3 ms·
^ this. I’m not familiar with Android signature approach. But it seems a pointless change to me. Just distribute additional CAs and re-sign my application. Th
by alanfranz 5y ago
^ this.
I’m not familiar with Android signature approach. But it seems a pointless change to me. Just distribute additional CAs and re-sign my application.
This is like asking users to provide their cleartext passwords.
- chenxiaolong 5y agoAndroid's PackageManager system doesn't use CAs. It's a trust-on-first-install system where any updates must be signed with the same cert as the original install. I don't know if it's still the case, but when I last looked at the code (around AOSP 6, I think), it did a byte-by-byte comparison of the certificate. If a update to an app was signed by even a renewed cert (with the same private key), Android would not allow it to be installed.
- alanfranz 5y agoThen change how PackageManager works.