps will refuse to run. I can decide to install the app or not? How do I go about replacing Google's system apps with my own, without preventing above mentioned apps from running? I can't. And I can't buy reasonable devices withou Google Android, due to the non-compete clause in the OEM contracts.
    - pas 9y ago
      Then don't buy it. Or support efforts like Librem (and LineageOS and Magisk). http://www.androidpolice.com/2017/07/16/safetynet-can-detect-magisk-fix-works/ http://www.androidpolice.com/2017/07/16/safetynet-can-detect... You can walk into your bank and access the services. Or call them. Or use their browser based service, right? Google and a lot of developers made the choice to restrict user freedom for more security. I don't agree with it, but it's what it is. A trade off. Of course, you can sign your own images and put the CA into the recovery DB and relock the bootloader on reasonable devices. ( https://mjg59.dreamwidth.org/31765.html https://mjg59.dreamwidth.org/31765.html ) Or at least you used to be able to.
- zb3 9y ago
  You can patch the app using apktool/smali or even use JTM[0], but I prefer just blocking their traffic using iptables. [0] - https://github.com/Fuzion24/JustTrustMe https://github.com/Fuzion24/JustTrustMe
  - kuschku 9y ago
    That also invalidates some SafetyNet verification, unless I abuse the new dex/apk signature verification vulnerability. Either the user controls the program, or the program controls the user.
vbezhenar 9y ago
Easier approach is to use your own DNS server and blacklist those domains.

Can I? On Android, apps now can decide if they want to accept user-installed CAs, or not. So if an app is hostile (say, all the Google apps), then I have no way to intercept their traffic anymore.

pas 9y ago
You can decide to install the app or not. And you can put your CA into the system CA store if you have root. (You can make an Android image, so technically the requirement is unlocked - unlockable - bootloader.)
- kuschku 9y ago
  Unlocking the bootloader makes the device permanently fail the strictest SafetyNet category. Apps can and will refuse to run in that situation. Modifying /system will make every SafetyNet check fail, as result Netflix, Snapchat, Google Play Movies, and most banking apps will refuse to run. I can decide to install the app or not? How do I go about replacing Google's system apps with my own, without preventing above mentioned apps from running? I can't. And I can't buy reasonable devices withou Google Android, due to the non-compete clause in the OEM contracts.
  - pas 9y ago
    Then don't buy it. Or support efforts like Librem (and LineageOS and Magisk). http://www.androidpolice.com/2017/07/16/safetynet-can-detect-magisk-fix-works/ http://www.androidpolice.com/2017/07/16/safetynet-can-detect... You can walk into your bank and access the services. Or call them. Or use their browser based service, right? Google and a lot of developers made the choice to restrict user freedom for more security. I don't agree with it, but it's what it is. A trade off. Of course, you can sign your own images and put the CA into the recovery DB and relock the bootloader on reasonable devices. ( https://mjg59.dreamwidth.org/31765.html https://mjg59.dreamwidth.org/31765.html ) Or at least you used to be able to.
zb3 9y ago
You can patch the app using apktool/smali or even use JTM[0], but I prefer just blocking their traffic using iptables. [0] - https://github.com/Fuzion24/JustTrustMe https://github.com/Fuzion24/JustTrustMe
- kuschku 9y ago
  That also invalidates some SafetyNet verification, unless I abuse the new dex/apk signature verification vulnerability. Either the user controls the program, or the program controls the user.

vbezhenar 9y ago

Easier approach is to use your own DNS server and blacklist those domains.